From 51aebc8445fece5e0e7daf62603bf004b9dfb8ce Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 14:18:15 +0000
Subject: [PATCH 001/326] chore(website deps): bump undici from 7.18.2 to
 7.24.1 in /website (#24925)

Bumps [undici](https://github.com/nodejs/undici) from 7.18.2 to 7.24.1.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v7.18.2...v7.24.1)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.24.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 website/yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/website/yarn.lock b/website/yarn.lock
index 3aa10cd2672e1..6e031634c03ef 100644
--- a/website/yarn.lock
+++ b/website/yarn.lock
@@ -3756,9 +3756,9 @@ undici-types@~7.16.0:
   integrity sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==
 
 undici@^7.12.0:
-  version "7.18.2"
-  resolved "https://registry.yarnpkg.com/undici/-/undici-7.18.2.tgz#6cf724ef799a67d94fd55adf66b1e184176efcdf"
-  integrity sha512-y+8YjDFzWdQlSE9N5nzKMT3g4a5UBX1HKowfdXh0uvAnTaqqwqB92Jt4UXBAeKekDs5IaDKyJFR4X1gYVCgXcw==
+  version "7.24.1"
+  resolved "https://registry.yarnpkg.com/undici/-/undici-7.24.1.tgz#3fd0fe40e67388860810ad3275f9a23b322de650"
+  integrity sha512-5xoBibbmnjlcR3jdqtY2Lnx7WbrD/tHlT01TmvqZUFVc9Q1w4+j5hbnapTqbcXITMH1ovjq/W7BkqBilHiVAaA==
 
 unicode-canonical-property-names-ecmascript@^2.0.0:
   version "2.0.1"

From e3225205fa88d04c4d76d0e485f27dc771900693 Mon Sep 17 00:00:00 2001
From: Benjamin Dornel <benjamindornel@gmail.com>
Date: Mon, 16 Mar 2026 22:31:01 +0800
Subject: [PATCH 002/326] enhancement(clickhouse sink): add UUID type support
 for ArrowStream (#24856)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

enhancement(clickhouse sink): add UUID type support for ArrowStream format

Map ClickHouse `UUID` columns to Arrow `Utf8`, letting ClickHouse
handle the String→UUID cast on insert. Removes UUID from the
unsupported types list in documentation.

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 ...ickhouse_arrow_uuid_support.enhancement.md |  3 +++
 src/sinks/clickhouse/arrow/parser.rs          | 25 ++++++++++++++++++-
 src/sinks/clickhouse/integration_tests.rs     | 18 +++++++++++--
 .../reference/components/sinks/clickhouse.cue |  1 -
 4 files changed, 43 insertions(+), 4 deletions(-)
 create mode 100644 changelog.d/clickhouse_arrow_uuid_support.enhancement.md

diff --git a/changelog.d/clickhouse_arrow_uuid_support.enhancement.md b/changelog.d/clickhouse_arrow_uuid_support.enhancement.md
new file mode 100644
index 0000000000000..e6dfc806b6775
--- /dev/null
+++ b/changelog.d/clickhouse_arrow_uuid_support.enhancement.md
@@ -0,0 +1,3 @@
+Added support for the ClickHouse `UUID` type in the ArrowStream format for the `clickhouse` sink. UUID columns are now automatically mapped to Arrow `Utf8` and cast by ClickHouse on insert.
+
+authors: benjamin-awd
diff --git a/src/sinks/clickhouse/arrow/parser.rs b/src/sinks/clickhouse/arrow/parser.rs
index ddafd0d0dc373..94286c09759ca 100644
--- a/src/sinks/clickhouse/arrow/parser.rs
+++ b/src/sinks/clickhouse/arrow/parser.rs
@@ -42,6 +42,9 @@ pub enum ClickHouseType {
     String,
     FixedString(u32),
 
+    // UUID type
+    Uuid,
+
     // Date/time types
     Date,
     DateTime,
@@ -93,7 +96,13 @@ impl ClickHouseType {
             }),
 
             // String types
-            Self::String | Self::FixedString(_) => Ok(DataType::Utf8),
+            // Note: UUID is mapped to Utf8 for two reasons:
+            // 1. Vector has no native UUID type — UUIDs are represented as strings in the event model
+            // 2. ClickHouse does not support UUID in Arrow format:
+            //    https://github.com/ClickHouse/ClickHouse/blob/master/src/Processors/Formats/Impl/CHColumnToArrowColumn.cpp
+            //    https://github.com/ClickHouse/ClickHouse/blob/master/src/Processors/Formats/Impl/ArrowColumnToCHColumn.cpp
+            // ClickHouse handles the String → UUID cast implicitly on insert.
+            Self::String | Self::FixedString(_) | Self::Uuid => Ok(DataType::Utf8),
 
             // Date/time types
             Self::Date => Ok(DataType::Date32),
@@ -230,6 +239,7 @@ fn ch_type(input: &str) -> IResult<&str, ClickHouseType> {
 
         // String types
         "String" => Ok((rest, ClickHouseType::String)),
+        "UUID" => Ok((rest, ClickHouseType::Uuid)),
         "FixedString" => parens(parse_u32)
             .map(ClickHouseType::FixedString)
             .parse(rest),
@@ -465,6 +475,19 @@ mod tests {
         assert!(matches!(data_type, DataType::Map(_, _)));
     }
 
+    #[test]
+    fn test_uuid_type_mapping() {
+        assert_eq!(convert_type("UUID").unwrap(), (DataType::Utf8, false));
+        assert_eq!(
+            convert_type("Nullable(UUID)").unwrap(),
+            (DataType::Utf8, true)
+        );
+        assert_eq!(
+            convert_type("LowCardinality(Nullable(UUID))").unwrap(),
+            (DataType::Utf8, true)
+        );
+    }
+
     #[test]
     fn test_unknown_type_fails() {
         let result = convert_type("UnknownType");
diff --git a/src/sinks/clickhouse/integration_tests.rs b/src/sinks/clickhouse/integration_tests.rs
index f86aeba915db9..a32771bf55730 100644
--- a/src/sinks/clickhouse/integration_tests.rs
+++ b/src/sinks/clickhouse/integration_tests.rs
@@ -565,7 +565,7 @@ async fn insert_events_arrow_with_schema_fetching() {
     client
         .create_table(
             &table,
-            "host String, timestamp DateTime64(3), message String, id Int64, name String, score Float64, active Bool",
+            "host String, timestamp DateTime64(3), message String, id Int64, name String, score Float64, active Bool, request_id UUID",
         )
         .await;
 
@@ -595,6 +595,10 @@ async fn insert_events_arrow_with_schema_fetching() {
         event.insert("name", format!("user_{}", i));
         event.insert("score", 95.5 + i as f64);
         event.insert("active", i % 2 == 0);
+        event.insert(
+            "request_id",
+            format!("550e8400-e29b-41d4-a716-44665544000{}", i),
+        );
         events.push(event.into());
     }
 
@@ -604,7 +608,7 @@ async fn insert_events_arrow_with_schema_fetching() {
     assert_eq!(3, output.rows);
 
     // Verify all fields exist and have the correct types
-    for row in output.data.iter() {
+    for (i, row) in output.data.iter().enumerate() {
         // Check standard Vector fields exist
         assert!(row.get("host").and_then(|v| v.as_str()).is_some());
         assert!(row.get("message").and_then(|v| v.as_str()).is_some());
@@ -620,6 +624,16 @@ async fn insert_events_arrow_with_schema_fetching() {
         assert!(row.get("name").and_then(|v| v.as_str()).is_some());
         assert!(row.get("score").and_then(|v| v.as_f64()).is_some());
         assert!(row.get("active").and_then(|v| v.as_bool()).is_some());
+
+        // Check UUID field
+        let request_id = row
+            .get("request_id")
+            .and_then(|v| v.as_str())
+            .expect("request_id should be present");
+        assert_eq!(
+            request_id,
+            format!("550e8400-e29b-41d4-a716-44665544000{}", i)
+        );
     }
 }
 
diff --git a/website/cue/reference/components/sinks/clickhouse.cue b/website/cue/reference/components/sinks/clickhouse.cue
index c0d80d1444388..320608e26858d 100644
--- a/website/cue/reference/components/sinks/clickhouse.cue
+++ b/website/cue/reference/components/sinks/clickhouse.cue
@@ -153,7 +153,6 @@ components: sinks: clickhouse: {
 				types are unsupported:
 				- `FIXED_SIZE_BINARY`
 				- `JSON`
-				- `UUID`
 				- `ENUM`
 
 				#### Timezone Handling

From 7390fe0bd4922b6f804b7c59e56dac36747af86d Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 16 Mar 2026 11:08:19 -0400
Subject: [PATCH 003/326] chore(external docs): document Cargo feature
 placement rules (#24933)

* docs(style): document Cargo feature placement rules in RUST_STYLE.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Apply suggestions from code review

Co-authored-by: Thomas <thomasqueirozb@gmail.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Thomas <thomasqueirozb@gmail.com>
---
 docs/RUST_STYLE.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/docs/RUST_STYLE.md b/docs/RUST_STYLE.md
index 5ee34496af7b8..5d51af6855704 100644
--- a/docs/RUST_STYLE.md
+++ b/docs/RUST_STYLE.md
@@ -90,6 +90,8 @@ Code in Vector should **NOT** panic under normal circumstances.
 
 ## Feature Flags
 
+### Component Feature Flags
+
 New components (sources, sinks, transforms) must be behind feature flags:
 
 ```bash
@@ -98,3 +100,26 @@ cargo test --lib --no-default-features --features sinks-console sinks::console
 ```
 
 See `features` section in `Cargo.toml` for examples.
+
+### Cargo Dependency Feature Placement
+
+[Cargo features are additive](https://doc.rust-lang.org/cargo/reference/features.html#feature-unification): once any crate in the dependency graph enables a feature, it is enabled for the entire build. This can be surprising — enabling a feature in one crate silently turns it on everywhere.
+
+Always set `default-features = false` in `[workspace.dependencies]`. For feature declarations, the rule is simple:
+
+- If only one crate needs a feature, declare it in that crate's own `Cargo.toml`.
+- If multiple crates need it, declare it in `[workspace.dependencies]`.
+
+Add a short comment near the dependency when the feature setup is non-obvious.
+
+**Auditing:** when unsure whether a feature is truly needed or only transitively enabled, verify with:
+
+```bash
+# Show the full feature tree for the workspace
+cargo tree -e features
+
+# Narrow down to a specific dependency
+cargo tree -e features -i <crate-name>
+```
+
+The `-i` flag shows which crates depend on `<crate-name>` and which features they activate, useful for tracing where a feature is coming from. If a feature only appears because another crate enables it, and your crate relies on that feature being present, declare it explicitly — otherwise your crate silently breaks if the other crate ever stops enabling it.

From c27f6d6dd8acc01f57e93c53af4fad0138a07aa1 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 16 Mar 2026 12:05:44 -0400
Subject: [PATCH 004/326] chore(deps): update heim fork to remove unmaintained
 crates (#24924)

* chore(deps): update heim fork to remove unmaintained crates

* Update licenses

* Fix merge conflicts

* Update licenses/Cargo.toml
---
 Cargo.lock           | 276 +++++++++++--------------------------------
 Cargo.toml           |   2 +-
 LICENSE-3rdparty.csv |   6 +-
 deny.toml            |   1 -
 4 files changed, 71 insertions(+), 214 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e35cfde496f83..db997157c76f8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -583,17 +583,6 @@ dependencies = [
  "pin-project-lite",
 ]
 
-[[package]]
-name = "async-channel"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
-dependencies = [
- "concurrent-queue",
- "event-listener 2.5.3",
- "futures-core",
-]
-
 [[package]]
 name = "async-channel"
 version = "2.3.1"
@@ -639,22 +628,21 @@ checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
 dependencies = [
  "async-task",
  "concurrent-queue",
- "fastrand 2.3.0",
- "futures-lite 2.6.0",
+ "fastrand",
+ "futures-lite",
  "pin-project-lite",
  "slab",
 ]
 
 [[package]]
 name = "async-fs"
-version = "1.6.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "279cf904654eeebfa37ac9bb1598880884924aab82e290aa65c9e77a0e142e06"
+checksum = "8034a681df4aed8b8edbd7fbe472401ecf009251c8b40556b304567052e294c5"
 dependencies = [
- "async-lock 2.8.0",
- "autocfg",
+ "async-lock 3.4.0",
  "blocking",
- "futures-lite 1.13.0",
+ "futures-lite",
 ]
 
 [[package]]
@@ -663,11 +651,11 @@ version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13f937e26114b93193065fd44f507aa2e9169ad0cdabbb996920b1fe1ddea7ba"
 dependencies = [
- "async-channel 2.3.1",
+ "async-channel",
  "async-executor",
  "async-lock 3.4.0",
  "blocking",
- "futures-lite 2.6.0",
+ "futures-lite",
  "tokio",
 ]
 
@@ -755,26 +743,6 @@ dependencies = [
  "warp",
 ]
 
-[[package]]
-name = "async-io"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fc5b45d93ef0529756f812ca52e44c221b35341892d3dcc34132ac02f3dd2af"
-dependencies = [
- "async-lock 2.8.0",
- "autocfg",
- "cfg-if",
- "concurrent-queue",
- "futures-lite 1.13.0",
- "log",
- "parking",
- "polling 2.8.0",
- "rustix 0.37.27",
- "slab",
- "socket2 0.4.10",
- "waker-fn",
-]
-
 [[package]]
 name = "async-io"
 version = "2.4.0"
@@ -785,9 +753,9 @@ dependencies = [
  "cfg-if",
  "concurrent-queue",
  "futures-io",
- "futures-lite 2.6.0",
+ "futures-lite",
  "parking",
- "polling 3.7.4",
+ "polling",
  "rustix 0.38.40",
  "slab",
  "tracing 0.1.44",
@@ -864,30 +832,31 @@ dependencies = [
 
 [[package]]
 name = "async-net"
-version = "1.8.0"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0434b1ed18ce1cf5769b8ac540e33f01fa9471058b5e89da9e06f3c882a8c12f"
+checksum = "b948000fad4873c1c9339d60f2623323a0cfd3816e5181033c6a5cb68b2accf7"
 dependencies = [
- "async-io 1.13.0",
+ "async-io",
  "blocking",
- "futures-lite 1.13.0",
+ "futures-lite",
 ]
 
 [[package]]
 name = "async-process"
-version = "1.8.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea6438ba0a08d81529c69b36700fa2f95837bfe3e776ab39cde9c14d9149da88"
+checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
 dependencies = [
- "async-io 1.13.0",
- "async-lock 2.8.0",
+ "async-channel",
+ "async-io",
+ "async-lock 3.4.0",
  "async-signal",
+ "async-task",
  "blocking",
  "cfg-if",
- "event-listener 3.0.1",
- "futures-lite 1.13.0",
- "rustix 0.38.40",
- "windows-sys 0.48.0",
+ "event-listener 5.3.1",
+ "futures-lite",
+ "rustix 1.0.1",
 ]
 
 [[package]]
@@ -924,7 +893,7 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e47d90f65a225c4527103a8d747001fc56e375203592b25ad103e1ca13124c5"
 dependencies = [
- "async-io 2.4.0",
+ "async-io",
  "async-lock 2.8.0",
  "atomic-waker",
  "cfg-if",
@@ -1015,7 +984,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "hex",
  "http 1.3.1",
  "ring",
@@ -1055,7 +1024,7 @@ dependencies = [
  "aws-types",
  "bytes 1.11.1",
  "bytes-utils",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "http-body 0.4.6",
@@ -1084,7 +1053,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "fastrand 2.3.0",
+ "fastrand",
  "flate2",
  "http 0.2.12",
  "http 1.3.1",
@@ -1112,7 +1081,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1136,7 +1105,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1160,7 +1129,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1185,7 +1154,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1209,7 +1178,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1237,7 +1206,7 @@ dependencies = [
  "aws-smithy-xml",
  "aws-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "hex",
  "hmac",
  "http 0.2.12",
@@ -1268,7 +1237,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1293,7 +1262,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1317,7 +1286,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1341,7 +1310,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1365,7 +1334,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1390,7 +1359,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1576,7 +1545,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes 1.11.1",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "http-body 0.4.6",
@@ -1818,7 +1787,7 @@ version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cffb0e931875b666fc4fcb20fee52e9bbd1ef836fd9e9e04ec21555f9f85f7ef"
 dependencies = [
- "fastrand 2.3.0",
+ "fastrand",
  "gloo-timers",
  "tokio",
 ]
@@ -1986,10 +1955,10 @@ version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
 dependencies = [
- "async-channel 2.3.1",
+ "async-channel",
  "async-task",
  "futures-io",
- "futures-lite 2.6.0",
+ "futures-lite",
  "piper",
 ]
 
@@ -3969,17 +3938,6 @@ version = "2.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
 
-[[package]]
-name = "event-listener"
-version = "3.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01cec0252c2afff729ee6f00e903d479fba81784c8e2bd77447673471fdfaea1"
-dependencies = [
- "concurrent-queue",
- "parking",
- "pin-project-lite",
-]
-
 [[package]]
 name = "event-listener"
 version = "5.3.1"
@@ -4067,15 +4025,6 @@ dependencies = [
  "regex-syntax",
 ]
 
-[[package]]
-name = "fastrand"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
-dependencies = [
- "instant",
-]
-
 [[package]]
 name = "fastrand"
 version = "2.3.0"
@@ -4357,28 +4306,13 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
 
-[[package]]
-name = "futures-lite"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49a9d51ce47660b1e808d3c990b4709f2f415d928835a17dfd16991515c46bce"
-dependencies = [
- "fastrand 1.9.0",
- "futures-core",
- "futures-io",
- "memchr",
- "parking",
- "pin-project-lite",
- "waker-fn",
-]
-
 [[package]]
 name = "futures-lite"
 version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f5edaec856126859abb19ed65f39e90fea3a9574b9707f13539acf4abf7eb532"
 dependencies = [
- "fastrand 2.3.0",
+ "fastrand",
  "futures-core",
  "futures-io",
  "parking",
@@ -4838,7 +4772,7 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 [[package]]
 name = "heim"
 version = "0.1.0-rc.1"
-source = "git+https://github.com/vectordotdev/heim.git?branch=update-nix#f3537d9b32e69a2a8ab19a0d42a1e6f5577a5a45"
+source = "git+https://github.com/vectordotdev/heim.git?branch=update-deps#b62e0420231552ef079e86ecff1e6b98def6a553"
 dependencies = [
  "heim-common",
  "heim-cpu",
@@ -4852,7 +4786,7 @@ dependencies = [
 [[package]]
 name = "heim-common"
 version = "0.1.0-rc.1"
-source = "git+https://github.com/vectordotdev/heim.git?branch=update-nix#f3537d9b32e69a2a8ab19a0d42a1e6f5577a5a45"
+source = "git+https://github.com/vectordotdev/heim.git?branch=update-deps#b62e0420231552ef079e86ecff1e6b98def6a553"
 dependencies = [
  "cfg-if",
  "core-foundation 0.9.3",
@@ -4860,7 +4794,7 @@ dependencies = [
  "futures-util",
  "lazy_static",
  "libc",
- "mach",
+ "mach2",
  "nix 0.23.2",
  "pin-utils",
  "uom",
@@ -4870,7 +4804,7 @@ dependencies = [
 [[package]]
 name = "heim-cpu"
 version = "0.1.0-rc.1"
-source = "git+https://github.com/vectordotdev/heim.git?branch=update-nix#f3537d9b32e69a2a8ab19a0d42a1e6f5577a5a45"
+source = "git+https://github.com/vectordotdev/heim.git?branch=update-deps#b62e0420231552ef079e86ecff1e6b98def6a553"
 dependencies = [
  "cfg-if",
  "futures 0.3.31",
@@ -4879,7 +4813,7 @@ dependencies = [
  "heim-runtime",
  "lazy_static",
  "libc",
- "mach",
+ "mach2",
  "ntapi 0.3.7",
  "smol",
  "winapi",
@@ -4888,7 +4822,7 @@ dependencies = [
 [[package]]
 name = "heim-disk"
 version = "0.1.0-rc.1"
-source = "git+https://github.com/vectordotdev/heim.git?branch=update-nix#f3537d9b32e69a2a8ab19a0d42a1e6f5577a5a45"
+source = "git+https://github.com/vectordotdev/heim.git?branch=update-deps#b62e0420231552ef079e86ecff1e6b98def6a553"
 dependencies = [
  "bitflags 1.3.2",
  "cfg-if",
@@ -4896,7 +4830,7 @@ dependencies = [
  "heim-common",
  "heim-runtime",
  "libc",
- "mach",
+ "mach2",
  "widestring 0.4.3",
  "winapi",
 ]
@@ -4904,7 +4838,7 @@ dependencies = [
 [[package]]
 name = "heim-host"
 version = "0.1.0-rc.1"
-source = "git+https://github.com/vectordotdev/heim.git?branch=update-nix#f3537d9b32e69a2a8ab19a0d42a1e6f5577a5a45"
+source = "git+https://github.com/vectordotdev/heim.git?branch=update-deps#b62e0420231552ef079e86ecff1e6b98def6a553"
 dependencies = [
  "cfg-if",
  "heim-common",
@@ -4912,7 +4846,7 @@ dependencies = [
  "lazy_static",
  "libc",
  "log",
- "mach",
+ "mach2",
  "ntapi 0.3.7",
  "platforms",
  "winapi",
@@ -4921,21 +4855,21 @@ dependencies = [
 [[package]]
 name = "heim-memory"
 version = "0.1.0-rc.1"
-source = "git+https://github.com/vectordotdev/heim.git?branch=update-nix#f3537d9b32e69a2a8ab19a0d42a1e6f5577a5a45"
+source = "git+https://github.com/vectordotdev/heim.git?branch=update-deps#b62e0420231552ef079e86ecff1e6b98def6a553"
 dependencies = [
  "cfg-if",
  "heim-common",
  "heim-runtime",
  "lazy_static",
  "libc",
- "mach",
+ "mach2",
  "winapi",
 ]
 
 [[package]]
 name = "heim-net"
 version = "0.1.0-rc.1"
-source = "git+https://github.com/vectordotdev/heim.git?branch=update-nix#f3537d9b32e69a2a8ab19a0d42a1e6f5577a5a45"
+source = "git+https://github.com/vectordotdev/heim.git?branch=update-deps#b62e0420231552ef079e86ecff1e6b98def6a553"
 dependencies = [
  "bitflags 1.3.2",
  "cfg-if",
@@ -4951,7 +4885,7 @@ dependencies = [
 [[package]]
 name = "heim-runtime"
 version = "0.1.0-rc.1"
-source = "git+https://github.com/vectordotdev/heim.git?branch=update-nix#f3537d9b32e69a2a8ab19a0d42a1e6f5577a5a45"
+source = "git+https://github.com/vectordotdev/heim.git?branch=update-deps#b62e0420231552ef079e86ecff1e6b98def6a553"
 dependencies = [
  "futures 0.3.31",
  "futures-timer",
@@ -5722,15 +5656,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "instant"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
-dependencies = [
- "cfg-if",
-]
-
 [[package]]
 name = "inventory"
 version = "0.3.22"
@@ -5740,17 +5665,6 @@ dependencies = [
  "rustversion",
 ]
 
-[[package]]
-name = "io-lifetimes"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eae7b9aee968036d54dce06cebaefd919e4472e753296daccd6d344e3e2df0c2"
-dependencies = [
- "hermit-abi 0.3.9",
- "libc",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "iovec"
 version = "0.1.4"
@@ -6426,12 +6340,6 @@ dependencies = [
  "linked-hash-map",
 ]
 
-[[package]]
-name = "linux-raw-sys"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.14"
@@ -6570,10 +6478,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baee0bbc17ce759db233beb01648088061bf678383130602a298e6998eedb2d8"
 
 [[package]]
-name = "mach"
-version = "0.3.2"
+name = "mach2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b823e83b2affd8f40a9ee8c29dbc56404c1e34cd2710921f2801e2cf29527afa"
+checksum = "6a1b95cd5421ec55b445b5ae102f5ea0e768de1f82bd3001e11f426c269c3aea"
 dependencies = [
  "libc",
 ]
@@ -7996,7 +7904,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "668d31b1c4eba19242f2088b2bf3316b82ca31082a8335764db4e083db7485d4"
 dependencies = [
  "atomic-waker",
- "fastrand 2.3.0",
+ "fastrand",
  "futures-io",
 ]
 
@@ -8061,22 +7969,6 @@ dependencies = [
  "plotters-backend",
 ]
 
-[[package]]
-name = "polling"
-version = "2.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b2d323e8ca7996b3e23126511a523f7e62924d93ecd5ae73b333815b0eb3dce"
-dependencies = [
- "autocfg",
- "bitflags 1.3.2",
- "cfg-if",
- "concurrent-queue",
- "libc",
- "log",
- "pin-project-lite",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "polling"
 version = "3.7.4"
@@ -8617,7 +8509,7 @@ version = "6.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6cee616af00383c461f9ceb0067d15dee68e7d313ae47dbd7f8543236aed7ee9"
 dependencies = [
- "async-channel 2.3.1",
+ "async-channel",
  "async-trait",
  "bytes 1.11.1",
  "chrono",
@@ -9610,20 +9502,6 @@ dependencies = [
  "semver",
 ]
 
-[[package]]
-name = "rustix"
-version = "0.37.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fea8ca367a3a01fe35e6943c400addf443c0f57670e6ec51196f71a4b8762dd2"
-dependencies = [
- "bitflags 1.3.2",
- "errno",
- "io-lifetimes",
- "libc",
- "linux-raw-sys 0.3.8",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "rustix"
 version = "0.38.40"
@@ -10428,19 +10306,19 @@ dependencies = [
 
 [[package]]
 name = "smol"
-version = "1.3.0"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13f2b548cd8447f8de0fdf1c592929f70f4fc7039a05e47404b0d096ec6987a1"
+checksum = "a33bd3e260892199c3ccfc487c88b2da2265080acb316cd920da72fdfd7c599f"
 dependencies = [
- "async-channel 1.9.0",
+ "async-channel",
  "async-executor",
  "async-fs",
- "async-io 1.13.0",
- "async-lock 2.8.0",
+ "async-io",
+ "async-lock 3.4.0",
  "async-net",
  "async-process",
  "blocking",
- "futures-lite 1.13.0",
+ "futures-lite",
 ]
 
 [[package]]
@@ -10510,16 +10388,6 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b6b67fb9a61334225b5b790716f609cd58395f895b3fe8b328786812a40bc3b"
 
-[[package]]
-name = "socket2"
-version = "0.4.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f7916fc008ca5542385b89a3d3ce689953c143e9304a9bf8beec1de48994c0d"
-dependencies = [
- "libc",
- "winapi",
-]
-
 [[package]]
 name = "socket2"
 version = "0.5.10"
@@ -11121,7 +10989,7 @@ version = "3.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
 dependencies = [
- "fastrand 2.3.0",
+ "fastrand",
  "getrandom 0.3.4",
  "once_cell",
  "rustix 1.0.1",
@@ -13266,12 +13134,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "waker-fn"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c4517f54858c779bbcbf228f4fca63d121bf85fbecb2dc578cdf4a39395690"
-
 [[package]]
 name = "walkdir"
 version = "2.4.0"
diff --git a/Cargo.toml b/Cargo.toml
index a43905a1dc00a..dbc8c97a192d2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -448,7 +448,7 @@ arr_macro = { version = "0.2.1" }
 
 # depending on fork for bumped nix dependency
 # https://github.com/heim-rs/heim/pull/360
-heim = { git = "https://github.com/vectordotdev/heim.git", branch = "update-nix", default-features = false, features = ["disk"] }
+heim = { git = "https://github.com/vectordotdev/heim.git", branch = "update-deps", default-features = false, features = ["disk"] }
 
 # make sure to update the external docs when the Lua version changes
 mlua = { version = "0.10.5", default-features = false, features = ["lua54", "send", "vendored", "macros"], optional = true }
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 7c616f5b55d3e..f360fe49e53a1 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -393,9 +393,7 @@ inotify,https://github.com/hannobraun/inotify,ISC,"Hanno Braun <mail@hannobraun.
 inotify-sys,https://github.com/hannobraun/inotify-sys,ISC,Hanno Braun <hb@hannobraun.de>
 inout,https://github.com/RustCrypto/utils,MIT OR Apache-2.0,RustCrypto Developers
 instability,https://github.com/ratatui-org/instability,MIT,"Stephen M. Coakley <me@stephencoakley.com>, Joshka"
-instant,https://github.com/sebcrozet/instant,BSD-3-Clause,sebcrozet <developer@crozet.re>
 inventory,https://github.com/dtolnay/inventory,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
-io-lifetimes,https://github.com/sunfishcode/io-lifetimes,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,Dan Gohman <dev@sunfishcode.online>
 iovec,https://github.com/carllerche/iovec,MIT OR Apache-2.0,Carl Lerche <me@carllerche.com>
 ipconfig,https://github.com/liranringel/ipconfig,MIT OR Apache-2.0,Liran Ringel <liranringel@gmail.com>
 ipcrypt-rs,https://github.com/jedisct1/rust-ipcrypt2,ISC,Frank Denis <github@pureftpd.org>
@@ -456,7 +454,7 @@ lz4,https://github.com/10xGenomics/lz4-rs,MIT,"Jens Heyens <jens.heyens@ewetel.n
 lz4-sys,https://github.com/10xGenomics/lz4-rs,MIT,"Jens Heyens <jens.heyens@ewetel.net>, Artem V. Navrotskiy <bozaro@buzzsoft.ru>, Patrick Marks <pmarks@gmail.com>"
 lz4_flex,https://github.com/pseitz/lz4_flex,MIT,"Pascal Seitz <pascal.seitz@gmail.com>, Arthur Silva <arthurprs@gmail.com>, ticki <Ticki@users.noreply.github.com>"
 macaddr,https://github.com/svartalf/rust-macaddr,Apache-2.0 OR MIT,svartalf <self@svartalf.info>
-mach,https://github.com/fitzgen/mach,BSD-2-Clause,"Nick Fitzgerald <fitzgen@gmail.com>, David Cuddeback <david.cuddeback@gmail.com>, Gonzalo Brito Gadeschi <gonzalobg88@gmail.com>"
+mach2,https://github.com/JohnTitor/mach2,BSD-2-Clause OR MIT OR Apache-2.0,The mach2 Authors
 macro_magic,https://github.com/sam0x17/macro_magic,MIT,sam0x17
 macro_magic_core,https://github.com/sam0x17/macro_magic,MIT,The macro_magic_core Authors
 macro_magic_core_macros,https://github.com/sam0x17/macro_magic,MIT,The macro_magic_core_macros Authors
@@ -568,7 +566,6 @@ piper,https://github.com/notgull/piper,MIT OR Apache-2.0,"Stjepan Glavina <stjep
 pkcs1,https://github.com/RustCrypto/formats/tree/master/pkcs1,Apache-2.0 OR MIT,RustCrypto Developers
 pkcs8,https://github.com/RustCrypto/formats/tree/master/pkcs8,Apache-2.0 OR MIT,RustCrypto Developers
 platforms,https://github.com/RustSec/platforms-crate,Apache-2.0 OR MIT,Tony Arcieri <bascule@gmail.com>
-polling,https://github.com/smol-rs/polling,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
 polling,https://github.com/smol-rs/polling,Apache-2.0 OR MIT,"Stjepan Glavina <stjepang@gmail.com>, John Nunley <dev@notgull.net>"
 poly1305,https://github.com/RustCrypto/universal-hashes,Apache-2.0 OR MIT,RustCrypto Developers
 portable-atomic,https://github.com/taiki-e/portable-atomic,Apache-2.0 OR MIT,The portable-atomic Authors
@@ -859,7 +856,6 @@ vrl,https://github.com/vectordotdev/vrl,MPL-2.0,Vector Contributors <vector@data
 vsimd,https://github.com/Nugine/simd,MIT,The vsimd Authors
 vte,https://github.com/alacritty/vte,Apache-2.0 OR MIT,"Joe Wilm <joe@jwilm.com>, Christian Duerr <contact@christianduerr.com>"
 wait-timeout,https://github.com/alexcrichton/wait-timeout,MIT OR Apache-2.0,Alex Crichton <alex@alexcrichton.com>
-waker-fn,https://github.com/smol-rs/waker-fn,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
 walkdir,https://github.com/BurntSushi/walkdir,Unlicense OR MIT,Andrew Gallant <jamslam@gmail.com>
 want,https://github.com/seanmonstar/want,MIT,Sean McArthur <sean@seanmonstar.com>
 warp,https://github.com/seanmonstar/warp,MIT,Sean McArthur <sean@seanmonstar.com>
diff --git a/deny.toml b/deny.toml
index c9a83079d192f..17ad08e1a8a5d 100644
--- a/deny.toml
+++ b/deny.toml
@@ -46,7 +46,6 @@ ignore = [
   "RUSTSEC-2023-0071",
   { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained" },
   { id = "RUSTSEC-2024-0384", reason = "instant is unmaintained" },
-  { id = "RUSTSEC-2020-0168", reason = "mach is unmaintained" },
   { id = "RUSTSEC-2025-0012", reason = "backoff is unmaintained" },
   # rustls-pemfile is unmaintained. Blocked by both async-nats and http 1.0.0 upgrade.
   { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile is unmaintained" },

From 0d8bb9bea3418bd6993e08b456fc495050a42930 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 17:07:42 +0000
Subject: [PATCH 005/326] chore(deps): bump pulsar from 6.3.1 to 6.7.0 (#24746)

* chore(deps): bump pulsar from 6.3.1 to 6.7.0

Bumps [pulsar](https://github.com/streamnative/pulsar-rs) from 6.3.1 to 6.7.0.
- [Release notes](https://github.com/streamnative/pulsar-rs/releases)
- [Commits](https://github.com/streamnative/pulsar-rs/compare/v6.3.1...v6.7.0)

---
updated-dependencies:
- dependency-name: pulsar
  dependency-version: 6.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update Cargo.toml

* Update licenses

* Add Default::default to new fields

* Remove TODO comment

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock                 | 40 +++++++++++++++++---------------------
 Cargo.toml                 |  2 +-
 LICENSE-3rdparty.csv       |  1 +
 src/sinks/pulsar/config.rs |  4 ++++
 4 files changed, 24 insertions(+), 23 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index db997157c76f8..8f526e6c4bb7b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6920,6 +6920,12 @@ version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5ce46fe64a9d73be07dcbe690a38ce1b293be448fd8ce1e6c1b8062c9f72c6a"
 
+[[package]]
+name = "murmur3"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9252111cf132ba0929b6f8e030cac2a24b507f3a4d6db6fb2896f27b354c714b"
+
 [[package]]
 name = "native-tls"
 version = "0.2.14"
@@ -7356,16 +7362,16 @@ dependencies = [
 
 [[package]]
 name = "oauth2"
-version = "4.4.2"
+version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c38841cdd844847e3e7c8d29cef9dcfed8877f8f56f9071f77843ecf3baf937f"
+checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64 0.13.1",
+ "base64 0.22.1",
  "chrono",
  "getrandom 0.2.15",
- "http 0.2.12",
+ "http 1.3.1",
  "rand 0.8.5",
- "reqwest 0.11.26",
+ "reqwest 0.12.28",
  "serde",
  "serde_json",
  "serde_path_to_error",
@@ -7494,16 +7500,16 @@ dependencies = [
 
 [[package]]
 name = "openidconnect"
-version = "3.5.0"
+version = "4.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f47e80a9cfae4462dd29c41e987edd228971d6565553fbc14b8a11e666d91590"
+checksum = "0d8c6709ba2ea764bbed26bce1adf3c10517113ddea6f2d4196e4851757ef2b2"
 dependencies = [
- "base64 0.13.1",
+ "base64 0.21.7",
  "chrono",
  "dyn-clone",
  "ed25519-dalek",
  "hmac",
- "http 0.2.12",
+ "http 1.3.1",
  "itertools 0.10.5",
  "log",
  "oauth2",
@@ -7513,7 +7519,6 @@ dependencies = [
  "rsa",
  "serde",
  "serde-value",
- "serde_derive",
  "serde_json",
  "serde_path_to_error",
  "serde_plain",
@@ -8505,9 +8510,9 @@ dependencies = [
 
 [[package]]
 name = "pulsar"
-version = "6.3.1"
+version = "6.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cee616af00383c461f9ceb0067d15dee68e7d313ae47dbd7f8543236aed7ee9"
+checksum = "24c00856d6c64af2078a74c2de029842cdaece2f35b1223f5166809ea49cf5cd"
 dependencies = [
  "async-channel",
  "async-trait",
@@ -8519,6 +8524,7 @@ dependencies = [
  "futures 0.3.31",
  "log",
  "lz4",
+ "murmur3",
  "native-tls",
  "nom 7.1.3",
  "oauth2",
@@ -9155,7 +9161,6 @@ dependencies = [
  "http 0.2.12",
  "http-body 0.4.6",
  "hyper 0.14.32",
- "hyper-rustls 0.24.2",
  "hyper-tls 0.5.0",
  "ipnet",
  "js-sys",
@@ -9165,7 +9170,6 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls 0.21.12",
  "rustls-pemfile 1.0.4",
  "serde",
  "serde_json",
@@ -9174,13 +9178,11 @@ dependencies = [
  "system-configuration 0.5.1",
  "tokio",
  "tokio-native-tls",
- "tokio-rustls 0.24.1",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots 0.25.2",
  "winreg",
 ]
 
@@ -13323,12 +13325,6 @@ dependencies = [
  "web-sys",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "0.25.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14247bb57be4f377dfb94c72830b8ce8fc6beac03cf4bf7b9732eadd414123fc"
-
 [[package]]
 name = "webpki-roots"
 version = "0.26.1"
diff --git a/Cargo.toml b/Cargo.toml
index dbc8c97a192d2..ddeb29d9d765b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -414,7 +414,7 @@ openssl-probe = { version = "0.1.6", default-features = false }
 ordered-float.workspace = true
 percent-encoding = { version = "2.3.1", default-features = false }
 postgres-openssl = { version = "0.5.1", default-features = false, features = ["runtime"], optional = true }
-pulsar = { version = "6.3.1", default-features = false, features = ["tokio-runtime", "auth-oauth2", "flate2", "lz4", "snap", "zstd"], optional = true }
+pulsar = { version = "6.7.0", default-features = false, features = ["tokio-runtime", "auth-oauth2", "flate2", "lz4", "snap", "zstd"], optional = true }
 quick-junit = { version = "0.5.1" }
 rand.workspace = true
 rand_distr.workspace = true
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index f360fe49e53a1..1f02718d93477 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -487,6 +487,7 @@ mongocrypt-sys,https://github.com/mongodb/libmongocrypt-rust,Apache-2.0,"Abraham
 mongodb,https://github.com/mongodb/mongo-rust-driver,Apache-2.0,"Saghm Rossi <saghmrossi@gmail.com>, Patrick Freed <patrick.freed@mongodb.com>, Isabel Atkinson <isabel.atkinson@mongodb.com>, Abraham Egnor <abraham.egnor@mongodb.com>, Kaitlin Mahar <kaitlin.mahar@mongodb.com>, Patrick Meredith <pmeredit@protonmail.com>"
 mongodb-internal-macros,https://github.com/mongodb/mongo-rust-driver,Apache-2.0,The mongodb-internal-macros Authors
 multer,https://github.com/rousan/multer-rs,MIT,Rousan Ali <hello@rousan.io>
+murmur3,https://github.com/stusmall/murmur3,MIT OR Apache-2.0,Stu Small <stuart.alan.small@gmail.com>
 native-tls,https://github.com/sfackler/rust-native-tls,MIT OR Apache-2.0,Steven Fackler <sfackler@gmail.com>
 ndk-context,https://github.com/rust-windowing/android-ndk-rs,MIT OR Apache-2.0,The Rust Windowing contributors
 newtype-uuid,https://github.com/oxidecomputer/newtype-uuid,MIT OR Apache-2.0,The newtype-uuid Authors
diff --git a/src/sinks/pulsar/config.rs b/src/sinks/pulsar/config.rs
index b006b6212d417..6b27035715226 100644
--- a/src/sinks/pulsar/config.rs
+++ b/src/sinks/pulsar/config.rs
@@ -310,6 +310,7 @@ impl PulsarSinkConfig {
                             .map_or(default_retry_options.keep_alive, |secs| {
                                 Duration::from_secs(secs)
                             }),
+                        connection_max_idle: Default::default(),
                     }
                 });
 
@@ -338,6 +339,9 @@ impl PulsarSinkConfig {
             batch_size: self.batch.max_events,
             batch_byte_size: self.batch.max_bytes,
             compression: None,
+            batch_timeout: Default::default(),
+            block_queue_if_full: Default::default(),
+            routing_policy: Default::default(),
         };
 
         match &self.compression {

From fd766a0738802e9dee2eae1e5d6f243ed9c69229 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 16 Mar 2026 13:10:58 -0400
Subject: [PATCH 006/326] chore(deps): make rdkafka use gssapi-vendored when
 publishing/testing (#24912)

* chore(deps): make rdkafka use gssapi-vendored when publishing/testing

* update licenses

* cargo fmt

* Remove gssapi from docs

* Re-add krb5-src to license file

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 Cargo.toml                        | 15 +++++++++------
 scripts/cross/bootstrap-ubuntu.sh |  4 +++-
 vdev/src/testing/build.rs         |  5 ++++-
 vdev/src/testing/integration.rs   |  4 ++--
 4 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index ddeb29d9d765b..f2bfd2b21f48c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -505,11 +505,14 @@ ntapi = { git = "https://github.com/MSxDOS/ntapi.git", rev = "24fc1e47677fc9f6e3
 
 [features]
 # Default features for *-unknown-linux-gnu and *-apple-darwin
-default = ["enable-unix", "rdkafka?/gssapi-vendored"]
-# Default features for `cargo docs`. The same as `default` but without `rdkafka?/gssapi-vendored` which would require installing libsasl in our doc build environment.
+default = ["enable-unix", "rdkafka?/gssapi"]
+# Default features for `cargo docs`. We're not using `gssapi` which would require installing libsasl2 in our doc environment.
 docs = ["enable-unix"]
 # Default features for *-unknown-linux-* which make use of `cmake` for dependencies
-default-cmake = ["enable-unix", "rdkafka?/gssapi-vendored", "rdkafka?/cmake_build"]
+default-cmake = ["enable-unix", "vendored", "rdkafka?/cmake_build"]
+
+vendored = ["rdkafka?/gssapi-vendored"]
+
 # Default features for *-pc-windows-msvc
 # TODO: Enable SASL https://github.com/vectordotdev/vector/pull/3081#issuecomment-659298042
 base = ["api", "enrichment-tables", "sinks", "sources", "transforms", "secrets", "vrl/stdlib"]
@@ -517,8 +520,8 @@ enable-api-client = ["base", "api-client"]
 enable-unix = ["enable-api-client", "sources-dnstap", "unix"]
 
 default-msvc = ["enable-api-client", "rdkafka?/cmake_build"]
-default-musl = ["enable-unix", "rdkafka?/gssapi-vendored", "rdkafka?/cmake_build"]
-default-no-api-client = ["base", "sources-dnstap", "unix", "rdkafka?/gssapi-vendored"]
+default-musl = ["enable-unix", "vendored", "rdkafka?/cmake_build"]
+default-no-api-client = ["base", "sources-dnstap", "unix", "vendored"]
 
 tokio-console = ["dep:console-subscriber", "tokio/tracing"]
 
@@ -544,7 +547,7 @@ target-armv7-unknown-linux-gnueabihf =  ["target-unix"]
 target-armv7-unknown-linux-musleabihf = ["target-base"]
 target-arm-unknown-linux-gnueabi =      ["target-unix"]
 target-arm-unknown-linux-musleabi =     ["target-base"]
-target-x86_64-unknown-linux-gnu =       ["target-unix", "rdkafka?/gssapi-vendored"]
+target-x86_64-unknown-linux-gnu =       ["target-unix", "vendored"]
 target-x86_64-unknown-linux-musl =      ["target-unix"]
 
 # Enables features that work only on systems providing `cfg(unix)`
diff --git a/scripts/cross/bootstrap-ubuntu.sh b/scripts/cross/bootstrap-ubuntu.sh
index 88e208ae2ea56..8068d1bcd3eb5 100755
--- a/scripts/cross/bootstrap-ubuntu.sh
+++ b/scripts/cross/bootstrap-ubuntu.sh
@@ -26,4 +26,6 @@ apt-get install -y \
       libclang1-9 \
       llvm-9 \
       clang \
-      unzip
+      unzip \
+      libsasl2-dev
+
diff --git a/vdev/src/testing/build.rs b/vdev/src/testing/build.rs
index 7b15f0c513d5f..9d564394d346a 100644
--- a/vdev/src/testing/build.rs
+++ b/vdev/src/testing/build.rs
@@ -67,7 +67,10 @@ pub fn build_integration_image() -> Result<()> {
     let mut cmd = prepare_build_command(
         &image,
         &dockerfile,
-        Some(&[ALL_INTEGRATIONS_FEATURE_FLAG.to_string()]),
+        Some(&[
+            ALL_INTEGRATIONS_FEATURE_FLAG.to_string(),
+            "vendored".to_string(),
+        ]),
         &Environment::default(),
         false, // Integration tests don't pre-build Vector tests.
     );
diff --git a/vdev/src/testing/integration.rs b/vdev/src/testing/integration.rs
index 213d7245abf8c..127346cb3206f 100644
--- a/vdev/src/testing/integration.rs
+++ b/vdev/src/testing/integration.rs
@@ -194,9 +194,9 @@ impl ComposeTest {
         // If using shared runner: use 'all-integration-tests' or 'all-e2e-tests'
         // If using per-test runner: use test-specific features from test.yaml
         args.push(if self.runner.is_shared_runner() {
-            self.local_config.feature_flag.to_string()
+            format!("{},vendored", self.local_config.feature_flag)
         } else {
-            self.config.features.join(",")
+            format!("{},vendored", self.config.features.join(","))
         });
 
         // If the test field is not present then use the --lib flag

From d38425ad1302489d7420a9d24447224559a5a446 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 17:16:13 +0000
Subject: [PATCH 007/326] chore(deps): bump regex from 1.11.2 to 1.12.3
 (#24796)

* chore(deps): bump regex from 1.11.2 to 1.12.3

Bumps [regex](https://github.com/rust-lang/regex) from 1.11.2 to 1.12.3.
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/regex/compare/1.11.2...1.12.3)

---
updated-dependencies:
- dependency-name: regex
  dependency-version: 1.12.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update licenses

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock                 | 20 ++++++++++----------
 Cargo.toml                 |  2 +-
 LICENSE-3rdparty.csv       |  2 +-
 lib/vector-core/Cargo.toml |  2 +-
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 8f526e6c4bb7b..e97720b69c1ba 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2140,7 +2140,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63044e1ae8e69f3b5a92c736ca6269b8d12fa7efe39bf34ddb06d102cf0e2cab"
 dependencies = [
  "memchr",
- "regex-automata 0.4.8",
+ "regex-automata 0.4.14",
  "serde",
 ]
 
@@ -4021,7 +4021,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72cf461f865c862bb7dc573f643dd6a2b6842f7c30b07882b56bd148cc2761b8"
 dependencies = [
  "bit-set",
- "regex-automata 0.4.8",
+ "regex-automata 0.4.14",
  "regex-syntax",
 ]
 
@@ -6123,7 +6123,7 @@ version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "feee752d43abd0f4807a921958ab4131f692a44d4d599733d4419c5d586176ce"
 dependencies = [
- "regex-automata 0.4.8",
+ "regex-automata 0.4.14",
  "rustversion",
 ]
 
@@ -6555,7 +6555,7 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
 dependencies = [
- "regex-automata 0.4.8",
+ "regex-automata 0.4.14",
 ]
 
 [[package]]
@@ -9069,13 +9069,13 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.11.2"
+version = "1.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.4.8",
+ "regex-automata 0.4.14",
  "regex-syntax",
 ]
 
@@ -9087,9 +9087,9 @@ checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
 
 [[package]]
 name = "regex-automata"
-version = "0.4.8"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "368758f23274712b504848e9d5a6f010445cc8b87a7cdb4d7cbee666c1288da3"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -11871,7 +11871,7 @@ dependencies = [
  "matchers",
  "nu-ansi-term",
  "once_cell",
- "regex-automata 0.4.8",
+ "regex-automata 0.4.14",
  "serde",
  "serde_json",
  "sharded-slab",
diff --git a/Cargo.toml b/Cargo.toml
index f2bfd2b21f48c..f4dec4497b1c8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -187,7 +187,7 @@ prost-reflect = { version = "0.14", features = ["serde"], default-features = fal
 prost-types = { version = "0.12", default-features = false }
 rand = { version = "0.9.2", default-features = false, features = ["small_rng", "thread_rng"] }
 rand_distr = { version = "0.5.1", default-features = false }
-regex = { version = "1.11.2", default-features = false, features = ["std", "perf"] }
+regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
 reqwest = { version = "0.11", features = ["json"] }
 rust_decimal = { version = "1.37.0", default-features = false, features = ["std"] }
 semver = { version = "1.0.27", default-features = false, features = ["serde", "std"] }
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 1f02718d93477..523769af4238a 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -634,7 +634,7 @@ ref-cast,https://github.com/dtolnay/ref-cast,MIT OR Apache-2.0,David Tolnay <dto
 ref-cast-impl,https://github.com/dtolnay/ref-cast,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 referencing,https://github.com/Stranger6667/jsonschema,MIT,Dmitry Dygalo <dmitry@dygalo.dev>
 regex,https://github.com/rust-lang/regex,MIT OR Apache-2.0,"The Rust Project Developers, Andrew Gallant <jamslam@gmail.com>"
-regex-automata,https://github.com/rust-lang/regex/tree/master/regex-automata,MIT OR Apache-2.0,"The Rust Project Developers, Andrew Gallant <jamslam@gmail.com>"
+regex-automata,https://github.com/rust-lang/regex,MIT OR Apache-2.0,"The Rust Project Developers, Andrew Gallant <jamslam@gmail.com>"
 regex-filtered,https://github.com/ua-parser/uap-rust,BSD-3-Clause,The regex-filtered Authors
 regex-lite,https://github.com/rust-lang/regex,MIT OR Apache-2.0,"The Rust Project Developers, Andrew Gallant <jamslam@gmail.com>"
 regex-syntax,https://github.com/rust-lang/regex/tree/master/regex-syntax,MIT OR Apache-2.0,"The Rust Project Developers, Andrew Gallant <jamslam@gmail.com>"
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index d416d018d3fbb..1147ce8b63e1a 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -41,7 +41,7 @@ proptest = { version = "1.10", optional = true }
 prost-types.workspace = true
 prost.workspace = true
 quanta = { version = "0.12.6", default-features = false }
-regex = { version = "1.11.2", default-features = false, features = ["std", "perf"] }
+regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
 ryu = { version = "1", default-features = false }
 serde.workspace = true
 serde_json.workspace = true

From c2fc606306e10e02263d2982f20c8c17f69a143b Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 16 Mar 2026 14:05:29 -0400
Subject: [PATCH 008/326] feat(vdev): check Cargo.lock for changes after cargo
 check/clippy (#24935)

* feat(vdev): check Cargo.lock for changes after cargo check/clippy

* Only commit if no lockfile changes are detected
---
 Cargo.lock                         | 26 +++++++++++++++++++--
 Cargo.toml                         |  1 +
 lib/codecs/Cargo.toml              |  2 +-
 lib/vector-vrl/category/Cargo.toml |  2 +-
 vdev/Cargo.toml                    |  1 +
 vdev/src/commands/check/rust.rs    | 37 +++++++++++++++++++++++-------
 6 files changed, 57 insertions(+), 12 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e97720b69c1ba..635320a783e62 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2546,7 +2546,7 @@ dependencies = [
  "similar-asserts",
  "smallvec",
  "snafu 0.8.9",
- "strum 0.26.3",
+ "strum 0.28.0",
  "syslog_loose 0.23.0",
  "tokio",
  "tokio-util",
@@ -10736,6 +10736,15 @@ dependencies = [
  "strum_macros 0.27.2",
 ]
 
+[[package]]
+name = "strum"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9628de9b8791db39ceda2b119bbe13134770b56c138ec1d3af810d045c04f9bd"
+dependencies = [
+ "strum_macros 0.28.0",
+]
+
 [[package]]
 name = "strum_macros"
 version = "0.25.3"
@@ -10774,6 +10783,18 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "strum_macros"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab85eea0270ee17587ed4156089e10b9e6880ee688791d45a905f5b1ca36f664"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2 1.0.106",
+ "quote 1.0.44",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "subtle"
 version = "2.5.0"
@@ -12362,6 +12383,7 @@ dependencies = [
  "serde_json",
  "serde_yaml",
  "sha2",
+ "strum 0.28.0",
  "tempfile",
  "toml 0.9.8",
  "toml_edit 0.23.9",
@@ -12914,7 +12936,7 @@ dependencies = [
 name = "vector-vrl-category"
 version = "0.1.0"
 dependencies = [
- "strum 0.27.2",
+ "strum 0.28.0",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index f4dec4497b1c8..f5639daa32ca8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -219,6 +219,7 @@ vector-vrl-functions = { path = "lib/vector-vrl/functions", default-features = f
 vrl = { git = "https://github.com/vectordotdev/vrl.git", branch = "main", default-features = false, features = ["arbitrary", "cli", "test", "test_framework", "stdlib-base"] }
 mock_instant = { version = "0.6" }
 serial_test = { version = "3.2" }
+strum = { version = "0.28", features = ["derive"] }
 
 [dependencies]
 cfg-if.workspace = true
diff --git a/lib/codecs/Cargo.toml b/lib/codecs/Cargo.toml
index 0ed26d0b16a41..90a5fd2780109 100644
--- a/lib/codecs/Cargo.toml
+++ b/lib/codecs/Cargo.toml
@@ -42,7 +42,7 @@ serde_json.workspace = true
 serde-aux = { version = "4.5", optional = true }
 smallvec = { version = "1", default-features = false, features = ["union"] }
 snafu.workspace = true
-strum = { version = "0.26.3", features = ["derive"], optional = true }
+strum = { workspace = true, optional = true }
 syslog_loose = { version = "0.23", default-features = false, optional = true }
 tokio-util = { version = "0.7", default-features = false, features = ["codec"] }
 tokio = { workspace = true, features = ["full"] }
diff --git a/lib/vector-vrl/category/Cargo.toml b/lib/vector-vrl/category/Cargo.toml
index dafb938de89fa..886b7dce5e72f 100644
--- a/lib/vector-vrl/category/Cargo.toml
+++ b/lib/vector-vrl/category/Cargo.toml
@@ -7,4 +7,4 @@ publish = false
 license = "MPL-2.0"
 
 [dependencies]
-strum = { version = "0.27", features = ["derive"] }
+strum.workspace = true
diff --git a/vdev/Cargo.toml b/vdev/Cargo.toml
index 959362252e3cb..8fea6eb281d0a 100644
--- a/vdev/Cargo.toml
+++ b/vdev/Cargo.toml
@@ -42,6 +42,7 @@ tempfile.workspace = true
 toml.workspace = true
 toml_edit = "0.23"
 semver.workspace = true
+strum.workspace = true
 indoc.workspace = true
 git2 = { version = "0.20.4" }
 cfg-if.workspace = true
diff --git a/vdev/src/commands/check/rust.rs b/vdev/src/commands/check/rust.rs
index cdd6e45381683..e7597550962df 100644
--- a/vdev/src/commands/check/rust.rs
+++ b/vdev/src/commands/check/rust.rs
@@ -1,9 +1,9 @@
-use anyhow::Result;
-use std::ffi::OsString;
+use anyhow::{Result, bail};
+use std::{ffi::OsString, fs};
 
 use crate::{
     app,
-    utils::{command::ChainArgs as _, git},
+    utils::{command::ChainArgs as _, git, paths},
 };
 
 /// Check the Rust code for errors
@@ -20,11 +20,16 @@ pub struct Cli {
     fix: bool,
 }
 
+#[derive(strum::Display, strum::AsRefStr, Clone, Copy, Debug)]
+#[strum(serialize_all = "lowercase")]
+enum Tool {
+    Clippy,
+    Check,
+}
+
 impl Cli {
     /// Build the argument vector for cargo invocation.
-    fn build_args(&self) -> Vec<OsString> {
-        let tool = if self.clippy { "clippy" } else { "check" };
-
+    fn build_args(&self, tool: Tool) -> Vec<OsString> {
         let pre_args = if self.fix {
             vec!["--fix"]
         } else {
@@ -47,14 +52,30 @@ impl Cli {
             ]
         };
 
-        [tool, "--workspace", "--all-targets"]
+        [tool.as_ref(), "--workspace", "--all-targets"]
             .chain_args(feature_args)
             .chain_args(pre_args)
             .chain_args(clippy_args)
     }
 
     pub fn exec(self) -> Result<()> {
-        app::exec("cargo", self.build_args(), true)?;
+        let lock_file = paths::find_repo_root()?.join("Cargo.lock");
+        let lock_before = fs::read(&lock_file)?;
+
+        let tool = if self.clippy {
+            Tool::Clippy
+        } else {
+            Tool::Check
+        };
+
+        app::exec("cargo", self.build_args(tool), true)?;
+
+        let lock_after = fs::read(&lock_file)?;
+        if lock_before != lock_after {
+            bail!(
+                "Cargo.lock was modified by `cargo {tool}`. Please commit the updated Cargo.lock."
+            );
+        }
 
         // If --fix was used, check for changes and commit them.
         if self.fix {

From 0573297e8ffcc1ad7a096f50f012b2efd0518c27 Mon Sep 17 00:00:00 2001
From: Jesper <mail@jeshj.com>
Date: Mon, 16 Mar 2026 19:54:36 +0100
Subject: [PATCH 009/326] feat(nats source,nats sink): Added feature flag for
 websockets in async-nats (#24291)

* Added feature flag for websockets in async-nats

* Add changelog

* Add websockets to expect.txt

---------

Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 .github/actions/spelling/expect.txt                | 1 +
 Cargo.toml                                         | 2 +-
 changelog.d/24291_async_nats_websockets.feature.md | 4 ++++
 3 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/24291_async_nats_websockets.feature.md

diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index edc77d73e5612..cfc0fe68ee854 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -646,6 +646,7 @@ wayfor
 wday
 webgraphviz
 websites
+websockets
 wensite
 whostheboss
 willreturn
diff --git a/Cargo.toml b/Cargo.toml
index f5639daa32ca8..86f06951af994 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -406,7 +406,7 @@ lru = { version = "0.16.3", default-features = false }
 maxminddb = { version = "0.27.0", default-features = false, optional = true, features = ["simdutf8"] }
 md-5 = { version = "0.10", default-features = false, optional = true }
 mongodb = { version = "3.3.0", default-features = false, optional = true, features = ["compat-3-0-0", "dns-resolver", "rustls-tls"] }
-async-nats = { version = "0.42.0", default-features = false, optional = true, features = ["ring"] }
+async-nats = { version = "0.42.0", default-features = false, optional = true, features = ["ring", "websockets"] }
 nkeys = { version = "0.4.5", default-features = false, optional = true }
 nom = { workspace = true, optional = true }
 notify = { version = "8.1.0", default-features = false, features = ["macos_fsevent"] }
diff --git a/changelog.d/24291_async_nats_websockets.feature.md b/changelog.d/24291_async_nats_websockets.feature.md
new file mode 100644
index 0000000000000..c11099ce6daf4
--- /dev/null
+++ b/changelog.d/24291_async_nats_websockets.feature.md
@@ -0,0 +1,4 @@
+Added websocket support to the `nats` source and sink. The `url` field now supports both `ws://` and
+`wss://` protocols.
+
+authors: gedemagt

From 3905b4f12067fb2508f0bcb031607da84623f17f Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 16 Mar 2026 15:07:53 -0400
Subject: [PATCH 010/326] chore(vdev): Update README.md and cleanup unused
 commands (#24936)

* chore(vdev): Update README.md and cleanup unused commands

* Update spelling allow/expect
---
 .github/actions/spelling/allow.txt  |  1 +
 .github/actions/spelling/expect.txt |  2 +
 vdev/README.md                      | 84 ++++++++++++++---------------
 vdev/src/commands/exec.rs           | 24 ---------
 vdev/src/commands/meta/mod.rs       |  2 -
 vdev/src/commands/meta/starship.rs  | 23 --------
 vdev/src/commands/mod.rs            |  2 -
 7 files changed, 43 insertions(+), 95 deletions(-)
 delete mode 100644 vdev/src/commands/exec.rs
 delete mode 100644 vdev/src/commands/meta/starship.rs

diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index b82a12c395bd2..2672ed4c357b7 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -60,6 +60,7 @@ Bedove
 Benss
 bigendian
 bindir
+binstall
 binfmt
 bitcast
 bitcode
diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index cfc0fe68ee854..60715b9c96c0e 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -170,11 +170,13 @@ duser
 dynamicwireless
 dyno
 ebfcee
+ector
 edenhill
 edns
 eeyun
 efgh
 Elhage
+elopment
 emerg
 endianess
 endler
diff --git a/vdev/README.md b/vdev/README.md
index f8dfeeab5d969..c036bc3c891fd 100644
--- a/vdev/README.md
+++ b/vdev/README.md
@@ -1,81 +1,77 @@
 # vdev
 
------
+---
 
-This is the command line tooling for Vector development.
+The V(ector) Dev(elopment) tool.
+
+This is the command line tooling for Vector development. You don't need to use or install this
+unless you are doing development in the Vector repo.
 
 Table of Contents:
 
+- [Pre-requisites](#pre-requisites)
 - [Installation](#installation)
-- [Configuration](#configuration)
-  - [Repository](#repository)
-  - [Starship](#starship)
-- [CLI](#cli)
 - [Running Tests](#running-tests)
+  - [Running Integration tests](#running-integration-tests)
+- [Developing vdev](#developing-vdev)
 
 ## Pre-requisites
 
 This assumes that you have the following tools installed:
 
-- cargo-nextest - https://nexte.st/
+- [git](https://git-scm.com/)
+- [cargo](https://rustup.rs/)
+- [docker](https://www.docker.com/)
+- [npm](https://www.npmjs.com/)
+- [ruby](https://www.ruby-lang.org/en/)
+
+Some other tools may need to be installed depending on the command you are running. All other
+dependencies can be installed by running
+
+```sh
+./scripts/environment/prepare.sh
+```
 
 ## Installation
 
+Note that installation is not required, since `cargo vdev` commands will invoke vdev from within the
+repository.
+
 Run the following command from the root of the Vector repository:
 
-```text
+```sh
 cargo install -f --path vdev
 ```
 
-## Configuration
-
-### Repository
+You can also install vdev from [crates.io](https://crates.io/crates/vdev)
 
-Setting the path to the repository explicitly allows the application to be used at any time no matter the current working directory.
-
-```text
-vdev config set repo .
+```sh
+cargo install vdev
 ```
 
-To test, enter your home directory and then run:
+Or using [binstall](https://github.com/cargo-bins/cargo-binstall), which will download a
+pre-compiled binary (fastest)
 
-```text
-vdev exec ls
+```sh
+cargo binstall vdev
 ```
 
-### Starship
-
-A custom command for the [Starship](https://starship.rs) prompt is available.
 
-```toml
-format = """
-...
-${custom.vdev}\
-...
-$line_break\
-...
-$character"""
+## Running Tests
 
-# <clipped>
+Unit tests can be run by calling `make test`.
 
-[custom.vdev]
-command = "vdev meta starship"
-when = true
-# Windows
-# shell = ["cmd", "/C"]
-# Other
-# shell = ["sh", "--norc"]
-```
+### Running Integration tests
 
-## CLI
+Integration tests require docker or podman to run.
 
-The CLI uses [Clap](https://github.com/clap-rs/clap) with the `derive` construction mechanism and is stored in the [commands](src/commands) directory.
+Integration tests are not run by default when running `make test`. Instead, they are accessible via the integration subcommand `cargo vdev int` (example: `cargo vdev int test aws` runs aws-related integration tests).
 
-Every command group/namespace has its own directory with a `cli` module, including the root `vdev` command group. All commands have an `exec` method that provides the actual implementation, which in the case of command groups will be calling sub-commands.
+You should use `./scripts/run-integration-test.sh`, which is the wrapper used by CI and which suits most development needs. Integration tests require a `cargo vdev int start`, `cargo vdev int test`, and `cargo vdev int stop`, which the script handles automatically. You can find the list of available integration tests using `cargo vdev int show`.
 
 
-## Running Tests
+## Developing vdev
 
-Unit tests can be run by calling `cargo vdev test`.
+The CLI uses [Clap](https://github.com/clap-rs/clap) with the `derive` construction mechanism and is stored in the [commands](src/commands) directory.
 
-Integration tests are not run by default when running `cargo vdev test`. Instead, they are accessible via the integration subcommand (example: `cargo vdev int test aws` runs aws-related integration tests). You can find the list of available integration tests using `cargo vdev int show`. Integration tests require docker or podman to run.
+Every command group/namespace has its own directory with a `cli` module, including the root `vdev` command group. All commands have an `exec` method that provides the actual implementation, which in the case of command groups will be calling sub-commands.
diff --git a/vdev/src/commands/exec.rs b/vdev/src/commands/exec.rs
deleted file mode 100644
index f7e6a11f6af6d..0000000000000
--- a/vdev/src/commands/exec.rs
+++ /dev/null
@@ -1,24 +0,0 @@
-use std::process::Command;
-
-use anyhow::Result;
-use clap::Args;
-
-use crate::app::CommandExt as _;
-
-/// Execute a command within the repository
-#[derive(Args, Debug)]
-#[command()]
-pub struct Cli {
-    #[arg(required = true, trailing_var_arg = true, allow_hyphen_values = true)]
-    args: Vec<String>,
-}
-
-impl Cli {
-    pub fn exec(self) -> Result<()> {
-        let status = Command::new(&self.args[0])
-            .in_repo()
-            .args(&self.args[1..])
-            .run()?;
-        std::process::exit(status.code().unwrap_or(1));
-    }
-}
diff --git a/vdev/src/commands/meta/mod.rs b/vdev/src/commands/meta/mod.rs
index cc67a0680bf5b..3a6abb7796870 100644
--- a/vdev/src/commands/meta/mod.rs
+++ b/vdev/src/commands/meta/mod.rs
@@ -1,8 +1,6 @@
 mod install_git_hooks;
-mod starship;
 
 crate::cli_subcommands! {
     "Collection of meta-utilities..."
-    starship,
     install_git_hooks,
 }
diff --git a/vdev/src/commands/meta/starship.rs b/vdev/src/commands/meta/starship.rs
deleted file mode 100644
index 5cc663f79da91..0000000000000
--- a/vdev/src/commands/meta/starship.rs
+++ /dev/null
@@ -1,23 +0,0 @@
-use anyhow::Result;
-use clap::Args;
-
-use crate::utils::cargo::CargoToml;
-
-/// Custom Starship prompt plugin
-#[derive(Args, Debug)]
-#[command(hide = true)]
-pub struct Cli {}
-
-impl Cli {
-    pub fn exec(self) -> Result<()> {
-        let mut contexts = vec![];
-
-        if let Ok(cargo_toml) = CargoToml::load() {
-            contexts.push(format!("version: {}", cargo_toml.package.version));
-        }
-
-        println!("vector{{ {} }}", contexts.join(", "));
-
-        Ok(())
-    }
-}
diff --git a/vdev/src/commands/mod.rs b/vdev/src/commands/mod.rs
index 807ed268b2fba..d80b6132e9ae4 100644
--- a/vdev/src/commands/mod.rs
+++ b/vdev/src/commands/mod.rs
@@ -72,7 +72,6 @@ mod check;
 mod complete;
 mod crate_versions;
 mod e2e;
-mod exec;
 mod features;
 mod fmt;
 mod info;
@@ -92,7 +91,6 @@ cli_commands! {
     complete,
     crate_versions,
     e2e,
-    exec,
     features,
     fmt,
     info,

From 1eca246d5bf297afcc153b555c19ac5f9e9ff372 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 16 Mar 2026 16:49:29 -0400
Subject: [PATCH 011/326] chore(dev): replace derivative macro with standard
 Default derives on enums (#24938)

chore: replace derivative macro with standard Default derives on enums
---
 lib/codecs/src/decoding/format/vrl.rs         |  4 +--
 .../src/decoding/framing/chunked_gelf.rs      |  5 ++-
 .../src/decoding/framing/length_delimited.rs  |  4 +--
 .../src/decoding/framing/newline_delimited.rs |  4 +--
 .../src/decoding/framing/octet_counting.rs    |  4 +--
 .../framing/varint_length_delimited.rs        |  4 +--
 .../src/encoding/framing/length_delimited.rs  |  4 +--
 .../framing/varint_length_delimited.rs        |  4 +--
 src/kafka.rs                                  |  5 ++-
 src/sinks/clickhouse/config.rs                |  5 ++-
 src/sinks/console/config.rs                   |  5 ++-
 src/sinks/elasticsearch/mod.rs                |  4 +--
 src/sinks/gcp/stackdriver/logs/config.rs      |  3 +-
 src/sinks/gcp_chronicle/compression.rs        |  5 ++-
 src/sinks/gcs_common/config.rs                | 10 +++---
 src/sinks/greptimedb/metrics/config.rs        |  2 +-
 src/sinks/http/config.rs                      |  5 ++-
 src/sinks/loki/config.rs                      |  5 ++-
 src/sinks/mqtt/config.rs                      |  5 ++-
 src/sinks/new_relic/config.rs                 | 10 +++---
 src/sinks/pulsar/config.rs                    |  5 ++-
 src/sinks/redis/config.rs                     | 32 ++++++++-----------
 src/sinks/s3_common/config.rs                 | 10 +++---
 src/sinks/util/adaptive_concurrency/tests.rs  |  5 ++-
 src/sinks/util/buffer/compression.rs          |  5 ++-
 src/sinks/util/service/concurrency.rs         |  2 +-
 src/sources/aws_kinesis_firehose/mod.rs       |  5 ++-
 src/sources/aws_s3/mod.rs                     | 10 +++---
 src/sources/demo_logs.rs                      |  5 ++-
 src/sources/redis/mod.rs                      | 12 +++----
 src/sources/util/body_decoding.rs             |  5 ++-
 31 files changed, 74 insertions(+), 119 deletions(-)

diff --git a/lib/codecs/src/decoding/format/vrl.rs b/lib/codecs/src/decoding/format/vrl.rs
index c67f60fdd8952..6b6a20be3be55 100644
--- a/lib/codecs/src/decoding/format/vrl.rs
+++ b/lib/codecs/src/decoding/format/vrl.rs
@@ -1,5 +1,4 @@
 use bytes::Bytes;
-use derivative::Derivative;
 use smallvec::{SmallVec, smallvec};
 use vector_config_macros::configurable_component;
 use vector_core::{
@@ -26,8 +25,7 @@ pub struct VrlDeserializerConfig {
 
 /// VRL-specific decoding options.
 #[configurable_component]
-#[derive(Debug, Clone, PartialEq, Eq, Derivative)]
-#[derivative(Default)]
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
 pub struct VrlDeserializerOptions {
     /// The [Vector Remap Language][vrl] (VRL) program to execute for each event.
     /// Note that the final contents of the `.` target will be used as the decoding result.
diff --git a/lib/codecs/src/decoding/framing/chunked_gelf.rs b/lib/codecs/src/decoding/framing/chunked_gelf.rs
index 9a82333c87960..3ba3c9bd33d33 100644
--- a/lib/codecs/src/decoding/framing/chunked_gelf.rs
+++ b/lib/codecs/src/decoding/framing/chunked_gelf.rs
@@ -85,11 +85,10 @@ pub struct ChunkedGelfDecoderOptions {
 
 /// Decompression options for ChunkedGelfDecoder.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, PartialEq, Eq, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
 pub enum ChunkedGelfDecompressionConfig {
     /// Automatically detect the decompression method based on the magic bytes of the message.
-    #[derivative(Default)]
+    #[default]
     Auto,
     /// Use Gzip decompression.
     Gzip,
diff --git a/lib/codecs/src/decoding/framing/length_delimited.rs b/lib/codecs/src/decoding/framing/length_delimited.rs
index 07a958dce1c52..16c562f653f2d 100644
--- a/lib/codecs/src/decoding/framing/length_delimited.rs
+++ b/lib/codecs/src/decoding/framing/length_delimited.rs
@@ -1,5 +1,4 @@
 use bytes::{Bytes, BytesMut};
-use derivative::Derivative;
 use tokio_util::codec::Decoder;
 use vector_config::configurable_component;
 
@@ -8,8 +7,7 @@ use crate::common::length_delimited::LengthDelimitedCoderOptions;
 
 /// Config used to build a `LengthDelimitedDecoder`.
 #[configurable_component]
-#[derive(Debug, Clone, Derivative)]
-#[derivative(Default)]
+#[derive(Debug, Clone, Default)]
 pub struct LengthDelimitedDecoderConfig {
     /// Options for the length delimited decoder.
     #[serde(skip_serializing_if = "vector_core::serde::is_default")]
diff --git a/lib/codecs/src/decoding/framing/newline_delimited.rs b/lib/codecs/src/decoding/framing/newline_delimited.rs
index 7bdc3a60881e5..90177031c31c9 100644
--- a/lib/codecs/src/decoding/framing/newline_delimited.rs
+++ b/lib/codecs/src/decoding/framing/newline_delimited.rs
@@ -1,5 +1,4 @@
 use bytes::{Bytes, BytesMut};
-use derivative::Derivative;
 use tokio_util::codec::Decoder;
 use vector_config::configurable_component;
 
@@ -16,8 +15,7 @@ pub struct NewlineDelimitedDecoderConfig {
 
 /// Options for building a `NewlineDelimitedDecoder`.
 #[configurable_component]
-#[derive(Clone, Debug, Derivative, PartialEq, Eq)]
-#[derivative(Default)]
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct NewlineDelimitedDecoderOptions {
     /// The maximum length of the byte buffer.
     ///
diff --git a/lib/codecs/src/decoding/framing/octet_counting.rs b/lib/codecs/src/decoding/framing/octet_counting.rs
index 749d66b8fffc9..80f5a28ee4aa4 100644
--- a/lib/codecs/src/decoding/framing/octet_counting.rs
+++ b/lib/codecs/src/decoding/framing/octet_counting.rs
@@ -1,7 +1,6 @@
 use std::io;
 
 use bytes::{Buf, Bytes, BytesMut};
-use derivative::Derivative;
 use tokio_util::codec::{LinesCodec, LinesCodecError};
 use tracing::trace;
 use vector_config::configurable_component;
@@ -30,8 +29,7 @@ impl OctetCountingDecoderConfig {
 
 /// Options for building a `OctetCountingDecoder`.
 #[configurable_component]
-#[derive(Clone, Debug, Derivative, PartialEq, Eq)]
-#[derivative(Default)]
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct OctetCountingDecoderOptions {
     /// The maximum length of the byte buffer.
     #[serde(skip_serializing_if = "vector_core::serde::is_default")]
diff --git a/lib/codecs/src/decoding/framing/varint_length_delimited.rs b/lib/codecs/src/decoding/framing/varint_length_delimited.rs
index 7b9d26f0a0596..a1b870fe1bb51 100644
--- a/lib/codecs/src/decoding/framing/varint_length_delimited.rs
+++ b/lib/codecs/src/decoding/framing/varint_length_delimited.rs
@@ -1,5 +1,4 @@
 use bytes::{Buf, Bytes, BytesMut};
-use derivative::Derivative;
 use snafu::Snafu;
 use tokio_util::codec::Decoder;
 use vector_config::configurable_component;
@@ -38,8 +37,7 @@ impl FramingError for VarintFramingError {
 
 /// Config used to build a `VarintLengthDelimitedDecoder`.
 #[configurable_component]
-#[derive(Debug, Clone, Derivative)]
-#[derivative(Default)]
+#[derive(Debug, Clone, Default)]
 pub struct VarintLengthDelimitedDecoderConfig {
     /// Maximum frame length
     #[serde(default = "default_max_frame_length")]
diff --git a/lib/codecs/src/encoding/framing/length_delimited.rs b/lib/codecs/src/encoding/framing/length_delimited.rs
index 660049ce5b305..152b3baf73673 100644
--- a/lib/codecs/src/encoding/framing/length_delimited.rs
+++ b/lib/codecs/src/encoding/framing/length_delimited.rs
@@ -1,5 +1,4 @@
 use bytes::BytesMut;
-use derivative::Derivative;
 use tokio_util::codec::{Encoder, LengthDelimitedCodec};
 use vector_config::configurable_component;
 
@@ -8,8 +7,7 @@ use crate::common::length_delimited::LengthDelimitedCoderOptions;
 
 /// Config used to build a `LengthDelimitedEncoder`.
 #[configurable_component]
-#[derive(Debug, Clone, Derivative, Eq, PartialEq)]
-#[derivative(Default)]
+#[derive(Debug, Clone, Default, Eq, PartialEq)]
 pub struct LengthDelimitedEncoderConfig {
     /// Options for the length delimited decoder.
     #[serde(skip_serializing_if = "vector_core::serde::is_default")]
diff --git a/lib/codecs/src/encoding/framing/varint_length_delimited.rs b/lib/codecs/src/encoding/framing/varint_length_delimited.rs
index 87f3737fa3d86..f874fb3d04e48 100644
--- a/lib/codecs/src/encoding/framing/varint_length_delimited.rs
+++ b/lib/codecs/src/encoding/framing/varint_length_delimited.rs
@@ -1,5 +1,4 @@
 use bytes::{BufMut, BytesMut};
-use derivative::Derivative;
 use snafu::Snafu;
 use tokio_util::codec::Encoder;
 use vector_config::configurable_component;
@@ -17,8 +16,7 @@ impl FramingError for VarintFramingError {}
 
 /// Config used to build a `VarintLengthDelimitedEncoder`.
 #[configurable_component]
-#[derive(Debug, Clone, PartialEq, Eq, Derivative)]
-#[derivative(Default)]
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
 pub struct VarintLengthDelimitedEncoderConfig {
     /// Maximum frame length
     #[serde(default = "default_max_frame_length")]
diff --git a/src/kafka.rs b/src/kafka.rs
index ee652cc4f3f90..0c9315288e313 100644
--- a/src/kafka.rs
+++ b/src/kafka.rs
@@ -19,12 +19,11 @@ enum KafkaError {
 
 /// Supported compression types for Kafka.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default)]
 #[serde(rename_all = "lowercase")]
 pub enum KafkaCompression {
     /// No compression.
-    #[derivative(Default)]
+    #[default]
     None,
 
     /// Gzip.
diff --git a/src/sinks/clickhouse/config.rs b/src/sinks/clickhouse/config.rs
index 827b684f2234b..58ed0a0ac3445 100644
--- a/src/sinks/clickhouse/config.rs
+++ b/src/sinks/clickhouse/config.rs
@@ -26,12 +26,11 @@ use crate::{
 ///
 /// [formats]: https://clickhouse.com/docs/en/interfaces/formats
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq, Hash)]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq, Hash)]
 #[serde(rename_all = "snake_case")]
-#[derivative(Default)]
 #[allow(clippy::enum_variant_names)]
 pub enum Format {
-    #[derivative(Default)]
+    #[default]
     /// JSONEachRow.
     JsonEachRow,
 
diff --git a/src/sinks/console/config.rs b/src/sinks/console/config.rs
index 9175cb3d0b516..c7a8717c0a933 100644
--- a/src/sinks/console/config.rs
+++ b/src/sinks/console/config.rs
@@ -18,14 +18,13 @@ use crate::{
 ///
 /// [standard_streams]: https://en.wikipedia.org/wiki/Standard_streams
 #[configurable_component]
-#[derive(Clone, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Debug, Default)]
 #[serde(rename_all = "lowercase")]
 pub enum Target {
     /// Write output to [STDOUT][stdout].
     ///
     /// [stdout]: https://en.wikipedia.org/wiki/Standard_streams#Standard_output_(stdout)
-    #[derivative(Default)]
+    #[default]
     Stdout,
 
     /// Write output to [STDERR][stderr].
diff --git a/src/sinks/elasticsearch/mod.rs b/src/sinks/elasticsearch/mod.rs
index fddae4eb3caf9..1466c415dbd1b 100644
--- a/src/sinks/elasticsearch/mod.rs
+++ b/src/sinks/elasticsearch/mod.rs
@@ -80,7 +80,7 @@ pub enum ElasticsearchMode {
 
 /// Bulk API actions.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, Hash, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
 #[serde(deny_unknown_fields, rename_all = "snake_case")]
 pub enum BulkAction {
     /// The `index` action.
@@ -127,7 +127,7 @@ impl TryFrom<&str> for BulkAction {
 
 /// Elasticsearch version types.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, Hash, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, Hash, PartialEq)]
 #[serde(deny_unknown_fields, rename_all = "snake_case")]
 pub enum VersionType {
     /// The `internal` type.
diff --git a/src/sinks/gcp/stackdriver/logs/config.rs b/src/sinks/gcp/stackdriver/logs/config.rs
index 94be249e1dfff..9b66eea4ac214 100644
--- a/src/sinks/gcp/stackdriver/logs/config.rs
+++ b/src/sinks/gcp/stackdriver/logs/config.rs
@@ -162,8 +162,7 @@ pub(super) enum StackdriverLogName {
 
 /// Label Configuration.
 #[configurable_component]
-#[derive(Clone, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Debug, Default)]
 pub(super) struct StackdriverLabelConfig {
     /// The value of this field is used to retrieve the associated labels from the `jsonPayload`
     /// and extract their values to set as LogEntry labels.
diff --git a/src/sinks/gcp_chronicle/compression.rs b/src/sinks/gcp_chronicle/compression.rs
index 3002d934f18dd..b58478eb6d04f 100644
--- a/src/sinks/gcp_chronicle/compression.rs
+++ b/src/sinks/gcp_chronicle/compression.rs
@@ -20,11 +20,10 @@ use crate::sinks::util::{
 };
 
 /// Compression configuration.
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 pub enum ChronicleCompression {
     /// No compression.
-    #[derivative(Default)]
+    #[default]
     None,
 
     /// [Gzip][gzip] compression.
diff --git a/src/sinks/gcs_common/config.rs b/src/sinks/gcs_common/config.rs
index 9f148190a72b3..dcebb6bea9e77 100644
--- a/src/sinks/gcs_common/config.rs
+++ b/src/sinks/gcs_common/config.rs
@@ -26,8 +26,7 @@ pub fn default_endpoint() -> String {
 ///
 /// [predefined_acls]: https://cloud.google.com/storage/docs/access-control/lists#predefined-acl
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default)]
 #[serde(rename_all = "kebab-case")]
 pub enum GcsPredefinedAcl {
     /// Bucket/object can be read by authenticated users.
@@ -65,7 +64,7 @@ pub enum GcsPredefinedAcl {
     /// part of the project team is granted the `READER` permission.
     ///
     /// This is the default.
-    #[derivative(Default)]
+    #[default]
     ProjectPrivate,
 
     /// Bucket/object can be read publicly.
@@ -81,14 +80,13 @@ pub enum GcsPredefinedAcl {
 ///
 /// [storage_classes]: https://cloud.google.com/storage/docs/storage-classes
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, PartialEq, Eq)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 #[serde(rename_all = "SCREAMING_SNAKE_CASE")]
 pub enum GcsStorageClass {
     /// Standard storage.
     ///
     /// This is the default.
-    #[derivative(Default)]
+    #[default]
     Standard,
 
     /// Nearline storage.
diff --git a/src/sinks/greptimedb/metrics/config.rs b/src/sinks/greptimedb/metrics/config.rs
index a4003ae4292a0..4261486a05706 100644
--- a/src/sinks/greptimedb/metrics/config.rs
+++ b/src/sinks/greptimedb/metrics/config.rs
@@ -18,7 +18,7 @@ use crate::sinks::{
 #[configurable(metadata(
     deprecated = "The `greptimedb` sink has been renamed. Please use `greptimedb_metrics` instead."
 ))]
-#[derive(Clone, Debug, Derivative)]
+#[derive(Clone, Debug, Default)]
 pub struct GreptimeDBConfig(GreptimeDBMetricsConfig);
 
 impl GenerateConfig for GreptimeDBConfig {
diff --git a/src/sinks/http/config.rs b/src/sinks/http/config.rs
index 2c9f257fae5e1..81df73add1efb 100644
--- a/src/sinks/http/config.rs
+++ b/src/sinks/http/config.rs
@@ -115,9 +115,8 @@ pub struct HttpSinkConfig {
 ///
 /// [rfc9110]: https://datatracker.ietf.org/doc/html/rfc9110#section-9.1
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq)]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 #[serde(rename_all = "snake_case")]
-#[derivative(Default)]
 pub enum HttpMethod {
     /// GET.
     Get,
@@ -126,7 +125,7 @@ pub enum HttpMethod {
     Head,
 
     /// POST.
-    #[derivative(Default)]
+    #[default]
     Post,
 
     /// PUT.
diff --git a/src/sinks/loki/config.rs b/src/sinks/loki/config.rs
index 06f827b353bab..16f25dc3d554b 100644
--- a/src/sinks/loki/config.rs
+++ b/src/sinks/loki/config.rs
@@ -171,8 +171,7 @@ impl SinkBatchSettings for LokiDefaultBatchSettings {
 /// any necessary sorting/reordering. If you're using an earlier version, then you must use `Drop`
 /// or `RewriteTimestamp` depending on which option makes the most sense for your use case.
 #[configurable_component]
-#[derive(Copy, Clone, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Copy, Clone, Debug, Default)]
 #[serde(rename_all = "snake_case")]
 pub enum OutOfOrderAction {
     /// Accept the event.
@@ -180,7 +179,7 @@ pub enum OutOfOrderAction {
     /// The event is not dropped and is sent without modification.
     ///
     /// Requires Loki 2.4.0 or newer.
-    #[derivative(Default)]
+    #[default]
     Accept,
 
     /// Rewrite the timestamp of the event to the timestamp of the latest event seen by the sink.
diff --git a/src/sinks/mqtt/config.rs b/src/sinks/mqtt/config.rs
index 4b6e589d3beb5..af0e4a3aaf645 100644
--- a/src/sinks/mqtt/config.rs
+++ b/src/sinks/mqtt/config.rs
@@ -53,13 +53,12 @@ pub struct MqttSinkConfig {
 
 /// Supported Quality of Service types for MQTT.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default)]
 #[serde(rename_all = "lowercase")]
 #[allow(clippy::enum_variant_names)]
 pub enum MqttQoS {
     /// AtLeastOnce.
-    #[derivative(Default)]
+    #[default]
     AtLeastOnce,
 
     /// AtMostOnce.
diff --git a/src/sinks/new_relic/config.rs b/src/sinks/new_relic/config.rs
index f0f6c1d7695a3..fa1e6622d6d61 100644
--- a/src/sinks/new_relic/config.rs
+++ b/src/sinks/new_relic/config.rs
@@ -12,12 +12,11 @@ use crate::{http::HttpClient, sinks::prelude::*};
 
 /// New Relic region.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq)]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 #[serde(rename_all = "snake_case")]
-#[derivative(Default)]
 pub enum NewRelicRegion {
     /// US region.
-    #[derivative(Default)]
+    #[default]
     Us,
 
     /// EU region.
@@ -26,12 +25,11 @@ pub enum NewRelicRegion {
 
 /// New Relic API endpoint.
 #[configurable_component]
-#[derive(Clone, Copy, Derivative, Debug, Eq, PartialEq)]
+#[derive(Clone, Copy, Default, Debug, Eq, PartialEq)]
 #[serde(rename_all = "snake_case")]
-#[derivative(Default)]
 pub enum NewRelicApi {
     /// Events API.
-    #[derivative(Default)]
+    #[default]
     Events,
 
     /// Metrics API.
diff --git a/src/sinks/pulsar/config.rs b/src/sinks/pulsar/config.rs
index 6b27035715226..e149c9c5acfe5 100644
--- a/src/sinks/pulsar/config.rs
+++ b/src/sinks/pulsar/config.rs
@@ -162,12 +162,11 @@ pub struct OAuth2Config {
 
 /// Supported compression types for Pulsar.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default)]
 #[serde(rename_all = "lowercase")]
 pub enum PulsarCompression {
     /// No compression.
-    #[derivative(Default)]
+    #[default]
     None,
 
     /// LZ4.
diff --git a/src/sinks/redis/config.rs b/src/sinks/redis/config.rs
index 17939e679da7a..69dfbdf44e6a3 100644
--- a/src/sinks/redis/config.rs
+++ b/src/sinks/redis/config.rs
@@ -22,8 +22,7 @@ impl TowerRequestConfigDefaults for RedisTowerRequestConfigDefaults {
 
 /// Redis data type to store messages in.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default)]
 #[serde(rename_all = "lowercase")]
 pub enum DataTypeConfig {
     /// The Redis `list` type.
@@ -31,7 +30,7 @@ pub enum DataTypeConfig {
     /// This resembles a deque, where messages can be popped and pushed from either end.
     ///
     /// This is the default.
-    #[derivative(Default)]
+    #[default]
     List,
 
     /// The Redis `sorted set` type.
@@ -48,7 +47,7 @@ pub enum DataTypeConfig {
 
 /// List-specific options.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq)]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 #[serde(rename_all = "lowercase")]
 pub struct ListOption {
     /// The method to use for pushing messages into a `list`.
@@ -57,8 +56,7 @@ pub struct ListOption {
 
 /// Method for pushing messages into a `list`.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 #[serde(rename_all = "lowercase")]
 pub enum ListMethod {
     /// Use the `rpush` method.
@@ -66,7 +64,7 @@ pub enum ListMethod {
     /// This pushes messages onto the tail of the list.
     ///
     /// This is the default.
-    #[derivative(Default)]
+    #[default]
     RPush,
 
     /// Use the `lpush` method.
@@ -77,7 +75,7 @@ pub enum ListMethod {
 
 /// Sorted Set-specific options
 #[configurable_component]
-#[derive(Clone, Debug, Derivative, Eq, PartialEq)]
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
 #[serde(rename_all = "lowercase")]
 pub struct SortedSetOption {
     /// The method to use for pushing messages into a `sorted set`.
@@ -96,8 +94,7 @@ pub struct SortedSetOption {
 
 /// Method for pushing messages into a `sorted set`.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 #[serde(rename_all = "lowercase")]
 pub enum SortedSetMethod {
     /// Use the `zadd` method.
@@ -105,7 +102,7 @@ pub enum SortedSetMethod {
     /// This adds messages onto a queue with a score.
     ///
     /// This is the default.
-    #[derivative(Default)]
+    #[default]
     ZAdd,
 }
 
@@ -281,14 +278,13 @@ impl From<SentinelConnectionSettings> for SentinelNodeConnectionInfo {
 
 /// How/if TLS should be established.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 #[serde(rename_all = "lowercase")]
 pub enum MaybeTlsMode {
     /// Don't use TLS.
     ///
     /// This is the default.
-    #[derivative(Default)]
+    #[default]
     None,
 
     /// Enable TLS with certificate verification.
@@ -311,8 +307,7 @@ impl From<MaybeTlsMode> for Option<TlsMode> {
 /// Connection independent information used to establish a connection
 /// to a redis instance sentinel owns.
 #[configurable_component]
-#[derive(Clone, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Debug, Default)]
 pub struct RedisConnectionSettings {
     /// The database number to use. Usually `0`.
     pub db: i64,
@@ -340,13 +335,12 @@ impl From<RedisConnectionSettings> for RedisConnectionInfo {
 
 /// The communication protocol to use with the redis server.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 pub enum RedisProtocolVersion {
     /// Use RESP2.
     ///
     /// This is the default.
-    #[derivative(Default)]
+    #[default]
     RESP2,
 
     /// Use RESP3.
diff --git a/src/sinks/s3_common/config.rs b/src/sinks/s3_common/config.rs
index aeb7d4b93113b..f78c649c6f667 100644
--- a/src/sinks/s3_common/config.rs
+++ b/src/sinks/s3_common/config.rs
@@ -141,12 +141,11 @@ fn example_tags() -> HashMap<String, String> {
 ///
 /// [aws_docs]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, PartialEq, Eq)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 #[serde(rename_all = "SCREAMING_SNAKE_CASE")]
 pub enum S3StorageClass {
     /// Standard Redundancy.
-    #[derivative(Default)]
+    #[default]
     Standard,
 
     /// Reduced Redundancy.
@@ -228,8 +227,7 @@ impl From<S3ServerSideEncryption> for ServerSideEncryption {
 ///
 /// [canned_acl]: https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default)]
 #[serde(rename_all = "kebab-case")]
 pub enum S3CannedAcl {
     /// Bucket/object are private.
@@ -238,7 +236,7 @@ pub enum S3CannedAcl {
     /// access.
     ///
     /// This is the default.
-    #[derivative(Default)]
+    #[default]
     Private,
 
     /// Bucket/object can be read publicly.
diff --git a/src/sinks/util/adaptive_concurrency/tests.rs b/src/sinks/util/adaptive_concurrency/tests.rs
index bce42b64ca156..740477d6de144 100644
--- a/src/sinks/util/adaptive_concurrency/tests.rs
+++ b/src/sinks/util/adaptive_concurrency/tests.rs
@@ -50,11 +50,10 @@ use crate::{
 
 /// Request handling action when the request limit has been exceeded.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default)]
 #[serde(rename_all = "lowercase")]
 enum Action {
-    #[derivative(Default)]
+    #[default]
     /// Additional requests will return with an error.
     Defer,
 
diff --git a/src/sinks/util/buffer/compression.rs b/src/sinks/util/buffer/compression.rs
index c990025c853d4..38e87108f7f9a 100644
--- a/src/sinks/util/buffer/compression.rs
+++ b/src/sinks/util/buffer/compression.rs
@@ -16,11 +16,10 @@ use vector_lib::configurable::{
 use crate::sinks::util::zstd::ZstdCompressionLevel;
 
 /// Compression configuration.
-#[derive(Copy, Clone, Debug, Derivative, Eq, PartialEq)]
-#[derivative(Default)]
+#[derive(Copy, Clone, Debug, Default, Eq, PartialEq)]
 pub enum Compression {
     /// No compression.
-    #[derivative(Default)]
+    #[default]
     None,
 
     /// [Gzip][gzip] compression.
diff --git a/src/sinks/util/service/concurrency.rs b/src/sinks/util/service/concurrency.rs
index 44c982caff0f9..43c2643807a99 100644
--- a/src/sinks/util/service/concurrency.rs
+++ b/src/sinks/util/service/concurrency.rs
@@ -18,7 +18,7 @@ use vector_lib::configurable::{
 ///
 /// This can be set either to one of the below enum values or to a positive integer, which denotes
 /// a fixed concurrency limit.
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq, Default)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Default)]
 pub enum Concurrency {
     /// A fixed concurrency of 1.
     ///
diff --git a/src/sources/aws_kinesis_firehose/mod.rs b/src/sources/aws_kinesis_firehose/mod.rs
index 4c86b74165e9b..24809473cdfb9 100644
--- a/src/sources/aws_kinesis_firehose/mod.rs
+++ b/src/sources/aws_kinesis_firehose/mod.rs
@@ -113,9 +113,8 @@ const fn access_keys_example() -> [&'static str; 2] {
 /// Compression scheme for records in a Firehose message.
 #[configurable_component]
 #[configurable(metadata(docs::advanced))]
-#[derive(Clone, Copy, Debug, Derivative, PartialEq, Eq)]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 #[serde(rename_all = "lowercase")]
-#[derivative(Default)]
 pub enum Compression {
     /// Automatically attempt to determine the compression scheme.
     ///
@@ -127,7 +126,7 @@ pub enum Compression {
     /// set `gzip` in this field so that any records that are not-gzipped are rejected.
     ///
     /// [magic_bytes]: https://en.wikipedia.org/wiki/List_of_file_signatures
-    #[derivative(Default)]
+    #[default]
     Auto,
 
     /// Uncompressed.
diff --git a/src/sources/aws_s3/mod.rs b/src/sources/aws_s3/mod.rs
index 1f2532bd51a24..38ca6e4cb6901 100644
--- a/src/sources/aws_s3/mod.rs
+++ b/src/sources/aws_s3/mod.rs
@@ -34,9 +34,8 @@ pub mod sqs;
 /// Compression scheme for objects retrieved from S3.
 #[configurable_component]
 #[configurable(metadata(docs::advanced))]
-#[derive(Clone, Copy, Debug, Derivative, PartialEq, Eq)]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
 #[serde(rename_all = "lowercase")]
-#[derivative(Default)]
 pub enum Compression {
     /// Automatically attempt to determine the compression scheme.
     ///
@@ -44,7 +43,7 @@ pub enum Compression {
     /// `Content-Type` metadata, as well as the key suffix (for example, `.gz`).
     ///
     /// It is set to `none` if the compression scheme cannot be determined.
-    #[derivative(Default)]
+    #[default]
     Auto,
 
     /// Uncompressed.
@@ -59,14 +58,13 @@ pub enum Compression {
 
 /// Strategies for consuming objects from AWS S3.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative)]
+#[derive(Clone, Copy, Debug, Default)]
 #[serde(rename_all = "lowercase")]
-#[derivative(Default)]
 enum Strategy {
     /// Consumes objects by processing bucket notification events sent to an [AWS SQS queue][aws_sqs].
     ///
     /// [aws_sqs]: https://aws.amazon.com/sqs/
-    #[derivative(Default)]
+    #[default]
     Sqs,
 }
 
diff --git a/src/sources/demo_logs.rs b/src/sources/demo_logs.rs
index 861a51a957d44..fe02da4574c80 100644
--- a/src/sources/demo_logs.rs
+++ b/src/sources/demo_logs.rs
@@ -94,8 +94,7 @@ pub enum DemoLogsConfigError {
 
 /// Output format configuration.
 #[configurable_component]
-#[derive(Clone, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Clone, Debug, Default)]
 #[serde(tag = "format", rename_all = "snake_case")]
 #[configurable(metadata(
     docs::enum_tag_description = "The format of the randomly generated output."
@@ -136,7 +135,7 @@ pub enum OutputFormat {
     /// Randomly generated HTTP server logs in [JSON][json] format.
     ///
     /// [json]: https://en.wikipedia.org/wiki/JSON
-    #[derivative(Default)]
+    #[default]
     Json,
 }
 
diff --git a/src/sources/redis/mod.rs b/src/sources/redis/mod.rs
index 0f71009701026..eb2545059ecf8 100644
--- a/src/sources/redis/mod.rs
+++ b/src/sources/redis/mod.rs
@@ -35,12 +35,11 @@ enum BuildError {
 
 /// Data type to use for reading messages from Redis.
 #[configurable_component]
-#[derive(Copy, Clone, Debug, Derivative)]
-#[derivative(Default)]
+#[derive(Copy, Clone, Debug, Default)]
 #[serde(rename_all = "lowercase")]
 pub enum DataTypeConfig {
     /// The `list` data type.
-    #[derivative(Default)]
+    #[default]
     List,
 
     /// The `channel` data type.
@@ -51,7 +50,7 @@ pub enum DataTypeConfig {
 
 /// Options for the Redis `list` data type.
 #[configurable_component]
-#[derive(Copy, Clone, Debug, Default, Derivative, Eq, PartialEq)]
+#[derive(Copy, Clone, Debug, Default, Eq, PartialEq)]
 #[serde(deny_unknown_fields, rename_all = "lowercase")]
 pub struct ListOption {
     #[configurable(derived)]
@@ -60,12 +59,11 @@ pub struct ListOption {
 
 /// Method for getting events from the `list` data type.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq)]
-#[derivative(Default)]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 #[serde(rename_all = "lowercase")]
 pub enum Method {
     /// Pop messages from the head of the list.
-    #[derivative(Default)]
+    #[default]
     Lpop,
 
     /// Pop messages from the tail of the list.
diff --git a/src/sources/util/body_decoding.rs b/src/sources/util/body_decoding.rs
index 6a99da3240792..d7947940e9ab4 100644
--- a/src/sources/util/body_decoding.rs
+++ b/src/sources/util/body_decoding.rs
@@ -2,12 +2,11 @@ use vector_lib::configurable::configurable_component;
 
 /// Content encoding.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Derivative, Eq, PartialEq)]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 #[serde(rename_all = "snake_case")]
-#[derivative(Default)]
 pub enum Encoding {
     /// Plaintext.
-    #[derivative(Default)]
+    #[default]
     Text,
 
     /// Newline-delimited JSON.

From a8730894c366cd5232353530fef4a4970cd6c307 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 17 Mar 2026 11:00:09 -0400
Subject: [PATCH 012/326] chore(deps): bump lz4_flex from 0.11.5 to 0.11.6
 (#24939)

Bumps [lz4_flex](https://github.com/pseitz/lz4_flex) from 0.11.5 to 0.11.6.
- [Release notes](https://github.com/pseitz/lz4_flex/releases)
- [Changelog](https://github.com/PSeitz/lz4_flex/blob/main/CHANGELOG.md)
- [Commits](https://github.com/pseitz/lz4_flex/compare/0.11.5...0.11.6)

---
updated-dependencies:
- dependency-name: lz4_flex
  dependency-version: 0.11.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 635320a783e62..610fc0628a731 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6464,9 +6464,9 @@ dependencies = [
 
 [[package]]
 name = "lz4_flex"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08ab2867e3eeeca90e844d1940eab391c9dc5228783db2ed999acbc0a9ed375a"
+checksum = "373f5eceeeab7925e0c1098212f2fbc4d416adec9d35051a6ab251e824c1854a"
 dependencies = [
  "twox-hash",
 ]

From 9dc3d3e9f7d486ce363975f21b1e1b3b537cb46d Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 17 Mar 2026 11:11:36 -0400
Subject: [PATCH 013/326] fix(aggregate transform): reduce memory when not in
 `Diff` mode (#24943)

* Separate prev_map into conditional enum struct

* Do the same with multi_map

* Add changelog

* Update changelog.d/24943_aggregate_transform_reduce_memory.fix.md

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>

* Mode -> InnerMode

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 ...3_aggregate_transform_reduce_memory.fix.md |   4 +
 src/transforms/aggregate.rs                   | 109 ++++++++++++++----
 2 files changed, 89 insertions(+), 24 deletions(-)
 create mode 100644 changelog.d/24943_aggregate_transform_reduce_memory.fix.md

diff --git a/changelog.d/24943_aggregate_transform_reduce_memory.fix.md b/changelog.d/24943_aggregate_transform_reduce_memory.fix.md
new file mode 100644
index 0000000000000..4f3be38504bcd
--- /dev/null
+++ b/changelog.d/24943_aggregate_transform_reduce_memory.fix.md
@@ -0,0 +1,4 @@
+Reduced the memory usage in the `aggregate` transform where previous values were being held
+even if `mode` was not set to `Diff`.
+
+authors: thomasqueirozb
diff --git a/src/transforms/aggregate.rs b/src/transforms/aggregate.rs
index 3c8622ec2dba5..c00315ad4871a 100644
--- a/src/transforms/aggregate.rs
+++ b/src/transforms/aggregate.rs
@@ -74,6 +74,65 @@ pub enum AggregationMode {
     Stdev,
 }
 
+#[derive(Clone, Debug, Default, PartialEq)]
+enum InnerMode {
+    /// Default mode. Sums incremental metrics and uses the latest value for absolute metrics.
+    #[default]
+    Auto,
+
+    /// Sums incremental metrics, ignores absolute
+    Sum,
+
+    /// Returns the latest value for absolute metrics, ignores incremental
+    Latest,
+
+    /// Counts metrics for incremental and absolute metrics
+    Count,
+
+    /// Returns difference between latest value for absolute, ignores incremental
+    Diff {
+        prev_map: HashMap<MetricSeries, MetricEntry>,
+    },
+
+    /// Max value of absolute metric, ignores incremental
+    Max,
+
+    /// Min value of absolute metric, ignores incremental
+    Min,
+
+    /// Mean value of absolute metric, ignores incremental
+    Mean {
+        multi_map: HashMap<MetricSeries, Vec<MetricEntry>>,
+    },
+
+    /// Stdev value of absolute metric, ignores incremental
+    Stdev {
+        multi_map: HashMap<MetricSeries, Vec<MetricEntry>>,
+    },
+}
+
+impl From<AggregationMode> for InnerMode {
+    fn from(value: AggregationMode) -> Self {
+        match value {
+            AggregationMode::Auto => InnerMode::Auto,
+            AggregationMode::Sum => InnerMode::Sum,
+            AggregationMode::Latest => InnerMode::Latest,
+            AggregationMode::Count => InnerMode::Count,
+            AggregationMode::Diff => InnerMode::Diff {
+                prev_map: HashMap::default(),
+            },
+            AggregationMode::Max => InnerMode::Max,
+            AggregationMode::Min => InnerMode::Min,
+            AggregationMode::Mean => InnerMode::Mean {
+                multi_map: HashMap::default(),
+            },
+            AggregationMode::Stdev => InnerMode::Stdev {
+                multi_map: HashMap::default(),
+            },
+        }
+    }
+}
+
 const fn default_mode() -> AggregationMode {
     AggregationMode::Auto
 }
@@ -110,9 +169,7 @@ type MetricEntry = (MetricData, EventMetadata);
 pub struct Aggregate {
     interval: Duration,
     map: HashMap<MetricSeries, MetricEntry>,
-    prev_map: HashMap<MetricSeries, MetricEntry>,
-    multi_map: HashMap<MetricSeries, Vec<MetricEntry>>,
-    mode: AggregationMode,
+    mode: InnerMode,
 }
 
 impl Aggregate {
@@ -120,38 +177,34 @@ impl Aggregate {
         Ok(Self {
             interval: Duration::from_millis(config.interval_ms),
             map: Default::default(),
-            prev_map: Default::default(),
-            multi_map: Default::default(),
-            mode: config.mode,
+            mode: config.mode.into(),
         })
     }
 
     fn record(&mut self, event: Event) {
         let (series, data, metadata) = event.into_metric().into_parts();
 
-        match self.mode {
-            AggregationMode::Auto => match data.kind {
+        match &mut self.mode {
+            InnerMode::Auto => match data.kind {
                 MetricKind::Incremental => self.record_sum(series, data, metadata),
                 MetricKind::Absolute => {
                     self.map.insert(series, (data, metadata));
                 }
             },
-            AggregationMode::Sum => self.record_sum(series, data, metadata),
-            AggregationMode::Latest | AggregationMode::Diff => match data.kind {
+            InnerMode::Sum => self.record_sum(series, data, metadata),
+            InnerMode::Latest | InnerMode::Diff { .. } => match data.kind {
                 MetricKind::Incremental => (),
                 MetricKind::Absolute => {
                     self.map.insert(series, (data, metadata));
                 }
             },
-            AggregationMode::Count => self.record_count(series, data, metadata),
-            AggregationMode::Max | AggregationMode::Min => {
-                self.record_comparison(series, data, metadata)
-            }
-            AggregationMode::Mean | AggregationMode::Stdev => match data.kind {
+            InnerMode::Count => self.record_count(series, data, metadata),
+            InnerMode::Max | InnerMode::Min => self.record_comparison(series, data, metadata),
+            InnerMode::Mean { multi_map } | InnerMode::Stdev { multi_map } => match data.kind {
                 MetricKind::Incremental => (),
                 MetricKind::Absolute => {
                     if matches!(data.value, MetricValue::Gauge { value: _ }) {
-                        match self.multi_map.entry(series) {
+                        match multi_map.entry(series) {
                             Entry::Occupied(mut entry) => {
                                 let existing = entry.get_mut();
                                 existing.push((data, metadata));
@@ -227,8 +280,8 @@ impl Aggregate {
                             && let MetricValue::Gauge { value: new_value } = data.value()
                         {
                             let should_update = match self.mode {
-                                AggregationMode::Max => new_value > existing_value,
-                                AggregationMode::Min => new_value < existing_value,
+                                InnerMode::Max => new_value > existing_value,
+                                InnerMode::Min => new_value < existing_value,
                                 _ => false,
                             };
                             if should_update {
@@ -251,8 +304,8 @@ impl Aggregate {
         let map = std::mem::take(&mut self.map);
         for (series, entry) in map.clone().into_iter() {
             let mut metric = Metric::from_parts(series, entry.0, entry.1);
-            if matches!(self.mode, AggregationMode::Diff)
-                && let Some(prev_entry) = self.prev_map.get(metric.series())
+            if let InnerMode::Diff { prev_map } = &self.mode
+                && let Some(prev_entry) = prev_map.get(metric.series())
                 && metric.data().kind == prev_entry.0.kind
                 && !metric.subtract(&prev_entry.0)
             {
@@ -261,7 +314,13 @@ impl Aggregate {
             output.push(Event::Metric(metric));
         }
 
-        let multi_map = std::mem::take(&mut self.multi_map);
+        let multi_map = match &mut self.mode {
+            InnerMode::Mean { multi_map } | InnerMode::Stdev { multi_map } => {
+                std::mem::take(multi_map)
+            }
+            _ => HashMap::default(),
+        };
+
         'outer: for (series, entries) in multi_map.into_iter() {
             if entries.is_empty() {
                 continue;
@@ -287,11 +346,11 @@ impl Aggregate {
 
             let final_mean = final_sum.clone();
             match self.mode {
-                AggregationMode::Mean => {
+                InnerMode::Mean { .. } => {
                     let metric = Metric::from_parts(series, final_mean, final_metadata);
                     output.push(Event::Metric(metric));
                 }
-                AggregationMode::Stdev => {
+                InnerMode::Stdev { .. } => {
                     let variance = entries
                         .iter()
                         .filter_map(|(data, _)| {
@@ -315,7 +374,9 @@ impl Aggregate {
             }
         }
 
-        self.prev_map = map;
+        if let InnerMode::Diff { prev_map } = &mut self.mode {
+            *prev_map = map;
+        }
         emit!(AggregateFlushed);
     }
 }

From 42b844e76882fa5cbf1fd5cfafcf653101dc9ad0 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 17 Mar 2026 11:13:06 -0400
Subject: [PATCH 014/326] chore(website deps): remove unused fs package
 (#24945)

---
 website/package.json | 1 -
 website/yarn.lock    | 5 -----
 2 files changed, 6 deletions(-)

diff --git a/website/package.json b/website/package.json
index fec13b066895d..f3deb2d5ac37c 100644
--- a/website/package.json
+++ b/website/package.json
@@ -40,7 +40,6 @@
     "domhandler": "^4.2.0",
     "dotenv-defaults": "^2.0.2",
     "downshift": "^6.1.3",
-    "fs": "^0.0.1-security",
     "glob-promise": "^4.2.0",
     "lodash.chunk": "^4.2.0",
     "path": "^0.12.7",
diff --git a/website/yarn.lock b/website/yarn.lock
index 6e031634c03ef..57cd6d50741c0 100644
--- a/website/yarn.lock
+++ b/website/yarn.lock
@@ -2432,11 +2432,6 @@ fs.realpath@^1.0.0:
   resolved "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz"
   integrity sha1-FQStJSMVjKpA20onh8sBQRmU6k8=
 
-fs@^0.0.1-security:
-  version "0.0.1-security"
-  resolved "https://registry.npmjs.org/fs/-/fs-0.0.1-security.tgz"
-  integrity sha1-invTcYa23d84E/I4WLV+yq9eQdQ=
-
 fsevents@~2.3.2:
   version "2.3.2"
   resolved "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz"

From 218aa4d29b7b0922f604b7f6d8a3ebd0cc8e0931 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 17 Mar 2026 12:01:18 -0400
Subject: [PATCH 015/326] chore(website): Add osv-scanner.toml and ignore
 MAL-2025-3174 (#24946)

Add osv-scanner.toml
---
 website/osv-scanner.toml | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 website/osv-scanner.toml

diff --git a/website/osv-scanner.toml b/website/osv-scanner.toml
new file mode 100644
index 0000000000000..65d943205867c
--- /dev/null
+++ b/website/osv-scanner.toml
@@ -0,0 +1,3 @@
+[[IgnoredVulns]]
+id = "MAL-2025-3174"
+reason = "typesense-sync: package pulled in from s3 and not from npm"

From 83bcf4cb297f85525f88a3cff1870ab8fbddd47b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 17 Mar 2026 12:23:49 -0400
Subject: [PATCH 016/326] chore(deps): bump quinn-proto from 0.11.9 to 0.11.14
 (#24926)

* chore(deps): bump quinn-proto from 0.11.9 to 0.11.14

Bumps [quinn-proto](https://github.com/quinn-rs/quinn) from 0.11.9 to 0.11.14.
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](https://github.com/quinn-rs/quinn/compare/quinn-proto-0.11.9...quinn-proto-0.11.14)

---
updated-dependencies:
- dependency-name: quinn-proto
  dependency-version: 0.11.14
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update licenses

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock           | 15 +++++++++++----
 LICENSE-3rdparty.csv |  1 +
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 610fc0628a731..08becf0e3552c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6424,6 +6424,12 @@ dependencies = [
  "linked-hash-map",
 ]
 
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
 [[package]]
 name = "lua-src"
 version = "547.0.0"
@@ -8660,13 +8666,14 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.9"
+version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2fe5ef3495d7d2e377ff17b1a8ce2ee2ec2a18cde8b6ad6619d65d0701c135d"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
 dependencies = [
  "bytes 1.11.1",
- "getrandom 0.2.15",
- "rand 0.8.5",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.2",
  "ring",
  "rustc-hash",
  "rustls 0.23.23",
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 523769af4238a..09e39573c8126 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -450,6 +450,7 @@ lockfree-object-pool,https://github.com/EVaillant/lockfree-object-pool,BSL-1.0,E
 log,https://github.com/rust-lang/log,MIT OR Apache-2.0,The Rust Project Developers
 lru,https://github.com/jeromefroe/lru-rs,MIT,Jerome Froelich <jeromefroelic@hotmail.com>
 lru-cache,https://github.com/contain-rs/lru-cache,MIT OR Apache-2.0,Stepan Koltsov <stepan.koltsov@gmail.com>
+lru-slab,https://github.com/Ralith/lru-slab,MIT OR Apache-2.0 OR Zlib,Benjamin Saunders <ben.e.saunders@gmail.com>
 lz4,https://github.com/10xGenomics/lz4-rs,MIT,"Jens Heyens <jens.heyens@ewetel.net>, Artem V. Navrotskiy <bozaro@buzzsoft.ru>, Patrick Marks <pmarks@gmail.com>"
 lz4-sys,https://github.com/10xGenomics/lz4-rs,MIT,"Jens Heyens <jens.heyens@ewetel.net>, Artem V. Navrotskiy <bozaro@buzzsoft.ru>, Patrick Marks <pmarks@gmail.com>"
 lz4_flex,https://github.com/pseitz/lz4_flex,MIT,"Pascal Seitz <pascal.seitz@gmail.com>, Arthur Silva <arthurprs@gmail.com>, ticki <Ticki@users.noreply.github.com>"

From dc9d8de0c8f2ff7a04a7373820f1ef652ed30520 Mon Sep 17 00:00:00 2001
From: Vladimir Zhuk <vladimir.zhuk@datadoghq.com>
Date: Tue, 17 Mar 2026 19:29:20 +0100
Subject: [PATCH 017/326] chore(datadog_metrics sink): switch to v2 endpoint
 (#24842)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* chore(datadog_metrics sink): switch to Datadog Metrics V2 endpoint

* chore(regression): Add statsd_to_datadog_metrics performance test

Add regression test to validate datadog_metrics sink v2 endpoint
performance under realistic high-throughput DogStatsD load.

Test Configuration:
- Load: Default lading dogstatsd settings (realistic ~2KB messages)
- Throughput: 500 Mb/s → ~250k events/sec
- Batch: Default settings (100k max_events, 2s timeout)
- Validates batch splitting when payloads exceed v2 size limits

This test ensures v2 endpoint correctly handles batch splitting
with realistic high-cardinality DogStatsD metrics under load.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix(datadog_metrics sink): apply per-endpoint batch size limit

Different series endpoints have different uncompressed payload limits (v2
is 12x smaller than v1). This ensures each batch fits in a single HTTP
request without splitting, reducing memory overhead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(datadog_metrics sink): fix test compilation errors in encoder and config

- Remove references to DatadogMetricsCompression and request_compression
  from encoder.rs tests (those symbols don't exist in current codebase;
  they belong to an unmerged compression-options branch)
- Fix batcher_user_max_bytes_is_preserved test to avoid struct update
  syntax with private PhantomData fields in BatchConfig

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(datadog_metrics sink): warn on deprecated VECTOR_TEMP_USE_DD_METRICS_SERIES_V2_API env var

The old opt-in env var is now a no-op since v2 is the default. Emit a
one-time warning so existing users know they can safely remove it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* trigger build

* feat(datadog_metrics sink): use separate batch size limits for Series and Sketches

Series v2 has a 5 MiB uncompressed payload limit while Sketches allows 60 MiB.
Previously both used the same (Series-derived) cap, which over-fragmented
sketch-heavy workloads into many small requests.

To support per-partition batch configuration, `PartitionedBatcher` now passes
the partition key to the batch config factory closure (`Fn(&Key) -> C` instead
of `Fn() -> C`). The explicit `timeout: Duration` parameter replaces the
previous extraction via `settings().timeout()`. All existing callers are
updated mechanically.

The `datadog_metrics` sink uses the new capability to select the appropriate
byte size limit per endpoint partition, keeping Series at 5 MiB and Sketches
at 60 MiB.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(datadog_metrics sink): fix CI failures after partitioned batcher refactor

- Add `Batch = B` constraint to `with_timer` test constructor so the
  compiler can infer `B` from the batch config type
- Replace `Box::new(move |_| ...)` with unboxed `move |_: &u8| ...` in
  tests to avoid HRTB inference issues with `Fn(&Key) -> C`
- Run `make fmt` to fix formatting in several sink files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(datadog_metrics sink): add series_api_version config field, remove env var support

- Add `series_api_version` config option (`v1` | `v2`, default `v2`) to `DatadogMetricsConfig`
- Make `SeriesApiVersion` a proper `#[configurable_component]` enum with serde support
- Remove `VECTOR_TEMP_USE_DD_METRICS_SERIES_V1_API` and `VECTOR_TEMP_USE_DD_METRICS_SERIES_V2_API` env vars
- Remove `get_api_version_backwards_compatible()` and `DatadogMetricsEndpoint::series()` helpers
- Thread `series_api_version` through config, sink, partitioner, and request builder
- Add `v1_batch_config_uses_v1_size_limit` test; update existing tests to pass explicit version

Rationale: Replace the hidden, process-global env var mechanism with a standard config field so
users can control the series API version per-sink without a full Vector restart, and so the option
is properly documented alongside other sink settings.

* update docs

* mark v1 as deprecated

* fix(datadog_metrics sink): fix gauge interval assertion after normalization strips interval_ms

`into_absolute()` always sets `interval_ms: None`, so the encoded
interval for gauges is always 0. The test expectation of 10 was
dead code until v2 became the default endpoint.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(datadog_metrics sink): validate both v1 and v2 series endpoints in e2e tests

- Add series_api_version matrix dimension ['v1', 'v2'] to test.yaml, expanding coverage from 3 to 6 environments
- Pass CONFIG_SERIES_API_VERSION through docker compose environment to the Vector container
- Parameterize series_api_version in vector.toml from the env var
- Refactor series::validate() to dispatch to v1 or v2 fetch function based on CONFIG_SERIES_API_VERSION
- Extract assertions into compare_intakes() helper (no new assertion logic)
- Replace blocking std::thread::sleep with async tokio::time::sleep in the test entry point

Rationale: Vector now supports configurable series_api_version (v1/v2) in the datadog_metrics sink. The e2e test previously hardcoded v1 for the vector pipeline. This change runs the same assertions against both API versions via the CI matrix, ensuring correctness is validated for each version independently without duplicating test logic.

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 ...g_metrics_series_v2_default.enhancement.md |   5 +
 lib/vector-stream/src/partitioned_batcher.rs  |  21 ++-
 .../statsd_to_datadog_metrics/experiment.yaml |  10 ++
 .../lading/lading.yaml                        |  16 +++
 .../vector/vector.yaml                        |  25 ++++
 src/sinks/aws_cloudwatch_logs/sink.rs         |   2 +-
 src/sinks/azure_common/sink.rs                |   4 +-
 src/sinks/clickhouse/sink.rs                  |   3 +-
 src/sinks/datadog/logs/sink.rs                |   2 +-
 src/sinks/datadog/metrics/config.rs           | 120 +++++++++++++-----
 src/sinks/datadog/metrics/encoder.rs          |  71 +++++++++++
 .../datadog/metrics/integration_tests.rs      |   4 +-
 src/sinks/datadog/metrics/request_builder.rs  |   5 +-
 src/sinks/datadog/metrics/sink.rs             |  61 ++++++---
 src/sinks/datadog/traces/sink.rs              |   4 +-
 src/sinks/doris/sink.rs                       |   4 +-
 src/sinks/gcp_chronicle/sink.rs               |   4 +-
 src/sinks/gcs_common/sink.rs                  |   4 +-
 src/sinks/greptimedb/logs/sink.rs             |   3 +-
 src/sinks/http/sink.rs                        |   8 +-
 src/sinks/loki/sink.rs                        |   4 +-
 src/sinks/opendal_common.rs                   |   4 +-
 src/sinks/prometheus/remote_write/sink.rs     |  12 +-
 src/sinks/s3_common/sink.rs                   |   4 +-
 src/sinks/splunk_hec/logs/sink.rs             |   3 +-
 src/sinks/splunk_hec/metrics/sink.rs          |   4 +-
 src/sinks/util/builder.rs                     |   8 +-
 tests/e2e/datadog-metrics/config/compose.yaml |   1 +
 tests/e2e/datadog-metrics/config/test.yaml    |   2 +
 tests/e2e/datadog-metrics/data/vector.toml    |   1 +
 tests/e2e/datadog/metrics/series.rs           |  37 ++++--
 .../sinks/generated/datadog_metrics.cue       |  24 ++++
 32 files changed, 382 insertions(+), 98 deletions(-)
 create mode 100644 changelog.d/datadog_metrics_series_v2_default.enhancement.md
 create mode 100644 regression/cases/statsd_to_datadog_metrics/experiment.yaml
 create mode 100644 regression/cases/statsd_to_datadog_metrics/lading/lading.yaml
 create mode 100644 regression/cases/statsd_to_datadog_metrics/vector/vector.yaml

diff --git a/changelog.d/datadog_metrics_series_v2_default.enhancement.md b/changelog.d/datadog_metrics_series_v2_default.enhancement.md
new file mode 100644
index 0000000000000..39e857b73f99d
--- /dev/null
+++ b/changelog.d/datadog_metrics_series_v2_default.enhancement.md
@@ -0,0 +1,5 @@
+The `datadog_metrics` sink now defaults to the Datadog series v2 endpoint (`/api/v2/series`) and
+exposes a new `series_api_version` configuration option (`v1` or `v2`) to control which endpoint is
+used. Set `series_api_version: v1` to fall back to the legacy v1 endpoint if needed.
+
+authors: vladimir-dd
diff --git a/lib/vector-stream/src/partitioned_batcher.rs b/lib/vector-stream/src/partitioned_batcher.rs
index 30cf039ec3840..0cd0413548595 100644
--- a/lib/vector-stream/src/partitioned_batcher.rs
+++ b/lib/vector-stream/src/partitioned_batcher.rs
@@ -211,10 +211,9 @@ where
     Prt::Key: Eq + Hash + Clone,
     Prt::Item: ByteSizeOf,
     C: BatchConfig<Prt::Item>,
-    F: Fn() -> C + Send,
+    F: Fn(&Prt::Key) -> C + Send,
 {
-    pub fn new(stream: St, partitioner: Prt, settings: F) -> Self {
-        let timeout = settings().timeout();
+    pub fn new(stream: St, partitioner: Prt, timeout: Duration, settings: F) -> Self {
         Self {
             state: settings,
             batches: HashMap::default(),
@@ -233,8 +232,8 @@ where
     Prt: Partitioner + Unpin,
     Prt::Key: Eq + Hash + Clone,
     Prt::Item: ByteSizeOf,
-    C: BatchConfig<Prt::Item>,
-    F: Fn() -> C + Send,
+    C: BatchConfig<Prt::Item, Batch = B>,
+    F: Fn(&Prt::Key) -> C + Send,
 {
     pub fn with_timer(stream: St, partitioner: Prt, timer: KT, settings: F) -> Self {
         Self {
@@ -256,7 +255,7 @@ where
     Prt::Item: ByteSizeOf,
     KT: KeyedTimer<Prt::Key>,
     C: BatchConfig<Prt::Item, Batch = B>,
-    F: Fn() -> C + Send,
+    F: Fn(&Prt::Key) -> C + Send,
 {
     type Item = (Prt::Key, B);
 
@@ -307,7 +306,7 @@ where
                     let batch = if let Some(batch) = this.batches.get_mut(&item_key) {
                         batch
                     } else {
-                        let batch = (this.state)();
+                        let batch = (this.state)(&item_key);
                         this.batches.insert(item_key.clone(), batch);
                         this.timer.insert(item_key.clone());
                         this.batches
@@ -479,7 +478,7 @@ mod test {
             let batch_settings = BatcherSettings::new(Duration::from_secs(1), allocation_limit, item_limit);
 
             let batcher = PartitionedBatcher::with_timer(&mut stream, partitioner, timer,
-                                              Box::new(move || batch_settings.as_byte_size_config()));
+                                              move |_: &u8| batch_settings.as_byte_size_config::<u64>());
             let batcher_size_hint = batcher.size_hint();
 
             assert_eq!(stream_size_hint, batcher_size_hint);
@@ -503,7 +502,7 @@ mod test {
             let allocation_limit = NonZeroUsize::new(allocation_limit as usize).unwrap();
             let batch_settings = BatcherSettings::new(Duration::from_secs(1), allocation_limit, item_limit);
             let mut batcher = PartitionedBatcher::with_timer(&mut stream, partitioner,
-                                                  timer, Box::new(move || batch_settings.as_byte_size_config()));
+                                                  timer, move |_: &u8| batch_settings.as_byte_size_config::<u64>());
             let mut batcher = Pin::new(&mut batcher);
 
             loop {
@@ -574,7 +573,7 @@ mod test {
             let allocation_limit = NonZeroUsize::new(allocation_limit as usize).unwrap();
             let batch_settings = BatcherSettings::new(Duration::from_secs(1), allocation_limit, item_limit);
             let mut batcher = PartitionedBatcher::with_timer(&mut stream, partitioner,
-                                                  timer, Box::new(move || batch_settings.as_byte_size_config()));
+                                                  timer, move |_: &u8| batch_settings.as_byte_size_config::<u64>());
             let mut batcher = Pin::new(&mut batcher);
 
             loop {
@@ -618,7 +617,7 @@ mod test {
             let allocation_limit = NonZeroUsize::new(allocation_limit as usize).unwrap();
             let batch_settings = BatcherSettings::new(Duration::from_secs(1), allocation_limit, item_limit);
             let mut batcher = PartitionedBatcher::with_timer(&mut stream, partitioner,
-                                                  timer, Box::new(move || batch_settings.as_byte_size_config()));
+                                                  timer, move |_: &u8| batch_settings.as_byte_size_config::<u64>());
             let mut batcher = Pin::new(&mut batcher);
 
             let mut observed_items = 0;
diff --git a/regression/cases/statsd_to_datadog_metrics/experiment.yaml b/regression/cases/statsd_to_datadog_metrics/experiment.yaml
new file mode 100644
index 0000000000000..7c0e069a9eddc
--- /dev/null
+++ b/regression/cases/statsd_to_datadog_metrics/experiment.yaml
@@ -0,0 +1,10 @@
+optimization_goal: egress_throughput
+
+target:
+  name: vector
+  command: /usr/bin/vector
+  cpu_allotment: 6
+  memory_allotment: 8GiB
+
+  environment:
+    VECTOR_THREADS: 4
diff --git a/regression/cases/statsd_to_datadog_metrics/lading/lading.yaml b/regression/cases/statsd_to_datadog_metrics/lading/lading.yaml
new file mode 100644
index 0000000000000..3494ed826fd6f
--- /dev/null
+++ b/regression/cases/statsd_to_datadog_metrics/lading/lading.yaml
@@ -0,0 +1,16 @@
+generator:
+  - tcp:
+      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      addr: "0.0.0.0:8125"
+      variant:
+        dogstatsd: {}
+      bytes_per_second: "500 Mb"
+      maximum_prebuild_cache_size_bytes: "256 Mb"
+
+blackhole:
+  - http:
+      binding_addr: "0.0.0.0:8080"
+
+target_metrics:
+  - prometheus:
+      uri: "http://127.0.0.1:9090/metrics"
diff --git a/regression/cases/statsd_to_datadog_metrics/vector/vector.yaml b/regression/cases/statsd_to_datadog_metrics/vector/vector.yaml
new file mode 100644
index 0000000000000..990d4d00c349f
--- /dev/null
+++ b/regression/cases/statsd_to_datadog_metrics/vector/vector.yaml
@@ -0,0 +1,25 @@
+data_dir: "/var/lib/vector"
+
+sources:
+  internal_metrics:
+    type: "internal_metrics"
+
+  statsd:
+    type: "statsd"
+    address: "0.0.0.0:8125"
+    mode: "tcp"
+
+sinks:
+  prometheus:
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
+    address: "0.0.0.0:9090"
+
+  datadog_metrics:
+    type: "datadog_metrics"
+    inputs: ["statsd"]
+    endpoint: "http://0.0.0.0:8080"
+    default_api_key: "DEADBEEF"
+    default_namespace: "vector"
+    healthcheck:
+      enabled: false
diff --git a/src/sinks/aws_cloudwatch_logs/sink.rs b/src/sinks/aws_cloudwatch_logs/sink.rs
index da272b2fafd28..7b47a5b34ff8f 100644
--- a/src/sinks/aws_cloudwatch_logs/sink.rs
+++ b/src/sinks/aws_cloudwatch_logs/sink.rs
@@ -49,7 +49,7 @@ where
                 let age_range = start..end;
                 future::ready(age_range.contains(&req.timestamp))
             })
-            .batched_partitioned(CloudwatchPartitioner, || {
+            .batched_partitioned(CloudwatchPartitioner, batcher_settings.timeout, |_| {
                 batcher_settings.as_byte_size_config()
             })
             .map(|(key, events)| {
diff --git a/src/sinks/azure_common/sink.rs b/src/sinks/azure_common/sink.rs
index 1309ae3ba0d66..de567272cf8cd 100644
--- a/src/sinks/azure_common/sink.rs
+++ b/src/sinks/azure_common/sink.rs
@@ -47,7 +47,9 @@ where
         let request_builder = self.request_builder;
 
         input
-            .batched_partitioned(partitioner, || settings.as_byte_size_config())
+            .batched_partitioned(partitioner, settings.timeout, |_| {
+                settings.as_byte_size_config()
+            })
             .filter_map(|(key, batch)| async move {
                 // We don't need to emit an error here if the event is dropped since this will occur if the template
                 // couldn't be rendered during the partitioning. A `TemplateRenderingError` is already emitted when
diff --git a/src/sinks/clickhouse/sink.rs b/src/sinks/clickhouse/sink.rs
index e86f484d89024..ea2f6d434097e 100644
--- a/src/sinks/clickhouse/sink.rs
+++ b/src/sinks/clickhouse/sink.rs
@@ -43,7 +43,8 @@ where
         input
             .batched_partitioned(
                 KeyPartitioner::new(self.database, self.table, self.format),
-                || batch_settings.as_byte_size_config(),
+                batch_settings.timeout,
+                |_| batch_settings.as_byte_size_config(),
             )
             .filter_map(|(key, batch)| async move { key.map(move |k| (k, batch)) })
             .request_builder(
diff --git a/src/sinks/datadog/logs/sink.rs b/src/sinks/datadog/logs/sink.rs
index 862d6973aea5f..0abf4bed1ade5 100644
--- a/src/sinks/datadog/logs/sink.rs
+++ b/src/sinks/datadog/logs/sink.rs
@@ -386,7 +386,7 @@ where
             conforms_as_agent: self.conforms_as_agent,
         });
 
-        let input = input.batched_partitioned(partitioner, || {
+        let input = input.batched_partitioned(partitioner, batch_settings.timeout, |_| {
             batch_settings.as_item_size_config(HttpJsonBatchSizer)
         });
         input
diff --git a/src/sinks/datadog/metrics/config.rs b/src/sinks/datadog/metrics/config.rs
index 6d004e694e0ea..e296bd823d60c 100644
--- a/src/sinks/datadog/metrics/config.rs
+++ b/src/sinks/datadog/metrics/config.rs
@@ -1,9 +1,9 @@
-use std::sync::OnceLock;
-
 use http::Uri;
 use snafu::ResultExt;
 use tower::ServiceBuilder;
-use vector_lib::{config::proxy::ProxyConfig, configurable::configurable_component};
+use vector_lib::{
+    config::proxy::ProxyConfig, configurable::configurable_component, stream::BatcherSettings,
+};
 
 use super::{
     request_builder::DatadogMetricsRequestBuilder,
@@ -21,18 +21,13 @@ use crate::{
     },
     tls::{MaybeTlsSettings, TlsEnableableConfig},
 };
-
 #[derive(Clone, Copy, Debug, Default)]
 pub struct DatadogMetricsDefaultBatchSettings;
 
-// This default is centered around "series" data, which should be the lion's share of what we
-// process.  Given that a single series, when encoded, is in the 150-300 byte range, we can fit a
-// lot of these into a single request, something like 150-200K series.  Simply to be a little more
-// conservative, though, we use 100K here.  This will also get a little more tricky when it comes to
-// distributions and sketches, but we're going to have to implement incremental encoding to handle
-// "we've exceeded our maximum payload size, split this batch" scenarios anyways.
 impl SinkBatchSettings for DatadogMetricsDefaultBatchSettings {
     const MAX_EVENTS: Option<usize> = Some(100_000);
+    // No default byte cap here; the appropriate limit (v1: 60 MiB, v2: 5 MiB) is applied at
+    // sink build time based on the active series API version.
     const MAX_BYTES: Option<usize> = None;
     const TIMEOUT_SECS: f64 = 2.0;
 }
@@ -41,9 +36,21 @@ pub(super) const SERIES_V1_PATH: &str = "/api/v1/series";
 pub(super) const SERIES_V2_PATH: &str = "/api/v2/series";
 pub(super) const SKETCHES_PATH: &str = "/api/beta/sketches";
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+/// The API version to use when submitting series metrics to Datadog.
+#[configurable_component]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Hash)]
+#[serde(rename_all = "snake_case")]
 pub enum SeriesApiVersion {
+    /// Use the v1 series endpoint (`/api/v1/series`).
+    ///
+    /// This is a legacy endpoint. Prefer `v2` unless you have a specific reason to use v1.
+    #[configurable(deprecated)]
     V1,
+
+    /// Use the v2 series endpoint (`/api/v2/series`).
+    ///
+    /// This is the recommended and default endpoint.
+    #[default]
     V2,
 }
 
@@ -54,15 +61,6 @@ impl SeriesApiVersion {
             Self::V2 => SERIES_V2_PATH,
         }
     }
-    fn get_api_version() -> Self {
-        static API_VERSION: OnceLock<SeriesApiVersion> = OnceLock::new();
-        *API_VERSION.get_or_init(|| {
-            match std::env::var("VECTOR_TEMP_USE_DD_METRICS_SERIES_V2_API") {
-                Ok(_) => Self::V2,
-                Err(_) => Self::V1,
-            }
-        })
-    }
 }
 
 /// Various metric type-specific API types.
@@ -94,14 +92,8 @@ impl DatadogMetricsEndpoint {
         matches!(self, Self::Series { .. })
     }
 
-    // Creates an instance of the `Series` variant with the default API version.
-    pub fn series() -> Self {
-        Self::Series(SeriesApiVersion::get_api_version())
-    }
-
     pub(super) const fn payload_limits(self) -> DatadogMetricsPayloadLimits {
         // from https://docs.datadoghq.com/api/latest/metrics/#submit-metrics
-
         let (uncompressed, compressed) = match self {
             // Sketches use the same payload size limits as v1 series
             DatadogMetricsEndpoint::Series(SeriesApiVersion::V1)
@@ -162,6 +154,13 @@ pub struct DatadogMetricsConfig {
     #[serde(default)]
     pub default_namespace: Option<String>,
 
+    /// Controls which Datadog series API endpoint is used to submit metrics.
+    ///
+    /// Defaults to `v2` (`/api/v2/series`). Set to `v1` (`/api/v1/series`) only if you need to
+    /// fall back to the legacy endpoint.
+    #[serde(default)]
+    pub series_api_version: SeriesApiVersion,
+
     #[configurable(derived)]
     #[serde(default)]
     pub batch: BatchConfig<DatadogMetricsDefaultBatchSettings>,
@@ -222,7 +221,7 @@ impl DatadogMetricsConfig {
     ) -> crate::Result<DatadogMetricsEndpointConfiguration> {
         let base_uri = self.get_base_agent_endpoint(dd_common);
 
-        let series_endpoint = build_uri(&base_uri, SeriesApiVersion::get_api_version().get_path())?;
+        let series_endpoint = build_uri(&base_uri, self.series_api_version.get_path())?;
         let sketches_endpoint = build_uri(&base_uri, SKETCHES_PATH)?;
 
         Ok(DatadogMetricsEndpointConfiguration::new(
@@ -253,7 +252,8 @@ impl DatadogMetricsConfig {
         dd_common: &DatadogCommonConfig,
         client: HttpClient,
     ) -> crate::Result<VectorSink> {
-        let batcher_settings = self.batch.into_batcher_settings()?;
+        let (batcher_settings, sketches_batcher_settings) =
+            resolve_endpoint_batch_settings(self.batch, self.series_api_version)?;
 
         // TODO: revisit our concurrency and batching defaults
         let request_limits = self.request.into_settings();
@@ -269,10 +269,18 @@ impl DatadogMetricsConfig {
         let request_builder = DatadogMetricsRequestBuilder::new(
             endpoint_configuration,
             self.default_namespace.clone(),
+            self.series_api_version,
         )?;
 
         let protocol = self.get_protocol(dd_common);
-        let sink = DatadogMetricsSink::new(service, request_builder, batcher_settings, protocol);
+        let sink = DatadogMetricsSink::new(
+            service,
+            request_builder,
+            batcher_settings,
+            sketches_batcher_settings,
+            protocol,
+            self.series_api_version,
+        );
 
         Ok(VectorSink::from_event_streamsink(sink))
     }
@@ -287,6 +295,28 @@ impl DatadogMetricsConfig {
     }
 }
 
+/// Returns `(series_settings, sketches_settings)`.
+///
+/// When the user has not set an explicit `max_bytes`, each endpoint is capped to its own
+/// uncompressed payload limit (5 MiB for Series v2, 60 MiB for Sketches). When an explicit
+/// limit is configured, both endpoints share it.
+fn resolve_endpoint_batch_settings(
+    batch: BatchConfig<DatadogMetricsDefaultBatchSettings>,
+    series_version: SeriesApiVersion,
+) -> crate::Result<(BatcherSettings, BatcherSettings)> {
+    let mut series = batch.into_batcher_settings()?;
+    let mut sketches = series;
+    if series.size_limit == usize::MAX {
+        series.size_limit = DatadogMetricsEndpoint::Series(series_version)
+            .payload_limits()
+            .uncompressed;
+        sketches.size_limit = DatadogMetricsEndpoint::Sketches
+            .payload_limits()
+            .uncompressed;
+    }
+    Ok((series, sketches))
+}
+
 fn build_uri(host: &str, endpoint: &str) -> crate::Result<Uri> {
     let result = format!("{host}{endpoint}")
         .parse::<Uri>()
@@ -302,4 +332,36 @@ mod tests {
     fn generate_config() {
         crate::test_util::test_generate_config::<DatadogMetricsConfig>();
     }
+
+    // When max_bytes is unset, each endpoint gets its own API payload limit.
+    #[test]
+    fn default_batch_config_uses_endpoint_specific_size_limits() {
+        let (series, sketches) =
+            resolve_endpoint_batch_settings(BatchConfig::default(), SeriesApiVersion::V2).unwrap();
+
+        assert_eq!(series.size_limit, 5_242_880); // 5 MiB — Series v2 limit
+        assert_eq!(sketches.size_limit, 62_914_560); // 60 MiB — Sketches limit
+    }
+
+    #[test]
+    fn v1_batch_config_uses_v1_size_limit() {
+        let (series, sketches) =
+            resolve_endpoint_batch_settings(BatchConfig::default(), SeriesApiVersion::V1).unwrap();
+
+        assert_eq!(series.size_limit, 62_914_560); // 60 MiB — Series v1 limit
+        assert_eq!(sketches.size_limit, 62_914_560); // 60 MiB — Sketches limit
+    }
+
+    // When the user sets max_bytes, both endpoints share that limit unchanged.
+    #[test]
+    fn explicit_max_bytes_applies_to_both_endpoints() {
+        let mut config = BatchConfig::<DatadogMetricsDefaultBatchSettings>::default();
+        config.max_bytes = Some(1_000_000);
+
+        let (series, sketches) =
+            resolve_endpoint_batch_settings(config, SeriesApiVersion::V2).unwrap();
+
+        assert_eq!(series.size_limit, 1_000_000);
+        assert_eq!(sketches.size_limit, 1_000_000);
+    }
 }
diff --git a/src/sinks/datadog/metrics/encoder.rs b/src/sinks/datadog/metrics/encoder.rs
index 617e69c1e5e6b..9f0b71c87ba98 100644
--- a/src/sinks/datadog/metrics/encoder.rs
+++ b/src/sinks/datadog/metrics/encoder.rs
@@ -1582,6 +1582,77 @@ mod tests {
         assert_eq!(result, Some((usize::MAX, compression_overhead_len + 1)));
     }
 
+    #[test]
+    fn default_payload_limits_are_endpoint_aware() {
+        let v1 = DatadogMetricsEndpoint::Series(SeriesApiVersion::V1).payload_limits();
+        assert_eq!(v1.uncompressed, 62_914_560);
+        assert_eq!(v1.compressed, 3_200_000);
+
+        let v2 = DatadogMetricsEndpoint::Series(SeriesApiVersion::V2).payload_limits();
+        assert_eq!(v2.uncompressed, 5_242_880);
+        assert_eq!(v2.compressed, 512_000);
+
+        let sketches = DatadogMetricsEndpoint::Sketches.payload_limits();
+        assert_eq!(sketches.uncompressed, 62_914_560);
+        assert_eq!(sketches.compressed, 3_200_000);
+    }
+
+    #[test]
+    fn v2_series_default_limits_split_large_batches() {
+        // Simulate a large send and validate that default V2 limits split payloads into multiple
+        // requests, while still making forward progress each pass.
+        let mut pending = vec![get_simple_counter(); 120_000];
+        let mut encoded_batches = 0;
+        let mut encoded_metrics = 0;
+
+        while !pending.is_empty() {
+            let mut encoder = DatadogMetricsEncoder::new(
+                DatadogMetricsEndpoint::Series(SeriesApiVersion::V2),
+                None,
+            )
+            .expect("default payload size limits should be valid");
+
+            let mut next_pending = Vec::new();
+            let mut hit_limit = false;
+            for metric in pending.drain(..) {
+                match encoder.try_encode(metric.clone()) {
+                    Ok(None) => {}
+                    Ok(Some(returned_metric)) => {
+                        hit_limit = true;
+                        next_pending.push(returned_metric);
+                    }
+                    Err(error) => panic!("unexpected encoding error: {error}"),
+                }
+            }
+
+            let finish_result = encoder.finish();
+            assert!(finish_result.is_ok());
+            let (_payload, processed) = finish_result.unwrap();
+            assert!(
+                !processed.is_empty(),
+                "encoder should always make progress for a non-empty batch"
+            );
+
+            encoded_metrics += processed.len();
+            encoded_batches += 1;
+
+            if hit_limit {
+                assert!(
+                    !next_pending.is_empty(),
+                    "hitting limits should leave metrics to process in the next batch"
+                );
+            }
+
+            pending = next_pending;
+        }
+
+        assert_eq!(encoded_metrics, 120_000);
+        assert!(
+            encoded_batches > 1,
+            "expected multiple batches for V2 default limits"
+        );
+    }
+
     #[test]
     fn encode_series_breaks_out_when_limit_reached_uncompressed() {
         // We manually create the encoder with an arbitrarily low "uncompressed" limit but high
diff --git a/src/sinks/datadog/metrics/integration_tests.rs b/src/sinks/datadog/metrics/integration_tests.rs
index e20ef106f7ee2..e63d4c35e73c9 100644
--- a/src/sinks/datadog/metrics/integration_tests.rs
+++ b/src/sinks/datadog/metrics/integration_tests.rs
@@ -321,7 +321,9 @@ fn validate_protobuf_set_gauge_rate(request: &(Parts, Bytes)) {
             ddmetric_proto::metric_payload::MetricType::Gauge
         );
         assert_eq!(gauge.points[0].value, 5678.0);
-        assert_eq!(gauge.interval, 10);
+        // interval_ms is dropped during normalization (incremental → absolute conversion
+        // via into_absolute() sets interval_ms: None), so interval is always 0 for gauges.
+        assert_eq!(gauge.interval, 0);
     }
 
     // validate counter w interval = rate
diff --git a/src/sinks/datadog/metrics/request_builder.rs b/src/sinks/datadog/metrics/request_builder.rs
index 32f3a7e2e5ae5..3b1c2f4607d39 100644
--- a/src/sinks/datadog/metrics/request_builder.rs
+++ b/src/sinks/datadog/metrics/request_builder.rs
@@ -8,7 +8,7 @@ use vector_lib::{
 };
 
 use super::{
-    config::{DatadogMetricsEndpoint, DatadogMetricsEndpointConfiguration},
+    config::{DatadogMetricsEndpoint, DatadogMetricsEndpointConfiguration, SeriesApiVersion},
     encoder::{CreateError, DatadogMetricsEncoder, EncoderError, FinishError},
     service::DatadogMetricsRequest,
 };
@@ -80,11 +80,12 @@ impl DatadogMetricsRequestBuilder {
     pub fn new(
         endpoint_configuration: DatadogMetricsEndpointConfiguration,
         default_namespace: Option<String>,
+        series_api_version: SeriesApiVersion,
     ) -> Result<Self, RequestBuilderError> {
         Ok(Self {
             endpoint_configuration,
             series_encoder: DatadogMetricsEncoder::new(
-                DatadogMetricsEndpoint::series(),
+                DatadogMetricsEndpoint::Series(series_api_version),
                 default_namespace.clone(),
             )?,
             sketches_encoder: DatadogMetricsEncoder::new(
diff --git a/src/sinks/datadog/metrics/sink.rs b/src/sinks/datadog/metrics/sink.rs
index 231aca75485ee..1cd075a831d9c 100644
--- a/src/sinks/datadog/metrics/sink.rs
+++ b/src/sinks/datadog/metrics/sink.rs
@@ -16,8 +16,10 @@ use vector_lib::{
 };
 
 use super::{
-    config::DatadogMetricsEndpoint, normalizer::DatadogMetricsNormalizer,
-    request_builder::DatadogMetricsRequestBuilder, service::DatadogMetricsRequest,
+    config::{DatadogMetricsEndpoint, SeriesApiVersion},
+    normalizer::DatadogMetricsNormalizer,
+    request_builder::DatadogMetricsRequestBuilder,
+    service::DatadogMetricsRequest,
 };
 use crate::{
     internal_events::DatadogMetricsEncodingError,
@@ -33,21 +35,24 @@ use crate::{
 /// Generally speaking, all "basic" metrics -- counter, gauge, set, aggregated summary-- are sent to
 /// the Series API, while distributions, aggregated histograms, and sketches (hehe) are sent to the
 /// Sketches API.
-struct DatadogMetricsTypePartitioner;
+struct DatadogMetricsTypePartitioner {
+    series_api_version: SeriesApiVersion,
+}
 
 impl Partitioner for DatadogMetricsTypePartitioner {
     type Item = Metric;
     type Key = (Option<Arc<str>>, DatadogMetricsEndpoint);
 
     fn partition(&self, item: &Self::Item) -> Self::Key {
+        let series = DatadogMetricsEndpoint::Series(self.series_api_version);
         let endpoint = match item.data().value() {
-            MetricValue::Counter { .. } => DatadogMetricsEndpoint::series(),
-            MetricValue::Gauge { .. } => DatadogMetricsEndpoint::series(),
-            MetricValue::Set { .. } => DatadogMetricsEndpoint::series(),
+            MetricValue::Counter { .. } => series,
+            MetricValue::Gauge { .. } => series,
+            MetricValue::Set { .. } => series,
             MetricValue::Distribution { .. } => DatadogMetricsEndpoint::Sketches,
             MetricValue::AggregatedHistogram { .. } => DatadogMetricsEndpoint::Sketches,
             // NOTE: AggregatedSummary will be split into counters and gauges during normalization
-            MetricValue::AggregatedSummary { .. } => DatadogMetricsEndpoint::series(),
+            MetricValue::AggregatedSummary { .. } => series,
             MetricValue::Sketch { .. } => DatadogMetricsEndpoint::Sketches,
         };
         (item.metadata().datadog_api_key(), endpoint)
@@ -57,8 +62,10 @@ impl Partitioner for DatadogMetricsTypePartitioner {
 pub(crate) struct DatadogMetricsSink<S> {
     service: S,
     request_builder: DatadogMetricsRequestBuilder,
-    batch_settings: BatcherSettings,
+    series_batch_settings: BatcherSettings,
+    sketches_batch_settings: BatcherSettings,
     protocol: String,
+    series_api_version: SeriesApiVersion,
 }
 
 impl<S> DatadogMetricsSink<S>
@@ -72,20 +79,28 @@ where
     pub const fn new(
         service: S,
         request_builder: DatadogMetricsRequestBuilder,
-        batch_settings: BatcherSettings,
+        series_batch_settings: BatcherSettings,
+        sketches_batch_settings: BatcherSettings,
         protocol: String,
+        series_api_version: SeriesApiVersion,
     ) -> Self {
         DatadogMetricsSink {
             service,
             request_builder,
-            batch_settings,
+            series_batch_settings,
+            sketches_batch_settings,
             protocol,
+            series_api_version,
         }
     }
 
     async fn run_inner(self: Box<Self>, input: BoxStream<'_, Event>) -> Result<(), ()> {
         let mut splitter: MetricSplitter<AggregatedSummarySplitter> = MetricSplitter::default();
-        let batch_settings = self.batch_settings;
+        let series_batch_settings = self.series_batch_settings;
+        let sketches_batch_settings = self.sketches_batch_settings;
+        let partitioner = DatadogMetricsTypePartitioner {
+            series_api_version: self.series_api_version,
+        };
 
         input
             // Convert `Event` to `Metric` so we don't have to deal with constant conversions.
@@ -99,10 +114,20 @@ where
             // what quantiles to generate, etc.
             .normalized_with_default::<DatadogMetricsNormalizer>()
             // We batch metrics by their endpoint: series endpoint for counters, gauge, and sets vs sketch endpoint for
-            // distributions, aggregated histograms, and sketches.
-            .batched_partitioned(DatadogMetricsTypePartitioner, || {
-                batch_settings.as_byte_size_config()
-            })
+            // distributions, aggregated histograms, and sketches. Each endpoint uses its own byte size
+            // limit: 5 MiB for Series v2 and 60 MiB for Sketches.
+            .batched_partitioned(
+                partitioner,
+                series_batch_settings.timeout,
+                |(_api_key, endpoint)| match endpoint {
+                    DatadogMetricsEndpoint::Series(_) => {
+                        series_batch_settings.as_byte_size_config()
+                    }
+                    DatadogMetricsEndpoint::Sketches => {
+                        sketches_batch_settings.as_byte_size_config()
+                    }
+                },
+            )
             // Aggregate counters with identical timestamps, otherwise identical counters (same
             // series and same timestamp, when rounded to whole seconds) will be dropped in a
             // last-write-wins situation when they hit the DD metrics intake.
@@ -233,10 +258,8 @@ mod tests {
 
     use chrono::{DateTime, Utc};
     use proptest::prelude::*;
-    use vector_lib::{
-        event::{Metric, MetricKind, MetricValue},
-        metric_tags,
-    };
+    use vector_lib::event::{Metric, MetricKind, MetricValue};
+    use vector_lib::metric_tags;
 
     use super::sort_and_collapse_counters_by_series_and_timestamp;
 
diff --git a/src/sinks/datadog/traces/sink.rs b/src/sinks/datadog/traces/sink.rs
index 8f48ab0acc63b..77f931fb931ab 100644
--- a/src/sinks/datadog/traces/sink.rs
+++ b/src/sinks/datadog/traces/sink.rs
@@ -108,7 +108,9 @@ where
         let batch_settings = self.batch_settings;
 
         input
-            .batched_partitioned(EventPartitioner, || batch_settings.as_byte_size_config())
+            .batched_partitioned(EventPartitioner, batch_settings.timeout, |_| {
+                batch_settings.as_byte_size_config()
+            })
             .incremental_request_builder(self.request_builder)
             .flat_map(stream::iter)
             .filter_map(|request| async move {
diff --git a/src/sinks/doris/sink.rs b/src/sinks/doris/sink.rs
index ac9a77f09742e..c87e76557c653 100644
--- a/src/sinks/doris/sink.rs
+++ b/src/sinks/doris/sink.rs
@@ -34,7 +34,9 @@ where
         let batch_settings = self.batch_settings;
         let key_partitioner = DorisKeyPartitioner::new(self.database, self.table);
         input
-            .batched_partitioned(key_partitioner, || batch_settings.as_byte_size_config())
+            .batched_partitioned(key_partitioner, batch_settings.timeout, |_| {
+                batch_settings.as_byte_size_config()
+            })
             .filter_map(|(key, batch)| async move { key.map(move |k| (k, batch)) })
             .request_builder(
                 default_request_builder_concurrency_limit(),
diff --git a/src/sinks/gcp_chronicle/sink.rs b/src/sinks/gcp_chronicle/sink.rs
index 8f37872ee4f72..bd98487b2ed96 100644
--- a/src/sinks/gcp_chronicle/sink.rs
+++ b/src/sinks/gcp_chronicle/sink.rs
@@ -48,7 +48,9 @@ where
         let request_builder = self.request_builder;
 
         input
-            .batched_partitioned(partitioner, || settings.as_byte_size_config())
+            .batched_partitioned(partitioner, settings.timeout, |_| {
+                settings.as_byte_size_config()
+            })
             .filter_map(|(key, batch)| async move {
                 // A `TemplateRenderingError` will have been emitted by `KeyPartitioner` if the key here is `None`,
                 // thus no further `EventsDropped` event needs emitting at this stage.
diff --git a/src/sinks/gcs_common/sink.rs b/src/sinks/gcs_common/sink.rs
index c545aaa6b196b..b2e4010ba301a 100644
--- a/src/sinks/gcs_common/sink.rs
+++ b/src/sinks/gcs_common/sink.rs
@@ -50,7 +50,9 @@ where
         let request_builder = self.request_builder;
 
         input
-            .batched_partitioned(partitioner, || settings.as_byte_size_config())
+            .batched_partitioned(partitioner, settings.timeout, |_| {
+                settings.as_byte_size_config()
+            })
             .filter_map(|(key, batch)| async move {
                 // A `TemplateRenderingError` will have been emitted by `KeyPartitioner` if the key here is `None`,
                 // thus no further `EventsDropped` event needs emitting at this stage.
diff --git a/src/sinks/greptimedb/logs/sink.rs b/src/sinks/greptimedb/logs/sink.rs
index c61ce3d76dfc3..a2b5b68acdb81 100644
--- a/src/sinks/greptimedb/logs/sink.rs
+++ b/src/sinks/greptimedb/logs/sink.rs
@@ -52,7 +52,8 @@ where
                     self.logs_sink_setting.pipeline_name,
                     self.logs_sink_setting.pipeline_version,
                 ),
-                || batcher_settings.as_byte_size_config(),
+                batcher_settings.timeout,
+                |_| batcher_settings.as_byte_size_config(),
             )
             .filter_map(|(key, batch)| async move { key.map(move |k| (k, batch)) })
             .request_builder(
diff --git a/src/sinks/http/sink.rs b/src/sinks/http/sink.rs
index 982a6515aac93..0c9a14d269daf 100644
--- a/src/sinks/http/sink.rs
+++ b/src/sinks/http/sink.rs
@@ -43,9 +43,11 @@ where
         };
         input
             // Batch the input stream with size calculation based on the configured codec
-            .batched_partitioned(KeyPartitioner::new(self.uri, self.headers), || {
-                self.batch_settings.as_item_size_config(batch_sizer.clone())
-            })
+            .batched_partitioned(
+                KeyPartitioner::new(self.uri, self.headers),
+                self.batch_settings.timeout,
+                |_| self.batch_settings.as_item_size_config(batch_sizer.clone()),
+            )
             .filter_map(|(key, batch)| async move { key.map(move |k| (k, batch)) })
             // Build requests with default concurrency limit.
             .request_builder(
diff --git a/src/sinks/loki/sink.rs b/src/sinks/loki/sink.rs
index 55a74dcbcfc0f..1bff5845f3618 100644
--- a/src/sinks/loki/sink.rs
+++ b/src/sinks/loki/sink.rs
@@ -513,7 +513,9 @@ impl LokiSink {
             .map(|event| encoder.encode_event(event))
             .filter_map(|event| async { event })
             .map(|record| filter.filter_record(record))
-            .batched_partitioned(RecordPartitioner, || batch_settings.as_byte_size_config())
+            .batched_partitioned(RecordPartitioner, batch_settings.timeout, |_| {
+                batch_settings.as_byte_size_config()
+            })
             .filter_map(|(partition, batch)| async {
                 if let Some(partition) = partition {
                     let mut count: usize = 0;
diff --git a/src/sinks/opendal_common.rs b/src/sinks/opendal_common.rs
index 4396002ae64b3..53e23e33ae8cc 100644
--- a/src/sinks/opendal_common.rs
+++ b/src/sinks/opendal_common.rs
@@ -78,7 +78,9 @@ where
         let request_builder = self.request_builder;
 
         input
-            .batched_partitioned(partitioner, || settings.as_byte_size_config())
+            .batched_partitioned(partitioner, settings.timeout, |_| {
+                settings.as_byte_size_config()
+            })
             .filter_map(|(key, batch)| async move {
                 // We don't need to emit an error here if the event is dropped since this will occur if the template
                 // couldn't be rendered during the partitioning. A `TemplateRenderingError` is already emitted when
diff --git a/src/sinks/prometheus/remote_write/sink.rs b/src/sinks/prometheus/remote_write/sink.rs
index 1b5f82ad76916..858f535a0d98e 100644
--- a/src/sinks/prometheus/remote_write/sink.rs
+++ b/src/sinks/prometheus/remote_write/sink.rs
@@ -182,10 +182,14 @@ where
             .filter_map(move |event| {
                 future::ready(make_remote_write_event(tenant_id.as_ref(), event))
             })
-            .batched_partitioned(PrometheusTenantIdPartitioner, || {
-                batch_settings
-                    .as_reducer_config(ByteSizeOfItemSize, EventCollection::new(self.aggregate))
-            })
+            .batched_partitioned(
+                PrometheusTenantIdPartitioner,
+                batch_settings.timeout,
+                |_| {
+                    batch_settings
+                        .as_reducer_config(ByteSizeOfItemSize, EventCollection::new(self.aggregate))
+                },
+            )
             .request_builder(default_request_builder_concurrency_limit(), request_builder)
             .filter_map(|request| async move {
                 match request {
diff --git a/src/sinks/s3_common/sink.rs b/src/sinks/s3_common/sink.rs
index 729a67153f641..5cad7ba89b6ee 100644
--- a/src/sinks/s3_common/sink.rs
+++ b/src/sinks/s3_common/sink.rs
@@ -47,7 +47,9 @@ where
         let request_builder = self.request_builder;
 
         input
-            .batched_partitioned(partitioner, || settings.as_byte_size_config())
+            .batched_partitioned(partitioner, settings.timeout, |_| {
+                settings.as_byte_size_config()
+            })
             .filter_map(|(key, batch)| async move { key.map(move |k| (k, batch)) })
             .request_builder(default_request_builder_concurrency_limit(), request_builder)
             .filter_map(|request| async move {
diff --git a/src/sinks/splunk_hec/logs/sink.rs b/src/sinks/splunk_hec/logs/sink.rs
index fb6742586130e..d80c44838c915 100644
--- a/src/sinks/splunk_hec/logs/sink.rs
+++ b/src/sinks/splunk_hec/logs/sink.rs
@@ -86,7 +86,8 @@ where
                 } else {
                     EventPartitioner::new(None, None, None, None)
                 },
-                || batch_settings.as_byte_size_config(),
+                batch_settings.timeout,
+                |_| batch_settings.as_byte_size_config(),
             )
             .request_builder(
                 default_request_builder_concurrency_limit(),
diff --git a/src/sinks/splunk_hec/metrics/sink.rs b/src/sinks/splunk_hec/metrics/sink.rs
index bb61a4ef1ecfb..57e05cc3953a4 100644
--- a/src/sinks/splunk_hec/metrics/sink.rs
+++ b/src/sinks/splunk_hec/metrics/sink.rs
@@ -53,7 +53,9 @@ where
                     default_namespace,
                 ))
             })
-            .batched_partitioned(EventPartitioner, || batch_settings.as_byte_size_config())
+            .batched_partitioned(EventPartitioner, batch_settings.timeout, |_| {
+                batch_settings.as_byte_size_config()
+            })
             .request_builder(
                 default_request_builder_concurrency_limit(),
                 self.request_builder,
diff --git a/src/sinks/util/builder.rs b/src/sinks/util/builder.rs
index 6d2b2a68753f5..725e20d974782 100644
--- a/src/sinks/util/builder.rs
+++ b/src/sinks/util/builder.rs
@@ -46,9 +46,13 @@ pub trait SinkBuilderExt: Stream {
     /// The stream will yield batches of events, with their partition key, when either a batch fills
     /// up or times out. [`Partitioner`] operates on a per-event basis, and has access to the event
     /// itself, and so can access any and all fields of an event.
+    ///
+    /// The `settings` closure receives the partition key for each new partition, allowing callers
+    /// to vary the batch configuration (e.g. byte size limit) per partition.
     fn batched_partitioned<P, C, F, B>(
         self,
         partitioner: P,
+        timeout: Duration,
         settings: F,
     ) -> PartitionedBatcher<Self, P, ExpirationQueue<P::Key>, C, F, B>
     where
@@ -57,9 +61,9 @@ pub trait SinkBuilderExt: Stream {
         P::Key: Eq + Hash + Clone,
         P::Item: ByteSizeOf,
         C: BatchConfig<P::Item>,
-        F: Fn() -> C + Send,
+        F: Fn(&P::Key) -> C + Send,
     {
-        PartitionedBatcher::new(self, partitioner, settings)
+        PartitionedBatcher::new(self, partitioner, timeout, settings)
     }
 
     /// Batches the stream based on the given batch settings and item size calculator.
diff --git a/tests/e2e/datadog-metrics/config/compose.yaml b/tests/e2e/datadog-metrics/config/compose.yaml
index d1beb57030c42..84c0f89278863 100644
--- a/tests/e2e/datadog-metrics/config/compose.yaml
+++ b/tests/e2e/datadog-metrics/config/compose.yaml
@@ -52,6 +52,7 @@ services:
     image: ${CONFIG_VECTOR_IMAGE}
     environment:
       - FEATURES=e2e-tests-datadog
+      - CONFIG_SERIES_API_VERSION
     working_dir: /home/vector
     command:
       - "/usr/bin/vector"
diff --git a/tests/e2e/datadog-metrics/config/test.yaml b/tests/e2e/datadog-metrics/config/test.yaml
index 0199618fe7f42..2b551be47c147 100644
--- a/tests/e2e/datadog-metrics/config/test.yaml
+++ b/tests/e2e/datadog-metrics/config/test.yaml
@@ -14,6 +14,8 @@ runner:
 matrix:
   # validate against the Agent latest nightly and also stable v6 and v7
   agent_version: ['latest', '6', '7']
+  # validate both series API versions
+  series_api_version: ['v1', 'v2']
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
diff --git a/tests/e2e/datadog-metrics/data/vector.toml b/tests/e2e/datadog-metrics/data/vector.toml
index c99e2f60ab9ba..c689e5c5ff2ed 100644
--- a/tests/e2e/datadog-metrics/data/vector.toml
+++ b/tests/e2e/datadog-metrics/data/vector.toml
@@ -14,3 +14,4 @@ type = "datadog_metrics"
 default_api_key = "unused"
 endpoint = "http://fakeintake-vector:80"
 batch.timeout_secs = 1
+series_api_version = "${CONFIG_SERIES_API_VERSION}"
diff --git a/tests/e2e/datadog/metrics/series.rs b/tests/e2e/datadog/metrics/series.rs
index 6b53c9282b01d..2c4e20a7ab269 100644
--- a/tests/e2e/datadog/metrics/series.rs
+++ b/tests/e2e/datadog/metrics/series.rs
@@ -218,19 +218,7 @@ async fn get_v2_series_from_pipeline(address: String) -> SeriesIntake {
     intake
 }
 
-pub(super) async fn validate() {
-    info!("==== getting series data from agent-only pipeline ==== ");
-    let agent_intake = get_v2_series_from_pipeline(fake_intake_agent_address()).await;
-
-    info!("==== getting series data from agent-vector pipeline ====");
-    let vector_intake = get_v1_series_from_pipeline(fake_intake_vector_address()).await;
-
-    assert_eq!(
-        agent_intake.len(),
-        vector_intake.len(),
-        "different number of unique Series contexts received"
-    );
-
+fn compare_intakes(agent_intake: &SeriesIntake, vector_intake: &SeriesIntake) {
     // The assertions we make below can be summarized as follows:
     //   - For each metric type, we have a different set of assertions which are relevant to
     //     the expectations for that metric type's behavior. For example, gauges are a last
@@ -249,6 +237,12 @@ pub(super) async fn validate() {
     //     used in the test case is not introducing inconsistencies in the data flowing between the
     //     Agent and the Datadog backend.
 
+    assert_eq!(
+        agent_intake.len(),
+        vector_intake.len(),
+        "different number of unique Series contexts received"
+    );
+
     agent_intake
         .iter()
         .zip(vector_intake.iter())
@@ -302,3 +296,20 @@ pub(super) async fn validate() {
             }
         });
 }
+
+pub(super) async fn validate() {
+    let api_version = std::env::var("CONFIG_SERIES_API_VERSION")
+        .expect("CONFIG_SERIES_API_VERSION must be set (e.g. 'v1' or 'v2')");
+
+    info!("==== getting series data from agent-only pipeline ==== ");
+    let agent_intake = get_v2_series_from_pipeline(fake_intake_agent_address()).await;
+
+    info!("==== getting series data from agent-vector pipeline ({api_version}) ====");
+    let vector_intake = match api_version.as_str() {
+        "v1" => get_v1_series_from_pipeline(fake_intake_vector_address()).await,
+        "v2" => get_v2_series_from_pipeline(fake_intake_vector_address()).await,
+        v => panic!("Unknown CONFIG_SERIES_API_VERSION: {v}"),
+    };
+
+    compare_intakes(&agent_intake, &vector_intake);
+}
diff --git a/website/cue/reference/components/sinks/generated/datadog_metrics.cue b/website/cue/reference/components/sinks/generated/datadog_metrics.cue
index 564c8c2422e3b..6d7ebc4378dd6 100644
--- a/website/cue/reference/components/sinks/generated/datadog_metrics.cue
+++ b/website/cue/reference/components/sinks/generated/datadog_metrics.cue
@@ -284,6 +284,30 @@ generated: components: sinks: datadog_metrics: configuration: {
 			}
 		}
 	}
+	series_api_version: {
+		description: """
+			Controls which Datadog series API endpoint is used to submit metrics.
+
+			Defaults to `v2` (`/api/v2/series`). Set to `v1` (`/api/v1/series`) only if you need to
+			fall back to the legacy endpoint.
+			"""
+		required: false
+		type: string: {
+			default: "v2"
+			enum: {
+				v1: """
+					Use the v1 series endpoint (`/api/v1/series`).
+
+					This is a legacy endpoint. Prefer `v2` unless you have a specific reason to use v1.
+					"""
+				v2: """
+					Use the v2 series endpoint (`/api/v2/series`).
+
+					This is the recommended and default endpoint.
+					"""
+			}
+		}
+	}
 	site: {
 		description: """
 			The Datadog [site][dd_site] to send observability data to.

From 1444b2bac009aa51343820dba7a36ce119dce56f Mon Sep 17 00:00:00 2001
From: zapdos26 <zapdos26@users.noreply.github.com>
Date: Tue, 17 Mar 2026 14:44:09 -0400
Subject: [PATCH 018/326] chore(deps): Bump rdkafka from 0.38.0 to 0.39.0
 (#24602)

* Update rdkafka to 0.39.0

* Update 3rd party license CSV

* Update licenses

* Add libsasl2 MacOS intructions

* Fix spellcheck

* Fix markdown

* Improve docs

---------

Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 .github/actions/spelling/allow.txt |  4 ++++
 Cargo.lock                         |  8 ++++----
 Cargo.toml                         |  2 +-
 docs/DEVELOPING.md                 | 13 +++++++++++++
 4 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index 2672ed4c357b7..2e594047a89a2 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -562,6 +562,10 @@ zstandard
 ZTE
 Zync
 sighup
+CPPFLAGS
+LDFLAGS
+libsasl
+pkgconfig
 CLAUDE
 linting
 lexers
diff --git a/Cargo.lock b/Cargo.lock
index 08becf0e3552c..3db4f718a1aaf 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8930,9 +8930,9 @@ dependencies = [
 
 [[package]]
 name = "rdkafka"
-version = "0.38.0"
+version = "0.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f1856d72dbbbea0d2a5b2eaf6af7fb3847ef2746e883b11781446a51dbc85c0"
+checksum = "d7956f9ac12b5712e50372d9749a3102f4810a8d42481c5eae3748d36d585bcf"
 dependencies = [
  "futures-channel",
  "futures-util",
@@ -8948,9 +8948,9 @@ dependencies = [
 
 [[package]]
 name = "rdkafka-sys"
-version = "4.9.0+2.10.0"
+version = "4.10.0+2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5230dca48bc354d718269f3e4353280e188b610f7af7e2fcf54b7a79d5802872"
+checksum = "e234cf318915c1059d4921ef7f75616b5219b10b46e9f3a511a15eb4b56a3f77"
 dependencies = [
  "cmake",
  "curl-sys",
diff --git a/Cargo.toml b/Cargo.toml
index 86f06951af994..b4565050babe5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -419,7 +419,7 @@ pulsar = { version = "6.7.0", default-features = false, features = ["tokio-runti
 quick-junit = { version = "0.5.1" }
 rand.workspace = true
 rand_distr.workspace = true
-rdkafka = { version = "0.38.0", default-features = false, features = ["curl-static", "tokio", "libz", "ssl", "zstd"], optional = true }
+rdkafka = { version = "0.39.0", default-features = false, features = ["curl-static", "tokio", "libz", "ssl", "zstd"], optional = true }
 redis = { version = "0.32.4", default-features = false, features = ["connection-manager", "sentinel", "tokio-comp", "tokio-native-tls-comp"], optional = true }
 regex.workspace = true
 roaring = { version = "0.11.2", default-features = false, features = ["std"], optional = true }
diff --git a/docs/DEVELOPING.md b/docs/DEVELOPING.md
index d286c9feca343..63633d2bdac7b 100644
--- a/docs/DEVELOPING.md
+++ b/docs/DEVELOPING.md
@@ -123,6 +123,19 @@ To build Vector on your own host will require a fairly complete development envi
 Loosely, you'll need the following:
 
 - **To build Vector:** Have working Rustup, Protobuf tools, C++/C build tools (LLVM, GCC, or MSVC), Python, and Perl, `make` (the GNU one preferably), `bash`, `cmake`, `GNU coreutils`, and `autotools`.
+  - You may also need to install `libsasl2` if you are compiling with default features or with any `kafka`-related features.
+    - Installing libsasl2 on Ubuntu
+      - Run `sudo apt-get install -y libsasl2-dev`
+    - Installing libsasl2 on MacOS
+      - Run `brew install cyrus-sasl`
+      - You will need to set the following environment variables:
+
+        ```bash
+        export LDFLAGS="-L$(brew --prefix cyrus-sasl)/lib $LDFLAGS"
+        export CPPFLAGS="-I$(brew --prefix cyrus-sasl)/include $CPPFLAGS"
+        export PKG_CONFIG_PATH="$(brew --prefix cyrus-sasl)/lib/pkgconfig:$PKG_CONFIG_PATH"
+        ```
+
 - **To run `make test`:** Install [`cargo-nextest`](https://nexte.st/)
 - **To run integration tests:** Have `docker` available, or a real live version of that service. (Use `AUTOSPAWN=false`)
 - **To run `make check-component-features`:** Have `remarshal` installed.

From 089db6775500eb6cbdfa5f4b7e6069185a8d61c5 Mon Sep 17 00:00:00 2001
From: Naoki Aoyama <9667078+naa0yama@users.noreply.github.com>
Date: Wed, 18 Mar 2026 03:45:28 +0900
Subject: [PATCH 019/326] feat(enrichment tables): add `network` CIDR field to
 lookup results (#24576)

* feat(geoip enrichment table): add network CIDR field to lookup results (#24411)

* chore: add changelog fragment for #24411

* docs(geoip enrichment table): add network and Anonymous-IP fields to ENRICHMENT_TABLE_EXPLAINER (#24411)

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 .../24411_geoip_network_field.enhancement.md  |  3 ++
 .../find_enrichment_table_records.json        |  2 +-
 .../get_enrichment_table_record.json          |  2 +-
 lib/vector-vrl/enrichment/src/lib.rs          | 12 ++++++++
 src/enrichment_tables/geoip.rs                | 29 +++++++++++++++----
 5 files changed, 40 insertions(+), 8 deletions(-)
 create mode 100644 changelog.d/24411_geoip_network_field.enhancement.md

diff --git a/changelog.d/24411_geoip_network_field.enhancement.md b/changelog.d/24411_geoip_network_field.enhancement.md
new file mode 100644
index 0000000000000..65d33f50f6b1b
--- /dev/null
+++ b/changelog.d/24411_geoip_network_field.enhancement.md
@@ -0,0 +1,3 @@
+The `geoip` enrichment table now includes a `network` field containing the CIDR network associated with the lookup result, available for all database types (City, ISP/ASN, Connection-Type, Anonymous-IP).
+
+authors: naa0yama
diff --git a/docs/generated/find_enrichment_table_records.json b/docs/generated/find_enrichment_table_records.json
index 105c16d7ca3bd..52840357ad746 100644
--- a/docs/generated/find_enrichment_table_records.json
+++ b/docs/generated/find_enrichment_table_records.json
@@ -2,7 +2,7 @@
   "anchor": "find_enrichment_table_records",
   "name": "find_enrichment_table_records",
   "category": "Enrichment",
-  "description": "Searches an [enrichment table](/docs/reference/glossary/#enrichment-tables) for rows that match the provided condition.\n\nFor `file` enrichment tables, this condition needs to be a VRL object in which\nthe key-value pairs indicate a field to search mapped to a value to search in that field.\nThis function returns the rows that match the provided condition(s). _All_ fields need to\nmatch for rows to be returned; if any fields do not match, then no rows are returned.\n\nThere are three forms of search criteria:\n\n1. **Exact match search**. The given field must match the value exactly. Case sensitivity\n   can be specified using the `case_sensitive` argument. An exact match search can use an\n   index directly into the dataset, which should make this search fairly \"cheap\" from a\n   performance perspective.\n\n2. **Wildcard match search**. The given fields specified by the exact match search may also\n    be matched exactly to the value provided to the `wildcard` parameter.\n    A wildcard match search can also use an index directly into the dataset.\n\n3. **Date range search**. The given field must be greater than or equal to the `from` date\n   and/or less than or equal to the `to` date. A date range search involves\n   sequentially scanning through the rows that have been located using any exact match\n   criteria. This can be an expensive operation if there are many rows returned by any exact\n   match criteria. Therefore, use date ranges as the _only_ criteria when the enrichment\n   data set is very small.\n\nFor `geoip` and `mmdb` enrichment tables, this condition needs to be a VRL object with a single key-value pair\nwhose value needs to be a valid IP address. Example: `{\"ip\": .ip }`. If a return field is expected\nand without a value, `null` is used. This table can return the following fields:\n\n* ISP databases:\n    * `autonomous_system_number`\n    * `autonomous_system_organization`\n    * `isp`\n    * `organization`\n\n* City databases:\n    * `city_name`\n    * `continent_code`\n    * `country_code`\n    * `country_name`\n    * `region_code`\n    * `region_name`\n    * `metro_code`\n    * `latitude`\n    * `longitude`\n    * `postal_code`\n    * `timezone`\n\n* Connection-Type databases:\n    * `connection_type`\n\nTo use this function, you need to update your configuration to\ninclude an\n[`enrichment_tables`](/docs/reference/configuration/global-options/#enrichment_tables)\nparameter.",
+  "description": "Searches an [enrichment table](/docs/reference/glossary/#enrichment-tables) for rows that match the provided condition.\n\nFor `file` enrichment tables, this condition needs to be a VRL object in which\nthe key-value pairs indicate a field to search mapped to a value to search in that field.\nThis function returns the rows that match the provided condition(s). _All_ fields need to\nmatch for rows to be returned; if any fields do not match, then no rows are returned.\n\nThere are three forms of search criteria:\n\n1. **Exact match search**. The given field must match the value exactly. Case sensitivity\n   can be specified using the `case_sensitive` argument. An exact match search can use an\n   index directly into the dataset, which should make this search fairly \"cheap\" from a\n   performance perspective.\n\n2. **Wildcard match search**. The given fields specified by the exact match search may also\n    be matched exactly to the value provided to the `wildcard` parameter.\n    A wildcard match search can also use an index directly into the dataset.\n\n3. **Date range search**. The given field must be greater than or equal to the `from` date\n   and/or less than or equal to the `to` date. A date range search involves\n   sequentially scanning through the rows that have been located using any exact match\n   criteria. This can be an expensive operation if there are many rows returned by any exact\n   match criteria. Therefore, use date ranges as the _only_ criteria when the enrichment\n   data set is very small.\n\nFor `geoip` and `mmdb` enrichment tables, this condition needs to be a VRL object with a single key-value pair\nwhose value needs to be a valid IP address. Example: `{\"ip\": .ip }`. If a return field is expected\nand without a value, `null` is used. This table can return the following fields:\n\n* ISP databases:\n    * `autonomous_system_number`\n    * `autonomous_system_organization`\n    * `isp`\n    * `organization`\n    * `network`\n\n* City databases:\n    * `city_name`\n    * `continent_code`\n    * `country_code`\n    * `country_name`\n    * `region_code`\n    * `region_name`\n    * `metro_code`\n    * `latitude`\n    * `longitude`\n    * `postal_code`\n    * `timezone`\n    * `network`\n\n* Connection-Type databases:\n    * `connection_type`\n    * `network`\n\n* Anonymous-IP databases:\n    * `is_anonymous`\n    * `is_anonymous_vpn`\n    * `is_hosting_provider`\n    * `is_public_proxy`\n    * `is_residential_proxy`\n    * `is_tor_exit_node`\n    * `network`\n\nTo use this function, you need to update your configuration to\ninclude an\n[`enrichment_tables`](/docs/reference/configuration/global-options/#enrichment_tables)\nparameter.",
   "arguments": [
     {
       "name": "table",
diff --git a/docs/generated/get_enrichment_table_record.json b/docs/generated/get_enrichment_table_record.json
index 947e8b3e65374..45a49c7606110 100644
--- a/docs/generated/get_enrichment_table_record.json
+++ b/docs/generated/get_enrichment_table_record.json
@@ -2,7 +2,7 @@
   "anchor": "get_enrichment_table_record",
   "name": "get_enrichment_table_record",
   "category": "Enrichment",
-  "description": "Searches an [enrichment table](/docs/reference/glossary/#enrichment-tables) for a row that matches the provided condition. A single row must be matched. If no rows are found or more than one row is found, an error is returned.\n\nFor `file` enrichment tables, this condition needs to be a VRL object in which\nthe key-value pairs indicate a field to search mapped to a value to search in that field.\nThis function returns the rows that match the provided condition(s). _All_ fields need to\nmatch for rows to be returned; if any fields do not match, then no rows are returned.\n\nThere are three forms of search criteria:\n\n1. **Exact match search**. The given field must match the value exactly. Case sensitivity\n   can be specified using the `case_sensitive` argument. An exact match search can use an\n   index directly into the dataset, which should make this search fairly \"cheap\" from a\n   performance perspective.\n\n2. **Wildcard match search**. The given fields specified by the exact match search may also\n    be matched exactly to the value provided to the `wildcard` parameter.\n    A wildcard match search can also use an index directly into the dataset.\n\n3. **Date range search**. The given field must be greater than or equal to the `from` date\n   and/or less than or equal to the `to` date. A date range search involves\n   sequentially scanning through the rows that have been located using any exact match\n   criteria. This can be an expensive operation if there are many rows returned by any exact\n   match criteria. Therefore, use date ranges as the _only_ criteria when the enrichment\n   data set is very small.\n\nFor `geoip` and `mmdb` enrichment tables, this condition needs to be a VRL object with a single key-value pair\nwhose value needs to be a valid IP address. Example: `{\"ip\": .ip }`. If a return field is expected\nand without a value, `null` is used. This table can return the following fields:\n\n* ISP databases:\n    * `autonomous_system_number`\n    * `autonomous_system_organization`\n    * `isp`\n    * `organization`\n\n* City databases:\n    * `city_name`\n    * `continent_code`\n    * `country_code`\n    * `country_name`\n    * `region_code`\n    * `region_name`\n    * `metro_code`\n    * `latitude`\n    * `longitude`\n    * `postal_code`\n    * `timezone`\n\n* Connection-Type databases:\n    * `connection_type`\n\nTo use this function, you need to update your configuration to\ninclude an\n[`enrichment_tables`](/docs/reference/configuration/global-options/#enrichment_tables)\nparameter.",
+  "description": "Searches an [enrichment table](/docs/reference/glossary/#enrichment-tables) for a row that matches the provided condition. A single row must be matched. If no rows are found or more than one row is found, an error is returned.\n\nFor `file` enrichment tables, this condition needs to be a VRL object in which\nthe key-value pairs indicate a field to search mapped to a value to search in that field.\nThis function returns the rows that match the provided condition(s). _All_ fields need to\nmatch for rows to be returned; if any fields do not match, then no rows are returned.\n\nThere are three forms of search criteria:\n\n1. **Exact match search**. The given field must match the value exactly. Case sensitivity\n   can be specified using the `case_sensitive` argument. An exact match search can use an\n   index directly into the dataset, which should make this search fairly \"cheap\" from a\n   performance perspective.\n\n2. **Wildcard match search**. The given fields specified by the exact match search may also\n    be matched exactly to the value provided to the `wildcard` parameter.\n    A wildcard match search can also use an index directly into the dataset.\n\n3. **Date range search**. The given field must be greater than or equal to the `from` date\n   and/or less than or equal to the `to` date. A date range search involves\n   sequentially scanning through the rows that have been located using any exact match\n   criteria. This can be an expensive operation if there are many rows returned by any exact\n   match criteria. Therefore, use date ranges as the _only_ criteria when the enrichment\n   data set is very small.\n\nFor `geoip` and `mmdb` enrichment tables, this condition needs to be a VRL object with a single key-value pair\nwhose value needs to be a valid IP address. Example: `{\"ip\": .ip }`. If a return field is expected\nand without a value, `null` is used. This table can return the following fields:\n\n* ISP databases:\n    * `autonomous_system_number`\n    * `autonomous_system_organization`\n    * `isp`\n    * `organization`\n    * `network`\n\n* City databases:\n    * `city_name`\n    * `continent_code`\n    * `country_code`\n    * `country_name`\n    * `region_code`\n    * `region_name`\n    * `metro_code`\n    * `latitude`\n    * `longitude`\n    * `postal_code`\n    * `timezone`\n    * `network`\n\n* Connection-Type databases:\n    * `connection_type`\n    * `network`\n\n* Anonymous-IP databases:\n    * `is_anonymous`\n    * `is_anonymous_vpn`\n    * `is_hosting_provider`\n    * `is_public_proxy`\n    * `is_residential_proxy`\n    * `is_tor_exit_node`\n    * `network`\n\nTo use this function, you need to update your configuration to\ninclude an\n[`enrichment_tables`](/docs/reference/configuration/global-options/#enrichment_tables)\nparameter.",
   "arguments": [
     {
       "name": "table",
diff --git a/lib/vector-vrl/enrichment/src/lib.rs b/lib/vector-vrl/enrichment/src/lib.rs
index df4575e91f08e..293a5db343d61 100644
--- a/lib/vector-vrl/enrichment/src/lib.rs
+++ b/lib/vector-vrl/enrichment/src/lib.rs
@@ -185,6 +185,7 @@ pub(crate) const ENRICHMENT_TABLE_EXPLAINER: &str = indoc! {r#"
         * `autonomous_system_organization`
         * `isp`
         * `organization`
+        * `network`
 
     * City databases:
         * `city_name`
@@ -198,9 +199,20 @@ pub(crate) const ENRICHMENT_TABLE_EXPLAINER: &str = indoc! {r#"
         * `longitude`
         * `postal_code`
         * `timezone`
+        * `network`
 
     * Connection-Type databases:
         * `connection_type`
+        * `network`
+
+    * Anonymous-IP databases:
+        * `is_anonymous`
+        * `is_anonymous_vpn`
+        * `is_hosting_provider`
+        * `is_public_proxy`
+        * `is_residential_proxy`
+        * `is_tor_exit_node`
+        * `network`
 
     To use this function, you need to update your configuration to
     include an
diff --git a/src/enrichment_tables/geoip.rs b/src/enrichment_tables/geoip.rs
index 782dbe8179afa..6716b4eaf2216 100644
--- a/src/enrichment_tables/geoip.rs
+++ b/src/enrichment_tables/geoip.rs
@@ -118,9 +118,15 @@ pub struct Geoip {
 fn lookup_value<'de, A: Deserialize<'de>>(
     dbreader: &'de Reader<Vec<u8>>,
     address: IpAddr,
-) -> crate::Result<Option<A>> {
+) -> crate::Result<Option<(A, String)>> {
     let result = dbreader.lookup(address)?;
-    Ok(result.decode::<A>()?)
+    match result.decode::<A>()? {
+        Some(data) => {
+            let network = result.network()?.to_string();
+            Ok(Some((data, network)))
+        }
+        None => Ok(None),
+    }
 }
 
 impl Geoip {
@@ -174,7 +180,7 @@ impl Geoip {
 
         match self.dbkind {
             DatabaseKind::Asn | DatabaseKind::Isp => {
-                let data = lookup_value::<Isp>(&self.dbreader, ip).ok()??;
+                let (data, network) = lookup_value::<Isp>(&self.dbreader, ip).ok()??;
 
                 add_field!("autonomous_system_number", data.autonomous_system_number);
                 add_field!(
@@ -183,9 +189,11 @@ impl Geoip {
                 );
                 add_field!("isp", data.isp);
                 add_field!("organization", data.organization);
+                add_field!("network", Some(network));
             }
             DatabaseKind::City => {
-                let data: City = lookup_value::<City>(&self.dbreader, ip).ok()??;
+                let (data, network): (City, String) =
+                    lookup_value::<City>(&self.dbreader, ip).ok()??;
 
                 add_field!("city_name", self.take_translation(&data.city.names));
 
@@ -223,14 +231,16 @@ impl Geoip {
                     subdivision.and_then(|subdivision| subdivision.iso_code)
                 );
                 add_field!("postal_code", data.postal.code);
+                add_field!("network", Some(network));
             }
             DatabaseKind::ConnectionType => {
-                let data = lookup_value::<ConnectionType>(&self.dbreader, ip).ok()??;
+                let (data, network) = lookup_value::<ConnectionType>(&self.dbreader, ip).ok()??;
 
                 add_field!("connection_type", data.connection_type);
+                add_field!("network", Some(network));
             }
             DatabaseKind::AnonymousIp => {
-                let data = lookup_value::<AnonymousIp>(&self.dbreader, ip).ok()??;
+                let (data, network) = lookup_value::<AnonymousIp>(&self.dbreader, ip).ok()??;
 
                 add_field!("is_anonymous", data.is_anonymous);
                 add_field!("is_anonymous_vpn", data.is_anonymous_vpn);
@@ -238,6 +248,7 @@ impl Geoip {
                 add_field!("is_public_proxy", data.is_public_proxy);
                 add_field!("is_residential_proxy", data.is_residential_proxy);
                 add_field!("is_tor_exit_node", data.is_tor_exit_node);
+                add_field!("network", Some(network));
             }
         }
 
@@ -367,6 +378,7 @@ mod tests {
         expected.insert("longitude".into(), Value::from(-1.25));
         expected.insert("postal_code".into(), "OX1".into());
         expected.insert("metro_code".into(), Value::Null);
+        expected.insert("network".into(), "2.125.160.216/29".into());
 
         assert_eq!(values, expected);
     }
@@ -403,6 +415,7 @@ mod tests {
         expected.insert("longitude".into(), Value::from(90.5));
         expected.insert("postal_code".into(), Value::Null);
         expected.insert("metro_code".into(), Value::Null);
+        expected.insert("network".into(), "67.43.156.0/24".into());
 
         assert_eq!(values, expected);
     }
@@ -426,6 +439,7 @@ mod tests {
         );
         expected.insert("isp".into(), "Verizon Business".into());
         expected.insert("organization".into(), "Verizon Business".into());
+        expected.insert("network".into(), "208.192.0.0/10".into());
 
         assert_eq!(values, expected);
     }
@@ -442,6 +456,7 @@ mod tests {
         );
         expected.insert("isp".into(), Value::Null);
         expected.insert("organization".into(), Value::Null);
+        expected.insert("network".into(), "2600:7000::/24".into());
 
         assert_eq!(values, expected);
     }
@@ -463,6 +478,7 @@ mod tests {
 
         let mut expected = ObjectMap::new();
         expected.insert("connection_type".into(), "Corporate".into());
+        expected.insert("network".into(), "201.243.200.0/24".into());
 
         assert_eq!(values, expected);
     }
@@ -494,6 +510,7 @@ mod tests {
         expected.insert("is_tor_exit_node".into(), true.into());
         expected.insert("is_public_proxy".into(), Value::Null);
         expected.insert("is_residential_proxy".into(), Value::Null);
+        expected.insert("network".into(), "101.99.92.179/32".into());
 
         assert_eq!(values, expected);
     }

From 5011c5dfd20a0200c37a42a6c3001ae3df94ef4d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 17 Mar 2026 15:16:34 -0400
Subject: [PATCH 020/326] chore(ci): bump docker/build-push-action from 6.18.0
 to 6.19.2 (#24734)

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.18.0 to 6.19.2.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/263435318d21b8e681c14492fe198d362a7d2c83...10e90e3645eae34f1e60eeb005ba3a3d33f178e8)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 6.19.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/environment.yml | 4 ++--
 .github/workflows/regression.yml  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/environment.yml b/.github/workflows/environment.yml
index 129e4c6612d9b..fce6b25c3c181 100644
--- a/.github/workflows/environment.yml
+++ b/.github/workflows/environment.yml
@@ -69,7 +69,7 @@ jobs:
         run: sudo -E bash scripts/ci-free-disk-space.sh
 
       - name: Build image (no push)
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           file: ./scripts/environment/Dockerfile
@@ -89,7 +89,7 @@ jobs:
 
       - name: Push image
         if: env.SHOULD_PUBLISH == 'true'
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           file: ./scripts/environment/Dockerfile
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 2621118a9df11..89a28f5121360 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -212,7 +212,7 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build 'vector' target image
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: baseline-vector/
           cache-from: type=gha
@@ -255,7 +255,7 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build 'vector' target image
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: comparison-vector/
           cache-from: type=gha

From 6527346294203cec7fb0d8b86c7fc98b26c14ff0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 17 Mar 2026 19:17:07 +0000
Subject: [PATCH 021/326] chore(ci): bump aws-actions/configure-aws-credentials
 from 5.1.1 to 6.0.0 (#24733)

chore(ci): bump aws-actions/configure-aws-credentials

Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 5.1.1 to 6.0.0.
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/61815dcd50bd041e203e49132bacad1fd04d2708...8df5847569e6427dd6c4fb1cf565c83acfa8afa7)

---
updated-dependencies:
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/regression.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 89a28f5121360..a8c6981e53a9d 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -281,7 +281,7 @@ jobs:
       - resolve-inputs
     steps:
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
           aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
@@ -315,7 +315,7 @@ jobs:
           docker load --input baseline-image.tar
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
           aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
@@ -355,7 +355,7 @@ jobs:
           docker load --input comparison-image.tar
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
           aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
@@ -394,7 +394,7 @@ jobs:
           ref: ${{ needs.resolve-inputs.outputs.comparison-sha }}
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
           aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
@@ -467,7 +467,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
           aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
@@ -510,7 +510,7 @@ jobs:
           ref: ${{ needs.resolve-inputs.outputs.comparison-sha }}
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
           aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}

From b1a43a4ba24b0e76e57736953a0f6f9d0ee58328 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 17 Mar 2026 20:52:26 +0000
Subject: [PATCH 022/326] chore(deps): bump sysinfo from 0.37.2 to 0.38.2
 (#24816)

* chore(deps): bump sysinfo from 0.37.2 to 0.38.2

Bumps [sysinfo](https://github.com/GuillaumeGomez/sysinfo) from 0.37.2 to 0.38.2.
- [Changelog](https://github.com/GuillaumeGomez/sysinfo/blob/main/CHANGELOG.md)
- [Commits](https://github.com/GuillaumeGomez/sysinfo/compare/v0.37.2...v0.38.2)

---
updated-dependencies:
- dependency-name: sysinfo
  dependency-version: 0.38.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* update licenses

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 Cargo.lock           | 97 ++++++++++++++++++++++++++------------------
 LICENSE-3rdparty.csv |  3 ++
 2 files changed, 61 insertions(+), 39 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3db4f718a1aaf..f19fbc7c50f2c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7397,18 +7397,18 @@ dependencies = [
 
 [[package]]
 name = "objc2-core-foundation"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c10c2894a6fed806ade6027bcd50662746363a9589d3ec9d9bef30a4e4bc166"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
  "bitflags 2.10.0",
 ]
 
 [[package]]
 name = "objc2-io-kit"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71c1c64d6120e51cd86033f67176b1cb66780c2efe34dec55176f77befd93c0a"
+checksum = "33fafba39597d6dc1fb709123dfa8289d39406734be322956a69f0931c73bb15"
 dependencies = [
  "libc",
  "objc2-core-foundation",
@@ -10897,7 +10897,7 @@ dependencies = [
  "ntapi 0.4.1",
  "objc2-core-foundation",
  "objc2-io-kit",
- "windows 0.60.0",
+ "windows 0.61.3",
 ]
 
 [[package]]
@@ -13463,24 +13463,24 @@ dependencies = [
 
 [[package]]
 name = "windows"
-version = "0.60.0"
+version = "0.61.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddf874e74c7a99773e62b1c671427abf01a425e77c3d3fb9fb1e4883ea934529"
+checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
 dependencies = [
  "windows-collections",
- "windows-core 0.60.1",
+ "windows-core 0.61.2",
  "windows-future",
- "windows-link 0.1.0",
+ "windows-link 0.1.3",
  "windows-numerics",
 ]
 
 [[package]]
 name = "windows-collections"
-version = "0.1.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5467f79cc1ba3f52ebb2ed41dbb459b8e7db636cc3429458d9a852e15bc24dec"
+checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
 dependencies = [
- "windows-core 0.60.1",
+ "windows-core 0.61.2",
 ]
 
 [[package]]
@@ -13507,25 +13507,26 @@ dependencies = [
 
 [[package]]
 name = "windows-core"
-version = "0.60.1"
+version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca21a92a9cae9bf4ccae5cf8368dce0837100ddf6e6d57936749e85f152f6247"
+checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
 dependencies = [
- "windows-implement 0.59.0",
- "windows-interface 0.59.1",
- "windows-link 0.1.0",
- "windows-result 0.3.1",
- "windows-strings 0.3.1",
+ "windows-implement 0.60.2",
+ "windows-interface 0.59.3",
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
 ]
 
 [[package]]
 name = "windows-future"
-version = "0.1.1"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a787db4595e7eb80239b74ce8babfb1363d8e343ab072f2ffe901400c03349f0"
+checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
 dependencies = [
- "windows-core 0.60.1",
- "windows-link 0.1.0",
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+ "windows-threading",
 ]
 
 [[package]]
@@ -13541,9 +13542,9 @@ dependencies = [
 
 [[package]]
 name = "windows-implement"
-version = "0.59.0"
+version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83577b051e2f49a058c308f17f273b570a6a758386fc291b5f6a934dd84e48c1"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.44",
@@ -13563,9 +13564,9 @@ dependencies = [
 
 [[package]]
 name = "windows-interface"
-version = "0.59.1"
+version = "0.59.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.44",
@@ -13574,9 +13575,9 @@ dependencies = [
 
 [[package]]
 name = "windows-link"
-version = "0.1.0"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dccfd733ce2b1753b03b6d3c65edf020262ea35e20ccdf3e288043e6dd620e3"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
 
 [[package]]
 name = "windows-link"
@@ -13586,12 +13587,12 @@ checksum = "45e46c0661abb7180e7b9c281db115305d49ca1709ab8242adf09666d2173c65"
 
 [[package]]
 name = "windows-numerics"
-version = "0.1.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "005dea54e2f6499f2cee279b8f703b3cf3b5734a2d8d21867c8f44003182eeed"
+checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
 dependencies = [
- "windows-core 0.60.1",
- "windows-link 0.1.0",
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
 ]
 
 [[package]]
@@ -13600,8 +13601,8 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c44a98275e31bfd112bb06ba96c8ab13c03383a3753fdddd715406a1824c7e0"
 dependencies = [
- "windows-link 0.1.0",
- "windows-result 0.3.1",
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
  "windows-strings 0.3.1",
 ]
 
@@ -13616,11 +13617,11 @@ dependencies = [
 
 [[package]]
 name = "windows-result"
-version = "0.3.1"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06374efe858fab7e4f881500e6e86ec8bc28f9462c47e5a9941a0142ad86b189"
+checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
 dependencies = [
- "windows-link 0.1.0",
+ "windows-link 0.1.3",
 ]
 
 [[package]]
@@ -13650,7 +13651,16 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "87fa48cc5d406560701792be122a10132491cff9d0aeb23583cc2dcafc847319"
 dependencies = [
- "windows-link 0.1.0",
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
+dependencies = [
+ "windows-link 0.1.3",
 ]
 
 [[package]]
@@ -13769,6 +13779,15 @@ dependencies = [
  "windows_x86_64_msvc 0.53.0",
 ]
 
+[[package]]
+name = "windows-threading"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.42.2"
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 09e39573c8126..2079e5d6819ba 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -888,7 +888,9 @@ windows-collections,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Th
 windows-core,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
 windows-future,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,The windows-future Authors
 windows-implement,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
+windows-implement,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,The windows-implement Authors
 windows-interface,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
+windows-interface,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,The windows-interface Authors
 windows-link,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
 windows-link,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,The windows-link Authors
 windows-numerics,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,The windows-numerics Authors
@@ -899,6 +901,7 @@ windows-strings,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Micros
 windows-sys,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
 windows-sys,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,The windows-sys Authors
 windows-targets,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
+windows-threading,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
 windows_aarch64_gnullvm,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
 windows_aarch64_msvc,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
 windows_i686_gnu,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft

From cfee4fb9d1853a5ae7db85e0bd5647ca7a7b57b0 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 17 Mar 2026 16:54:19 -0400
Subject: [PATCH 023/326] chore(deps): upgrade mold linker from 1.2.1/2.0.0 to
 2.40.4 (#24947)

---
 .github/actions/setup/action.yml              | 2 +-
 scripts/environment/bootstrap-ubuntu-24.04.sh | 2 +-
 tilt/Dockerfile                               | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 8dbb5416de92f..3d70368bac027 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -182,7 +182,7 @@ runs:
         # We explicitly put `mold-wrapper.so` right beside `mold` itself because it's hard-coded to look in the same directory
         # first when trying to load the shared object, so we can dodge having to care about the "right" lib folder to put it in.
         TEMP=$(mktemp -d)
-        MOLD_VERSION=1.2.1
+        MOLD_VERSION=2.40.4
         MOLD_TARGET=mold-${MOLD_VERSION}-$(uname -m)-linux
         curl -fsSL "https://github.com/rui314/mold/releases/download/v${MOLD_VERSION}/${MOLD_TARGET}.tar.gz" \
         --output "$TEMP/${MOLD_TARGET}.tar.gz"
diff --git a/scripts/environment/bootstrap-ubuntu-24.04.sh b/scripts/environment/bootstrap-ubuntu-24.04.sh
index 5e59d383dbc1a..9d135f779b933 100755
--- a/scripts/environment/bootstrap-ubuntu-24.04.sh
+++ b/scripts/environment/bootstrap-ubuntu-24.04.sh
@@ -145,7 +145,7 @@ if [ -z "${DISABLE_MOLD:-""}" ] ; then
     # We explicitly put `mold-wrapper.so` right beside `mold` itself because it's hard-coded to look in the same directory
     # first when trying to load the shared object, so we can dodge having to care about the "right" lib folder to put it in.
     TEMP=$(mktemp -d)
-    MOLD_VERSION=1.2.1
+    MOLD_VERSION=2.40.4
     MOLD_TARGET=mold-${MOLD_VERSION}-$(uname -m)-linux
     curl -fsSL "https://github.com/rui314/mold/releases/download/v${MOLD_VERSION}/${MOLD_TARGET}.tar.gz" \
         --output "$TEMP/${MOLD_TARGET}.tar.gz"
diff --git a/tilt/Dockerfile b/tilt/Dockerfile
index cbf78acf36bf4..f8c1b1df1cabd 100644
--- a/tilt/Dockerfile
+++ b/tilt/Dockerfile
@@ -11,7 +11,7 @@ RUN apt-get update && apt-get -y --no-install-recommends install build-essential
 RUN git clone https://github.com/rui314/mold.git \
     && mkdir mold/build \
     && cd mold/build \
-    && git checkout v2.0.0 \
+    && git checkout v2.40.4 \
     && ../install-build-deps.sh \
     && cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_COMPILER=c++ .. \
     && cmake --build . -j $(nproc) \

From fbb1e4b501d6081d72f864da891a98464e60d097 Mon Sep 17 00:00:00 2001
From: Bruce Guenter <bruce.guenter@datadoghq.com>
Date: Tue, 17 Mar 2026 18:05:08 -0600
Subject: [PATCH 024/326] fix(buffers): Improve buffer utilization metric
 tracking (#24911)

The buffer usage metrics, in particular the value of the current utilization
levels, were tracked using an atomic `u64` which was updated using a
`fetch_update` mechanism in order to protect against underflowing. This same
mechanism was extended to all of the atomics as well for consistency. The
problem with that is that `fetch_udpate` internally uses a loop around a
`compare-and-exchange` operation which is very expensive, particularly when
contended. In comparison, the base `fetch_add` is typically a single locked
instruction which completes in many fewer cycles.

This change returns these atomics to only ever use `fetch_add` and then
calculate the current level by subtracting the count of increments from the
count of decrements. This improves correctness by avoiding problems around
underflow as well as optimizing performace (very slightly).
---
 ...-buffer-utilization-metric-tracking.fix.md |   3 +
 lib/vector-buffers/src/buffer_usage_data.rs   | 158 +++++++-----------
 2 files changed, 66 insertions(+), 95 deletions(-)
 create mode 100644 changelog.d/24911-buffer-utilization-metric-tracking.fix.md

diff --git a/changelog.d/24911-buffer-utilization-metric-tracking.fix.md b/changelog.d/24911-buffer-utilization-metric-tracking.fix.md
new file mode 100644
index 0000000000000..fd1c23e5414b6
--- /dev/null
+++ b/changelog.d/24911-buffer-utilization-metric-tracking.fix.md
@@ -0,0 +1,3 @@
+Fixed regression in buffer utilization metric tracking around underflow.
+
+authors: bruceg
diff --git a/lib/vector-buffers/src/buffer_usage_data.rs b/lib/vector-buffers/src/buffer_usage_data.rs
index 61bda12f91160..ce7a67648db3d 100644
--- a/lib/vector-buffers/src/buffer_usage_data.rs
+++ b/lib/vector-buffers/src/buffer_usage_data.rs
@@ -19,34 +19,6 @@ use crate::{
 /// always used a "relaxed" ordering when updating them.
 const ORDERING: Ordering = Ordering::Relaxed;
 
-fn increment_counter(counter: &AtomicU64, delta: u64) {
-    counter
-        .fetch_update(ORDERING, ORDERING, |current| {
-            Some(current.checked_add(delta).unwrap_or_else(|| {
-                warn!(
-                    current,
-                    delta, "Buffer counter overflowed. Clamping value to `u64::MAX`."
-                );
-                u64::MAX
-            }))
-        })
-        .ok();
-}
-
-fn decrement_counter(counter: &AtomicU64, delta: u64) {
-    counter
-        .fetch_update(ORDERING, ORDERING, |current| {
-            Some(current.checked_sub(delta).unwrap_or_else(|| {
-                warn!(
-                    current,
-                    delta, "Buffer counter underflowed. Clamping value to `0`."
-                );
-                0
-            }))
-        })
-        .ok();
-}
-
 /// Snapshot of category metrics.
 struct CategorySnapshot {
     event_count: u64,
@@ -62,10 +34,15 @@ impl CategorySnapshot {
 
 /// Per-category metrics.
 ///
-/// This tracks the number of events, and their size in the buffer, that a given category has interacted with. A
-/// category in this case could be something like the receive or send categories i.e. being written into the buffer, and
-/// then read out of the buffer. Overall, it's a simple grouping mechanism because we often want to track the change in
-/// both number of events, and their size as measured by the buffer.
+/// This tracks the number of events, and their size in the buffer, that a given category has
+/// interacted with. A category in this case could be something like the receive or send categories
+/// i.e. being written into the buffer, and then read out of the buffer. Overall, it's a simple
+/// grouping mechanism because we often want to track the change in both number of events, and their
+/// size as measured by the buffer.
+///
+///  At a sustained 1 GiB/sec, which is still faster than Vector can currently achieve, a `u64` byte
+///  counter would take over 500 years to overflow. As such, we don't handle failures due to
+///  overflow as it is effectively impossible.
 #[derive(Debug, Default)]
 struct CategoryMetrics {
     event_count: AtomicU64,
@@ -75,14 +52,8 @@ struct CategoryMetrics {
 impl CategoryMetrics {
     /// Increments the event count and byte size by the given amounts.
     fn increment(&self, event_count: u64, event_byte_size: u64) {
-        increment_counter(&self.event_count, event_count);
-        increment_counter(&self.event_byte_size, event_byte_size);
-    }
-
-    /// Decrements the event count and byte size by the given amounts.
-    fn decrement(&self, event_count: u64, event_byte_size: u64) {
-        decrement_counter(&self.event_count, event_count);
-        decrement_counter(&self.event_byte_size, event_byte_size);
+        self.event_count.fetch_add(event_count, ORDERING);
+        self.event_byte_size.fetch_add(event_byte_size, ORDERING);
     }
 
     /// Sets the event count and event byte size to the given amount.
@@ -115,6 +86,41 @@ impl CategoryMetrics {
     }
 }
 
+/// `CurrentMetrics` is a wrapper around a pair of `CategoryMetrics` that are used to track a
+/// "current" value that may increment or decrement. The challenge this solves is that the
+/// increments and decrements may race and result in underflows that are hard to handle using only
+/// efficient atomic operations. By tracking the increments and decrements separately, we can ensure
+/// that the current value is always accurate even if the increments and decrements race.
+#[derive(Debug, Default)]
+struct CurrentMetrics {
+    increments: CategoryMetrics,
+    decrements: CategoryMetrics,
+}
+
+impl CurrentMetrics {
+    fn increment(&self, event_count: u64, event_byte_size: u64) {
+        self.increments.increment(event_count, event_byte_size);
+    }
+
+    fn decrement(&self, event_count: u64, event_byte_size: u64) {
+        self.decrements.increment(event_count, event_byte_size);
+    }
+
+    fn get(&self) -> CategorySnapshot {
+        let entered_total = self.increments.get();
+        let left_total = self.decrements.get();
+
+        CategorySnapshot {
+            event_count: entered_total
+                .event_count
+                .saturating_sub(left_total.event_count),
+            event_byte_size: entered_total
+                .event_byte_size
+                .saturating_sub(left_total.event_byte_size),
+        }
+    }
+}
+
 /// Handle to buffer usage metrics for a specific buffer stage.
 #[derive(Clone, Debug)]
 pub struct BufferUsageHandle {
@@ -195,7 +201,7 @@ struct BufferUsageData {
     dropped: CategoryMetrics,
     dropped_intentional: CategoryMetrics,
     max_size: CategoryMetrics,
-    current: CategoryMetrics,
+    current: CurrentMetrics,
 }
 
 impl BufferUsageData {
@@ -372,68 +378,30 @@ impl BufferUsage {
 
 #[cfg(test)]
 mod tests {
-    use std::thread;
-
     use super::*;
 
     #[test]
-    fn test_multithreaded_updates_are_correct() {
-        const NUM_THREADS: u64 = 16;
-        const INCREMENTS_PER_THREAD: u64 = 10_000;
-
-        let counter = Arc::new(AtomicU64::new(0));
-
-        let mut handles = vec![];
-
-        for _ in 0..NUM_THREADS {
-            let counter = Arc::clone(&counter);
-            let handle = thread::spawn(move || {
-                for _ in 0..INCREMENTS_PER_THREAD {
-                    increment_counter(&counter, 1);
-                    decrement_counter(&counter, 1);
-                }
-            });
-            handles.push(handle);
-        }
-
-        for handle in handles {
-            handle.join().unwrap();
-        }
-
-        assert_eq!(counter.load(ORDERING), 0);
-    }
-
-    #[test]
-    fn test_decrement_counter_prevents_negatives() {
-        let counter = AtomicU64::new(100);
-
-        decrement_counter(&counter, 50);
-        assert_eq!(counter.load(ORDERING), 50);
-
-        decrement_counter(&counter, 100);
-        assert_eq!(counter.load(ORDERING), 0);
+    fn current_usage_is_derived_from_entered_and_left_totals() {
+        let handle = BufferUsageHandle {
+            state: Arc::new(BufferUsageData::new(0)),
+        };
 
-        decrement_counter(&counter, 50);
-        assert_eq!(counter.load(ORDERING), 0);
+        handle.increment_received_event_count_and_byte_size(10, 1000);
+        handle.increment_sent_event_count_and_byte_size(3, 300);
+        handle.increment_dropped_event_count_and_byte_size(2, 200, false);
 
-        decrement_counter(&counter, u64::MAX);
-        assert_eq!(counter.load(ORDERING), 0);
+        let current = handle.state.current.get();
+        assert_eq!(current.event_count, 5);
+        assert_eq!(current.event_byte_size, 500);
     }
 
     #[test]
-    fn test_increment_counter_prevents_overflow() {
-        let counter = AtomicU64::new(u64::MAX - 2);
-
-        increment_counter(&counter, 1);
-        assert_eq!(counter.load(ORDERING), u64::MAX - 1);
-
-        increment_counter(&counter, 1);
-        assert_eq!(counter.load(ORDERING), u64::MAX);
-
-        increment_counter(&counter, 1);
-        assert_eq!(counter.load(ORDERING), u64::MAX);
+    fn current_usage_saturates_at_zero() {
+        let data = BufferUsageData::new(0);
+        data.current.decrement(10, 1000);
 
-        increment_counter(&counter, u64::MAX);
-        assert_eq!(counter.load(ORDERING), u64::MAX);
+        let current = data.current.get();
+        assert_eq!(current.event_count, 0);
+        assert_eq!(current.event_byte_size, 0);
     }
 }

From 95f439420ae1dea0df7fbd295e7f354b144360c8 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 18 Mar 2026 10:25:48 -0400
Subject: [PATCH 025/326] fix(api): place per-output sent events in Events Out
 column (#24951)

* fix(top): place per-output sent events in Events Out column

Output sub-rows for components with multiple output ports (e.g. route
transforms with `_unmatched`, `success` outputs) were placing the
per-output sent events metric in column index 5 (Bytes In) instead of
column index 6 (Events Out).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* add scopes

* changelog: add entry for PR #24951

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix name

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/semantic.yml                 | 6 ++++--
 changelog.d/24951_top_events_out_column.fix.md | 3 +++
 lib/vector-top/src/dashboard.rs                | 2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)
 create mode 100644 changelog.d/24951_top_events_out_column.fix.md

diff --git a/.github/workflows/semantic.yml b/.github/workflows/semantic.yml
index f873f32108c5c..79a36a94ec7cf 100644
--- a/.github/workflows/semantic.yml
+++ b/.github/workflows/semantic.yml
@@ -15,8 +15,8 @@ permissions:
 jobs:
   main:
     permissions:
-      pull-requests: read  # for amannn/action-semantic-pull-request to analyze PRs
-      statuses: write  # for amannn/action-semantic-pull-request to mark status of analyzed PR
+      pull-requests: read # for amannn/action-semantic-pull-request to analyze PRs
+      statuses: write # for amannn/action-semantic-pull-request to mark status of analyzed PR
     name: Check Semantic PR
     runs-on: ubuntu-24.04
     steps:
@@ -36,6 +36,8 @@ jobs:
           scopes: |
             administration
             api
+            api top
+            api tap
             ARC
             architecture
             auth
diff --git a/changelog.d/24951_top_events_out_column.fix.md b/changelog.d/24951_top_events_out_column.fix.md
new file mode 100644
index 0000000000000..e4191569cc205
--- /dev/null
+++ b/changelog.d/24951_top_events_out_column.fix.md
@@ -0,0 +1,3 @@
+Fixed `vector top` displaying per-output sent events in the wrong column (Bytes In instead of Events Out) for components with multiple output ports.
+
+authors: pront
diff --git a/lib/vector-top/src/dashboard.rs b/lib/vector-top/src/dashboard.rs
index c4078ebde6afb..1b73d5b89e9c8 100644
--- a/lib/vector-top/src/dashboard.rs
+++ b/lib/vector-top/src/dashboard.rs
@@ -373,7 +373,7 @@ impl<'a> Widgets<'a> {
                         .map(Cell::from)
                         .collect::<Vec<_>>();
                     data[1] = Cell::from(id.as_str());
-                    data[5] = Cell::from(sent_events_metric);
+                    data[6] = Cell::from(sent_events_metric);
                     items.push(Row::new(data).style(Style::default()));
                 }
             }

From 30936678f92a03c827f9fd8506fa02693332f59b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ensar=20Saraj=C4=8Di=C4=87?= <dev@ensarsarajcic.com>
Date: Wed, 18 Mar 2026 19:34:43 +0100
Subject: [PATCH 026/326] feat(cli): add support for edge_attributes in graph
 configuration (#24593)

* feat(cli): add support for edge_attributes in graph configuration

Closes: #24591

* Add changelog entry

* feat(cli): include memory enrichment tables in graph output

* feat(cli): add memory enrichment tables in graph mermaid output

* Generate docs

* Inline id

* Use whole `OutputId` as key in edge_attributes

* Fallback to just component name if port is not present in edge_attributes

* Generate component docs
---
 .../24593_graph_edge_attributes.feature.md    |   3 +
 src/config/dot_graph.rs                       |  41 ++-
 src/graph.rs                                  | 139 ++++++++--
 .../reference/components/generated/sinks.cue  |  69 +++--
 .../components/generated/sources.cue          |  67 +++--
 .../components/generated/transforms.cue       |  67 +++--
 .../cue/reference/generated/configuration.cue | 244 ++++++++++++++----
 7 files changed, 505 insertions(+), 125 deletions(-)
 create mode 100644 changelog.d/24593_graph_edge_attributes.feature.md

diff --git a/changelog.d/24593_graph_edge_attributes.feature.md b/changelog.d/24593_graph_edge_attributes.feature.md
new file mode 100644
index 0000000000000..719cbc6b4635a
--- /dev/null
+++ b/changelog.d/24593_graph_edge_attributes.feature.md
@@ -0,0 +1,3 @@
+`graph.edge_attributes` can now be added to transforms and sinks to add attributes to edges in graphs generated using `vector graph`. Memory enrichment tables are also considered for graphs, because they can have inputs and outputs.
+
+authors: esensar Quad9DNS
diff --git a/src/config/dot_graph.rs b/src/config/dot_graph.rs
index 0d3d7ca1e4900..a006837cf672f 100644
--- a/src/config/dot_graph.rs
+++ b/src/config/dot_graph.rs
@@ -15,15 +15,52 @@ pub struct GraphConfig {
     /// They are added to the node as provided
     #[configurable(metadata(
         docs::additional_props_description = "A single graph node attribute in graphviz DOT language.",
-        docs::examples = "example_graph_options()"
+        docs::examples = "example_node_options()"
     ))]
+    #[serde(default)]
     pub node_attributes: HashMap<String, String>,
+
+    /// Edge attributes to add to the edges linked to this component's node in resulting graph
+    ///
+    /// They are added to the edge as provided
+    #[configurable(metadata(
+        docs::additional_props_description = "A collection of graph edge attributes in graphviz DOT language, related to a single input component.",
+        docs::examples = "example_edges_options()"
+    ))]
+    #[serde(default)]
+    pub edge_attributes: HashMap<String, EdgeAttributes>,
 }
 
-fn example_graph_options() -> HashMap<String, String> {
+#[configurable_component]
+#[configurable(metadata(docs::advanced))]
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+#[serde(deny_unknown_fields)]
+/// A collection of graph edge attributes in graphviz DOT language, related to a single input
+/// component.
+pub struct EdgeAttributes(
+    #[configurable(metadata(
+        docs::additional_props_description = "A single graph edge attribute in graphviz DOT language.",
+        docs::examples = "example_edge_options()"
+    ))]
+    pub HashMap<String, String>,
+);
+
+fn example_node_options() -> HashMap<String, String> {
     HashMap::<_, _>::from_iter([
         ("name".to_string(), "Example Node".to_string()),
         ("color".to_string(), "red".to_string()),
         ("width".to_string(), "5.0".to_string()),
     ])
 }
+
+fn example_edges_options() -> HashMap<String, HashMap<String, String>> {
+    HashMap::<_, _>::from_iter([("example_input".to_string(), example_edge_options())])
+}
+
+fn example_edge_options() -> HashMap<String, String> {
+    HashMap::<_, _>::from_iter([
+        ("label".to_string(), "Example Edge".to_string()),
+        ("color".to_string(), "red".to_string()),
+        ("width".to_string(), "5.0".to_string()),
+    ])
+}
diff --git a/src/graph.rs b/src/graph.rs
index cfdcfffb3c6f5..241833b32f59c 100644
--- a/src/graph.rs
+++ b/src/graph.rs
@@ -1,9 +1,17 @@
-use std::{collections::HashMap, fmt::Write as _, path::PathBuf};
+use std::{
+    collections::{HashMap, HashSet},
+    fmt::Write as _,
+    path::PathBuf,
+};
 
 use clap::Parser;
 use itertools::Itertools;
+use vector_lib::{config::OutputId, id::ComponentKey};
 
-use crate::config;
+use crate::config::{
+    self,
+    dot_graph::{EdgeAttributes, GraphConfig},
+};
 
 #[derive(Parser, Debug)]
 #[command(rename_all = "kebab-case")]
@@ -94,6 +102,16 @@ fn node_attributes_to_string(attributes: &HashMap<String, String>, default_shape
     attrs.iter().map(|(k, v)| format!("{k}=\"{v}\"")).join(" ")
 }
 
+fn edge_attributes_to_string(attributes: &EdgeAttributes, default_label: Option<&str>) -> String {
+    let mut attrs = attributes.0.clone();
+    if let Some(default_label) = default_label
+        && !attrs.contains_key("label")
+    {
+        attrs.insert("label".to_string(), default_label.to_string());
+    }
+    attrs.iter().map(|(k, v)| format!("{k}=\"{v}\"")).join(" ")
+}
+
 pub(crate) fn cmd(opts: &Opts) -> exitcode::ExitCode {
     let paths = opts.paths_with_formats();
     let paths = match config::process_paths(&paths) {
@@ -122,6 +140,43 @@ pub(crate) fn cmd(opts: &Opts) -> exitcode::ExitCode {
 fn render_dot(config: config::Config) -> exitcode::ExitCode {
     let mut dot = String::from("digraph {\n");
 
+    let mut written_tables = HashSet::<ComponentKey>::new();
+
+    for (id, table) in config
+        .enrichment_tables
+        .iter()
+        .filter_map(|(key, table)| table.as_source(key))
+    {
+        writeln!(
+            dot,
+            "  \"{}\" [{}]",
+            id,
+            node_attributes_to_string(&table.graph.node_attributes, "cylinder")
+        )
+        .expect("write to String never fails");
+        written_tables.insert(id);
+    }
+
+    for (id, table) in config
+        .enrichment_tables
+        .iter()
+        .filter_map(|(key, table)| table.as_sink(key))
+    {
+        if !written_tables.contains(&id) {
+            writeln!(
+                dot,
+                "  \"{}\" [{}]",
+                id,
+                node_attributes_to_string(&table.graph.node_attributes, "cylinder")
+            )
+            .expect("write to String never fails");
+        }
+
+        for input in table.inputs.iter() {
+            render_dot_edge(&mut dot, &id, input, &table.graph);
+        }
+    }
+
     for (id, source) in config.sources() {
         writeln!(
             dot,
@@ -142,16 +197,7 @@ fn render_dot(config: config::Config) -> exitcode::ExitCode {
         .expect("write to String never fails");
 
         for input in transform.inputs.iter() {
-            if let Some(port) = &input.port {
-                writeln!(
-                    dot,
-                    "  \"{}\" -> \"{}\" [label=\"{}\"]",
-                    input.component, id, port
-                )
-                .expect("write to String never fails");
-            } else {
-                writeln!(dot, "  \"{input}\" -> \"{id}\"").expect("write to String never fails");
-            }
+            render_dot_edge(&mut dot, id, input, &transform.graph);
         }
     }
 
@@ -165,16 +211,7 @@ fn render_dot(config: config::Config) -> exitcode::ExitCode {
         .expect("write to String never fails");
 
         for input in &sink.inputs {
-            if let Some(port) = &input.port {
-                writeln!(
-                    dot,
-                    "  \"{}\" -> \"{}\" [label=\"{}\"]",
-                    input.component, id, port
-                )
-                .expect("write to String never fails");
-            } else {
-                writeln!(dot, "  \"{input}\" -> \"{id}\"").expect("write to String never fails");
-            }
+            render_dot_edge(&mut dot, id, input, &sink.graph);
         }
     }
 
@@ -188,9 +225,67 @@ fn render_dot(config: config::Config) -> exitcode::ExitCode {
     exitcode::OK
 }
 
+fn render_dot_edge(into: &mut String, id: &ComponentKey, input: &OutputId, graph: &GraphConfig) {
+    let edge_attributes = graph
+        .edge_attributes
+        .get(&input.to_string())
+        .or_else(|| graph.edge_attributes.get(&input.component.to_string()));
+    if let Some(port) = &input.port {
+        writeln!(
+            into,
+            "  \"{}\" -> \"{id}\" [{}]",
+            input.component,
+            edge_attributes_to_string(
+                edge_attributes.unwrap_or(&EdgeAttributes::default()),
+                Some(port)
+            )
+        )
+        .expect("write to String never fails");
+    } else if let Some(edge_attributes) = edge_attributes {
+        writeln!(
+            into,
+            "  \"{input}\" -> \"{id}\" [{}]",
+            edge_attributes_to_string(edge_attributes, None)
+        )
+        .expect("write to String never fails");
+    } else {
+        writeln!(into, "  \"{input}\" -> \"{id}\"").expect("write to String never fails");
+    }
+}
+
 fn render_mermaid(config: config::Config) -> exitcode::ExitCode {
     let mut mermaid = String::from("flowchart TD;\n");
 
+    writeln!(mermaid, "\n  %% Enrichment tables").unwrap();
+    let mut written_tables = HashSet::<ComponentKey>::new();
+
+    for (id, _) in config
+        .enrichment_tables
+        .iter()
+        .filter_map(|(key, table)| table.as_source(key))
+    {
+        writeln!(mermaid, "  {id}[({id})]").unwrap();
+        written_tables.insert(id);
+    }
+
+    for (id, table) in config
+        .enrichment_tables
+        .iter()
+        .filter_map(|(key, table)| table.as_sink(key))
+    {
+        if !written_tables.contains(&id) {
+            writeln!(mermaid, "  {id}[({id})]").unwrap();
+        }
+
+        for input in table.inputs.iter() {
+            if let Some(port) = &input.port {
+                writeln!(mermaid, "  {0} -->|{port}| {id}", input.component).unwrap();
+            } else {
+                writeln!(mermaid, "  {0} --> {id}", input.component).unwrap();
+            }
+        }
+    }
+
     writeln!(mermaid, "\n  %% Sources").unwrap();
     for (id, _) in config.sources() {
         writeln!(mermaid, "  {id}[/{id}/]").unwrap();
diff --git a/website/cue/reference/components/generated/sinks.cue b/website/cue/reference/components/generated/sinks.cue
index 9bb1bc943749e..6268666fc49c5 100644
--- a/website/cue/reference/components/generated/sinks.cue
+++ b/website/cue/reference/components/generated/sinks.cue
@@ -82,23 +82,58 @@ generated: components: sinks: configuration: {
 			Configure output for component when generated with graph command
 			"""
 		required: false
-		type: object: options: node_attributes: {
-			description: """
-				Node attributes to add to this component's node in resulting graph
-
-				They are added to the node as provided
-				"""
-			required: false
-			type: object: {
-				examples: [{
-					color: "red"
-					name:  "Example Node"
-					width: "5.0"
-				}]
-				options: "*": {
-					description: "A single graph node attribute in graphviz DOT language."
-					required:    true
-					type: string: {}
+		type: object: options: {
+			edge_attributes: {
+				description: """
+					Edge attributes to add to the edges linked to this component's node in resulting graph
+
+					They are added to the edge as provided
+					"""
+				required: false
+				type: object: {
+					examples: [{
+						example_input: {
+							color: "red"
+							label: "Example Edge"
+							width: "5.0"
+						}
+					}]
+					options: "*": {
+						description: "A collection of graph edge attributes in graphviz DOT language, related to a single input component."
+						required:    true
+						type: object: {
+							examples: [{
+								color: "red"
+								label: "Example Edge"
+								width: "5.0"
+							}]
+							options: "*": {
+								description: "A single graph edge attribute in graphviz DOT language."
+								required:    true
+								type: string: {}
+							}
+						}
+					}
+				}
+			}
+			node_attributes: {
+				description: """
+					Node attributes to add to this component's node in resulting graph
+
+					They are added to the node as provided
+					"""
+				required: false
+				type: object: {
+					examples: [{
+						color: "red"
+						name:  "Example Node"
+						width: "5.0"
+					}]
+					options: "*": {
+						description: "A single graph node attribute in graphviz DOT language."
+						required:    true
+						type: string: {}
+					}
 				}
 			}
 		}
diff --git a/website/cue/reference/components/generated/sources.cue b/website/cue/reference/components/generated/sources.cue
index 03b0c109f2be9..04ce33d83212f 100644
--- a/website/cue/reference/components/generated/sources.cue
+++ b/website/cue/reference/components/generated/sources.cue
@@ -8,23 +8,58 @@ generated: components: sources: configuration: {
 			Configure output for component when generated with graph command
 			"""
 		required: false
-		type: object: options: node_attributes: {
-			description: """
-				Node attributes to add to this component's node in resulting graph
+		type: object: options: {
+			edge_attributes: {
+				description: """
+					Edge attributes to add to the edges linked to this component's node in resulting graph
+
+					They are added to the edge as provided
+					"""
+				required: false
+				type: object: {
+					examples: [{
+						example_input: {
+							color: "red"
+							label: "Example Edge"
+							width: "5.0"
+						}
+					}]
+					options: "*": {
+						description: "A collection of graph edge attributes in graphviz DOT language, related to a single input component."
+						required:    true
+						type: object: {
+							examples: [{
+								color: "red"
+								label: "Example Edge"
+								width: "5.0"
+							}]
+							options: "*": {
+								description: "A single graph edge attribute in graphviz DOT language."
+								required:    true
+								type: string: {}
+							}
+						}
+					}
+				}
+			}
+			node_attributes: {
+				description: """
+					Node attributes to add to this component's node in resulting graph
 
-				They are added to the node as provided
-				"""
-			required: false
-			type: object: {
-				examples: [{
-					color: "red"
-					name:  "Example Node"
-					width: "5.0"
-				}]
-				options: "*": {
-					description: "A single graph node attribute in graphviz DOT language."
-					required:    true
-					type: string: {}
+					They are added to the node as provided
+					"""
+				required: false
+				type: object: {
+					examples: [{
+						color: "red"
+						name:  "Example Node"
+						width: "5.0"
+					}]
+					options: "*": {
+						description: "A single graph node attribute in graphviz DOT language."
+						required:    true
+						type: string: {}
+					}
 				}
 			}
 		}
diff --git a/website/cue/reference/components/generated/transforms.cue b/website/cue/reference/components/generated/transforms.cue
index a7bee15d2958e..14181061b6fdd 100644
--- a/website/cue/reference/components/generated/transforms.cue
+++ b/website/cue/reference/components/generated/transforms.cue
@@ -8,23 +8,58 @@ generated: components: transforms: configuration: {
 			Configure output for component when generated with graph command
 			"""
 		required: false
-		type: object: options: node_attributes: {
-			description: """
-				Node attributes to add to this component's node in resulting graph
+		type: object: options: {
+			edge_attributes: {
+				description: """
+					Edge attributes to add to the edges linked to this component's node in resulting graph
 
-				They are added to the node as provided
-				"""
-			required: false
-			type: object: {
-				examples: [{
-					color: "red"
-					name:  "Example Node"
-					width: "5.0"
-				}]
-				options: "*": {
-					description: "A single graph node attribute in graphviz DOT language."
-					required:    true
-					type: string: {}
+					They are added to the edge as provided
+					"""
+				required: false
+				type: object: {
+					examples: [{
+						example_input: {
+							color: "red"
+							label: "Example Edge"
+							width: "5.0"
+						}
+					}]
+					options: "*": {
+						description: "A collection of graph edge attributes in graphviz DOT language, related to a single input component."
+						required:    true
+						type: object: {
+							examples: [{
+								color: "red"
+								label: "Example Edge"
+								width: "5.0"
+							}]
+							options: "*": {
+								description: "A single graph edge attribute in graphviz DOT language."
+								required:    true
+								type: string: {}
+							}
+						}
+					}
+				}
+			}
+			node_attributes: {
+				description: """
+					Node attributes to add to this component's node in resulting graph
+
+					They are added to the node as provided
+					"""
+				required: false
+				type: object: {
+					examples: [{
+						color: "red"
+						name:  "Example Node"
+						width: "5.0"
+					}]
+					options: "*": {
+						description: "A single graph node attribute in graphviz DOT language."
+						required:    true
+						type: string: {}
+					}
 				}
 			}
 		}
diff --git a/website/cue/reference/generated/configuration.cue b/website/cue/reference/generated/configuration.cue
index 0dbca1b677111..5b98f0c6fbe35 100644
--- a/website/cue/reference/generated/configuration.cue
+++ b/website/cue/reference/generated/configuration.cue
@@ -53,25 +53,60 @@ generated: configuration: {
 			type: object: options: "*": {
 				type: object: options: {
 					graph: {
-						type: object: options: node_attributes: {
-							type: object: {
-								options: "*": {
-									type: string: {}
-									required:    true
-									description: "A single graph node attribute in graphviz DOT language."
+						type: object: options: {
+							edge_attributes: {
+								type: object: {
+									options: "*": {
+										type: object: {
+											options: "*": {
+												type: string: {}
+												required:    true
+												description: "A single graph edge attribute in graphviz DOT language."
+											}
+											examples: [{
+												color: "red"
+												label: "Example Edge"
+												width: "5.0"
+											}]
+										}
+										description: "A collection of graph edge attributes in graphviz DOT language, related to a single input component."
+										required:    true
+									}
+									examples: [{
+										example_input: {
+											color: "red"
+											label: "Example Edge"
+											width: "5.0"
+										}
+									}]
 								}
-								examples: [{
-									color: "red"
-									name:  "Example Node"
-									width: "5.0"
-								}]
+								description: """
+																		Edge attributes to add to the edges linked to this component's node in resulting graph
+
+																		They are added to the edge as provided
+																		"""
+								required: false
 							}
-							description: """
+							node_attributes: {
+								type: object: {
+									options: "*": {
+										type: string: {}
+										required:    true
+										description: "A single graph node attribute in graphviz DOT language."
+									}
+									examples: [{
+										color: "red"
+										name:  "Example Node"
+										width: "5.0"
+									}]
+								}
+								description: """
 																		Node attributes to add to this component's node in resulting graph
 
 																		They are added to the node as provided
 																		"""
-							required: false
+								required: false
+							}
 						}
 						description: """
 														Extra graph configuration
@@ -855,25 +890,60 @@ generated: configuration: {
 						required: false
 					}
 					graph: {
-						type: object: options: node_attributes: {
-							type: object: {
-								options: "*": {
-									type: string: {}
-									required:    true
-									description: "A single graph node attribute in graphviz DOT language."
+						type: object: options: {
+							edge_attributes: {
+								type: object: {
+									options: "*": {
+										type: object: {
+											options: "*": {
+												type: string: {}
+												required:    true
+												description: "A single graph edge attribute in graphviz DOT language."
+											}
+											examples: [{
+												color: "red"
+												label: "Example Edge"
+												width: "5.0"
+											}]
+										}
+										description: "A collection of graph edge attributes in graphviz DOT language, related to a single input component."
+										required:    true
+									}
+									examples: [{
+										example_input: {
+											color: "red"
+											label: "Example Edge"
+											width: "5.0"
+										}
+									}]
 								}
-								examples: [{
-									color: "red"
-									name:  "Example Node"
-									width: "5.0"
-								}]
+								description: """
+																		Edge attributes to add to the edges linked to this component's node in resulting graph
+
+																		They are added to the edge as provided
+																		"""
+								required: false
 							}
-							description: """
+							node_attributes: {
+								type: object: {
+									options: "*": {
+										type: string: {}
+										required:    true
+										description: "A single graph node attribute in graphviz DOT language."
+									}
+									examples: [{
+										color: "red"
+										name:  "Example Node"
+										width: "5.0"
+									}]
+								}
+								description: """
 																		Node attributes to add to this component's node in resulting graph
 
 																		They are added to the node as provided
 																		"""
-							required: false
+								required: false
+							}
 						}
 						description: """
 														Extra graph configuration
@@ -996,25 +1066,60 @@ generated: configuration: {
 			type: object: options: "*": {
 				type: object: options: {
 					graph: {
-						type: object: options: node_attributes: {
-							type: object: {
-								options: "*": {
-									type: string: {}
-									required:    true
-									description: "A single graph node attribute in graphviz DOT language."
+						type: object: options: {
+							edge_attributes: {
+								type: object: {
+									options: "*": {
+										type: object: {
+											options: "*": {
+												type: string: {}
+												required:    true
+												description: "A single graph edge attribute in graphviz DOT language."
+											}
+											examples: [{
+												color: "red"
+												label: "Example Edge"
+												width: "5.0"
+											}]
+										}
+										description: "A collection of graph edge attributes in graphviz DOT language, related to a single input component."
+										required:    true
+									}
+									examples: [{
+										example_input: {
+											color: "red"
+											label: "Example Edge"
+											width: "5.0"
+										}
+									}]
 								}
-								examples: [{
-									color: "red"
-									name:  "Example Node"
-									width: "5.0"
-								}]
+								description: """
+																		Edge attributes to add to the edges linked to this component's node in resulting graph
+
+																		They are added to the edge as provided
+																		"""
+								required: false
 							}
-							description: """
+							node_attributes: {
+								type: object: {
+									options: "*": {
+										type: string: {}
+										required:    true
+										description: "A single graph node attribute in graphviz DOT language."
+									}
+									examples: [{
+										color: "red"
+										name:  "Example Node"
+										width: "5.0"
+									}]
+								}
+								description: """
 																		Node attributes to add to this component's node in resulting graph
 
 																		They are added to the node as provided
 																		"""
-							required: false
+								required: false
+							}
 						}
 						description: """
 														Extra graph configuration
@@ -1093,25 +1198,60 @@ generated: configuration: {
 			type: object: options: "*": {
 				type: object: options: {
 					graph: {
-						type: object: options: node_attributes: {
-							type: object: {
-								options: "*": {
-									type: string: {}
-									required:    true
-									description: "A single graph node attribute in graphviz DOT language."
+						type: object: options: {
+							edge_attributes: {
+								type: object: {
+									options: "*": {
+										type: object: {
+											options: "*": {
+												type: string: {}
+												required:    true
+												description: "A single graph edge attribute in graphviz DOT language."
+											}
+											examples: [{
+												color: "red"
+												label: "Example Edge"
+												width: "5.0"
+											}]
+										}
+										description: "A collection of graph edge attributes in graphviz DOT language, related to a single input component."
+										required:    true
+									}
+									examples: [{
+										example_input: {
+											color: "red"
+											label: "Example Edge"
+											width: "5.0"
+										}
+									}]
 								}
-								examples: [{
-									color: "red"
-									name:  "Example Node"
-									width: "5.0"
-								}]
+								description: """
+																		Edge attributes to add to the edges linked to this component's node in resulting graph
+
+																		They are added to the edge as provided
+																		"""
+								required: false
 							}
-							description: """
+							node_attributes: {
+								type: object: {
+									options: "*": {
+										type: string: {}
+										required:    true
+										description: "A single graph node attribute in graphviz DOT language."
+									}
+									examples: [{
+										color: "red"
+										name:  "Example Node"
+										width: "5.0"
+									}]
+								}
+								description: """
 																		Node attributes to add to this component's node in resulting graph
 
 																		They are added to the node as provided
 																		"""
-							required: false
+								required: false
+							}
 						}
 						description: """
 														Extra graph configuration

From a8f3a9b45e6d2f6a897995bce85e3ad9a9a13442 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ensar=20Saraj=C4=8Di=C4=87?= <dev@ensarsarajcic.com>
Date: Wed, 18 Mar 2026 19:39:25 +0100
Subject: [PATCH 027/326] enhancement(dnstap source): expose message size when
 parsing dnstap data (#24552)

* enhancement(dnstap source): expose raw message size when parsing dnstap data

Closes: #24545

* Add changelog entry

* Change message size from frame size to DNS message size

* Split `messageSize` into `requestMessageSize` and `responseMessageSize`
---
 ..._dnstap_parser_message_size.enhancement.md |  3 ++
 lib/vector-vrl/dnstap-parser/src/parser.rs    | 28 +++++++++++++++++++
 lib/vector-vrl/dnstap-parser/src/schema.rs    | 14 ++++++++++
 .../src/vrl_functions/parse_dnstap.rs         |  6 ++++
 4 files changed, 51 insertions(+)
 create mode 100644 changelog.d/24552_dnstap_parser_message_size.enhancement.md

diff --git a/changelog.d/24552_dnstap_parser_message_size.enhancement.md b/changelog.d/24552_dnstap_parser_message_size.enhancement.md
new file mode 100644
index 0000000000000..9472bde7f3346
--- /dev/null
+++ b/changelog.d/24552_dnstap_parser_message_size.enhancement.md
@@ -0,0 +1,3 @@
+Adds new fields to parsed dnstap data: `requestMessageSize` and `responseMessageSize`. It represents the size of the DNS message.
+
+authors: esensar Quad9DNS
diff --git a/lib/vector-vrl/dnstap-parser/src/parser.rs b/lib/vector-vrl/dnstap-parser/src/parser.rs
index 3876ff363bec6..5e14303c4a5a2 100644
--- a/lib/vector-vrl/dnstap-parser/src/parser.rs
+++ b/lib/vector-vrl/dnstap-parser/src/parser.rs
@@ -260,6 +260,13 @@ impl DnstapParser {
         match dnstap_message_type_id {
             1..=12 => {
                 if let Some(query_message) = dnstap_message.query_message {
+                    DnstapParser::insert(
+                        event,
+                        prefix.clone(),
+                        &DNSTAP_VALUE_PATHS.request_message_size,
+                        query_message.len(),
+                    );
+
                     let mut query_message_parser =
                         DnsMessageParser::with_options(query_message, parsing_options.clone());
                     if let Err(error) = DnstapParser::parse_dns_query_message(
@@ -278,6 +285,12 @@ impl DnstapParser {
                 }
 
                 if let Some(response_message) = dnstap_message.response_message {
+                    DnstapParser::insert(
+                        event,
+                        prefix.clone(),
+                        &DNSTAP_VALUE_PATHS.response_message_size,
+                        response_message.len(),
+                    );
                     let mut response_message_parser =
                         DnsMessageParser::with_options(response_message, parsing_options);
                     if let Err(error) = DnstapParser::parse_dns_query_message(
@@ -297,6 +310,12 @@ impl DnstapParser {
             }
             13 | 14 => {
                 if let Some(update_request_message) = dnstap_message.query_message {
+                    DnstapParser::insert(
+                        event,
+                        prefix.clone(),
+                        &DNSTAP_VALUE_PATHS.request_message_size,
+                        update_request_message.len(),
+                    );
                     let mut update_request_message_parser = DnsMessageParser::with_options(
                         update_request_message,
                         parsing_options.clone(),
@@ -317,6 +336,12 @@ impl DnstapParser {
                 }
 
                 if let Some(update_response_message) = dnstap_message.response_message {
+                    DnstapParser::insert(
+                        event,
+                        prefix.clone(),
+                        &DNSTAP_VALUE_PATHS.response_message_size,
+                        update_response_message.len(),
+                    );
                     let mut update_response_message_parser =
                         DnsMessageParser::with_options(update_response_message, parsing_options);
                     if let Err(error) = DnstapParser::parse_dns_update_message(
@@ -1060,6 +1085,7 @@ mod tests {
             ("dataTypeId", Value::Integer(1)),
             ("messageType", Value::Bytes(Bytes::from("ResolverQuery"))),
             ("messageTypeId", Value::Integer(3)),
+            ("requestMessageSize", Value::Integer(54)),
             ("queryZone", Value::Bytes(Bytes::from("com."))),
             ("requestData.fullRcode", Value::Integer(0)),
             ("requestData.header.aa", Value::Boolean(false)),
@@ -1256,6 +1282,8 @@ mod tests {
             ("dataTypeId", Value::Integer(1)),
             ("messageType", Value::Bytes(Bytes::from("UpdateResponse"))),
             ("messageTypeId", Value::Integer(14)),
+            ("requestMessageSize", Value::Integer(29)),
+            ("responseMessageSize", Value::Integer(29)),
             ("requestData.fullRcode", Value::Integer(0)),
             ("requestData.header.adCount", Value::Integer(0)),
             ("requestData.header.id", Value::Integer(28811)),
diff --git a/lib/vector-vrl/dnstap-parser/src/schema.rs b/lib/vector-vrl/dnstap-parser/src/schema.rs
index 29a1b861f6e69..c2fea507d60e1 100644
--- a/lib/vector-vrl/dnstap-parser/src/schema.rs
+++ b/lib/vector-vrl/dnstap-parser/src/schema.rs
@@ -174,6 +174,16 @@ impl DnstapEventSchema {
                 Kind::object(self.request_message_schema_definition()),
                 None,
             )
+            .optional_field(
+                &DNSTAP_VALUE_PATHS.request_message_size,
+                Kind::integer(),
+                None,
+            )
+            .optional_field(
+                &DNSTAP_VALUE_PATHS.response_message_size,
+                Kind::integer(),
+                None,
+            )
     }
 
     /// The schema definition for a dns tap message.
@@ -211,6 +221,8 @@ pub struct DnstapPaths {
     pub message_type_id: OwnedValuePath,
     pub request_message: OwnedValuePath,
     pub response_message: OwnedValuePath,
+    pub request_message_size: OwnedValuePath,
+    pub response_message_size: OwnedValuePath,
 
     // DnsQueryMessageSchema
     pub response_code: OwnedValuePath,
@@ -311,6 +323,8 @@ pub static DNSTAP_VALUE_PATHS: LazyLock<DnstapPaths> = LazyLock::new(|| DnstapPa
     message_type_id: owned_value_path!("messageTypeId"),
     request_message: owned_value_path!("requestData"),
     response_message: owned_value_path!("responseData"),
+    request_message_size: owned_value_path!("requestMessageSize"),
+    response_message_size: owned_value_path!("responseMessageSize"),
     response_code: owned_value_path!("fullRcode"),
     response: owned_value_path!("rcodeName"),
     header: owned_value_path!("header"),
diff --git a/lib/vector-vrl/dnstap-parser/src/vrl_functions/parse_dnstap.rs b/lib/vector-vrl/dnstap-parser/src/vrl_functions/parse_dnstap.rs
index 8c0a5d07f35e7..b534226b68cb7 100644
--- a/lib/vector-vrl/dnstap-parser/src/vrl_functions/parse_dnstap.rs
+++ b/lib/vector-vrl/dnstap-parser/src/vrl_functions/parse_dnstap.rs
@@ -67,6 +67,8 @@ impl Function for ParseDnstap {
                         "extraInfo": "",
                         "messageType": "ResolverQuery",
                         "messageTypeId": 3,
+                        "requestMessageSize": 54,
+                        "responseMessageSize": 100,
                         "queryZone": "com.",
                         "requestData": {
                             "fullRcode": 0,
@@ -244,6 +246,8 @@ mod tests {
                     extraInfo: "",
                     messageType: "ResolverQuery",
                     messageTypeId: 3,
+                    requestMessageSize: 54,
+                    responseMessageSize: 100,
                     queryZone: "com.",
                     requestData: {
                         fullRcode: 0,
@@ -358,6 +362,8 @@ mod tests {
                     dataTypeId: 1,
                     messageType: "UpdateResponse",
                     messageTypeId: 14,
+                    requestMessageSize: 29,
+                    responseMessageSize: 29,
                     requestData: {
                         fullRcode: 0,
                         header: {

From f34e8d32140ab25024ff51863ed9b5038defdc80 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 19 Mar 2026 09:13:57 -0400
Subject: [PATCH 028/326] docs(dnstap source): regenerate VRL docs with message
 size fields (#24960)

---
 docs/generated/parse_dnstap.json | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/generated/parse_dnstap.json b/docs/generated/parse_dnstap.json
index 6bc7356fe5201..c30eb26893e02 100644
--- a/docs/generated/parse_dnstap.json
+++ b/docs/generated/parse_dnstap.json
@@ -41,6 +41,8 @@
         "extraInfo": "",
         "messageType": "ResolverQuery",
         "messageTypeId": 3,
+        "requestMessageSize": 54,
+        "responseMessageSize": 100,
         "queryZone": "com.",
         "requestData": {
           "fullRcode": 0,

From 483db702e3745f4b823edac33e1d76bf7060f964 Mon Sep 17 00:00:00 2001
From: Vladimir Zhuk <vladimir.zhuk@datadoghq.com>
Date: Thu, 19 Mar 2026 14:16:35 +0100
Subject: [PATCH 029/326] fix(releasing): add libsasl2-2 runtime dep to
 Debian-based images (#24962)

fix(docker): add libsasl2-2 runtime dep to Debian-based images

After fd766a073 switched rdkafka from gssapi-vendored (static) to
gssapi (dynamic linking), the vector binary now requires libsasl2.so.2
at runtime. The Debian final stages in both the distribution and
regression Dockerfiles were missing this package, causing the
smoke-test RUN to fail with:

  /usr/bin/vector: error while loading shared libraries: libsasl2.so.2

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 distribution/docker/debian/Dockerfile | 2 +-
 regression/Dockerfile                 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/distribution/docker/debian/Dockerfile b/distribution/docker/debian/Dockerfile
index 095989978231a..a726f8a72004c 100644
--- a/distribution/docker/debian/Dockerfile
+++ b/distribution/docker/debian/Dockerfile
@@ -16,7 +16,7 @@ LABEL org.opencontainers.image.documentation="https://vector.dev/docs"
 
 # we want the latest versions of these
 # hadolint ignore=DL3008
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates tzdata systemd && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates tzdata systemd libsasl2-2 && rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder /usr/bin/vector /usr/bin/vector
 COPY --from=builder /usr/share/vector /usr/share/vector
diff --git a/regression/Dockerfile b/regression/Dockerfile
index dc1a037e47636..98b03547af9f7 100644
--- a/regression/Dockerfile
+++ b/regression/Dockerfile
@@ -14,7 +14,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
 # TARGET
 #
 FROM docker.io/debian:trixie-slim@sha256:c85a2732e97694ea77237c61304b3bb410e0e961dd6ee945997a06c788c545bb
-RUN apt-get update && apt-get dist-upgrade -y && apt-get -y --no-install-recommends install zlib1g ca-certificates && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get dist-upgrade -y && apt-get -y --no-install-recommends install zlib1g ca-certificates libsasl2-2 && rm -rf /var/lib/apt/lists/*
 COPY --from=builder /vector/vector /usr/bin/vector
 RUN mkdir --parents --mode=0777 /var/lib/vector
 

From 5f0f03e181a031ee51a71e2bd9fcf0698f073a5b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 19 Mar 2026 15:13:14 +0000
Subject: [PATCH 030/326] chore(deps): bump fakedata_generator from 0.5.0 to
 0.7.1 (#24800)

* chore(deps): bump fakedata_generator from 0.5.0 to 0.7.1

Bumps [fakedata_generator](https://github.com/KevinGimbel/fakedata_generator) from 0.5.0 to 0.7.1.
- [Changelog](https://github.com/KevinGimbel/fakedata_generator/blob/main/CHANGELOG.md)
- [Commits](https://github.com/KevinGimbel/fakedata_generator/commits/v0.7.1)

---
updated-dependencies:
- dependency-name: fakedata_generator
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* update licenses

* Update generated VRL docs

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 Cargo.lock              | 6 +++---
 LICENSE-3rdparty.csv    | 2 +-
 lib/fakedata/Cargo.toml | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f19fbc7c50f2c..925ecad0423d2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3998,12 +3998,12 @@ dependencies = [
 
 [[package]]
 name = "fakedata_generator"
-version = "0.5.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57b82fba4b485b819fde74012109688a9d2bd4ce7b22583ac12c9fa239f74a02"
+checksum = "b42ec18312c068f0d6008ad66ad2fa289ab40a16d07a06406c200baa09eb1e7c"
 dependencies = [
  "passt",
- "rand 0.8.5",
+ "rand 0.9.2",
  "serde",
  "serde_json",
 ]
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 2079e5d6819ba..bb490b1376fbe 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -276,7 +276,7 @@ event-listener-strategy,https://github.com/smol-rs/event-listener-strategy,Apach
 evmap,https://github.com/jonhoo/rust-evmap,MIT OR Apache-2.0,Jon Gjengset <jon@thesquareplanet.com>
 evmap-derive,https://github.com/jonhoo/rust-evmap,MIT OR Apache-2.0,Jon Gjengset <jon@thesquareplanet.com>
 exitcode,https://github.com/benwilber/exitcode,Apache-2.0,Ben Wilber <benwilber@gmail.com>
-fakedata_generator,https://github.com/kevingimbel/fakedata_generator,MIT,Kevin Gimbel <hallo@kevingimbel.com>
+fakedata_generator,https://github.com/KevinGimbel/fakedata_generator,MIT,Kevin Gimbel <kevin@gimbel.dev>
 fallible-iterator,https://github.com/sfackler/rust-fallible-iterator,MIT OR Apache-2.0,Steven Fackler <sfackler@gmail.com>
 fancy-regex,https://github.com/fancy-regex/fancy-regex,MIT,"Raph Levien <raph@google.com>, Robin Stocker <robin@nibor.org>, Keith Hall <keith.hall@available.systems>"
 fastrand,https://github.com/smol-rs/fastrand,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
diff --git a/lib/fakedata/Cargo.toml b/lib/fakedata/Cargo.toml
index 708086e24002c..576ad22e96cad 100644
--- a/lib/fakedata/Cargo.toml
+++ b/lib/fakedata/Cargo.toml
@@ -8,5 +8,5 @@ license = "MPL-2.0"
 
 [dependencies]
 chrono.workspace = true
-fakedata_generator = "0.5.0"
+fakedata_generator = "0.7.1"
 rand.workspace = true

From 3c69a8b8a668c6d20ea57d6883a3771803893648 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 19 Mar 2026 11:43:24 -0400
Subject: [PATCH 031/326] chore(external docs): instruct agents to use PR
 template when creating PRs (#24965)

* docs(agents): instruct agents to use PR template when creating PRs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs(agents): simplify PR template instruction to avoid duplication

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs(agents): improve PR template instruction wording

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 AGENTS.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index 24fd23e790e76..63460acdae3e9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -254,6 +254,10 @@ cargo install dd-rust-license-tool --locked
 make build-licenses
 ```
 
+## Creating Pull Requests
+
+Before opening a PR, read [`.github/PULL_REQUEST_TEMPLATE.md`](.github/PULL_REQUEST_TEMPLATE.md) and use it as the reference for the PR body structure and title.
+
 ## Reference Documentation
 
 These documents provide context that AI agents and developers need when working on Vector code.

From f02424389cfa4abf8e1168b5b63fb227499c9bd4 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 19 Mar 2026 11:54:48 -0400
Subject: [PATCH 032/326] feat(ci): add Datadog static analysis workflow
 (#24966)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/static-analysis.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/static-analysis.yml

diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
new file mode 100644
index 0000000000000..d3330f07b7280
--- /dev/null
+++ b/.github/workflows/static-analysis.yml
@@ -0,0 +1,26 @@
+name: Static Analysis
+
+on:
+  push:
+    branches:
+      - master
+      - "**"  # Run on all branches (includes PR branches)
+  workflow_dispatch:  # Allow manual trigger from GitHub UI
+
+permissions:
+  contents: read
+
+jobs:
+  static-analysis:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Datadog Static Analyzer
+        if: ${{ secrets.DD_API_KEY != '' }}
+        uses: DataDog/datadog-static-analyzer-github-action@8340f18875fcefca86844b5f947ce2431387e552 # v3.0.0
+        with:
+          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_app_key: ${{ secrets.DD_APP_KEY }}
+          dd_site: datadoghq.com
+          secrets_enabled: true

From a7fae1f7ad17b51e3960850300b45955ac0952e0 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 19 Mar 2026 12:27:12 -0400
Subject: [PATCH 033/326] feat(ci): add code coverage workflow with Datadog
 upload (#24964)

* feat(ci): add code coverage workflow with Datadog upload

- Add coverage.yml generating lcov coverage with cargo-llvm-cov and uploading to Datadog via datadog-ci (runs on master pushes and weekly)
- Add cargo-llvm-cov (v0.8.4) to prepare.sh and the setup composite action; llvm-tools-preview is installed automatically inside maybe_install_cargo_tool when cargo-llvm-cov is requested

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(ci): remove weekly schedule from coverage workflow

Runs on every master push so the schedule is redundant.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/actions/setup/action.yml |  7 +++++++
 .github/workflows/coverage.yml   | 36 ++++++++++++++++++++++++++++++++
 scripts/environment/prepare.sh   | 13 ++++++++++--
 3 files changed, 54 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/coverage.yml

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 3d70368bac027..379afd232341c 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -58,6 +58,10 @@ inputs:
     required: false
     default: false
     description: "Install cargo-hack for feature compilation checks."
+  cargo-llvm-cov:
+    required: false
+    default: false
+    description: "Install cargo-llvm-cov for code coverage."
   dd-rust-license-tool:
     required: false
     default: false
@@ -111,6 +115,7 @@ runs:
                    "${{ inputs.cargo-deny }}" \
                    "${{ inputs.cargo-msrv }}" \
                    "${{ inputs.cargo-hack }}" \
+                   "${{ inputs.cargo-llvm-cov }}" \
                    "${{ inputs.dd-rust-license-tool }}" \
                    "${{ inputs.wasm-pack }}"; do
           if [[ "$val" == "true" ]]; then
@@ -259,6 +264,7 @@ runs:
           ~/.cargo/bin/cargo-deny
           ~/.cargo/bin/cargo-msrv
           ~/.cargo/bin/cargo-hack
+          ~/.cargo/bin/cargo-llvm-cov
           ~/.cargo/bin/dd-rust-license-tool
           ~/.cargo/bin/wasm-pack
           /usr/local/bin/markdownlint
@@ -278,6 +284,7 @@ runs:
         [[ "${{ inputs.cargo-deny }}" == "true" ]] && mods+=("cargo-deny")
         [[ "${{ inputs.cargo-msrv }}" == "true" ]] && mods+=("cargo-msrv")
         [[ "${{ inputs.cargo-hack }}" == "true" ]] && mods+=("cargo-hack")
+        [[ "${{ inputs.cargo-llvm-cov }}" == "true" ]] && mods+=("cargo-llvm-cov")
         [[ "${{ inputs.dd-rust-license-tool }}" == "true" ]] && mods+=("dd-rust-license-tool")
         [[ "${{ inputs.wasm-pack }}" == "true" ]] && mods+=("wasm-pack")
         [[ "${{ inputs.markdownlint }}" == "true" ]] && mods+=("markdownlint")
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
new file mode 100644
index 0000000000000..7afeaa70f1c35
--- /dev/null
+++ b/.github/workflows/coverage.yml
@@ -0,0 +1,36 @@
+name: Code Coverage
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:  # Allow manual trigger from GitHub UI
+
+permissions:
+  contents: read
+
+env:
+  CI: true
+  CARGO_INCREMENTAL: '0'  # Disable incremental compilation for coverage
+
+jobs:
+  coverage:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: ./.github/actions/setup
+        with:
+          rust: true
+          cargo-llvm-cov: true
+          datadog-ci: true
+
+      - name: "Generate code coverage"
+        run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
+
+      - name: "Upload coverage to Datadog"
+        env:
+          DD_API_KEY: ${{ secrets.DD_API_KEY }}
+          DD_SITE: datadoghq.com
+          DD_ENV: ci
+        run: datadog-ci coverage upload lcov.info
diff --git a/scripts/environment/prepare.sh b/scripts/environment/prepare.sh
index a06f50844c353..5bd5a29a79ac2 100755
--- a/scripts/environment/prepare.sh
+++ b/scripts/environment/prepare.sh
@@ -35,6 +35,7 @@ CARGO_DENY_VERSION="0.19.0"
 CARGO_MSRV_VERSION="0.18.4"
 CARGO_HACK_VERSION="0.6.43"
 DD_RUST_LICENSE_TOOL_VERSION="1.0.6"
+CARGO_LLVM_COV_VERSION="0.8.4"
 WASM_PACK_VERSION="0.13.1"
 MARKDOWNLINT_VERSION="0.45.0"
 DATADOG_CI_VERSION="5.9.0"
@@ -48,6 +49,7 @@ ALL_MODULES=(
   cargo-deny
   cargo-msrv
   cargo-hack
+  cargo-llvm-cov
   dd-rust-license-tool
   wasm-pack
   markdownlint
@@ -87,6 +89,7 @@ Modules:
   cargo-deny
   cargo-msrv
   cargo-hack
+  cargo-llvm-cov
   dd-rust-license-tool
   wasm-pack
   markdownlint
@@ -138,6 +141,11 @@ maybe_install_cargo_tool() {
   if ! $version_cmd --version 2>/dev/null | grep -q "^${version_pattern}"; then
     cargo "${install[@]}" "$tool" --version "$version" --force --locked
   fi
+
+  # cargo-llvm-cov requires the llvm-tools-preview rustup component
+  if [[ "$tool" == "cargo-llvm-cov" ]]; then
+    rustup component add llvm-tools-preview
+  fi
 }
 
 # Helper for NPM packages
@@ -161,8 +169,8 @@ maybe_install_npm_package() {
 # Always ensure git safe.directory is set
 git config --global --add safe.directory "$(pwd)"
 
-REQUIRES_RUSTUP=(dd-rust-license-tool cargo-deb cross cargo-nextest cargo-deny cargo-msrv cargo-hack wasm-pack vdev)
-REQUIRES_BINSTALL=(cargo-deb cross cargo-nextest cargo-deny cargo-msrv cargo-hack wasm-pack vdev)
+REQUIRES_RUSTUP=(dd-rust-license-tool cargo-deb cross cargo-nextest cargo-deny cargo-msrv cargo-hack cargo-llvm-cov wasm-pack vdev)
+REQUIRES_BINSTALL=(cargo-deb cross cargo-nextest cargo-deny cargo-msrv cargo-hack cargo-llvm-cov wasm-pack vdev)
 require_binstall=false
 
 for tool in "${REQUIRES_BINSTALL[@]}"; do
@@ -205,6 +213,7 @@ maybe_install_cargo_tool cargo-nextest "${CARGO_NEXTEST_VERSION}"
 maybe_install_cargo_tool cargo-deny "${CARGO_DENY_VERSION}"
 maybe_install_cargo_tool cargo-msrv "${CARGO_MSRV_VERSION}"
 maybe_install_cargo_tool cargo-hack "${CARGO_HACK_VERSION}"
+maybe_install_cargo_tool cargo-llvm-cov "${CARGO_LLVM_COV_VERSION}"
 maybe_install_cargo_tool dd-rust-license-tool "${DD_RUST_LICENSE_TOOL_VERSION}"
 maybe_install_cargo_tool wasm-pack "${WASM_PACK_VERSION}"
 maybe_install_cargo_tool vdev "${VDEV_VERSION}"

From 37a48ae53eb0e5930f4f4506903eb5b10c613789 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 19 Mar 2026 21:44:04 +0000
Subject: [PATCH 034/326] chore(deps): bump cargo-lock from 10.1.0 to 11.0.1
 (#24748)

Bumps [cargo-lock](https://github.com/rustsec/rustsec) from 10.1.0 to 11.0.1.
- [Release notes](https://github.com/rustsec/rustsec/releases)
- [Commits](https://github.com/rustsec/rustsec/commits/cargo-lock/v11.0.1)

---
updated-dependencies:
- dependency-name: cargo-lock
  dependency-version: 11.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock                               | 46 ++++++------------------
 lib/vector-vrl/web-playground/Cargo.toml |  2 +-
 2 files changed, 11 insertions(+), 37 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 925ecad0423d2..5efa8b3da18ea 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2227,13 +2227,13 @@ checksum = "6bd91ee7b2422bcb158d90ef4d14f75ef67f340943fc4149891dcce8f8b972a3"
 
 [[package]]
 name = "cargo-lock"
-version = "10.1.0"
+version = "11.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c06acb4f71407ba205a07cb453211e0e6a67b21904e47f6ba1f9589e38f2e454"
+checksum = "63585cdf8572aa7adf0e30a253f988f2b77233bfac1973d52efb6dd53a75920e"
 dependencies = [
  "semver",
  "serde",
- "toml 0.8.23",
+ "toml",
  "url",
 ]
 
@@ -2550,7 +2550,7 @@ dependencies = [
  "syslog_loose 0.23.0",
  "tokio",
  "tokio-util",
- "toml 0.9.8",
+ "toml",
  "tracing 0.1.44",
  "tracing-test",
  "uuid",
@@ -9899,7 +9899,7 @@ version = "0.3.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fc44799282f511a5d403d72a4ff028dc2c87f7fe6830abe3c33bb2fa6dfccec"
 dependencies = [
- "toml 0.9.8",
+ "toml",
 ]
 
 [[package]]
@@ -10006,15 +10006,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "serde_spanned"
-version = "0.6.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "serde_spanned"
 version = "1.0.3"
@@ -11454,18 +11445,6 @@ dependencies = [
  "webpki-roots 0.26.1",
 ]
 
-[[package]]
-name = "toml"
-version = "0.8.23"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
-dependencies = [
- "serde",
- "serde_spanned 0.6.9",
- "toml_datetime 0.6.11",
- "toml_edit 0.22.27",
-]
-
 [[package]]
 name = "toml"
 version = "0.9.8"
@@ -11474,7 +11453,7 @@ checksum = "f0dc8b1fb61449e27716ec0e1bdf0f6b8f3e8f6b05391e8497b8b6d7804ea6d8"
 dependencies = [
  "indexmap 2.12.0",
  "serde_core",
- "serde_spanned 1.0.3",
+ "serde_spanned",
  "toml_datetime 0.7.3",
  "toml_parser",
  "toml_writer",
@@ -11486,9 +11465,6 @@ name = "toml_datetime"
 version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
-dependencies = [
- "serde",
-]
 
 [[package]]
 name = "toml_datetime"
@@ -11517,8 +11493,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
  "indexmap 2.12.0",
- "serde",
- "serde_spanned 0.6.9",
  "toml_datetime 0.6.11",
  "toml_write",
  "winnow 0.7.13",
@@ -12392,7 +12366,7 @@ dependencies = [
  "sha2",
  "strum 0.28.0",
  "tempfile",
- "toml 0.9.8",
+ "toml",
  "toml_edit 0.23.9",
  "vector-vrl-functions",
  "vrl",
@@ -12579,7 +12553,7 @@ dependencies = [
  "tokio-test",
  "tokio-tungstenite 0.20.1",
  "tokio-util",
- "toml 0.9.8",
+ "toml",
  "tonic 0.11.0",
  "tonic-build 0.11.0",
  "tonic-health",
@@ -12725,7 +12699,7 @@ dependencies = [
  "serde_json",
  "serde_with",
  "snafu 0.8.9",
- "toml 0.9.8",
+ "toml",
  "tracing 0.1.44",
  "url",
  "vector-config-common",
@@ -12825,7 +12799,7 @@ dependencies = [
  "tokio-stream",
  "tokio-test",
  "tokio-util",
- "toml 0.9.8",
+ "toml",
  "tonic 0.11.0",
  "tracing 0.1.44",
  "tracing-subscriber",
diff --git a/lib/vector-vrl/web-playground/Cargo.toml b/lib/vector-vrl/web-playground/Cargo.toml
index d84b2c8d69ad4..1c7fd0f360d64 100644
--- a/lib/vector-vrl/web-playground/Cargo.toml
+++ b/lib/vector-vrl/web-playground/Cargo.toml
@@ -23,4 +23,4 @@ enrichment = { path = "../enrichment" }
 getrandom = { version = "0.2.15", features = ["js"] }
 
 [build-dependencies]
-cargo-lock = "10.1.0"
+cargo-lock = "11.0.1"

From 97dfb6c6a870a162d07827706e85f5ee2fe3b3a9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 20 Mar 2026 09:53:12 -0400
Subject: [PATCH 035/326] chore(deps): bump const-str from 1.0.0 to 1.1.0
 (#24815)

Bumps [const-str](https://github.com/Nugine/const-str) from 1.0.0 to 1.1.0.
- [Release notes](https://github.com/Nugine/const-str/releases)
- [Commits](https://github.com/Nugine/const-str/compare/v1.0.0...v1.1.0)

---
updated-dependencies:
- dependency-name: const-str
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 4 ++--
 Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 5efa8b3da18ea..7f5b22746bac2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2766,9 +2766,9 @@ dependencies = [
 
 [[package]]
 name = "const-str"
-version = "1.0.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93e19f68b180ebff43d6d42005c4b5f046c65fcac28369ba8b3beaad633f9ec0"
+checksum = "18f12cc9948ed9604230cdddc7c86e270f9401ccbe3c2e98a4378c5e7632212f"
 
 [[package]]
 name = "convert_case"
diff --git a/Cargo.toml b/Cargo.toml
index b4565050babe5..fc2ba6790f508 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -155,7 +155,7 @@ chrono-tz = { version = "0.10.4", default-features = false, features = ["serde"]
 clap = { version = "4.5.60", default-features = false, features = ["derive", "error-context", "env", "help", "std", "string", "usage", "wrap_help"] }
 clap_complete = "4.5.66"
 colored = { version = "3.1.1", default-features = false }
-const-str = { version = "1.0.0", default-features = false }
+const-str = { version = "1.1.0", default-features = false }
 crossbeam-utils = { version = "0.8.21", default-features = false }
 darling = { version = "0.20.11", default-features = false, features = ["suggestions"] }
 dashmap = { version = "6.1.0", default-features = false }

From 18898e0149f43924a07554303cce3d0a4595eb5b Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 20 Mar 2026 13:22:10 -0400
Subject: [PATCH 036/326] chore(deps): bump quickcheck to 1.1.0 and use
 workspace dep (#24970)

* chore(deps): Bump quickcheck from 1.0.3 to 1.1.0

* Update generated VRL docs

* Update licenses

* chore(deps): enable wasm_js feature for getrandom 0.4 in web-playground

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
---
 Cargo.lock                               | 222 ++++++++++++++++++++---
 Cargo.toml                               |   3 +-
 LICENSE-3rdparty.csv                     |  15 +-
 lib/file-source-common/Cargo.toml        |   2 +-
 lib/file-source/Cargo.toml               |   2 +-
 lib/vector-buffers/Cargo.toml            |   2 +-
 lib/vector-core/Cargo.toml               |   2 +-
 lib/vector-vrl/web-playground/Cargo.toml |   1 +
 8 files changed, 218 insertions(+), 31 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 7f5b22746bac2..35f095a19e231 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2042,7 +2042,7 @@ checksum = "77e9d642a7e3a318e37c2c9427b5a6a48aa1ad55dcd986f3034ab2239045a645"
 dependencies = [
  "darling 0.21.3",
  "ident_case",
- "prettyplease 0.2.15",
+ "prettyplease 0.2.37",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "rustversion",
@@ -3858,16 +3858,6 @@ dependencies = [
  "regex",
 ]
 
-[[package]]
-name = "env_logger"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a19187fea3ac7e84da7dacf48de0c45d63c6a76f9490dae389aead16c243fce3"
-dependencies = [
- "log",
- "regex",
-]
-
 [[package]]
 name = "env_logger"
 version = "0.11.6"
@@ -4401,8 +4391,24 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "r-efi",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.0",
  "wasip2",
+ "wasip3",
  "wasm-bindgen",
 ]
 
@@ -5530,6 +5536,12 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
 [[package]]
 name = "ident_case"
 version = "1.0.1"
@@ -5919,7 +5931,7 @@ dependencies = [
 name = "k8s-e2e-tests"
 version = "0.1.0"
 dependencies = [
- "env_logger 0.11.6",
+ "env_logger",
  "futures 0.3.31",
  "indoc",
  "k8s-openapi",
@@ -6153,6 +6165,12 @@ dependencies = [
  "spin 0.5.2",
 ]
 
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
 [[package]]
 name = "lexical-core"
 version = "1.0.6"
@@ -8131,9 +8149,9 @@ dependencies = [
 
 [[package]]
 name = "prettyplease"
-version = "0.2.15"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae005bd773ab59b4725093fd7df83fd7892f7d8eafb48dbd7de6e024e4215f9d"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
 dependencies = [
  "proc-macro2 1.0.106",
  "syn 2.0.117",
@@ -8361,7 +8379,7 @@ dependencies = [
  "multimap",
  "once_cell",
  "petgraph",
- "prettyplease 0.2.15",
+ "prettyplease 0.2.37",
  "prost 0.12.6",
  "prost-types 0.12.6",
  "regex",
@@ -8381,7 +8399,7 @@ dependencies = [
  "multimap",
  "once_cell",
  "petgraph",
- "prettyplease 0.2.15",
+ "prettyplease 0.2.37",
  "prost 0.13.5",
  "prost-types 0.13.5",
  "regex",
@@ -8626,20 +8644,20 @@ dependencies = [
 
 [[package]]
 name = "quickcheck"
-version = "1.0.3"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "588f6378e4dd99458b60ec275b4477add41ce4fa9f64dcba6f15adccb19b50d6"
+checksum = "95c589f335db0f6aaa168a7cd27b1fc6920f5e1470c804f814d9cd6e62a0f70b"
 dependencies = [
- "env_logger 0.8.4",
+ "env_logger",
  "log",
- "rand 0.8.5",
+ "rand 0.10.0",
 ]
 
 [[package]]
 name = "quickcheck_macros"
-version = "1.1.0"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f71ee38b42f8459a88d3362be6f9b841ad2d5421844f61eb1c59c11bff3ac14a"
+checksum = "a9a28b8493dd664c8b171dd944da82d933f7d456b829bfb236738e1fe06c5ba4"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.44",
@@ -8729,6 +8747,12 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "radium"
 version = "0.7.0"
@@ -8766,6 +8790,16 @@ dependencies = [
  "rand_core 0.9.0",
 ]
 
+[[package]]
+name = "rand"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
+dependencies = [
+ "getrandom 0.4.2",
+ "rand_core 0.10.0",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@@ -8805,6 +8839,12 @@ dependencies = [
  "zerocopy 0.8.16",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c8d0fd677905edcbeedbf2edb6494d676f0e98d54d5cf9bda0b061cb8fb8aba"
+
 [[package]]
 name = "rand_distr"
 version = "0.5.1"
@@ -11614,7 +11654,7 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be4ef6dd70a610078cb4e338a0f79d06bc759ff1b22d2120c2ff02ae264ba9c2"
 dependencies = [
- "prettyplease 0.2.15",
+ "prettyplease 0.2.37",
  "proc-macro2 1.0.106",
  "prost-build 0.12.6",
  "quote 1.0.44",
@@ -12980,6 +13020,7 @@ dependencies = [
  "cargo-lock",
  "enrichment",
  "getrandom 0.2.15",
+ "getrandom 0.4.2",
  "gloo-utils",
  "serde",
  "vector-vrl-functions",
@@ -13198,7 +13239,16 @@ version = "1.0.1+wasi-0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0562428422c63773dad2c345a1882263bbf4d65cf3f42e90921f787ef5ad58e7"
 dependencies = [
- "wit-bindgen",
+ "wit-bindgen 0.46.0",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen 0.51.0",
 ]
 
 [[package]]
@@ -13264,6 +13314,28 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap 2.12.0",
+ "wasm-encoder",
+ "wasmparser",
+]
+
 [[package]]
 name = "wasm-streams"
 version = "0.4.0"
@@ -13277,6 +13349,18 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags 2.10.0",
+ "hashbrown 0.15.2",
+ "indexmap 2.12.0",
+ "semver",
+]
+
 [[package]]
 name = "wasmtimer"
 version = "0.4.3"
@@ -13999,6 +14083,94 @@ version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
 
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck 0.5.0",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck 0.5.0",
+ "indexmap 2.12.0",
+ "prettyplease 0.2.37",
+ "syn 2.0.117",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease 0.2.37",
+ "proc-macro2 1.0.106",
+ "quote 1.0.44",
+ "syn 2.0.117",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags 2.10.0",
+ "indexmap 2.12.0",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap 2.12.0",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid 0.2.4",
+ "wasmparser",
+]
+
 [[package]]
 name = "woothee"
 version = "0.13.0"
diff --git a/Cargo.toml b/Cargo.toml
index fc2ba6790f508..1cfdf70ae5530 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -185,6 +185,7 @@ prost = { version = "0.12", default-features = false, features = ["std"] }
 prost-build = { version = "0.12", default-features = false }
 prost-reflect = { version = "0.14", features = ["serde"], default-features = false }
 prost-types = { version = "0.12", default-features = false }
+quickcheck = { version = "1.1.0" }
 rand = { version = "0.9.2", default-features = false, features = ["small_rng", "thread_rng"] }
 rand_distr = { version = "0.5.1", default-features = false }
 regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
@@ -483,7 +484,7 @@ itertools.workspace = true
 libc.workspace = true
 mock_instant.workspace = true
 proptest.workspace = true
-quickcheck = "1.0.3"
+quickcheck.workspace = true
 reqwest.workspace = true
 rstest = { version = "0.26.1" }
 serial_test.workspace = true
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index bb490b1376fbe..72c0f17e00d3d 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -263,7 +263,8 @@ enum-ordinalize-derive,https://github.com/magiclen/enum-ordinalize,MIT,The enum-
 enum_dispatch,https://gitlab.com/antonok/enum_dispatch,MIT OR Apache-2.0,Anton Lazarev <https://antonok.com>
 enumflags2,https://github.com/meithecatte/enumflags2,MIT OR Apache-2.0,"maik klein <maikklein@googlemail.com>, Maja Kądziołka <maya@compilercrim.es>"
 enumflags2_derive,https://github.com/meithecatte/enumflags2,MIT OR Apache-2.0,"maik klein <maikklein@googlemail.com>, Maja Kądziołka <maya@compilercrim.es>"
-env_logger,https://github.com/env-logger-rs/env_logger,MIT OR Apache-2.0,The Rust Project Developers
+env_filter,https://github.com/rust-cli/env_logger,MIT OR Apache-2.0,The env_filter Authors
+env_logger,https://github.com/rust-cli/env_logger,MIT OR Apache-2.0,The env_logger Authors
 equivalent,https://github.com/cuviper/equivalent,Apache-2.0 OR MIT,The equivalent Authors
 erased-serde,https://github.com/dtolnay/erased-serde,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 errno,https://github.com/lambda-fairy/rust-errno,MIT OR Apache-2.0,Chris Wong <lambda.fairy@gmail.com>
@@ -382,6 +383,7 @@ icu_properties,https://github.com/unicode-org/icu4x,Unicode-3.0,The ICU4X Projec
 icu_properties_data,https://github.com/unicode-org/icu4x,Unicode-3.0,The ICU4X Project Developers
 icu_provider,https://github.com/unicode-org/icu4x,Unicode-3.0,The ICU4X Project Developers
 icu_provider_macros,https://github.com/unicode-org/icu4x,Unicode-3.0,The ICU4X Project Developers
+id-arena,https://github.com/fitzgen/id-arena,MIT OR Apache-2.0,"Nick Fitzgerald <fitzgen@gmail.com>, Aleksey Kladov <aleksey.kladov@gmail.com>"
 ident_case,https://github.com/TedDriggs/ident_case,MIT OR Apache-2.0,Ted Driggs <ted.driggs@outlook.com>
 idna,https://github.com/servo/rust-url,MIT OR Apache-2.0,The rust-url developers
 idna_adapter,https://github.com/hsivonen/idna_adapter,Apache-2.0 OR MIT,The rust-url developers
@@ -426,6 +428,7 @@ kube-runtime,https://github.com/kube-rs/kube,Apache-2.0,"clux <sszynrae@gmail.co
 lalrpop-util,https://github.com/lalrpop/lalrpop,Apache-2.0 OR MIT,Niko Matsakis <niko@alum.mit.edu>
 lapin,https://github.com/amqp-rs/lapin,MIT,"Geoffroy Couprie <geo.couprie@gmail.com>, Marc-Antoine Perennou <Marc-Antoine@Perennou.com>"
 lazy_static,https://github.com/rust-lang-nursery/lazy-static.rs,MIT OR Apache-2.0,Marvin Löbel <loebel.marvin@gmail.com>
+leb128fmt,https://github.com/bluk/leb128fmt,MIT OR Apache-2.0,Bryant Luk <code@bryantluk.com>
 lexical-core,https://github.com/Alexhuszagh/rust-lexical,MIT OR Apache-2.0,Alex Huszagh <ahuszagh@gmail.com>
 lexical-parse-float,https://github.com/Alexhuszagh/rust-lexical,MIT OR Apache-2.0,Alex Huszagh <ahuszagh@gmail.com>
 lexical-parse-integer,https://github.com/Alexhuszagh/rust-lexical,MIT OR Apache-2.0,Alex Huszagh <ahuszagh@gmail.com>
@@ -618,6 +621,7 @@ radix_trie,https://github.com/michaelsproul/rust_radix_trie,MIT,Michael Sproul <
 rand,https://github.com/rust-random/rand,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers"
 rand_chacha,https://github.com/rust-random/rand,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers, The CryptoCorrosion Contributors"
 rand_core,https://github.com/rust-random/rand,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers"
+rand_core,https://github.com/rust-random/rand_core,MIT OR Apache-2.0,The Rand Project Developers
 rand_distr,https://github.com/rust-random/rand_distr,MIT OR Apache-2.0,The Rand Project Developers
 rand_xorshift,https://github.com/rust-random/rngs,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers"
 ratatui,https://github.com/ratatui/ratatui,MIT,"Florian Dehau <work@fdehau.com>, The Ratatui Developers"
@@ -863,13 +867,17 @@ want,https://github.com/seanmonstar/want,MIT,Sean McArthur <sean@seanmonstar.com
 warp,https://github.com/seanmonstar/warp,MIT,Sean McArthur <sean@seanmonstar.com>
 wasi,https://github.com/bytecodealliance/wasi,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,The Cranelift Project Developers
 wasip2,https://github.com/bytecodealliance/wasi-rs,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,The wasip2 Authors
+wasip3,https://github.com/bytecodealliance/wasi-rs,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,The wasip3 Authors
 wasite,https://github.com/ardaku/wasite,Apache-2.0 OR BSL-1.0 OR MIT,The wasite Authors
 wasm-bindgen,https://github.com/wasm-bindgen/wasm-bindgen,MIT OR Apache-2.0,The wasm-bindgen Developers
 wasm-bindgen-futures,https://github.com/rustwasm/wasm-bindgen/tree/master/crates/futures,MIT OR Apache-2.0,The wasm-bindgen Developers
 wasm-bindgen-macro,https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/macro,MIT OR Apache-2.0,The wasm-bindgen Developers
 wasm-bindgen-macro-support,https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/macro-support,MIT OR Apache-2.0,The wasm-bindgen Developers
 wasm-bindgen-shared,https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/shared,MIT OR Apache-2.0,The wasm-bindgen Developers
+wasm-encoder,https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wasm-encoder,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,Nick Fitzgerald <fitzgen@gmail.com>
+wasm-metadata,https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wasm-metadata,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,The wasm-metadata Authors
 wasm-streams,https://github.com/MattiasBuelens/wasm-streams,MIT OR Apache-2.0,Mattias Buelens <mattias@buelens.com>
+wasmparser,https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wasmparser,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,Yury Delendik <ydelendik@mozilla.com>
 wasmtimer,https://github.com/whizsid/wasmtimer-rs,MIT,"WhizSid <whizsid@aol.com>, Pierre Krieger <pierre.krieger1708@gmail.com>"
 web-sys,https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/web-sys,MIT OR Apache-2.0,The wasm-bindgen Developers
 web-time,https://github.com/daxpedda/web-time,MIT OR Apache-2.0,The web-time Authors
@@ -913,6 +921,11 @@ windows_x86_64_msvc,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Mi
 winnow,https://github.com/winnow-rs/winnow,MIT,The winnow Authors
 winreg,https://github.com/gentoo90/winreg-rs,MIT,Igor Shaula <gentoo90@gmail.com>
 wit-bindgen,https://github.com/bytecodealliance/wit-bindgen,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,Alex Crichton <alex@alexcrichton.com>
+wit-bindgen-core,https://github.com/bytecodealliance/wit-bindgen,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,Alex Crichton <alex@alexcrichton.com>
+wit-bindgen-rust,https://github.com/bytecodealliance/wit-bindgen,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,Alex Crichton <alex@alexcrichton.com>
+wit-bindgen-rust-macro,https://github.com/bytecodealliance/wit-bindgen,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,Alex Crichton <alex@alexcrichton.com>
+wit-component,https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wit-component,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,Peter Huene <peter@huene.dev>
+wit-parser,https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wit-parser,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,Alex Crichton <alex@alexcrichton.com>
 woothee,https://github.com/woothee/woothee-rust,Apache-2.0,hhatto <hhatto.jp@gmail.com>
 write16,https://github.com/hsivonen/write16,Apache-2.0 OR MIT,The write16 Authors
 writeable,https://github.com/unicode-org/icu4x,Unicode-3.0,The ICU4X Project Developers
diff --git a/lib/file-source-common/Cargo.toml b/lib/file-source-common/Cargo.toml
index a53c52a27f6b8..e115f3a74bf52 100644
--- a/lib/file-source-common/Cargo.toml
+++ b/lib/file-source-common/Cargo.toml
@@ -26,6 +26,6 @@ vector-config = { path = "../vector-config", default-features = false }
 tokio = { workspace = true, features = ["full"] }
 
 [dev-dependencies]
-quickcheck = "1"
+quickcheck.workspace = true
 tempfile.workspace = true
 similar-asserts = "1.7.0"
diff --git a/lib/file-source/Cargo.toml b/lib/file-source/Cargo.toml
index 4b48b35b4f20e..7e8e6b6cd1153 100644
--- a/lib/file-source/Cargo.toml
+++ b/lib/file-source/Cargo.toml
@@ -25,5 +25,5 @@ async-compression = { version = "0.4.41", features = ["tokio", "gzip"] }
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["full"] }
-quickcheck = "1"
+quickcheck.workspace = true
 tempfile.workspace = true
diff --git a/lib/vector-buffers/Cargo.toml b/lib/vector-buffers/Cargo.toml
index 02b43c29e382f..9f712b573af9b 100644
--- a/lib/vector-buffers/Cargo.toml
+++ b/lib/vector-buffers/Cargo.toml
@@ -43,7 +43,7 @@ hdrhistogram = "7.5.4"
 metrics-tracing-context.workspace = true
 metrics-util = { workspace = true, features = ["debugging"] }
 proptest = "1.10"
-quickcheck = "1.0"
+quickcheck.workspace = true
 rand.workspace = true
 serde_yaml.workspace = true
 temp-dir = "0.1.16"
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index 1147ce8b63e1a..f36a5944c3ea5 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -80,7 +80,7 @@ base64 = "0.22.1"
 chrono-tz.workspace = true
 criterion = { version = "0.7.0", features = ["html_reports"] }
 env-test-util = "1.0.1"
-quickcheck = "1"
+quickcheck.workspace = true
 quickcheck_macros = "1"
 proptest = "1.10"
 similar-asserts = "1.7.0"
diff --git a/lib/vector-vrl/web-playground/Cargo.toml b/lib/vector-vrl/web-playground/Cargo.toml
index 1c7fd0f360d64..9b3fbd6392576 100644
--- a/lib/vector-vrl/web-playground/Cargo.toml
+++ b/lib/vector-vrl/web-playground/Cargo.toml
@@ -21,6 +21,7 @@ vector-vrl-functions.workspace = true
 enrichment = { path = "../enrichment" }
 # Required per https://docs.rs/getrandom/latest/getrandom/#webassembly-support
 getrandom = { version = "0.2.15", features = ["js"] }
+getrandom_v04 = { package = "getrandom", version = "0.4", features = ["wasm_js"] }
 
 [build-dependencies]
 cargo-lock = "11.0.1"

From 2097fc35d7dc8d3caee9607d563165374e312e21 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 20 Mar 2026 19:12:17 +0000
Subject: [PATCH 037/326] chore(deps): bump criterion from 0.7.0 to 0.8.2
 (#24803)

* chore(deps): bump criterion from 0.7.0 to 0.8.2

Bumps [criterion](https://github.com/criterion-rs/criterion.rs) from 0.7.0 to 0.8.2.
- [Release notes](https://github.com/criterion-rs/criterion.rs/releases)
- [Changelog](https://github.com/criterion-rs/criterion.rs/blob/master/CHANGELOG.md)
- [Commits](https://github.com/criterion-rs/criterion.rs/compare/criterion-plot-v0.7.0...criterion-v0.8.2)

---
updated-dependencies:
- dependency-name: criterion
  dependency-version: 0.8.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore(deps): make criterion a workspace dependency

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock                    | 29 +++++++++++++++++++++++++----
 Cargo.toml                    |  3 ++-
 lib/dnsmsg-parser/Cargo.toml  |  2 +-
 lib/tracing-limit/Cargo.toml  |  2 +-
 lib/vector-buffers/Cargo.toml |  2 +-
 lib/vector-core/Cargo.toml    |  2 +-
 6 files changed, 31 insertions(+), 9 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 35f095a19e231..75e89d42c3280 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -111,6 +111,15 @@ dependencies = [
  "alloc-no-stdlib",
 ]
 
+[[package]]
+name = "alloca"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5a7d05ea6aea7e9e64d25b9156ba2fee3fdd659e34e41063cd2fc7cd020d7f4"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
@@ -2920,10 +2929,11 @@ dependencies = [
 
 [[package]]
 name = "criterion"
-version = "0.7.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1c047a62b0cc3e145fa84415a3191f628e980b194c2755aa12300a4e6cbd928"
+checksum = "950046b2aa2492f9a536f5f4f9a3de7b9e2476e575e05bd6c333371add4d98f3"
 dependencies = [
+ "alloca",
  "anes",
  "cast",
  "ciborium",
@@ -2932,6 +2942,7 @@ dependencies = [
  "itertools 0.13.0",
  "num-traits",
  "oorandom",
+ "page_size",
  "plotters",
  "rayon",
  "regex",
@@ -2944,9 +2955,9 @@ dependencies = [
 
 [[package]]
 name = "criterion-plot"
-version = "0.6.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b1bcc0dc7dfae599d84ad0b1a55f80cde8af3725da8313b528da95ef783e338"
+checksum = "d8d80a2f4f5b554395e47b5d8305bc3d27813bacb73493eb1001e8f76dae29ea"
 dependencies = [
  "cast",
  "itertools 0.13.0",
@@ -7708,6 +7719,16 @@ dependencies = [
  "unicode-width 0.1.13",
 ]
 
+[[package]]
+name = "page_size"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d5b2194ed13191c1999ae0704b7839fb18384fa22e49b57eeaa97d79ce40da"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.0"
diff --git a/Cargo.toml b/Cargo.toml
index 1cfdf70ae5530..ed8631a6d1e94 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -156,6 +156,7 @@ clap = { version = "4.5.60", default-features = false, features = ["derive", "er
 clap_complete = "4.5.66"
 colored = { version = "3.1.1", default-features = false }
 const-str = { version = "1.1.0", default-features = false }
+criterion = "0.8"
 crossbeam-utils = { version = "0.8.21", default-features = false }
 darling = { version = "0.20.11", default-features = false, features = ["suggestions"] }
 dashmap = { version = "6.1.0", default-features = false }
@@ -479,7 +480,7 @@ approx = "0.5.1"
 assert_cmd = { version = "2.0.17", default-features = false }
 aws-smithy-runtime = { version = "1.8.3", default-features = false, features = ["tls-rustls"] }
 base64 = "0.22.1"
-criterion = { version = "0.7.0", features = ["html_reports", "async_tokio"] }
+criterion = { workspace = true, features = ["html_reports", "async_tokio"] }
 itertools.workspace = true
 libc.workspace = true
 mock_instant.workspace = true
diff --git a/lib/dnsmsg-parser/Cargo.toml b/lib/dnsmsg-parser/Cargo.toml
index 9861bd93718a8..b392579014ef1 100644
--- a/lib/dnsmsg-parser/Cargo.toml
+++ b/lib/dnsmsg-parser/Cargo.toml
@@ -15,7 +15,7 @@ hickory-proto.workspace = true
 snafu.workspace = true
 
 [dev-dependencies]
-criterion = "0.7"
+criterion.workspace = true
 
 [lib]
 bench = false
diff --git a/lib/tracing-limit/Cargo.toml b/lib/tracing-limit/Cargo.toml
index 2308c8ce81084..ba52c12fdea99 100644
--- a/lib/tracing-limit/Cargo.toml
+++ b/lib/tracing-limit/Cargo.toml
@@ -15,7 +15,7 @@ tracing-subscriber = { workspace = true, features = ["registry", "std"] }
 dashmap = { version = "6.1.0", default-features = false }
 
 [dev-dependencies]
-criterion = "0.7"
+criterion.workspace = true
 mock_instant.workspace = true
 serial_test.workspace = true
 tracing = "0.1.44"
diff --git a/lib/vector-buffers/Cargo.toml b/lib/vector-buffers/Cargo.toml
index 9f712b573af9b..04ad96436baf1 100644
--- a/lib/vector-buffers/Cargo.toml
+++ b/lib/vector-buffers/Cargo.toml
@@ -37,7 +37,7 @@ ordered-float.workspace = true
 
 [dev-dependencies]
 clap.workspace = true
-criterion = { version = "0.7", features = ["html_reports", "async_tokio"] }
+criterion = { workspace = true, features = ["html_reports", "async_tokio"] }
 crossbeam-queue = "0.3.12"
 hdrhistogram = "7.5.4"
 metrics-tracing-context.workspace = true
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index f36a5944c3ea5..a7e33377bc09c 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -78,7 +78,7 @@ prost-build.workspace = true
 [dev-dependencies]
 base64 = "0.22.1"
 chrono-tz.workspace = true
-criterion = { version = "0.7.0", features = ["html_reports"] }
+criterion = { workspace = true, features = ["html_reports"] }
 env-test-util = "1.0.1"
 quickcheck.workspace = true
 quickcheck_macros = "1"

From 2c334d223578ea17d7ca5bbbf305f21c9b68a7e2 Mon Sep 17 00:00:00 2001
From: Piotr Stalmach <61430212+Azyrys@users.noreply.github.com>
Date: Fri, 20 Mar 2026 21:07:16 +0100
Subject: [PATCH 038/326] enhancement(kafka sink): Add support for traces in
 kafka sink (#24639)

* add support for traces in kafka sink

* add changelog

* add suggestion

Made-with: Cursor

* fix fmt

Made-with: Cursor
---
 ...9_kafka_sink_add_traces_support.feature.md |   3 +
 src/sinks/kafka/config.rs                     |   3 +-
 src/sinks/kafka/request_builder.rs            |  37 ++++-
 src/sinks/kafka/tests.rs                      | 129 +++++++++++++++++-
 4 files changed, 160 insertions(+), 12 deletions(-)
 create mode 100644 changelog.d/24639_kafka_sink_add_traces_support.feature.md

diff --git a/changelog.d/24639_kafka_sink_add_traces_support.feature.md b/changelog.d/24639_kafka_sink_add_traces_support.feature.md
new file mode 100644
index 0000000000000..b89dff7437ff3
--- /dev/null
+++ b/changelog.d/24639_kafka_sink_add_traces_support.feature.md
@@ -0,0 +1,3 @@
+The `kafka` sink now supports trace events.
+
+authors: pstalmach
diff --git a/src/sinks/kafka/config.rs b/src/sinks/kafka/config.rs
index 67af212957d5b..b1e00a3e0c32c 100644
--- a/src/sinks/kafka/config.rs
+++ b/src/sinks/kafka/config.rs
@@ -288,8 +288,7 @@ impl SinkConfig for KafkaSinkConfig {
     fn input(&self) -> Input {
         let requirements = Requirement::empty().optional_meaning("timestamp", Kind::timestamp());
 
-        Input::new(self.encoding.config().input_type() & (DataType::Log | DataType::Metric))
-            .with_schema_requirement(requirements)
+        Input::new(self.encoding.config().input_type()).with_schema_requirement(requirements)
     }
 
     fn acknowledgements(&self) -> &AcknowledgementsConfig {
diff --git a/src/sinks/kafka/request_builder.rs b/src/sinks/kafka/request_builder.rs
index 23c67a1f40bb0..feb280bbcd864 100644
--- a/src/sinks/kafka/request_builder.rs
+++ b/src/sinks/kafka/request_builder.rs
@@ -67,28 +67,36 @@ impl RequestBuilder<(String, Event)> for KafkaRequestBuilder {
 fn get_key(event: &Event, key_field: Option<&OwnedTargetPath>) -> Option<Bytes> {
     key_field.and_then(|key_field| match event {
         Event::Log(log) => log.get(key_field).map(|value| value.coerce_to_bytes()),
+        Event::Trace(trace) => trace.get(key_field).map(|value| value.coerce_to_bytes()),
         Event::Metric(metric) => metric
             .tags()
             .and_then(|tags| tags.get(key_field.to_string().as_str()))
             .map(|value| value.to_owned().into()),
-        _ => None,
     })
 }
 
 fn get_timestamp_millis(event: &Event) -> Option<i64> {
     match &event {
         Event::Log(log) => log.get_timestamp().and_then(|v| v.as_timestamp()).copied(),
+        Event::Trace(trace) => trace
+            .as_ref()
+            .get_timestamp()
+            .and_then(|v| v.as_timestamp())
+            .copied(),
         Event::Metric(metric) => metric.timestamp(),
-        _ => None,
     }
     .map(|ts| ts.timestamp_millis())
 }
 
 fn get_headers(event: &Event, headers_key: Option<&OwnedTargetPath>) -> Option<OwnedHeaders> {
     headers_key.and_then(|headers_key| {
-        if let Event::Log(log) = event
-            && let Some(headers) = log.get(headers_key)
-        {
+        let headers = match event {
+            Event::Log(log) => log.get(headers_key),
+            Event::Trace(trace) => trace.get(headers_key),
+            Event::Metric(_) => None,
+        };
+
+        if let Some(headers) = headers {
             match headers {
                 Value::Object(headers_map) => {
                     let mut owned_headers = OwnedHeaders::new_with_capacity(headers_map.len());
@@ -123,7 +131,7 @@ mod tests {
     use rdkafka::message::Headers;
 
     use super::*;
-    use crate::event::{LogEvent, ObjectMap};
+    use crate::event::{LogEvent, ObjectMap, TraceEvent};
 
     #[test]
     fn kafka_get_headers() {
@@ -141,4 +149,21 @@ mod tests {
         assert_eq!(headers.get(1).key, "b-key");
         assert_eq!(headers.get(1).value.unwrap(), "b-value".as_bytes());
     }
+
+    #[test]
+    fn kafka_get_headers_trace() {
+        let headers_key = OwnedTargetPath::try_from("headers".to_string()).unwrap();
+        let mut header_values = ObjectMap::new();
+        header_values.insert("a-key".into(), Value::Bytes(Bytes::from("a-value")));
+        header_values.insert("b-key".into(), Value::Bytes(Bytes::from("b-value")));
+
+        let mut event = Event::Trace(TraceEvent::from(LogEvent::from("hello")));
+        event.as_mut_trace().insert(&headers_key, header_values);
+
+        let headers = get_headers(&event, Some(&headers_key)).unwrap();
+        assert_eq!(headers.get(0).key, "a-key");
+        assert_eq!(headers.get(0).value.unwrap(), "a-value".as_bytes());
+        assert_eq!(headers.get(1).key, "b-key");
+        assert_eq!(headers.get(1).value.unwrap(), "b-value".as_bytes());
+    }
 }
diff --git a/src/sinks/kafka/tests.rs b/src/sinks/kafka/tests.rs
index c3286ee71ce47..845b17e44061b 100644
--- a/src/sinks/kafka/tests.rs
+++ b/src/sinks/kafka/tests.rs
@@ -6,14 +6,14 @@ mod integration_test {
     use std::{collections::HashMap, future::ready, thread, time::Duration};
 
     use bytes::Bytes;
-    use futures::StreamExt;
+    use futures::{StreamExt, stream};
     use rdkafka::{
         Message, Offset, TopicPartitionList,
         consumer::{BaseConsumer, Consumer},
         message::Headers,
     };
     use vector_lib::{
-        codecs::TextSerializerConfig,
+        codecs::{JsonSerializerConfig, TextSerializerConfig},
         config::{Tags, Telemetry, init_telemetry},
         event::{BatchNotifier, BatchStatus},
         lookup::lookup_v2::ConfigTargetPath,
@@ -21,7 +21,7 @@ mod integration_test {
 
     use super::super::{config::KafkaSinkConfig, sink::KafkaSink, *};
     use crate::{
-        event::{ObjectMap, Value},
+        event::{ObjectMap, TraceEvent, Value},
         kafka::{KafkaAuthConfig, KafkaCompression, KafkaSaslConfig},
         sinks::prelude::*,
         test_util::{
@@ -29,7 +29,7 @@ mod integration_test {
                 DATA_VOLUME_SINK_TAGS, SINK_TAGS, assert_data_volume_sink_compliance,
                 assert_sink_compliance,
             },
-            random_lines_with_stream, random_string, wait_for,
+            map_event_batch_stream, random_lines_with_stream, random_string, wait_for,
         },
         tls::{TEST_PEM_INTERMEDIATE_CA_PATH, TlsConfig, TlsEnableableConfig},
     };
@@ -311,6 +311,127 @@ mod integration_test {
         .await;
     }
 
+    #[tokio::test]
+    async fn kafka_happy_path_trace_events() {
+        crate::test_util::trace_init();
+
+        assert_sink_compliance(&SINK_TAGS, async move {
+            let topic_prefix = format!("test-trace-{}", random_string(10));
+            let topic = format!("{}-{}", topic_prefix, chrono::Utc::now().format("%Y%m%d"));
+            let key_field = ConfigTargetPath::try_from("trace_key".to_string()).unwrap();
+            let headers_key = ConfigTargetPath::try_from("trace_headers".to_string()).unwrap();
+            let trace_key = "trace-partition-key";
+            let header_key = "trace-header-key";
+            let header_value = "trace-header-value";
+
+            let config = KafkaSinkConfig {
+                bootstrap_servers: kafka_address(9091),
+                topic: Template::try_from(format!("{topic_prefix}-%Y%m%d")).unwrap(),
+                healthcheck_topic: None,
+                key_field: Some(key_field.clone()),
+                encoding: JsonSerializerConfig::default().into(),
+                batch: BatchConfig::default(),
+                compression: KafkaCompression::None,
+                auth: KafkaAuthConfig::default(),
+                socket_timeout_ms: Duration::from_millis(60000),
+                message_timeout_ms: Duration::from_millis(300000),
+                rate_limit_duration_secs: 1,
+                rate_limit_num: i64::MAX as u64,
+                librdkafka_options: HashMap::new(),
+                headers_key: Some(headers_key.clone()),
+                acknowledgements: Default::default(),
+            };
+
+            let num_events = 100;
+            let mut expected_messages = Vec::with_capacity(num_events);
+
+            let (batch, receiver) = BatchNotifier::new_with_receiver();
+            let mut events = Vec::with_capacity(num_events);
+            for i in 0..num_events {
+                let message = format!("trace-message-{i}");
+                expected_messages.push(message.clone());
+
+                let mut trace = TraceEvent::default();
+                trace.insert("message", message);
+                trace.insert("trace_key", trace_key);
+                trace.insert("timestamp", chrono::Utc::now());
+
+                let mut trace_headers = ObjectMap::new();
+                trace_headers.insert(header_key.into(), Value::Bytes(Bytes::from(header_value)));
+                trace.insert(&headers_key, trace_headers);
+
+                events.push(Event::Trace(trace.with_batch_notifier(&batch)));
+            }
+
+            let sink = KafkaSink::new(config).unwrap();
+            let sink = VectorSink::from_event_streamsink(sink);
+            let stream = map_event_batch_stream(stream::iter(events), Some(batch));
+            sink.run(stream).await.unwrap();
+            assert_eq!(receiver.await, BatchStatus::Delivered);
+
+            // Read back everything from the beginning.
+            let mut client_config = rdkafka::ClientConfig::new();
+            client_config.set("bootstrap.servers", kafka_address(9091).as_str());
+            client_config.set("group.id", random_string(10));
+            client_config.set("enable.partition.eof", "true");
+            let mut tpl = TopicPartitionList::new();
+            tpl.add_partition(&topic, 0)
+                .set_offset(Offset::Beginning)
+                .unwrap();
+            let consumer: BaseConsumer = client_config.create().unwrap();
+            consumer.assign(&tpl).unwrap();
+
+            wait_for(
+                || match consumer.fetch_watermarks(&topic, 0, Duration::from_secs(3)) {
+                    Ok((_low, high)) => ready(high >= num_events as i64),
+                    Err(err) => {
+                        println!("retrying due to error fetching watermarks: {err}");
+                        ready(false)
+                    }
+                },
+            )
+            .await;
+
+            let (low, high) = consumer
+                .fetch_watermarks(&topic, 0, Duration::from_secs(3))
+                .unwrap();
+            assert_eq!((0, num_events as i64), (low, high));
+
+            let mut failures = 0;
+            let mut observed_messages = Vec::new();
+            while failures < 100 {
+                match consumer.poll(Duration::from_secs(3)) {
+                    Some(Ok(msg)) => {
+                        let payload: &str = msg.payload_view().unwrap().unwrap();
+                        let payload_json: serde_json::Value =
+                            serde_json::from_str(payload).unwrap();
+                        observed_messages
+                            .push(payload_json["message"].as_str().unwrap().to_owned());
+
+                        let key = msg.key().unwrap();
+                        assert_eq!(key, trace_key.as_bytes());
+
+                        let timestamp = msg.timestamp().to_millis();
+                        assert!(timestamp.is_some());
+
+                        let header = msg.headers().unwrap().get(0);
+                        assert_eq!(header.key, header_key);
+                        assert_eq!(header.value.unwrap(), header_value.as_bytes());
+                    }
+                    None if observed_messages.len() >= num_events => break,
+                    _ => {
+                        failures += 1;
+                        thread::sleep(Duration::from_millis(50));
+                    }
+                }
+            }
+
+            assert_eq!(observed_messages.len(), num_events);
+            assert_eq!(observed_messages, expected_messages);
+        })
+        .await;
+    }
+
     async fn kafka_happy_path(
         server: String,
         sasl: Option<KafkaSaslConfig>,

From c748d6f9e19632cb64f666058794aa2d9004926f Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 20 Mar 2026 18:28:58 -0400
Subject: [PATCH 039/326] fix(ci): use cargo nextest in coverage workflow to
 prevent test pollution (#24973)

* fix(ci): use cargo nextest in coverage workflow to prevent test pollution

* Add libsasl2 and protoc

* fix(ci): drop --all-features from coverage to avoid integration tests
---
 .github/workflows/coverage.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 7afeaa70f1c35..a4a4c39d4f760 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -22,11 +22,14 @@ jobs:
       - uses: ./.github/actions/setup
         with:
           rust: true
+          libsasl2: true
+          protoc: true
           cargo-llvm-cov: true
+          cargo-nextest: true
           datadog-ci: true
 
       - name: "Generate code coverage"
-        run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
+        run: cargo llvm-cov nextest --workspace --lcov --output-path lcov.info
 
       - name: "Upload coverage to Datadog"
         env:

From 4d8ca64dbbbc2434bd4a69a3d46705c3fad6a56c Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 23 Mar 2026 13:53:30 -0400
Subject: [PATCH 040/326] chore(dev): pin localstack image to SHA256 digest
 (#24988)

chore(aws integration): pin localstack image to SHA256 digest
---
 tests/integration/aws/config/compose.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/integration/aws/config/compose.yaml b/tests/integration/aws/config/compose.yaml
index 202fdfb94e4cd..4fbbd62f6e120 100644
--- a/tests/integration/aws/config/compose.yaml
+++ b/tests/integration/aws/config/compose.yaml
@@ -4,7 +4,7 @@ services:
   mock-ec2-metadata:
     image: public.ecr.aws/aws-ec2/amazon-ec2-metadata-mock:v1.13.0
   mock-localstack:
-    image: docker.io/localstack/localstack:stable
+    image: docker.io/localstack/localstack@sha256:46302bcb91a7e8008e6394be8afafdbfa40fb77a54d4046a38be35992042d5de
     environment:
     - SERVICES=kinesis,s3,cloudwatch,es,firehose,kms,sqs,sns,logs
   mock-ecs:

From 6ef3752d12be1e8de38449df30f953f75301f64f Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 23 Mar 2026 12:52:03 -0400
Subject: [PATCH 041/326] chore(deps): remove futures features and resolve
 RUSTSEC-2026-0058 (#24975)

chore(deps): remove futures compat and io-compat features (RUSTSEC-2026-0058)
---
 Cargo.lock           | 284 +++++++++++++++++++------------------------
 Cargo.toml           |   2 +-
 LICENSE-3rdparty.csv |   4 -
 3 files changed, 124 insertions(+), 166 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 75e89d42c3280..feb1b17a72aaa 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -403,7 +403,7 @@ version = "56.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e003216336f70446457e280807a73899dd822feaf02087d31febca1363e2fccc"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "half",
  "num",
 ]
@@ -680,7 +680,7 @@ dependencies = [
  "async-stream",
  "async-trait",
  "base64 0.22.1",
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "fnv",
  "futures-timer",
@@ -734,7 +734,7 @@ version = "7.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34ecdaff7c9cffa3614a9f9999bf9ee4c3078fe3ce4d6a6e161736b56febf2de"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "indexmap 2.12.0",
  "serde",
  "serde_json",
@@ -810,8 +810,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08f6da6d49a956424ca4e28fe93656f790d748b469eaccbc7488fec545315180"
 dependencies = [
  "base64 0.22.1",
- "bytes 1.11.1",
- "futures 0.3.31",
+ "bytes",
+ "futures",
  "memchr",
  "nkeys",
  "nuid",
@@ -992,7 +992,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "hex",
  "http 1.3.1",
@@ -1031,7 +1031,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "bytes-utils",
  "fastrand",
  "http 0.2.12",
@@ -1089,7 +1089,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "http 0.2.12",
  "http 1.3.1",
@@ -1113,7 +1113,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "http 0.2.12",
  "http 1.3.1",
@@ -1137,7 +1137,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "http 0.2.12",
  "http 1.3.1",
@@ -1162,7 +1162,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "http 0.2.12",
  "http 1.3.1",
@@ -1186,7 +1186,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "http 0.2.12",
  "http 1.3.1",
@@ -1214,7 +1214,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "hex",
  "hmac",
@@ -1245,7 +1245,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "http 0.2.12",
  "http 1.3.1",
@@ -1294,7 +1294,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "http 0.2.12",
  "http 1.3.1",
@@ -1318,7 +1318,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "http 0.2.12",
  "http 1.3.1",
@@ -1342,7 +1342,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "http 0.2.12",
  "http 1.3.1",
@@ -1386,7 +1386,7 @@ dependencies = [
  "aws-smithy-http",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
- "bytes 1.11.1",
+ "bytes",
  "form_urlencoded",
  "hex",
  "hmac",
@@ -1427,7 +1427,7 @@ checksum = "6750f3dd509b0694a4377f0293ed2f9630d710b1cebe281fa8bac8f099f88bc6"
 dependencies = [
  "aws-smithy-http",
  "aws-smithy-types",
- "bytes 1.11.1",
+ "bytes",
  "crc-fast",
  "hex",
  "http 1.3.1",
@@ -1448,7 +1448,7 @@ checksum = "f77bf78b73a78930daa91cac3974be3ad935fcdf10cc1413a108efb7c79a645a"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
- "bytes 1.11.1",
+ "bytes",
  "flate2",
  "futures-util",
  "http 1.3.1",
@@ -1465,7 +1465,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf09d74e5e32f76b8762da505a3cd59303e367a664ca67295387baa8c1d7548"
 dependencies = [
  "aws-smithy-types",
- "bytes 1.11.1",
+ "bytes",
  "crc32fast",
 ]
 
@@ -1478,7 +1478,7 @@ dependencies = [
  "aws-smithy-eventstream",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
- "bytes 1.11.1",
+ "bytes",
  "bytes-utils",
  "futures-core",
  "futures-util",
@@ -1553,7 +1553,7 @@ dependencies = [
  "aws-smithy-observability",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
- "bytes 1.11.1",
+ "bytes",
  "fastrand",
  "http 0.2.12",
  "http 1.3.1",
@@ -1574,7 +1574,7 @@ checksum = "876ab3c9c29791ba4ba02b780a3049e21ec63dabda09268b175272c3733a79e6"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-types",
- "bytes 1.11.1",
+ "bytes",
  "http 0.2.12",
  "http 1.3.1",
  "pin-project-lite",
@@ -1590,7 +1590,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2b1117b3b2bbe166d11199b540ceed0d0f7676e36e7b962b5a437a9971eac75"
 dependencies = [
  "base64-simd",
- "bytes 1.11.1",
+ "bytes",
  "bytes-utils",
  "futures-core",
  "http 0.2.12",
@@ -1641,7 +1641,7 @@ dependencies = [
  "async-trait",
  "axum-core 0.3.4",
  "bitflags 1.3.2",
- "bytes 1.11.1",
+ "bytes",
  "futures-util",
  "http 0.2.12",
  "http-body 0.4.6",
@@ -1669,7 +1669,7 @@ checksum = "3a6c9af12842a67734c9a2e355436e5d03b22383ed60cf13cd0c18fbfe3dcbcf"
 dependencies = [
  "async-trait",
  "axum-core 0.4.5",
- "bytes 1.11.1",
+ "bytes",
  "futures-util",
  "http 1.3.1",
  "http-body 1.0.1",
@@ -1695,7 +1695,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "759fa577a247914fd3f7f76d62972792636412fbfd634cd452f6a385a74d2d2c"
 dependencies = [
  "async-trait",
- "bytes 1.11.1",
+ "bytes",
  "futures-util",
  "http 0.2.12",
  "http-body 0.4.6",
@@ -1712,7 +1712,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
 dependencies = [
  "async-trait",
- "bytes 1.11.1",
+ "bytes",
  "futures-util",
  "http 1.3.1",
  "http-body 1.0.1",
@@ -1734,8 +1734,8 @@ dependencies = [
  "async-lock 3.4.0",
  "async-trait",
  "azure_core_macros",
- "bytes 1.11.1",
- "futures 0.3.31",
+ "bytes",
+ "futures",
  "openssl",
  "pin-project",
  "rustc_version",
@@ -1767,7 +1767,7 @@ dependencies = [
  "async-lock 3.4.0",
  "async-trait",
  "azure_core",
- "futures 0.3.31",
+ "futures",
  "pin-project",
  "serde",
  "time",
@@ -1988,7 +1988,7 @@ checksum = "8796b390a5b4c86f9f2e8173a68c2791f4fa6b038b84e96dbc01c016d1e6722c"
 dependencies = [
  "base64 0.22.1",
  "bollard-stubs",
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "futures-core",
  "futures-util",
@@ -2199,16 +2199,6 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
-[[package]]
-name = "bytes"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "206fdffcfa2df7cbe15601ef46c813fce0965eb3286db6b56c583b814b51c81c"
-dependencies = [
- "byteorder",
- "iovec",
-]
-
 [[package]]
 name = "bytes"
 version = "1.11.1"
@@ -2224,7 +2214,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e47d3a8076e283f3acd27400535992edb3ba4b5bb72f8891ad8fbe7932a7d4b9"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "either",
 ]
 
@@ -2527,14 +2517,14 @@ dependencies = [
  "apache-avro 0.20.0",
  "arrow",
  "async-trait",
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "csv-core",
  "derivative",
  "derive_more 2.1.1",
  "dyn-clone",
  "flate2",
- "futures 0.3.31",
+ "futures",
  "indoc",
  "influxdb-line-protocol",
  "memchr",
@@ -2618,7 +2608,7 @@ version = "4.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35ed6e9d84f0b51a7f52daf1c7d71dd136fd7a3f41a8462b8cdb8c78d920fad4"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "futures-core",
  "memchr",
  "pin-project-lite",
@@ -3547,7 +3537,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "chrono-tz",
  "dnsmsg-parser",
@@ -3599,7 +3589,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a11dd7f04a6a6d2aea0153c6e31f5ea7af8b2efdf52cdaeea7a9a592c7fefef9"
 dependencies = [
  "bumpalo",
- "bytes 1.11.1",
+ "bytes",
  "domain-macros",
  "futures-util",
  "hashbrown 0.14.5",
@@ -4053,10 +4043,10 @@ name = "file-source"
 version = "0.1.0"
 dependencies = [
  "async-compression",
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "file-source-common",
- "futures 0.3.31",
+ "futures",
  "futures-util",
  "glob",
  "indexmap 2.12.0",
@@ -4075,7 +4065,7 @@ version = "0.1.0"
 dependencies = [
  "async-compression",
  "bstr 1.12.1",
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "crc",
  "dashmap",
@@ -4242,12 +4232,6 @@ version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
-[[package]]
-name = "futures"
-version = "0.1.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a471a38ef8ed83cd6e40aa59c1ffe17db6855c18e3604d9c4ed8c08ebc28678"
-
 [[package]]
 name = "futures"
 version = "0.3.31"
@@ -4355,7 +4339,6 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 dependencies = [
- "futures 0.1.31",
  "futures-channel",
  "futures-core",
  "futures-io",
@@ -4366,7 +4349,6 @@ dependencies = [
  "pin-project-lite",
  "pin-utils",
  "slab",
- "tokio-io",
 ]
 
 [[package]]
@@ -4476,7 +4458,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b1f1228623a5a37d4834f984573a01086708b109bbf0f7c2ee8d70b0c90d7a5"
 dependencies = [
  "arc-swap",
- "futures 0.3.31",
+ "futures",
  "log",
  "reqwest 0.12.28",
  "serde",
@@ -4590,7 +4572,7 @@ dependencies = [
  "dashmap",
  "derive_builder",
  "enum_dispatch",
- "futures 0.3.31",
+ "futures",
  "futures-util",
  "greptime-proto",
  "parking_lot",
@@ -4631,7 +4613,7 @@ version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
@@ -4651,7 +4633,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
 dependencies = [
  "atomic-waker",
- "bytes 1.11.1",
+ "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
@@ -4757,7 +4739,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06683b93020a07e3dbcf5f8c0f6d40080d725bea7936fc01ad345c01b97dc270"
 dependencies = [
  "base64 0.21.7",
- "bytes 1.11.1",
+ "bytes",
  "headers-core",
  "http 0.2.12",
  "httpdate",
@@ -4824,7 +4806,7 @@ version = "0.1.0-rc.1"
 source = "git+https://github.com/vectordotdev/heim.git?branch=update-deps#b62e0420231552ef079e86ecff1e6b98def6a553"
 dependencies = [
  "cfg-if",
- "futures 0.3.31",
+ "futures",
  "glob",
  "heim-common",
  "heim-runtime",
@@ -4904,7 +4886,7 @@ name = "heim-runtime"
 version = "0.1.0-rc.1"
 source = "git+https://github.com/vectordotdev/heim.git?branch=update-deps#b62e0420231552ef079e86ecff1e6b98def6a553"
 dependencies = [
- "futures 0.3.31",
+ "futures",
  "futures-timer",
  "once_cell",
  "smol",
@@ -5077,7 +5059,7 @@ version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "fnv",
  "itoa",
 ]
@@ -5088,7 +5070,7 @@ version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "fnv",
  "itoa",
 ]
@@ -5099,7 +5081,7 @@ version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "http 0.2.12",
  "pin-project-lite",
 ]
@@ -5110,7 +5092,7 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "http 1.3.1",
 ]
 
@@ -5120,7 +5102,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "futures-core",
  "http 1.3.1",
  "http-body 1.0.1",
@@ -5167,7 +5149,7 @@ version = "0.14.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "futures-channel",
  "futures-core",
  "futures-util",
@@ -5192,7 +5174,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eb3aa54a13a0dfe7fbe3a59e0c76093041720fdc77b110cc0fc260fafb4dc51e"
 dependencies = [
  "atomic-waker",
- "bytes 1.11.1",
+ "bytes",
  "futures-channel",
  "futures-core",
  "h2 0.4.13",
@@ -5266,8 +5248,8 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca815a891b24fdfb243fa3239c86154392b0953ee584aa1a2a1f66d20cbe75cc"
 dependencies = [
- "bytes 1.11.1",
- "futures 0.3.31",
+ "bytes",
+ "futures",
  "headers",
  "http 0.2.12",
  "hyper 0.14.32",
@@ -5342,7 +5324,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "hyper 0.14.32",
  "native-tls",
  "tokio",
@@ -5355,7 +5337,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "http-body-util",
  "hyper 1.7.0",
  "hyper-util",
@@ -5372,7 +5354,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c6995591a8f1380fcb4ba966a252a4b29188d51d2b89e3a252f5305be65aea8"
 dependencies = [
  "base64 0.22.1",
- "bytes 1.11.1",
+ "bytes",
  "futures-channel",
  "futures-core",
  "futures-util",
@@ -5632,7 +5614,7 @@ version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22fa7ee6be451ea0b1912b962c91c8380835e97cf1584a77e18264e908448dcb"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "log",
  "nom 7.1.3",
  "smallvec",
@@ -5688,15 +5670,6 @@ dependencies = [
  "rustversion",
 ]
 
-[[package]]
-name = "iovec"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2b3ea6ff95e175473f8ffe6a7eb7c00d054240321b84c57051175fe3c1e075e"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "ipconfig"
 version = "0.3.2"
@@ -5943,7 +5916,7 @@ name = "k8s-e2e-tests"
 version = "0.1.0"
 dependencies = [
  "env_logger",
- "futures 0.3.31",
+ "futures",
  "indoc",
  "k8s-openapi",
  "k8s-test-framework",
@@ -6046,9 +6019,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "af97b8b696eb737e5694f087c498ca725b172c2a5bc3a6916328d160225537ee"
 dependencies = [
  "base64 0.22.1",
- "bytes 1.11.1",
+ "bytes",
  "either",
- "futures 0.3.31",
+ "futures",
  "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
@@ -6103,7 +6076,7 @@ dependencies = [
  "async-stream",
  "backon",
  "educe",
- "futures 0.3.31",
+ "futures",
  "hashbrown 0.16.0",
  "hostname 0.4.2",
  "json-patch",
@@ -6937,7 +6910,7 @@ version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a15d522be0a9c3e46fd2632e272d178f56387bdb5c9fbb3a36c649062e9b5219"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "encoding_rs",
  "futures-util",
  "http 1.3.1",
@@ -7449,7 +7422,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "126c3ca37c9c44cec575247f43a3e4374d8927684f129d2beeb0d2cef262fe12"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "serde",
  "smallvec",
 ]
@@ -7516,9 +7489,9 @@ dependencies = [
  "anyhow",
  "backon",
  "base64 0.22.1",
- "bytes 1.11.1",
+ "bytes",
  "chrono",
- "futures 0.3.31",
+ "futures",
  "getrandom 0.2.15",
  "http 1.3.1",
  "http-body 1.0.1",
@@ -7622,7 +7595,7 @@ dependencies = [
 name = "opentelemetry-proto"
 version = "0.1.0"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "glob",
  "hex",
@@ -8080,7 +8053,7 @@ checksum = "3ee9dd5fe15055d2b6806f4736aa0c9637217074e224bbec46d4041b91bb9491"
 dependencies = [
  "base64 0.22.1",
  "byteorder",
- "bytes 1.11.1",
+ "bytes",
  "fallible-iterator",
  "hmac",
  "md-5",
@@ -8096,7 +8069,7 @@ version = "0.2.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54b858f82211e84682fecd373f68e1ceae642d8d751a1ebd13f33de6257b3e20"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "fallible-iterator",
  "postgres-protocol",
@@ -8341,7 +8314,7 @@ version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b82eaa1d779e9a4bc1c3217db8ffbeabaae1dca241bf70183242128d48681cd"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "prost-derive 0.11.9",
 ]
 
@@ -8351,7 +8324,7 @@ version = "0.12.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "deb1435c188b76130da55f17a466d252ff7b1418b2ad3e037d127b94e3411f29"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "prost-derive 0.12.6",
 ]
 
@@ -8361,7 +8334,7 @@ version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "prost-derive 0.13.5",
 ]
 
@@ -8371,7 +8344,7 @@ version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "119533552c9a7ffacc21e099c24a0ac8bb19c2a2a3f363de84cd9b844feab270"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "heck 0.4.1",
  "itertools 0.10.5",
  "lazy_static",
@@ -8393,7 +8366,7 @@ version = "0.12.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22505a5c94da8e3b7c2996394d1c933236c4d743e81a410bcca4e6989fc066a4"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "heck 0.5.0",
  "itertools 0.12.1",
  "log",
@@ -8561,12 +8534,12 @@ checksum = "24c00856d6c64af2078a74c2de029842cdaece2f35b1223f5166809ea49cf5cd"
 dependencies = [
  "async-channel",
  "async-trait",
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "crc",
  "data-url",
  "flate2",
- "futures 0.3.31",
+ "futures",
  "log",
  "lz4",
  "murmur3",
@@ -8691,7 +8664,7 @@ version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "62e96808277ec6f97351a2380e6c25114bc9e67037775464979f3037c92d05ef"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
@@ -8709,7 +8682,7 @@ version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "getrandom 0.3.4",
  "lru-slab",
  "rand 0.9.2",
@@ -9032,7 +9005,7 @@ checksum = "7cd3650deebc68526b304898b192fa4102a4ef0b9ada24da096559cb60e0eef8"
 dependencies = [
  "arc-swap",
  "backon",
- "bytes 1.11.1",
+ "bytes",
  "cfg-if",
  "combine 4.6.6",
  "futures-channel",
@@ -9221,7 +9194,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78bf93c4af7a8bb7d879d51cebe797356ff10ae8516ace542b5182d9dcac10b2"
 dependencies = [
  "base64 0.21.7",
- "bytes 1.11.1",
+ "bytes",
  "encoding_rs",
  "futures-core",
  "futures-util",
@@ -9261,7 +9234,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
  "base64 0.22.1",
- "bytes 1.11.1",
+ "bytes",
  "cookie",
  "cookie_store",
  "encoding_rs",
@@ -9329,7 +9302,7 @@ checksum = "105747e3a037fe5bf17458d794de91149e575b6183fc72c85623a44abb9683f5"
 dependencies = [
  "anyhow",
  "async-trait",
- "futures 0.3.31",
+ "futures",
  "getrandom 0.2.15",
  "http 1.3.1",
  "hyper 1.7.0",
@@ -9388,7 +9361,7 @@ checksum = "2297bf9c81a3f0dc96bc9521370b88f054168c29826a75e89c55ff196e7ed6a1"
 dependencies = [
  "bitvec",
  "bytecheck",
- "bytes 1.11.1",
+ "bytes",
  "hashbrown 0.12.3",
  "ptr_meta",
  "rend",
@@ -9519,7 +9492,7 @@ version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1568e15fab2d546f940ed3a21f48bbbd1c494c90c99c4481339364a497f94a9"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "flume 0.11.0",
  "futures-util",
  "log",
@@ -9539,7 +9512,7 @@ checksum = "35affe401787a9bd846712274d97654355d21b2a2c092a3139aabe31e9022282"
 dependencies = [
  "arrayvec",
  "borsh",
- "bytes 1.11.1",
+ "bytes",
  "num-traits",
  "rand 0.8.5",
  "rkyv",
@@ -10152,7 +10125,7 @@ version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b258109f244e1d6891bf1053a55d63a5cd4f8f4c30cf9a1280989f80e7a1fa9"
 dependencies = [
- "futures 0.3.31",
+ "futures",
  "log",
  "once_cell",
  "parking_lot",
@@ -10529,7 +10502,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
 dependencies = [
  "base64 0.22.1",
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "crc",
  "crossbeam-queue",
@@ -10607,7 +10580,7 @@ dependencies = [
  "base64 0.22.1",
  "bitflags 2.10.0",
  "byteorder",
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "crc",
  "digest",
@@ -11289,7 +11262,7 @@ version = "1.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "libc",
  "mio",
  "parking_lot",
@@ -11301,17 +11274,6 @@ dependencies = [
  "windows-sys 0.61.0",
 ]
 
-[[package]]
-name = "tokio-io"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57fc868aae093479e3131e3d165c93b1c7474109d13c90ec0dda2a1bbfff0674"
-dependencies = [
- "bytes 0.4.12",
- "futures 0.1.31",
- "log",
-]
-
 [[package]]
 name = "tokio-io-timeout"
 version = "1.2.0"
@@ -11362,7 +11324,7 @@ checksum = "2b40d66d9b2cfe04b628173409368e58247e8eddbbd3b0e6c6ba1d09f20f6c9e"
 dependencies = [
  "async-trait",
  "byteorder",
- "bytes 1.11.1",
+ "bytes",
  "fallible-iterator",
  "futures-channel",
  "futures-util",
@@ -11476,7 +11438,7 @@ version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "futures-core",
  "futures-io",
  "futures-sink",
@@ -11492,7 +11454,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f591660438b3038dd04d16c938271c79e7e06260ad2ea2885a4861bfb238605d"
 dependencies = [
  "base64 0.22.1",
- "bytes 1.11.1",
+ "bytes",
  "futures-core",
  "futures-sink",
  "http 1.3.1",
@@ -11603,7 +11565,7 @@ dependencies = [
  "async-trait",
  "axum 0.6.20",
  "base64 0.21.7",
- "bytes 1.11.1",
+ "bytes",
  "flate2",
  "h2 0.3.26",
  "http 0.2.12",
@@ -11636,7 +11598,7 @@ dependencies = [
  "async-trait",
  "axum 0.7.5",
  "base64 0.22.1",
- "bytes 1.11.1",
+ "bytes",
  "h2 0.4.13",
  "http 1.3.1",
  "http-body 1.0.1",
@@ -11742,7 +11704,7 @@ checksum = "61c5bb1d698276a2443e5ecfabc1008bf15a36c12e6a7176e7bf089ea9131140"
 dependencies = [
  "async-compression",
  "bitflags 2.10.0",
- "bytes 1.11.1",
+ "bytes",
  "futures-core",
  "futures-util",
  "http 0.2.12",
@@ -11765,7 +11727,7 @@ dependencies = [
  "async-compression",
  "base64 0.22.1",
  "bitflags 2.10.0",
- "bytes 1.11.1",
+ "bytes",
  "futures-core",
  "futures-util",
  "http 1.3.1",
@@ -11876,7 +11838,7 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97d095ae15e245a057c8e8451bab9b3ee1e1f68e9ba2b4fbc18d0ac5237835f2"
 dependencies = [
- "futures 0.3.31",
+ "futures",
  "futures-task",
  "pin-project",
  "tracing 0.1.44",
@@ -11972,7 +11934,7 @@ name = "tracing-tower"
 version = "0.1.0"
 source = "git+https://github.com/tokio-rs/tracing?rev=e0642d949891546a3bb7e47080365ee7274f05cd#e0642d949891546a3bb7e47080365ee7274f05cd"
 dependencies = [
- "futures 0.3.31",
+ "futures",
  "tower-service",
  "tracing 0.2.0",
  "tracing-futures 0.3.0",
@@ -12007,7 +11969,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e3dac10fd62eaf6617d3a904ae222845979aec67c615d1c842b4002c7666fb9"
 dependencies = [
  "byteorder",
- "bytes 1.11.1",
+ "bytes",
  "data-encoding",
  "http 0.2.12",
  "httparse",
@@ -12026,7 +11988,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ef1a641ea34f399a848dea702823bbecfb4c486f911735368f1f137cb8257e1"
 dependencies = [
  "byteorder",
- "bytes 1.11.1",
+ "bytes",
  "data-encoding",
  "http 1.3.1",
  "httparse",
@@ -12097,8 +12059,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44f91ea93fdd5fd4985fcc0a197ed8e8da18705912bef63c9b9b3148d6f35510"
 dependencies = [
  "base64 0.22.1",
- "bytes 1.11.1",
- "futures 0.3.31",
+ "bytes",
+ "futures",
  "quick-xml 0.38.4",
  "serde",
  "serde_json",
@@ -12114,7 +12076,7 @@ dependencies = [
  "async-trait",
  "base64 0.22.1",
  "dyn-clone",
- "futures 0.3.31",
+ "futures",
  "getrandom 0.3.4",
  "pin-project",
  "rand 0.9.2",
@@ -12480,7 +12442,7 @@ dependencies = [
  "bloomy",
  "bollard",
  "byteorder",
- "bytes 1.11.1",
+ "bytes",
  "bytesize",
  "cfg-if",
  "chrono",
@@ -12505,7 +12467,7 @@ dependencies = [
  "exitcode",
  "fakedata",
  "flate2",
- "futures 0.3.31",
+ "futures",
  "futures-util",
  "glob",
  "goauth",
@@ -12652,7 +12614,7 @@ dependencies = [
  "anyhow",
  "chrono",
  "clap",
- "futures 0.3.31",
+ "futures",
  "graphql_client",
  "reqwest 0.11.26",
  "serde",
@@ -12672,7 +12634,7 @@ dependencies = [
  "async-stream",
  "async-trait",
  "bytecheck",
- "bytes 1.11.1",
+ "bytes",
  "clap",
  "crc32fast",
  "criterion",
@@ -12681,7 +12643,7 @@ dependencies = [
  "dashmap",
  "derivative",
  "fslock",
- "futures 0.3.31",
+ "futures",
  "hdrhistogram",
  "memmap2",
  "metrics",
@@ -12713,11 +12675,11 @@ name = "vector-common"
 version = "0.1.0"
 dependencies = [
  "async-stream",
- "bytes 1.11.1",
+ "bytes",
  "chrono",
  "crossbeam-utils",
  "derivative",
- "futures 0.3.31",
+ "futures",
  "indexmap 2.12.0",
  "itertools 0.14.0",
  "metrics",
@@ -12803,7 +12765,7 @@ dependencies = [
  "async-trait",
  "base64 0.22.1",
  "bitmask-enum",
- "bytes 1.11.1",
+ "bytes",
  "cfg-if",
  "chrono",
  "chrono-tz",
@@ -12814,7 +12776,7 @@ dependencies = [
  "enumflags2",
  "env-test-util",
  "float_eq",
- "futures 0.3.31",
+ "futures",
  "futures-util",
  "headers",
  "http 0.2.12",
@@ -12914,7 +12876,7 @@ name = "vector-stream"
 version = "0.1.0"
 dependencies = [
  "async-stream",
- "futures 0.3.31",
+ "futures",
  "futures-util",
  "pin-project",
  "proptest",
@@ -12935,7 +12897,7 @@ version = "0.1.0"
 dependencies = [
  "async-graphql",
  "colored",
- "futures 0.3.31",
+ "futures",
  "glob",
  "serde_yaml",
  "tokio",
@@ -12958,7 +12920,7 @@ dependencies = [
  "clap",
  "crossterm",
  "exitcode",
- "futures 0.3.31",
+ "futures",
  "futures-util",
  "glob",
  "humantime",
@@ -13073,7 +13035,7 @@ dependencies = [
  "base16",
  "base62",
  "base64-simd",
- "bytes 1.11.1",
+ "bytes",
  "cbc",
  "cfb-mode",
  "cfg-if",
@@ -13226,7 +13188,7 @@ version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4378d202ff965b011c64817db11d5829506d3404edeadb61f190d111da3f231c"
 dependencies = [
- "bytes 1.11.1",
+ "bytes",
  "futures-channel",
  "futures-util",
  "headers",
@@ -13388,7 +13350,7 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c598d6b99ea013e35844697fc4670d08339d5cda15588f193c6beedd12f644b"
 dependencies = [
- "futures 0.3.31",
+ "futures",
  "js-sys",
  "parking_lot",
  "pin-utils",
@@ -14084,7 +14046,7 @@ dependencies = [
  "assert-json-diff",
  "base64 0.22.1",
  "deadpool",
- "futures 0.3.31",
+ "futures",
  "http 1.3.1",
  "http-body-util",
  "hyper 1.7.0",
diff --git a/Cargo.toml b/Cargo.toml
index ed8631a6d1e94..d7405ba9f8a09 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -163,7 +163,7 @@ dashmap = { version = "6.1.0", default-features = false }
 derivative = { version = "2.2.0", default-features = false }
 exitcode = { version = "1.1.2", default-features = false }
 flate2 = { version = "1.1.2", default-features = false, features = ["zlib-rs"] }
-futures = { version = "0.3.31", default-features = false, features = ["compat", "io-compat", "std"], package = "futures" }
+futures = { version = "0.3.31", default-features = false, features = ["std"] }
 futures-util = { version = "0.3.29", default-features = false }
 glob = { version = "0.3.3", default-features = false }
 hickory-proto = { version = "0.25.2", default-features = false, features = ["dnssec-ring"] }
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 72c0f17e00d3d..c023f25e685b5 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -142,7 +142,6 @@ bytecheck_derive,https://github.com/djkoloski/bytecheck,MIT,David Koloski <djkol
 bytecount,https://github.com/llogiq/bytecount,Apache-2.0 OR MIT,"Andre Bogus <bogusandre@gmail.de>, Joshua Landau <joshua@landau.ws>"
 bytemuck,https://github.com/Lokathor/bytemuck,Zlib OR Apache-2.0 OR MIT,Lokathor <zefria@gmail.com>
 byteorder,https://github.com/BurntSushi/byteorder,Unlicense OR MIT,Andrew Gallant <jamslam@gmail.com>
-bytes,https://github.com/carllerche/bytes,MIT,Carl Lerche <me@carllerche.com>
 bytes,https://github.com/tokio-rs/bytes,MIT,"Carl Lerche <me@carllerche.com>, Sean McArthur <sean@seanmonstar.com>"
 bytes-utils,https://github.com/vorner/bytes-utils,Apache-2.0 OR MIT,Michal 'vorner' Vaner <vorner@vorner.cz>
 bytesize,https://github.com/bytesize-rs/bytesize,Apache-2.0,"Hyunsik Choi <hyunsik.choi@gmail.com>, MrCroxx <mrcroxx@outlook.com>, Rob Ede <robjtede@icloud.com>"
@@ -298,7 +297,6 @@ fraction,https://github.com/dnsl48/fraction,MIT OR Apache-2.0,dnsl48 <dnsl48@gma
 fsevent-sys,https://github.com/octplane/fsevent-rust/tree/master/fsevent-sys,MIT,Pierre Baillet <pierre@baillet.name>
 fslock,https://github.com/brunoczim/fslock,MIT,The fslock Authors
 funty,https://github.com/myrrlyn/funty,MIT,myrrlyn <self@myrrlyn.dev>
-futures,https://github.com/rust-lang-nursery/futures-rs,MIT OR Apache-2.0,Alex Crichton <alex@alexcrichton.com>
 futures,https://github.com/rust-lang/futures-rs,MIT OR Apache-2.0,The futures Authors
 futures-channel,https://github.com/rust-lang/futures-rs,MIT OR Apache-2.0,The futures-channel Authors
 futures-core,https://github.com/rust-lang/futures-rs,MIT OR Apache-2.0,The futures-core Authors
@@ -396,7 +394,6 @@ inotify-sys,https://github.com/hannobraun/inotify-sys,ISC,Hanno Braun <hb@hannob
 inout,https://github.com/RustCrypto/utils,MIT OR Apache-2.0,RustCrypto Developers
 instability,https://github.com/ratatui-org/instability,MIT,"Stephen M. Coakley <me@stephencoakley.com>, Joshka"
 inventory,https://github.com/dtolnay/inventory,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
-iovec,https://github.com/carllerche/iovec,MIT OR Apache-2.0,Carl Lerche <me@carllerche.com>
 ipconfig,https://github.com/liranringel/ipconfig,MIT OR Apache-2.0,Liran Ringel <liranringel@gmail.com>
 ipcrypt-rs,https://github.com/jedisct1/rust-ipcrypt2,ISC,Frank Denis <github@pureftpd.org>
 ipnet,https://github.com/krisprice/ipnet,MIT OR Apache-2.0,Kris Price <kris@krisprice.nz>
@@ -783,7 +780,6 @@ tinystr,https://github.com/unicode-org/icu4x,Unicode-3.0,The ICU4X Project Devel
 tinyvec,https://github.com/Lokathor/tinyvec,Zlib OR Apache-2.0 OR MIT,Lokathor <zefria@gmail.com>
 tinyvec_macros,https://github.com/Soveu/tinyvec_macros,MIT OR Apache-2.0 OR Zlib,Soveu <marx.tomasz@gmail.com>
 tokio,https://github.com/tokio-rs/tokio,MIT,Tokio Contributors <team@tokio.rs>
-tokio-io,https://github.com/tokio-rs/tokio,MIT,Carl Lerche <me@carllerche.com>
 tokio-io-timeout,https://github.com/sfackler/tokio-io-timeout,MIT OR Apache-2.0,Steven Fackler <sfackler@gmail.com>
 tokio-macros,https://github.com/tokio-rs/tokio,MIT,Tokio Contributors <team@tokio.rs>
 tokio-native-tls,https://github.com/tokio-rs/tls,MIT,Tokio Contributors <team@tokio.rs>

From 415059f727929adee4d88801ca760be2ac0b967a Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 23 Mar 2026 15:19:24 -0400
Subject: [PATCH 042/326] chore(deps): bump async-nats from 0.42.0 to 0.46.0
 (#24974)

---
 Cargo.lock           | 19 +++++--------------
 Cargo.toml           |  2 +-
 LICENSE-3rdparty.csv |  1 -
 3 files changed, 6 insertions(+), 16 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index feb1b17a72aaa..308f1e508f129 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -805,16 +805,15 @@ dependencies = [
 
 [[package]]
 name = "async-nats"
-version = "0.42.0"
+version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08f6da6d49a956424ca4e28fe93656f790d748b469eaccbc7488fec545315180"
+checksum = "df5af9ebfb0a14481d3eaf6101e6391261e4f30d25b26a7635ade8a39482ded0"
 dependencies = [
  "base64 0.22.1",
  "bytes",
- "futures",
+ "futures-util",
  "memchr",
  "nkeys",
- "nuid",
  "once_cell",
  "pin-project",
  "portable-atomic",
@@ -822,7 +821,7 @@ dependencies = [
  "regex",
  "ring",
  "rustls-native-certs 0.7.0",
- "rustls-pemfile 2.1.0",
+ "rustls-pki-types",
  "rustls-webpki 0.102.8",
  "serde",
  "serde_json",
@@ -832,6 +831,7 @@ dependencies = [
  "time",
  "tokio",
  "tokio-rustls 0.26.2",
+ "tokio-stream",
  "tokio-util",
  "tokio-websockets",
  "tracing 0.1.44",
@@ -7173,15 +7173,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "nuid"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc895af95856f929163a0aa20c26a78d26bfdc839f51b9d5aa7a5b79e52b7e83"
-dependencies = [
- "rand 0.8.5",
-]
-
 [[package]]
 name = "num"
 version = "0.4.1"
diff --git a/Cargo.toml b/Cargo.toml
index d7405ba9f8a09..e0fe08655bdef 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -408,7 +408,7 @@ lru = { version = "0.16.3", default-features = false }
 maxminddb = { version = "0.27.0", default-features = false, optional = true, features = ["simdutf8"] }
 md-5 = { version = "0.10", default-features = false, optional = true }
 mongodb = { version = "3.3.0", default-features = false, optional = true, features = ["compat-3-0-0", "dns-resolver", "rustls-tls"] }
-async-nats = { version = "0.42.0", default-features = false, optional = true, features = ["ring", "websockets"] }
+async-nats = { version = "0.46.0", default-features = false, optional = true, features = ["ring", "websockets", "jetstream", "nkeys"] }
 nkeys = { version = "0.4.5", default-features = false, optional = true }
 nom = { workspace = true, optional = true }
 notify = { version = "8.1.0", default-features = false, features = ["macos_fsevent"] }
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index c023f25e685b5..cf10bc525c9d5 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -505,7 +505,6 @@ notify,https://github.com/notify-rs/notify,CC0-1.0,"Félix Saparelli <me@passcod
 notify-types,https://github.com/notify-rs/notify,MIT OR Apache-2.0,Daniel Faust <hessijames@gmail.com>
 ntapi,https://github.com/MSxDOS/ntapi,Apache-2.0 OR MIT,MSxDOS <melcodos@gmail.com>
 nu-ansi-term,https://github.com/nushell/nu-ansi-term,MIT,"ogham@bsago.me, Ryan Scheel (Havvy) <ryan.havvy@gmail.com>, Josh Triplett <josh@joshtriplett.org>, The Nushell Project Developers"
-nuid,https://github.com/casualjim/rs-nuid,Apache-2.0,Ivan Porto Carrero <ivan@oflanders.co.nz>
 num,https://github.com/rust-num/num,MIT OR Apache-2.0,The Rust Project Developers
 num-bigint,https://github.com/rust-num/num-bigint,MIT OR Apache-2.0,The Rust Project Developers
 num-bigint-dig,https://github.com/dignifiedquire/num-bigint,MIT OR Apache-2.0,"dignifiedquire <dignifiedquire@gmail.com>, The Rust Project Developers"

From 05f7b4338b06ef7c8731cd8f391ca4e62f875b43 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 23 Mar 2026 12:45:40 -0700
Subject: [PATCH 043/326] chore(ci): add missing Windows source files to
 integration_windows filter (#24992)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/integration_windows.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/integration_windows.yml b/.github/workflows/integration_windows.yml
index ca60a57c1f122..5e89827f52e3a 100644
--- a/.github/workflows/integration_windows.yml
+++ b/.github/workflows/integration_windows.yml
@@ -23,6 +23,9 @@ jobs:
             windows:
               - "src/sources/windows_event_log/**"
               - "src/internal_events/windows_event_log.rs"
+              - "src/internal_events/windows.rs"
+              - "src/vector_windows.rs"
+              - "src/service.rs"
               - "tests/integration/windows-event-log/**"
               - ".github/workflows/integration_windows.yml"
 

From f62a9ffa8729fb1e7e6d074d4d115c96f7f2740a Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 23 Mar 2026 13:25:16 -0700
Subject: [PATCH 044/326] chore(deps): ignore RUSTSEC-2026-0049 (rustls-webpki)
 until rustls can be upgraded (#24986)

* chore: ignore new RUSTSEC advisories that cannot be immediately fixed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: remove RUSTSEC-2026-0058 ignore, addressed by #24975

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 deny.toml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/deny.toml b/deny.toml
index 17ad08e1a8a5d..5a3f7dee13c4d 100644
--- a/deny.toml
+++ b/deny.toml
@@ -49,4 +49,7 @@ ignore = [
   { id = "RUSTSEC-2025-0012", reason = "backoff is unmaintained" },
   # rustls-pemfile is unmaintained. Blocked by both async-nats and http 1.0.0 upgrade.
   { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile is unmaintained" },
+  # rustls-webpki 0.101.7 vulnerability. Fix requires upgrading rustls from 0.21 to 0.23+,
+  # which is a significant chain upgrade through aws-smithy-http-client, hyper-rustls, tokio-rustls, etc.
+  { id = "RUSTSEC-2026-0049", reason = "Fix requires major rustls upgrade (0.21 -> 0.23+); tracked for future upgrade" },
 ]

From aedd2a66cb27b26621fff2c6d7dbd53a199fe0fa Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 23 Mar 2026 13:26:02 -0700
Subject: [PATCH 045/326] docs(file sink): add security warning to path
 template field (#24983)

The rendered path can resolve to any filesystem location. Add a
docs::warnings annotation so users are made aware when fields from
untrusted sources are used in the path template.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/sinks/file/mod.rs                                     | 3 +++
 website/cue/reference/components/sinks/generated/file.cue | 1 +
 2 files changed, 4 insertions(+)

diff --git a/src/sinks/file/mod.rs b/src/sinks/file/mod.rs
index e3af256f6501b..f6c0934fa2d9e 100644
--- a/src/sinks/file/mod.rs
+++ b/src/sinks/file/mod.rs
@@ -57,6 +57,9 @@ pub struct FileSinkConfig {
         docs::examples = "/tmp/application-{{ application_id }}-%Y-%m-%d.log"
     ))]
     #[configurable(metadata(docs::examples = "/tmp/vector-%Y-%m-%d.log.zst"))]
+    #[configurable(metadata(
+        docs::warnings = "The rendered path can resolve to any location on the filesystem. Vector will write to it if the process has permission."
+    ))]
     pub path: Template,
 
     /// The amount of time that a file can be idle and stay open.
diff --git a/website/cue/reference/components/sinks/generated/file.cue b/website/cue/reference/components/sinks/generated/file.cue
index 112bb8b4d90aa..606ccaf957f03 100644
--- a/website/cue/reference/components/sinks/generated/file.cue
+++ b/website/cue/reference/components/sinks/generated/file.cue
@@ -590,6 +590,7 @@ generated: components: sinks: file: configuration: {
 			examples: ["/tmp/vector-%Y-%m-%d.log", "/tmp/application-{{ application_id }}-%Y-%m-%d.log", "/tmp/vector-%Y-%m-%d.log.zst"]
 			syntax: "template"
 		}
+		warnings: ["The rendered path can resolve to any location on the filesystem. Vector will write to it if the process has permission."]
 	}
 	timezone: {
 		description: """

From 93a9771b1824c848c8efdf7166638226f01f42d2 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 24 Mar 2026 06:22:00 -0700
Subject: [PATCH 046/326] chore(api)!: replace GraphQL observability API with
 gRPC, remove async-graphql dependencies (#24364)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* chore(api): grpc server (remove graphql)

* reuse event.proto

* docs(api): clarify metadata preservation in proto conversion

The comment now explicitly mentions that Log.metadata_full preserves event metadata during conversion.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* test(api): migrate vector_api tests from GraphQL to gRPC

Migrate the vector_api integration tests from the deprecated GraphQL API to the new gRPC API.

Changes:
- Updated test infrastructure to use gRPC client instead of GraphQL
- Migrated component queries from GraphQL to gRPC GetComponents RPC
- Replaced GraphQL subscriptions with gRPC streaming for tap functionality
- Added metrics population in gRPC GetComponents handler to support metrics tests
- Fixed config reload tests to work around Vector behavior where components with
  unchanged names but modified connections don't appear during the reload transition
- Increased startup timeout from 2s to 10s to handle slower test environments
- Added 500ms delay before polling after SIGHUP to let Vector process the signal

Test fixes:
- Updated all assertions to use gRPC proto types (ComponentsResponse, ComponentType, etc.)
- Changed tap tests to collect events inline instead of storing streams to avoid lifetime issues
- Simplified reload tests to completely replace components instead of keeping old names
- All 7 tests now pass: tap (4 tests), top (3 tests)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(dev): cargo fmt

* docs: add changelog for GraphQL to gRPC API migration

Add breaking change changelog documenting the removal of the GraphQL
Playground and replacement with gRPC API. Includes migration guide with
grpcurl examples for common operations.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* allow grpcurl word

* fix(api): address gRPC migration issues

P0:
- Bind TCP listener before spawning to fail fast on port conflicts

P1:
- Restore fail-fast behavior on API startup failures
- Fix tap output format regression (JSON/YAML/logfmt)
- Remove metric batching to support <10 components
- Fix double throughput normalization

P2:
- Validate parameters before casting to unsigned types
- Report Vector uptime instead of subscription lifetime

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* wip

chore(dev): cargo fmt

* support JSON/YAML/logfmt formats

* chore(dev): cargo fmt

* feat(api): add gRPC reflection support

Enables gRPC server reflection for the observability API, allowing
tools like grpcurl and grpcui to introspect the API without needing
the .proto files.

Changes:
- Add tonic-reflection dependency with server feature
- Register reflection service in gRPC server
- Expose FILE_DESCRIPTOR_SET from generated protobuf code

This allows clients to:
- List available services: grpcurl -plaintext localhost:8686 list
- Describe methods: grpcurl -plaintext localhost:8686 describe
- Call methods without proto files

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(api-client): include third-party proto path for event.proto

Fixes CI build failure where protoc couldn't find google/protobuf/timestamp.proto
when compiling event.proto in vector-api-client build script.

The first tonic_build::configure() call was missing the third-party include path,
causing the build to fail when looking for Google well-known types.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* chore(dev): cargo fmt

* chore(dev): cargo vdev build licenses

* add note to old blog post

* refactor(grpc): apply review fixes to gRPC migration

- Fix 1: make Client::new() sync and infallible (URL validated lazily on connect);
  update all call sites, improve test for connection failure to use port 65535
- Fix 2: avoid throwaway health-check client in tap cmd; extract
  run_tap_with_client() in TapRunner and thread the pre-connected client through
  tap_internal() so cmd() reuses it instead of creating a second connection
- Fix 3: cap component poll interval at 1s minimum in poll_components to avoid
  flooding GetComponents at short metrics intervals (e.g. 100ms)
- Fix 4: populate on_type with the real plugin type name (e.g. "demo_logs",
  "kafka") sourced from TapOutput.component_type; update component_to_row to
  use ComponentType enum for kind and on_type for component_type
- Fix 5: document the intentional proto round-trip in serialize_event explaining
  the vector-api-client / vector-core type separation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* make build-licenses

* docs(grpc): clarify std::sync::Mutex usage in async streaming handlers

The lock is never held across an .await point — it only guards synchronous
HashMap updates inside IntervalStream closures — so std::sync::Mutex is
the correct, cheaper choice over tokio::sync::Mutex. Add a comment to
prevent future readers from reflexively replacing it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(grpc): enforce limit >= 1 for StreamOutputEvents at all layers

The limit field controls both the reservoir size and the internal channel
capacity in stream_output_events, so 0 is not a valid value (unlike
GetComponents where 0 means "no limit").

- Proto: document the >= 1 requirement and explain why 0 is not valid
- Server: improve the error message to reference the affected internals
- CLI: add value_parser range(1..) so `--limit 0` is rejected at parse
  time with a clear clap error, before the request reaches the server

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(grpc): correct reservoir sampling bias in stream_output_events

Algorithm R requires drawing a random index from 0..=i (inclusive) for
the i-th event seen. The previous code used 0..batch (exclusive), which
made the first event after the reservoir fills guaranteed to replace an
existing entry (100% probability instead of limit/(limit+1)).

The fix is a one-character change: 0..batch -> 0..=batch.

The same bug existed in the old GraphQL implementation; this is not a
regression but a pre-existing correctness issue now fixed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: improve --url help text and expand changelog for gRPC migration

- Add `(e.g. http://localhost:8686)` to --url help in tap and top
- Expand changelog to clarify GraphQL API is fully removed, add --url
  format migration guide, and note required fields in grpcurl example

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): remove deprecated graphql and playground config fields

The `api.graphql` and `api.playground` fields were silently ignored
after the GraphQL→gRPC migration. Remove them so configs containing
those fields are rejected with a clear error rather than accepted
and ignored. Update the changelog accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: update website and internal docs for GraphQL→gRPC migration

- Rewrite website/docs/reference/api.md for gRPC (remove GraphQL/Playground sections)
- Update configuration/api.md description to reference gRPC endpoint
- Update api.cue to describe gRPC service and proto file
- Update cli.cue: --url flag descriptions now say "gRPC" not "GraphQL"
- Update internal_metrics.cue: remove "GraphQL" from api_started_total description
- Regenerate generated/configuration.cue (removes graphql/playground fields)
- Update AGENTS.md: api/ directory is now gRPC, not GraphQL

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* typo fix

* chore: apply prettier formatting to modified markdown files

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add deprecation warning to GraphQL-related highlight posts

The GraphQL API has been replaced by gRPC. Add a warning banner to the
three highlight posts that reference the GraphQL API so users landing
on them are aware of the migration.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: set deprecation version to 0.55.0 in GraphQL warning banners

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(api-client): rename GrpcClient to Client, remove deny attributes

- Rename GrpcClient → Client; the "Grpc" prefix is redundant given the crate name
- Remove #![deny(warnings)] and #![deny(missing_debug_implementations)]

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): resolve component type for sinks using metric tags

TapResource.outputs only covers sources and transforms (components with
outputs). Sinks always fell back to "unknown" in GetComponents.

Extract the component_type metric tag (which all components emit) as a
fallback so sinks report their actual plugin type (e.g. "console").

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): propagate component type names via TapResource for all component kinds

Sinks were showing as 'unknown' in `vector top` because TapResource.outputs
only covers sources and transforms (components with fanout outputs). Sinks
have no outputs so were never included.

Fix by adding a `type_names` map to TapResource populated directly from
RunningTopology for all component types (sources, transforms, and sinks).
The gRPC GetComponents handler now reads from this map rather than
falling back to metric tags.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* perf(top): share single gRPC connection across all metric streams

Previously subscribe() called connect() 11 times sequentially, creating
a separate TCP+HTTP/2 handshake per metric stream. HTTP/2 natively
multiplexes concurrent streams over one connection, and tonic's Channel
is Arc-backed and cheap to clone, so a single connect() is sufficient.

This restores the behaviour of the old GraphQL implementation which shared
one WebSocket connection across all subscriptions via Arc<SubscriptionClient>.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(tap): break outer tap worker loop on notification send failure

The break on notification send failure was inside a `for event in events`
loop nested within the outer `loop { select! { ... } }`, so it only exited
the inner iterator loop. The tap worker would keep running with a live
TapController after the client stream had gone away, accumulating orphaned
topology taps across reconnects.

Fix with a labeled break to exit the outer loop.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(tap): extract Reservoir struct to eliminate nested loop complexity

The tap worker loop had a for-loop inside a select! arm that required a
labeled break to exit the outer loop on send failure. Extract the sampling
and flushing logic into a Reservoir struct with handle_payload() and flush()
methods returning Result<(), ()>. The select! arms become single-line checks,
and the labeled break is gone.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): sum metric series per component instead of overwriting

filter_and_group_metrics used insert() which overwrites earlier values for
the same component_id. Metrics like component_sent_events_total emit one
series per output label, so multi-output components (e.g. route transform)
would report only whichever series was seen last. Switch to entry/or_insert
+= to sum all series, fixing incorrect totals in GetComponents and the
streaming RPCs that feed vector top.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* make build-licenses

* fix(top): seed poll_components from init_components snapshot

poll_components started with an empty known_components set, so any
component removed between init_components() and the first poll (up to 1s
later) would never trigger a ComponentRemoved event — the stale row
persisted in vector top until reconnect.

Fix by passing the initial component IDs from the init_components snapshot
through subscribe() into poll_components, so both the UI and the poller
start from the same truth.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* make build-licenses

* fix(api): cap stream_output_events limit to prevent unbounded allocation

A client could send limit=i32::MAX, causing Vec::with_capacity to
attempt a multi-GB allocation in Reservoir::new and crash the process.
Add a 100_000 server-side cap with a clear error response.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): enforce minimum 100ms interval on all metric streams

Clients could set interval_ms=1 and hammer capture_metrics() at 1kHz
across concurrent subscriptions. Consolidate the per-endpoint interval
validation into a single validate_interval_ms helper that rejects
anything below MIN_INTERVAL_MS (100ms).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(api): extract metric stream helpers to eliminate boilerplate

- Add BoxStream<T> alias to simplify tonic associated type declarations
- Add get_controller() and metric_totals_stream()/metric_throughput_stream()
  helpers to deduplicate stream setup across handlers
- Add validate_interval_ms() to centralize interval floor enforcement
- Add output_ports_by_component() on TapResource and ports_to_proto_outputs()
  helper to expose named output ports in get_components

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(tap): stop retrying non-recoverable gRPC errors

Permanent errors (INVALID_ARGUMENT, OUT_OF_RANGE, NOT_FOUND, PERMISSION_DENIED,
UNAUTHENTICATED, UNIMPLEMENTED, invalid URL) now cause an immediate exit instead
of looping forever in the reconnect cycle.

- Add Error::is_fatal() to vector-api-client, inspecting tonic::Code before
  the status is serialised to a string
- Add TapExecutorError::Fatal variant and route fatal client errors into it
  via the From<vector_api_client::Error> impl
- In tap cmd, break on is_fatal() before checking --no-reconnect

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(top): exclude poll_components from stream-failure reconnection gate

poll_components was added to the same handles vec as the metric stream tasks,
so join_all(handles) in cmd.rs would never complete when metric streams failed
early (e.g. server-side INVALID_ARGUMENT) while get_components kept succeeding.
This left vector top stuck in a connected state with frozen metrics and no
reconnect attempt.

Split subscribe() return into SubscribeHandles { metric_handles, poll_handle }.
cmd.rs now joins only metric_handles and aborts poll_handle afterwards, so any
metric stream failure immediately unblocks the reconnect loop.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(top): populate per-output sent events and terminate idle tap workers

Two fixes addressing open review threads:

1. Per-output sent events (metrics.rs): The streaming endpoints only emit
   component-level totals; per-output data is available from GetComponents.
   poll_components now emits SentEventsTotals with per-output data from the
   snapshot, restoring per-output rows in vector top for multi-output
   components (e.g. route transforms with _unmatched/success ports).

2. Idle tap worker leak (service.rs): The interval arm of the tap worker
   loop called flush() which returns Ok(()) for empty batches, so a client
   disconnect with no matching events left the worker and its TapController
   alive indefinitely. Now checks event_tx.is_closed() on each tick.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(top): populate per-output Events Out and unify timing constants

Three changes:

1. Fix per-output Events Out showing N/A for multi-output transforms (e.g.
   route): add filter_and_group_metrics_by_output() on the server to group
   component_sent_events_total by (component_id, output), and populate
   Output.sent_events_total in GetComponents responses. poll_components
   already reads these values and emits SentEventsTotals to state.

2. Remove MIN_POLL_INTERVAL_MS: poll_components now uses the user's
   --interval directly (already validated >= 100ms server-side), making
   all metrics -- including per-output data -- update at a single
   user-controlled frequency. Previously per-output data was capped at 1s
   even when --interval was shorter.

3. Unify RECONNECT_DELAY: the constant was duplicated in src/top/cmd.rs
   and src/tap/cmd.rs. Now defined once as RECONNECT_DELAY_MS in
   vector-api-client and imported by both.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api,top): address code review issues in gRPC observability API

- Add per-output breakdown to streaming sent_events proto messages
  (output_totals/output_throughputs map fields on ComponentTotalsResponse
  and ComponentThroughputResponse); introduce dedicated server-side stream
  builders that populate these fields and wire them to the sent_events RPCs
- Remove redundant per-output poll_components emission now that the stream
  carries the data directly
- Validate --interval >= 100 at the CLI boundary in `vector top`, matching
  the server-side minimum and the pattern already used by `vector tap`
- Sort components alphabetically before applying limit in GetComponents for
  stable, deterministic results across repeated calls
- Fix tap_survives_config_reload test to hold the stream open across the
  reload rather than opening a fresh one; add use<> bound to
  stream_output_events to prevent lifetime overcapture in Rust 2024

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): restore shutdown health semantics in gRPC service

The GraphQL health handler returned HTTP 503 during shutdown by checking
the topology running AtomicBool. The gRPC migration dropped that flag,
making the health RPC always return healthy:true — including while Vector
was shutting down.

Pass Arc<AtomicBool> (topology.running) through GrpcServer::start and
into ObservabilityService. The health handler now returns Status::UNAVAILABLE
when the flag is false, matching the old GraphQL behaviour and honouring
the existing shutdown logic in RunningTopology::stop().

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(tap,api): reject logfmt for non-log events, validate tap interval, add multi-output test

- Return an error when --format logfmt is used with metric or trace events
  instead of silently falling back to JSON
- Add value_parser range(100..) to vector tap --interval, matching top's validation
- Add multi_output_transform_reports_per_output_sent_events integration test
  asserting GetComponents.outputs and StreamComponentSentEventsTotal.output_totals
  for a route transform with named outputs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* cargo fmt

* fix(api): restore api_started_total metric and startup log for gRPC server

The ApiStarted internal event was deleted along with GraphQL. Re-add it
to grpc.rs and emit it from setup_api once the gRPC server successfully
binds, restoring the api_started_total counter and "API server running"
log line.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(api): remove remaining GraphQL references

- Delete .graphqlconfig (referenced old GraphQL endpoint)
- Remove async-graphql dependabot group
- Remove async-graphql dep and api feature from vector-tap Cargo.toml
- Strip async-graphql imports and derive attributes from notification.rs
- Remove vector-tap/api feature activation from vector-lib
- Update stale comments in vector-core config and config/vector.yaml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: cargo fmt and remove async-graphql from Cargo.lock and license inventory

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(api): remove stale GraphQL migration comments

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add deprecation warnings to GraphQL docs and fix AGENTS.md API reference

- Add warning banner to blog post and highlight pages noting migration
  to gRPC in 0.55.0
- Update AGENTS.md api/ directory description from GraphQL to gRPC

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: address urseberry review feedback

- Fix changelog wording: "will now reject" -> "now rejects"
- Update warning banners: "we migrated" -> "Datadog migrated"

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: fix warning banner wording - remove Datadog reference

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: standardize warning banners to multi-line Hugo shortcode form

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: extract grpc migration warning into reusable Hugo shortcode

Create grpc-migration-warning.html shortcode and replace all four
inline warning blocks with a single {{< grpc-migration-warning >}} call.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(api): remove unused tokio-tungstenite and reqwest deps from vector-api-client

Leftovers from the GraphQL era (WebSocket subscriptions and HTTP requests).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: address thomasqueirozb review feedback

- Add compatibility note to changelog: 0.55+ clients require 0.55+ server
- Add grpc.io link to api.md
- Link proto file directly in api.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(api): gate ApiStarted and its imports behind the api feature flag

Fixes unused import/dead_code warnings when building without the api
feature (e.g. component-validation-tests).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(api): replace 9 streaming RPCs with unified StreamComponentMetrics

Consolidates StreamComponentReceivedEventsTotal,
StreamComponentSentEventsTotal, StreamComponentReceivedBytesTotal,
StreamComponentSentBytesTotal, StreamComponentErrorsTotal,
StreamComponentReceivedEventsThroughput,
StreamComponentSentEventsThroughput,
StreamComponentReceivedBytesThroughput, and
StreamComponentSentBytesThroughput into a single
StreamComponentMetrics(ComponentMetricStreamRequest) RPC.

The unified response type ComponentMetricResponse uses
oneof value { TotalMetric total; ThroughputMetric throughput; }
to carry per-output breakdowns alongside the aggregated value,
keeping the schema honest about which fields are populated.

StreamComponentAllocatedBytes remains a separate RPC since it is
semantically distinct and has no per-output breakdown.

Also moves ApiStarted internal event from grpc.rs (gated behind
sources-vector/opentelemetry) into a new api.rs module gated
behind the api feature flag.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(api): apply buf lint fixes to observability proto and cascade Rust updates

- Add METRIC_NAME_ prefix to MetricName enum values (ENUM_VALUE_PREFIX)
- Rename proto package to vector.observability.v1 (PACKAGE_VERSION_SUFFIX)
- Rename service Observability -> ObservabilityService (SERVICE_SUFFIX)
- Rename all request/response messages to match their RPC names per
  RPC_REQUEST_RESPONSE_UNIQUE convention (e.g. MetaRequest ->
  GetMetaRequest, HeartbeatRequest -> StreamHeartbeatRequest, etc.)
- Add COMPONENT_TYPE_UNSPECIFIED zero value to ComponentType enum
  (ENUM_ZERO_VALUE_SUFFIX)
- Cascade all renames through Rust: service.rs, client.rs, metrics.rs,
  vector-tap, and integration tests
- Update grpcurl examples in changelog

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(api): use Uri in Client::new, drop url dep, clean up tests, fix api.md title

- Client::new now takes http::Uri instead of String; Endpoint is built
  eagerly so connect() can no longer fail with InvalidUrl
- Remove unused `url` dep from vector-api-client, add `http`
- Remove test_invalid_url and test_connection_failure (assert nothing useful)
- Update all callers to parse their string URL into Uri
- Fix api.md title to "The Vector Observability API" and update stale
  grpcurl examples to use vector.observability.v1.ObservabilityService

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(tap): gate gRPC client code behind `api` feature

Move `TapRunner`, `EventFormatter`, `OutputChannel`, and `TapExecutorError`
into a new `runner` module gated by the `api` feature, and make the
associated heavy deps (`vector-api-client`, `prost`, `bytes`, `serde_*`, etc.)
optional. Also removes the unused `tokio-tungstenite` dep. Restores
`vector-lib/api = ["vector-tap/api"]` so the feature activation chain is
preserved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(api): move fn-level allow attributes and apply rustfmt

Move `#[allow(clippy::print_stderr)]` to the `fn cmd` level in both
`src/top/cmd.rs` and `src/tap/cmd.rs` instead of per-statement blocks,
and inline `{url}` format captures where applicable. Also applies
rustfmt line-wrapping to service.rs and top.rs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(top): remove interval from EventType throughput variants

The gRPC server already normalizes throughput values to per-second by
dividing by `interval_secs` before streaming them. The `interval` field
in the four `*Throughputs` EventType variants was therefore unused
(`_interval`) and carried over from the old GraphQL client, which had to
do the `v * (1000.0 / interval_ms)` normalization itself.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* style: collapse pub use statement in vector-tap lib.rs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(api): address thomasqueirozb review feedback

- Use OS entropy (thread RNG) instead of epoch-based seed for reservoir
  sampler RNG in service.rs; removes SystemTime/UNIX_EPOCH boilerplate
- Return exitcode::USAGE (bad input) instead of exitcode::UNAVAILABLE
  when URL fails to parse in tap/top cmd
- Rename tap_internal parameter initial_client -> mut client_opt,
  eliminating the intermediate local binding
- Thread http::Uri through top::cmd -> subscription -> metrics::subscribe
  and metrics::init_components, removing the String -> Uri round-trip;
  re-export http::Uri from vector-api-client for callers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: use http::Uri directly instead of re-exporting through vector-api-client

Add http as a direct dep to vector-top and import http::Uri directly in
metrics.rs and top/cmd.rs, rather than leaking it through a re-export
in vector-api-client.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add link to proto file in changelog entry

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* cargo fmt

* fix(tests): add transforms-route to vector-api-tests feature set

The multi_output_transform_reports_per_output_sent_events test uses a
route transform, but the feature was not included in vector-api-tests,
causing Vector to exit with CONFIG error (78) when starting.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/actions/spelling/allow.txt            |    1 +
 .github/dependabot.yml                        |    3 -
 .graphqlconfig                                |   15 -
 AGENTS.md                                     |    2 +-
 Cargo.lock                                    |  298 +-
 Cargo.toml                                    |   21 +-
 LICENSE-3rdparty.csv                          |   17 +-
 build.rs                                      |    5 +-
 changelog.d/graphql_to_grpc_api.breaking.md   |   42 +
 config/vector.yaml                            |    5 +-
 lib/vector-api-client/Cargo.toml              |   32 +-
 lib/vector-api-client/build.rs                |   34 +
 .../graphql/queries/components.graphql        |   62 -
 .../graphql/queries/health.graphql            |    3 -
 .../queries/meta_version_string.graphql       |    5 -
 lib/vector-api-client/graphql/schema.json     | 7206 -----------------
 .../subscriptions/component_added.graphql     |    7 -
 .../component_allocated_bytes.graphql         |    8 -
 .../component_errors_totals.graphql           |    8 -
 ...mponent_received_bytes_throughputs.graphql |    6 -
 .../component_received_bytes_totals.graphql   |    8 -
 ...ponent_received_events_throughputs.graphql |    6 -
 .../component_received_events_totals.graphql  |    8 -
 .../subscriptions/component_removed.graphql   |    6 -
 .../component_sent_bytes_throughputs.graphql  |    6 -
 .../component_sent_bytes_totals.graphql       |    8 -
 .../component_sent_events_throughputs.graphql |   10 -
 .../component_sent_events_totals.graphql      |   14 -
 .../graphql/subscriptions/heartbeat.graphql   |    5 -
 ...ut_events_by_component_id_patterns.graphql |   30 -
 .../processed_bytes_throughput.graphql        |    3 -
 .../graphql/subscriptions/uptime.graphql      |    5 -
 lib/vector-api-client/src/client.rs           |  221 +-
 lib/vector-api-client/src/error.rs            |   77 +
 lib/vector-api-client/src/gql/components.rs   |  224 -
 lib/vector-api-client/src/gql/health.rs       |   64 -
 lib/vector-api-client/src/gql/meta.rs         |   26 -
 lib/vector-api-client/src/gql/metrics.rs      |  341 -
 lib/vector-api-client/src/gql/mod.rs          |   14 -
 lib/vector-api-client/src/gql/tap.rs          |   90 -
 lib/vector-api-client/src/lib.rs              |   54 +-
 lib/vector-api-client/src/subscription.rs     |  199 -
 lib/vector-api-client/src/test/mod.rs         |  160 -
 .../component_by_component_key.graphql        |    6 -
 .../tests/queries/component_links.graphql     |   45 -
 .../queries/components_connection.graphql     |   18 -
 .../tests/queries/file_source_metrics.graphql |   25 -
 .../tests/subscriptions/errors_total.graphql  |    5 -
 lib/vector-core/src/config/mod.rs             |    2 +-
 lib/vector-tap/Cargo.toml                     |   37 +-
 lib/vector-tap/src/controller.rs              |    1 +
 lib/vector-tap/src/lib.rs                     |  256 +-
 lib/vector-tap/src/notification.rs            |   10 -
 lib/vector-tap/src/runner.rs                  |  344 +
 lib/vector-tap/src/topology.rs                |   18 +
 lib/vector-top/Cargo.toml                     |    1 +
 lib/vector-top/src/metrics.rs                 |  664 +-
 lib/vector-top/src/state.rs                   |   41 +-
 proto/vector/observability.proto              |  203 +
 src/api/grpc/mod.rs                           |    3 +
 src/api/grpc/service.rs                       |  863 ++
 src/api/grpc_server.rs                        |   96 +
 src/api/handler.rs                            |   23 -
 src/api/mod.rs                                |   10 +-
 src/api/schema/components/mod.rs              |  577 --
 src/api/schema/components/sink.rs             |  202 -
 src/api/schema/components/source.rs           |  403 -
 src/api/schema/components/state.rs            |   89 -
 src/api/schema/components/transform.rs        |  223 -
 src/api/schema/events/encoding.rs             |    9 -
 src/api/schema/events/log.rs                  |   77 -
 src/api/schema/events/metric.rs               |  139 -
 src/api/schema/events/mod.rs                  |  157 -
 src/api/schema/events/output.rs               |   70 -
 src/api/schema/events/trace.rs                |   56 -
 src/api/schema/filter.rs                      |  219 -
 src/api/schema/gen.rs                         |  116 -
 src/api/schema/health.rs                      |   43 -
 src/api/schema/meta.rs                        |   27 -
 src/api/schema/metrics/allocated_bytes.rs     |   71 -
 src/api/schema/metrics/errors.rs              |   71 -
 src/api/schema/metrics/filter.rs              |  397 -
 src/api/schema/metrics/host.rs                |  373 -
 src/api/schema/metrics/mod.rs                 |  284 -
 src/api/schema/metrics/output.rs              |   88 -
 src/api/schema/metrics/received_bytes.rs      |  108 -
 src/api/schema/metrics/received_events.rs     |  107 -
 src/api/schema/metrics/sent_bytes.rs          |  108 -
 src/api/schema/metrics/sent_events.rs         |  133 -
 src/api/schema/metrics/sink/generic.rs        |   33 -
 src/api/schema/metrics/sink/mod.rs            |   26 -
 src/api/schema/metrics/source/file.rs         |  351 -
 src/api/schema/metrics/source/generic.rs      |   33 -
 src/api/schema/metrics/source/mod.rs          |   31 -
 src/api/schema/metrics/transform/generic.rs   |   28 -
 src/api/schema/metrics/transform/mod.rs       |   25 -
 src/api/schema/metrics/uptime.rs              |   34 -
 src/api/schema/mod.rs                         |   31 -
 src/api/schema/relay.rs                       |  168 -
 src/api/schema/sort.rs                        |   61 -
 src/api/server.rs                             |  204 -
 src/api/tests.rs                              |  589 --
 src/app.rs                                    |   41 +-
 src/config/api.rs                             |   49 +-
 src/internal_events/api.rs                    |   11 +-
 src/proto/mod.rs                              |    6 +-
 src/proto/observability.rs                    |   13 +
 src/tap/cmd.rs                                |   81 +-
 src/tap/mod.rs                                |   30 +-
 src/top/cmd.rs                                |   86 +-
 src/top/mod.rs                                |   24 +-
 src/topology/controller.rs                    |   56 +-
 src/topology/running.rs                       |   25 +-
 tests/vector_api/harness.rs                   |   95 +-
 tests/vector_api/lib.rs                       |    4 +-
 tests/vector_api/tap.rs                       |  359 +-
 tests/vector_api/top.rs                       |  281 +-
 website/content/en/blog/graphql-api.md        |    2 +
 website/content/en/docs/reference/api.md      |   25 +-
 .../en/docs/reference/configuration/api.md    |    3 +-
 .../en/highlights/2020-12-23-graphql-api.md   |    2 +
 .../en/highlights/2020-12-23-vector-top.md    |    2 +
 .../en/highlights/2021-04-21-vector-tap.md    |    2 +
 website/cue/reference/api.cue                 |   44 +-
 website/cue/reference/cli.cue                 |    4 +-
 .../components/sources/internal_metrics.cue   |    2 +-
 .../cue/reference/generated/configuration.cue |   23 +-
 .../shortcodes/grpc-migration-warning.html    |    1 +
 128 files changed, 3020 insertions(+), 16042 deletions(-)
 delete mode 100644 .graphqlconfig
 create mode 100644 changelog.d/graphql_to_grpc_api.breaking.md
 create mode 100644 lib/vector-api-client/build.rs
 delete mode 100644 lib/vector-api-client/graphql/queries/components.graphql
 delete mode 100644 lib/vector-api-client/graphql/queries/health.graphql
 delete mode 100644 lib/vector-api-client/graphql/queries/meta_version_string.graphql
 delete mode 100644 lib/vector-api-client/graphql/schema.json
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_added.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_allocated_bytes.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_errors_totals.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_received_bytes_throughputs.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_received_bytes_totals.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_received_events_throughputs.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_received_events_totals.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_removed.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_sent_bytes_throughputs.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_sent_bytes_totals.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_sent_events_throughputs.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/component_sent_events_totals.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/heartbeat.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/output_events_by_component_id_patterns.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/processed_bytes_throughput.graphql
 delete mode 100644 lib/vector-api-client/graphql/subscriptions/uptime.graphql
 create mode 100644 lib/vector-api-client/src/error.rs
 delete mode 100644 lib/vector-api-client/src/gql/components.rs
 delete mode 100644 lib/vector-api-client/src/gql/health.rs
 delete mode 100644 lib/vector-api-client/src/gql/meta.rs
 delete mode 100644 lib/vector-api-client/src/gql/metrics.rs
 delete mode 100644 lib/vector-api-client/src/gql/mod.rs
 delete mode 100644 lib/vector-api-client/src/gql/tap.rs
 delete mode 100644 lib/vector-api-client/src/subscription.rs
 delete mode 100644 lib/vector-api-client/src/test/mod.rs
 delete mode 100644 lib/vector-api-client/tests/queries/component_by_component_key.graphql
 delete mode 100644 lib/vector-api-client/tests/queries/component_links.graphql
 delete mode 100644 lib/vector-api-client/tests/queries/components_connection.graphql
 delete mode 100644 lib/vector-api-client/tests/queries/file_source_metrics.graphql
 delete mode 100644 lib/vector-api-client/tests/subscriptions/errors_total.graphql
 create mode 100644 lib/vector-tap/src/runner.rs
 create mode 100644 proto/vector/observability.proto
 create mode 100644 src/api/grpc/mod.rs
 create mode 100644 src/api/grpc/service.rs
 create mode 100644 src/api/grpc_server.rs
 delete mode 100644 src/api/handler.rs
 delete mode 100644 src/api/schema/components/mod.rs
 delete mode 100644 src/api/schema/components/sink.rs
 delete mode 100644 src/api/schema/components/source.rs
 delete mode 100644 src/api/schema/components/state.rs
 delete mode 100644 src/api/schema/components/transform.rs
 delete mode 100644 src/api/schema/events/encoding.rs
 delete mode 100644 src/api/schema/events/log.rs
 delete mode 100644 src/api/schema/events/metric.rs
 delete mode 100644 src/api/schema/events/mod.rs
 delete mode 100644 src/api/schema/events/output.rs
 delete mode 100644 src/api/schema/events/trace.rs
 delete mode 100644 src/api/schema/filter.rs
 delete mode 100644 src/api/schema/gen.rs
 delete mode 100644 src/api/schema/health.rs
 delete mode 100644 src/api/schema/meta.rs
 delete mode 100644 src/api/schema/metrics/allocated_bytes.rs
 delete mode 100644 src/api/schema/metrics/errors.rs
 delete mode 100644 src/api/schema/metrics/filter.rs
 delete mode 100644 src/api/schema/metrics/host.rs
 delete mode 100644 src/api/schema/metrics/mod.rs
 delete mode 100644 src/api/schema/metrics/output.rs
 delete mode 100644 src/api/schema/metrics/received_bytes.rs
 delete mode 100644 src/api/schema/metrics/received_events.rs
 delete mode 100644 src/api/schema/metrics/sent_bytes.rs
 delete mode 100644 src/api/schema/metrics/sent_events.rs
 delete mode 100644 src/api/schema/metrics/sink/generic.rs
 delete mode 100644 src/api/schema/metrics/sink/mod.rs
 delete mode 100644 src/api/schema/metrics/source/file.rs
 delete mode 100644 src/api/schema/metrics/source/generic.rs
 delete mode 100644 src/api/schema/metrics/source/mod.rs
 delete mode 100644 src/api/schema/metrics/transform/generic.rs
 delete mode 100644 src/api/schema/metrics/transform/mod.rs
 delete mode 100644 src/api/schema/metrics/uptime.rs
 delete mode 100644 src/api/schema/mod.rs
 delete mode 100644 src/api/schema/relay.rs
 delete mode 100644 src/api/schema/sort.rs
 delete mode 100644 src/api/server.rs
 delete mode 100644 src/api/tests.rs
 create mode 100644 src/proto/observability.rs
 create mode 100644 website/layouts/shortcodes/grpc-migration-warning.html

diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index 2e594047a89a2..a3f2dae3ceea2 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -567,5 +567,6 @@ LDFLAGS
 libsasl
 pkgconfig
 CLAUDE
+grpcurl
 linting
 lexers
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6ed4fe363146b..fd32d14deed15 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -45,9 +45,6 @@ updates:
         patterns:
         - "futures"
         - "futures-util"
-      graphql:
-        patterns:
-        - "async-graphql*"
       metrics:
         patterns:
         - "metrics"
diff --git a/.graphqlconfig b/.graphqlconfig
deleted file mode 100644
index ca7f234a758f1..0000000000000
--- a/.graphqlconfig
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "name": "Vector API",
-  "schemaPath": "lib/vector-api-client/graphql/schema.json",
-  "extensions": {
-    "endpoints": {
-      "Default GraphQL Endpoint": {
-        "url": "http://localhost:8686/graphql",
-        "headers": {
-          "user-agent": "Headless GraphQL"
-        },
-        "introspect": false
-      }
-    }
-  }
-}
diff --git a/AGENTS.md b/AGENTS.md
index 63460acdae3e9..580018abf0283 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -21,7 +21,7 @@ reduction and improved data quality for observability infrastructure.
   - `sinks/` - Data output destinations
   - `config/` - Configuration system and validation
   - `topology/` - Component graph management
-  - `api/` - GraphQL API for management and monitoring
+  - `api/` - gRPC API for management and monitoring
   - `cli.rs` - Command-line interface
 
 - `/lib/` - Modular library crates
diff --git a/Cargo.lock b/Cargo.lock
index 308f1e508f129..d23731697fa21 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,16 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "Inflector"
-version = "0.11.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe438c63458706e03479442743baae6c88256498e6431708f6dfc520a26515d3"
-dependencies = [
- "lazy_static",
- "regex",
-]
-
 [[package]]
 name = "adler2"
 version = "2.0.0"
@@ -539,12 +529,6 @@ dependencies = [
  "regex-syntax",
 ]
 
-[[package]]
-name = "ascii"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eab1c04a571841102f5345a8fc0f6bb3d31c315dec879b5c6e42e40ce7ffa34e"
-
 [[package]]
 name = "ascii-canvas"
 version = "4.0.0"
@@ -668,90 +652,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "async-graphql"
-version = "7.0.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "036618f842229ba0b89652ffe425f96c7c16a49f7e3cb23b56fca7f61fd74980"
-dependencies = [
- "async-graphql-derive",
- "async-graphql-parser",
- "async-graphql-value",
- "async-stream",
- "async-trait",
- "base64 0.22.1",
- "bytes",
- "chrono",
- "fnv",
- "futures-timer",
- "futures-util",
- "http 1.3.1",
- "indexmap 2.12.0",
- "mime",
- "multer",
- "num-traits",
- "pin-project-lite",
- "regex",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "static_assertions_next",
- "thiserror 1.0.68",
-]
-
-[[package]]
-name = "async-graphql-derive"
-version = "7.0.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd45deb3dbe5da5cdb8d6a670a7736d735ba65b455328440f236dfb113727a3d"
-dependencies = [
- "Inflector",
- "async-graphql-parser",
- "darling 0.20.11",
- "proc-macro-crate 3.2.0",
- "proc-macro2 1.0.106",
- "quote 1.0.44",
- "strum 0.26.3",
- "syn 2.0.117",
- "thiserror 1.0.68",
-]
-
-[[package]]
-name = "async-graphql-parser"
-version = "7.0.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b7607e59424a35dadbc085b0d513aa54ec28160ee640cf79ec3b634eba66d3"
-dependencies = [
- "async-graphql-value",
- "pest",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "async-graphql-value"
-version = "7.0.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34ecdaff7c9cffa3614a9f9999bf9ee4c3078fe3ce4d6a6e161736b56febf2de"
-dependencies = [
- "bytes",
- "indexmap 2.12.0",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "async-graphql-warp"
-version = "7.0.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff6008a33c32d5a048aa72437821eb864dd56a80c0d80c8df48f11f12154db6c"
-dependencies = [
- "async-graphql",
- "futures-util",
- "serde_json",
- "warp",
-]
-
 [[package]]
 name = "async-io"
 version = "2.4.0"
@@ -2589,19 +2489,6 @@ dependencies = [
  "windows-sys 0.61.0",
 ]
 
-[[package]]
-name = "combine"
-version = "3.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3da6baa321ec19e1cc41d31bf599f00c783d0517095cdaf0332e3fe8d20680"
-dependencies = [
- "ascii",
- "byteorder",
- "either",
- "memchr",
- "unreachable",
-]
-
 [[package]]
 name = "combine"
 version = "4.6.6"
@@ -4492,64 +4379,6 @@ dependencies = [
  "web-time",
 ]
 
-[[package]]
-name = "graphql-introspection-query"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f2a4732cf5140bd6c082434494f785a19cfb566ab07d1382c3671f5812fed6d"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "graphql-parser"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2ebc8013b4426d5b81a4364c419a95ed0b404af2b82e2457de52d9348f0e474"
-dependencies = [
- "combine 3.8.1",
- "thiserror 1.0.68",
-]
-
-[[package]]
-name = "graphql_client"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a50cfdc7f34b7f01909d55c2dcb71d4c13cbcbb4a1605d6c8bd760d654c1144b"
-dependencies = [
- "graphql_query_derive",
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "graphql_client_codegen"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e27ed0c2cf0c0cc52c6bcf3b45c907f433015e580879d14005386251842fb0a"
-dependencies = [
- "graphql-introspection-query",
- "graphql-parser",
- "heck 0.4.1",
- "lazy_static",
- "proc-macro2 1.0.106",
- "quote 1.0.44",
- "serde",
- "serde_json",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "graphql_query_derive"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83febfa838f898cfa73dfaa7a8eb69ff3409021ac06ee94cfb3d622f6eeb1a97"
-dependencies = [
- "graphql_client_codegen",
- "proc-macro2 1.0.106",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "greptime-proto"
 version = "0.1.0"
@@ -5816,7 +5645,7 @@ checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
 dependencies = [
  "cesu8",
  "cfg-if",
- "combine 4.6.6",
+ "combine",
  "jni-sys",
  "log",
  "thiserror 1.0.68",
@@ -6904,24 +6733,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "multer"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a15d522be0a9c3e46fd2632e272d178f56387bdb5c9fbb3a36c649062e9b5219"
-dependencies = [
- "bytes",
- "encoding_rs",
- "futures-util",
- "http 1.3.1",
- "httparse",
- "log",
- "memchr",
- "mime",
- "spin 0.9.8",
- "version_check",
-]
-
 [[package]]
 name = "multimap"
 version = "0.8.3"
@@ -8998,7 +8809,7 @@ dependencies = [
  "backon",
  "bytes",
  "cfg-if",
- "combine 4.6.6",
+ "combine",
  "futures-channel",
  "futures-util",
  "itoa",
@@ -10679,12 +10490,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
-[[package]]
-name = "static_assertions_next"
-version = "1.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7beae5182595e9a8b683fa98c4317f956c9a2dec3b9716990d20023cc60c766"
-
 [[package]]
 name = "stream-cancel"
 version = "0.8.2"
@@ -10746,9 +10551,6 @@ name = "strum"
 version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"
-dependencies = [
- "strum_macros 0.26.4",
-]
 
 [[package]]
 name = "strum"
@@ -11406,21 +11208,8 @@ checksum = "212d5dcb2a1ce06d81107c3d0ffa3121fe974b73f068c8282cb1c32328113b6c"
 dependencies = [
  "futures-util",
  "log",
- "rustls 0.21.12",
  "tokio",
- "tungstenite 0.20.1",
-]
-
-[[package]]
-name = "tokio-tungstenite"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c83b561d025642014097b66e6c1bb422783339e0909e4429cde4749d1990bc38"
-dependencies = [
- "futures-util",
- "log",
- "tokio",
- "tungstenite 0.21.0",
+ "tungstenite",
 ]
 
 [[package]]
@@ -11648,6 +11437,19 @@ dependencies = [
  "tonic 0.11.0",
 ]
 
+[[package]]
+name = "tonic-reflection"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "548c227bd5c0fae5925812c4ec6c66ffcfced23ea370cb823f4d18f0fc1cb6a7"
+dependencies = [
+ "prost 0.12.6",
+ "prost-types 0.12.6",
+ "tokio",
+ "tokio-stream",
+ "tonic 0.11.0",
+]
+
 [[package]]
 name = "tower"
 version = "0.4.13"
@@ -11972,25 +11774,6 @@ dependencies = [
  "utf-8",
 ]
 
-[[package]]
-name = "tungstenite"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ef1a641ea34f399a848dea702823bbecfb4c486f911735368f1f137cb8257e1"
-dependencies = [
- "byteorder",
- "bytes",
- "data-encoding",
- "http 1.3.1",
- "httparse",
- "log",
- "rand 0.8.5",
- "sha1",
- "thiserror 1.0.68",
- "url",
- "utf-8",
-]
-
 [[package]]
 name = "twox-hash"
 version = "2.1.2"
@@ -12235,15 +12018,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "unreachable"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "382810877fe448991dfc7f0dd6e3ae5d58088fd0ea5e35189655f84e6814fa56"
-dependencies = [
- "void",
-]
-
 [[package]]
 name = "unsafe-libyaml"
 version = "0.2.11"
@@ -12398,8 +12172,6 @@ dependencies = [
  "arrow-schema",
  "assert_cmd",
  "async-compression",
- "async-graphql",
- "async-graphql-warp",
  "async-nats",
  "async-rs",
  "async-stream",
@@ -12565,12 +12337,13 @@ dependencies = [
  "tokio-postgres",
  "tokio-stream",
  "tokio-test",
- "tokio-tungstenite 0.20.1",
+ "tokio-tungstenite",
  "tokio-util",
  "toml",
  "tonic 0.11.0",
  "tonic-build 0.11.0",
  "tonic-health",
+ "tonic-reflection",
  "tower 0.5.3",
  "tower-http 0.4.4",
  "tower-test",
@@ -12600,21 +12373,18 @@ dependencies = [
 
 [[package]]
 name = "vector-api-client"
-version = "0.1.2"
+version = "0.2.0"
 dependencies = [
- "anyhow",
- "chrono",
- "clap",
  "futures",
- "graphql_client",
- "reqwest 0.11.26",
- "serde",
- "serde_json",
+ "http 0.2.12",
+ "prost 0.12.6",
+ "prost-build 0.12.6",
+ "prost-types 0.12.6",
+ "snafu 0.8.9",
  "tokio",
  "tokio-stream",
- "tokio-tungstenite 0.20.1",
- "url",
- "uuid",
+ "tonic 0.11.0",
+ "tonic-build 0.11.0",
 ]
 
 [[package]]
@@ -12886,14 +12656,18 @@ dependencies = [
 name = "vector-tap"
 version = "0.1.0"
 dependencies = [
- "async-graphql",
+ "bytes",
+ "clap",
+ "codecs",
  "colored",
  "futures",
  "glob",
+ "prost 0.12.6",
+ "serde_json",
  "serde_yaml",
  "tokio",
  "tokio-stream",
- "tokio-tungstenite 0.20.1",
+ "tokio-util",
  "tracing 0.1.44",
  "url",
  "uuid",
@@ -12914,6 +12688,7 @@ dependencies = [
  "futures",
  "futures-util",
  "glob",
+ "http 0.2.12",
  "humantime",
  "indoc",
  "num-format",
@@ -13009,12 +12784,6 @@ version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
-[[package]]
-name = "void"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a02e4885ed3bc0f2de90ea6dd45ebcbb66dacffe03547fadbb0eeae2770887d"
-
 [[package]]
 name = "vrl"
 version = "0.31.0"
@@ -13195,7 +12964,6 @@ dependencies = [
  "serde_json",
  "serde_urlencoded",
  "tokio",
- "tokio-tungstenite 0.21.0",
  "tokio-util",
  "tower-service",
  "tracing 0.1.44",
diff --git a/Cargo.toml b/Cargo.toml
index e0fe08655bdef..0a577cde861d9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -19,13 +19,6 @@ name = "vector"
 test = false
 bench = false
 
-[[bin]]
-name = "graphql-schema"
-path = "src/api/schema/gen.rs"
-test = false
-bench = false
-required-features = ["default-no-api-client"]
-
 [[bin]]
 name = "secret-backend-example"
 path = "src/config/loading/secret_backend_example.rs"
@@ -207,6 +200,7 @@ toml = { version = "0.9.8", default-features = false, features = ["serde", "disp
 tonic = { version = "0.11", default-features = false, features = ["transport", "codegen", "prost", "tls", "tls-roots", "gzip"] }
 tonic-build = { version = "0.11", default-features = false, features = ["transport", "prost"] }
 tonic-health = { version = "0.11", default-features = false }
+tonic-reflection = { version = "0.11", default-features = false, features = ["server"] }
 tracing = { version = "0.1.44", default-features = false }
 tracing-subscriber = { version = "0.3.22", default-features = false, features = ["fmt"]  }
 url = { version = "2.5.4", default-features = false, features = ["serde"] }
@@ -344,10 +338,6 @@ lapin = { version = "4.3.0", default-features = false, features = ["tokio", "nat
 async-rs = { version = "0.8", default-features = false, features = ["tokio"], optional = true }
 deadpool = { version = "0.12.2", default-features = false, features = ["managed", "rt_tokio_1"], optional = true }
 
-# API
-async-graphql = { version = "7.0.17", default-features = false, optional = true, features = ["chrono", "playground"] }
-async-graphql-warp = { version = "7.0.17", default-features = false, optional = true }
-
 # Opentelemetry
 
 hex = { version = "0.4.3", default-features = false, optional = true }
@@ -442,6 +432,7 @@ toml.workspace = true
 hickory-proto = { workspace = true, optional = true }
 tonic = { workspace = true, optional = true }
 tonic-health = { workspace = true, optional = true }
+tonic-reflection = { workspace = true, optional = true }
 thread_local = { version = "1.1.9", default-features = false, optional = true }
 typetag = { version = "0.2.20", default-features = false }
 url.workspace = true
@@ -565,9 +556,12 @@ docker = ["dep:bollard", "dep:dirs-next"]
 
 # API
 api = [
-  "dep:async-graphql",
-  "dep:async-graphql-warp",
   "dep:base64",
+  "dep:tonic",
+  "dep:tonic-reflection",
+  "dep:prost",
+  "dep:prost-types",
+  "protobuf-build",
   "vector-lib/api",
 ]
 
@@ -1077,6 +1071,7 @@ vector-api-tests = [
   "sources-demo_logs",
   "transforms-log_to_metric",
   "transforms-remap",
+  "transforms-route",
   "sinks-blackhole"
 ]
 vector-unit-test-tests = [
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index cf10bc525c9d5..8a5759685500e 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -1,5 +1,4 @@
 Component,Origin,License,Copyright
-Inflector,https://github.com/whatisinternet/inflector,BSD-2-Clause,Josh Teeter<joshteeter@gmail.com>
 adler2,https://github.com/oyvindln/adler2,0BSD OR MIT OR Apache-2.0,"Jonas Schievink <jonasschievink@gmail.com>, oyvindln <oyvindln@users.noreply.github.com>"
 adler32,https://github.com/remram44/adler32-rs,Zlib,Remi Rampin <remirampin@gmail.com>
 aead,https://github.com/RustCrypto/traits,MIT OR Apache-2.0,RustCrypto Developers
@@ -41,7 +40,6 @@ arrow-row,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.
 arrow-schema,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
 arrow-select,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
 arrow-string,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
-ascii,https://github.com/tomprogrammer/rust-ascii,Apache-2.0  OR  MIT,"Thomas Bahn <thomas@thomas-bahn.net>, Torbjørn Birch Moltu <t.b.moltu@lyse.net>, Simon Sapin <simon.sapin@exyr.org>"
 async-broadcast,https://github.com/smol-rs/async-broadcast,MIT OR Apache-2.0,"Stjepan Glavina <stjepang@gmail.com>, Yoshua Wuyts <yoshuawuyts@gmail.com>, Zeeshan Ali Khan <zeeshanak@gnome.org>"
 async-channel,https://github.com/smol-rs/async-channel,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
 async-compat,https://github.com/smol-rs/async-compat,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
@@ -49,11 +47,6 @@ async-compression,https://github.com/Nullus157/async-compression,MIT OR Apache-2
 async-executor,https://github.com/smol-rs/async-executor,Apache-2.0 OR MIT,"Stjepan Glavina <stjepang@gmail.com>, John Nunley <dev@notgull.net>"
 async-fs,https://github.com/smol-rs/async-fs,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
 async-global-executor,https://github.com/Keruspe/async-global-executor,Apache-2.0 OR MIT,Marc-Antoine Perennou <Marc-Antoine@Perennou.com>
-async-graphql,https://github.com/async-graphql/async-graphql,MIT OR Apache-2.0,"sunli <scott_s829@163.com>, Koxiaet"
-async-graphql-derive,https://github.com/async-graphql/async-graphql,MIT OR Apache-2.0,"sunli <scott_s829@163.com>, Koxiaet"
-async-graphql-parser,https://github.com/async-graphql/async-graphql,MIT OR Apache-2.0,"sunli <scott_s829@163.com>, Koxiaet"
-async-graphql-value,https://github.com/async-graphql/async-graphql,MIT OR Apache-2.0,"sunli <scott_s829@163.com>, Koxiaet"
-async-graphql-warp,https://github.com/async-graphql/async-graphql,MIT OR Apache-2.0,"sunli <scott_s829@163.com>, Koxiaet"
 async-io,https://github.com/smol-rs/async-io,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
 async-lock,https://github.com/smol-rs/async-lock,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
 async-native-tls,https://github.com/async-email/async-native-tls,MIT OR Apache-2.0,dignifiedquire <me@dignifiedquire.com>
@@ -315,11 +308,6 @@ glob,https://github.com/rust-lang/glob,MIT OR Apache-2.0,The Rust Project Develo
 gloo-timers,https://github.com/rustwasm/gloo/tree/master/crates/timers,MIT OR Apache-2.0,Rust and WebAssembly Working Group
 goauth,https://github.com/durch/rust-goauth,MIT,Drazen Urch <github@drazenur.ch>
 governor,https://github.com/boinkor-net/governor,MIT,Andreas Fuchs <asf@boinkor.net>
-graphql-introspection-query,https://github.com/graphql-rust/graphql-client,Apache-2.0 OR MIT,Tom Houlé <tom@tomhoule.com>
-graphql-parser,https://github.com/graphql-rust/graphql-parser,MIT OR Apache-2.0,Paul Colomiets <paul@colomiets.name>
-graphql_client,https://github.com/graphql-rust/graphql-client,Apache-2.0 OR MIT,Tom Houlé <tom@tomhoule.com>
-graphql_client_codegen,https://github.com/graphql-rust/graphql-client,Apache-2.0 OR MIT,Tom Houlé <tom@tomhoule.com>
-graphql_query_derive,https://github.com/graphql-rust/graphql-client,Apache-2.0 OR MIT,Tom Houlé <tom@tomhoule.com>
 greptime-proto,https://github.com/GreptimeTeam/greptime-proto,Apache-2.0,The greptime-proto Authors
 greptimedb-ingester,https://github.com/GreptimeTeam/greptimedb-ingester-rust,Apache-2.0,The greptimedb-ingester Authors
 grok,https://github.com/mmastrac/grok,Apache-2.0,"Matt Mastracci <matthew@mastracci.com>, Michael Nitschinger <michael@nitschinger.at>"
@@ -487,7 +475,6 @@ mongocrypt,https://github.com/mongodb/libmongocrypt-rust,Apache-2.0,"Abraham Egn
 mongocrypt-sys,https://github.com/mongodb/libmongocrypt-rust,Apache-2.0,"Abraham Egnor <abraham.egnor@mongodb.com>, Isabel Atkinson <isabel.atkinson@mongodb.com>"
 mongodb,https://github.com/mongodb/mongo-rust-driver,Apache-2.0,"Saghm Rossi <saghmrossi@gmail.com>, Patrick Freed <patrick.freed@mongodb.com>, Isabel Atkinson <isabel.atkinson@mongodb.com>, Abraham Egnor <abraham.egnor@mongodb.com>, Kaitlin Mahar <kaitlin.mahar@mongodb.com>, Patrick Meredith <pmeredit@protonmail.com>"
 mongodb-internal-macros,https://github.com/mongodb/mongo-rust-driver,Apache-2.0,The mongodb-internal-macros Authors
-multer,https://github.com/rousan/multer-rs,MIT,Rousan Ali <hello@rousan.io>
 murmur3,https://github.com/stusmall/murmur3,MIT OR Apache-2.0,Stu Small <stuart.alan.small@gmail.com>
 native-tls,https://github.com/sfackler/rust-native-tls,MIT OR Apache-2.0,Steven Fackler <sfackler@gmail.com>
 ndk-context,https://github.com/rust-windowing/android-ndk-rs,MIT OR Apache-2.0,The Rust Windowing contributors
@@ -741,7 +728,6 @@ sqlx-postgres,https://github.com/launchbadge/sqlx,MIT OR Apache-2.0,"Ryan Leckey
 sqlx-sqlite,https://github.com/launchbadge/sqlx,MIT OR Apache-2.0,"Ryan Leckey <leckey.ryan@gmail.com>, Austin Bonander <austin.bonander@gmail.com>, Chloe Ross <orangesnowfox@gmail.com>, Daniel Akhterov <akhterovd@gmail.com>"
 stable_deref_trait,https://github.com/storyyeller/stable_deref_trait,MIT OR Apache-2.0,Robert Grosse <n210241048576@gmail.com>
 static_assertions,https://github.com/nvzqz/static-assertions-rs,MIT OR Apache-2.0,Nikolai Vazquez
-static_assertions_next,https://github.com/scuffletv/static-assertions,MIT OR Apache-2.0,Nikolai Vazquez
 stream-cancel,https://github.com/jonhoo/stream-cancel,MIT OR Apache-2.0,Jon Gjengset <jon@thesquareplanet.com>
 stringprep,https://github.com/sfackler/rust-stringprep,MIT OR Apache-2.0,Steven Fackler <sfackler@gmail.com>
 strip-ansi-escapes,https://github.com/luser/strip-ansi-escapes,Apache-2.0 OR MIT,Ted Mielczarek <ted@mielczarek.org>
@@ -799,6 +785,7 @@ toml_write,https://github.com/toml-rs/toml,MIT OR Apache-2.0,The toml_write Auth
 toml_writer,https://github.com/toml-rs/toml,MIT OR Apache-2.0,The toml_writer Authors
 tonic,https://github.com/hyperium/tonic,MIT,Lucio Franco <luciofranco14@gmail.com>
 tonic-health,https://github.com/hyperium/tonic,MIT,James Nugent <james@jen20.com>
+tonic-reflection,https://github.com/hyperium/tonic,MIT,"James Nugent <james@jen20.com>, Samani G. Gikandi <samani@gojulas.com>"
 tower,https://github.com/tower-rs/tower,MIT,Tower Maintainers <team@tower-rs.com>
 tower-http,https://github.com/tower-rs/tower-http,MIT,Tower Maintainers <team@tower-rs.com>
 tower-layer,https://github.com/tower-rs/tower,MIT,Tower Maintainers <team@tower-rs.com>
@@ -838,7 +825,6 @@ unicode-width,https://github.com/unicode-rs/unicode-width,MIT OR Apache-2.0,"kwa
 unicode-xid,https://github.com/unicode-rs/unicode-xid,MIT OR Apache-2.0,"erick.tryzelaar <erick.tryzelaar@gmail.com>, kwantam <kwantam@gmail.com>, Manish Goregaokar <manishsmail@gmail.com>"
 unit-prefix,https://codeberg.org/commons-rs/unit-prefix,MIT,"Fabio Valentini <decathorpe@gmail.com>, Benjamin Sago <ogham@bsago.me>"
 universal-hash,https://github.com/RustCrypto/traits,MIT OR Apache-2.0,RustCrypto Developers
-unreachable,https://github.com/reem/rust-unreachable,MIT  OR  Apache-2.0,Jonathan Reem <jonathan.reem@gmail.com>
 unsafe-libyaml,https://github.com/dtolnay/unsafe-libyaml,MIT,David Tolnay <dtolnay@gmail.com>
 untrusted,https://github.com/briansmith/untrusted,ISC,Brian Smith <brian@briansmith.org>
 uom,https://github.com/iliekturtles/uom,Apache-2.0 OR MIT,Mike Boutin <mike.boutin@gmail.com>
@@ -852,7 +838,6 @@ utf8parse,https://github.com/alacritty/vte,Apache-2.0 OR MIT,"Joe Wilm <joe@jwil
 uuid,https://github.com/uuid-rs/uuid,Apache-2.0 OR MIT,"Ashley Mannix<ashleymannix@live.com.au>, Dylan DPC<dylan.dpc@gmail.com>, Hunar Roop Kahlon<hunar.roop@gmail.com>"
 uuid-simd,https://github.com/Nugine/simd,MIT,The uuid-simd Authors
 valuable,https://github.com/tokio-rs/valuable,MIT,The valuable Authors
-void,https://github.com/reem/rust-void,MIT,Jonathan Reem <jonathan.reem@gmail.com>
 vrl,https://github.com/vectordotdev/vrl,MPL-2.0,Vector Contributors <vector@datadoghq.com>
 vsimd,https://github.com/Nugine/simd,MIT,The vsimd Authors
 vte,https://github.com/alacritty/vte,Apache-2.0 OR MIT,"Joe Wilm <joe@jwilm.com>, Christian Duerr <contact@christianduerr.com>"
diff --git a/build.rs b/build.rs
index cf35846cbe61c..5d6d533e86423 100644
--- a/build.rs
+++ b/build.rs
@@ -120,6 +120,7 @@ fn main() {
         println!("cargo:rerun-if-changed=proto/vector/dd_trace.proto");
         println!("cargo:rerun-if-changed=proto/vector/ddsketch_full.proto");
         println!("cargo:rerun-if-changed=proto/vector/vector.proto");
+        println!("cargo:rerun-if-changed=proto/vector/observability.proto");
 
         // Create and store the "file descriptor set" from the compiled Protocol Buffers packages.
         //
@@ -133,7 +134,8 @@ fn main() {
         let mut prost_build = prost_build::Config::new();
         prost_build
             .btree_map(["."])
-            .file_descriptor_set_path(protobuf_fds_path);
+            .file_descriptor_set_path(protobuf_fds_path)
+            .extern_path(".event", "crate::event::proto"); // Use existing event types from vector-core
 
         tonic_build::configure()
             .protoc_arg("--experimental_allow_proto3_optional")
@@ -147,6 +149,7 @@ fn main() {
                     "proto/third-party/google/pubsub/v1/pubsub.proto",
                     "proto/third-party/google/rpc/status.proto",
                     "proto/vector/vector.proto",
+                    "proto/vector/observability.proto",
                 ],
                 &[
                     "proto/third-party",
diff --git a/changelog.d/graphql_to_grpc_api.breaking.md b/changelog.d/graphql_to_grpc_api.breaking.md
new file mode 100644
index 0000000000000..20ab9d67b35e3
--- /dev/null
+++ b/changelog.d/graphql_to_grpc_api.breaking.md
@@ -0,0 +1,42 @@
+The Vector observability API has been migrated from GraphQL to gRPC for improved
+performance, efficiency and maintainability. The `vector top` and `vector tap`
+commands continue to work as before, as they have been updated to use the new
+gRPC API internally. The gRPC service definition is available in
+[`proto/vector/observability.proto`](https://github.com/vectordotdev/vector/blob/master/proto/vector/observability.proto).
+
+Note: `vector top` and `vector tap` from version 0.55.0 or later are not
+compatible with Vector instances running earlier versions.
+
+- Remove the `api.graphql` and `api.playground` fields from your config. Vector
+  now rejects configs that contain them.
+
+- If you use `vector top` or `vector tap` with an explicit `--url`, remove the
+  `/graphql` path suffix:
+
+```bash
+# Old
+vector top --url http://localhost:8686/graphql
+
+# New (the gRPC API listens at the root)
+vector top --url http://localhost:8686
+```
+
+- The GraphQL API (HTTP endpoint `/graphql`, WebSocket subscriptions, and the
+  GraphQL Playground at `/playground`) has been removed. You can interact with
+  the new gRPC API using tools like
+  [grpcurl](https://github.com/fullstorydev/grpcurl):
+
+```bash
+# Check health
+grpcurl -plaintext localhost:8686 vector.observability.v1.ObservabilityService/Health
+
+# List components
+grpcurl -plaintext localhost:8686 vector.observability.v1.ObservabilityService/GetComponents
+
+# Stream events (tap) — limit and interval_ms are required and must be >= 1
+grpcurl -plaintext \
+  -d '{"outputs_patterns": ["*"], "limit": 100, "interval_ms": 500}' \
+  localhost:8686 vector.observability.v1.ObservabilityService/StreamOutputEvents
+```
+
+authors: pront
diff --git a/config/vector.yaml b/config/vector.yaml
index 590c2aa9ba152..c48be7abd7a31 100644
--- a/config/vector.yaml
+++ b/config/vector.yaml
@@ -41,9 +41,8 @@ sinks:
       json:
         pretty: true
 
-# Vector's GraphQL API (disabled by default)
-# Uncomment to try it out with the `vector top` command or
-# in your browser at http://localhost:8686
+# Vector's API (disabled by default)
+# Uncomment to try it out with the `vector top` command
 # api:
 #   enabled: true
 #   address: "127.0.0.1:8686"
diff --git a/lib/vector-api-client/Cargo.toml b/lib/vector-api-client/Cargo.toml
index 3fbc200af231b..00243fb9d0ecd 100644
--- a/lib/vector-api-client/Cargo.toml
+++ b/lib/vector-api-client/Cargo.toml
@@ -1,34 +1,28 @@
 [package]
 name = "vector-api-client"
-version = "0.1.2"
+version = "0.2.0"
 authors = ["Vector Contributors <vector@datadoghq.com>"]
 edition = "2024"
 publish = false
 license = "MPL-2.0"
 
 [dependencies]
+# gRPC
+tonic.workspace = true
+prost.workspace = true
+prost-types.workspace = true
 
-# Serde
-serde.workspace = true
-serde_json.workspace = true
-
-# Error handling
-anyhow.workspace = true
-
-# Tokio / Futures
+# Async
 futures.workspace = true
 tokio = { workspace = true, features = ["macros", "rt", "sync"] }
 tokio-stream = { workspace = true, features = ["sync"] }
 
-# GraphQL
-graphql_client = { version = "0.14.0", default-features = false, features = ["graphql_query_derive"] }
+# Error handling
+snafu.workspace = true
 
-# HTTP / WebSockets
-reqwest = { version = "0.11.26", default-features = false, features = ["json"] }
-tokio-tungstenite = { workspace = true, features = ["connect", "rustls"] }
+# Utils
+http = { version = "0.2", default-features = false }
 
-# External libs
-chrono.workspace = true
-clap.workspace = true
-url = { version = "2.5.4", default-features = false }
-uuid.workspace = true
+[build-dependencies]
+tonic-build.workspace = true
+prost-build.workspace = true
diff --git a/lib/vector-api-client/build.rs b/lib/vector-api-client/build.rs
new file mode 100644
index 0000000000000..a85641a4b2476
--- /dev/null
+++ b/lib/vector-api-client/build.rs
@@ -0,0 +1,34 @@
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    println!("cargo:rerun-if-changed=../../proto/vector/observability.proto");
+    println!("cargo:rerun-if-changed=../../proto");
+    println!("cargo:rerun-if-changed=../../lib/vector-core/proto/event.proto");
+
+    // First, generate event.proto types
+    tonic_build::configure().build_server(false).compile(
+        &["../../lib/vector-core/proto/event.proto"],
+        &["../../lib/vector-core/proto", "../../proto/third-party"],
+    )?;
+
+    // Then, generate observability.proto using extern_path to reference the event types
+    let mut prost_config = prost_build::Config::new();
+    prost_config.extern_path(".event", "crate::proto::event");
+    // Allow clippy warning for large enum variant in generated code
+    // TappedEvent contains a large EventWrapper while EventNotification is small
+    prost_config.type_attribute(
+        ".vector.observability.v1.StreamOutputEventsResponse",
+        "#[allow(clippy::large_enum_variant)]",
+    );
+
+    tonic_build::configure()
+        .build_server(false)
+        .compile_with_config(
+            prost_config,
+            &["../../proto/vector/observability.proto"],
+            &[
+                "../../proto",
+                "../../proto/third-party",
+                "../../lib/vector-core/proto",
+            ],
+        )?;
+    Ok(())
+}
diff --git a/lib/vector-api-client/graphql/queries/components.graphql b/lib/vector-api-client/graphql/queries/components.graphql
deleted file mode 100644
index 3a6f78fc27989..0000000000000
--- a/lib/vector-api-client/graphql/queries/components.graphql
+++ /dev/null
@@ -1,62 +0,0 @@
-query ComponentsQuery($first: Int!) {
-    components(first: $first) {
-        edges {
-            node {
-                __typename
-                componentId
-                componentType
-                ... on Source {
-                    outputs {
-                        outputId
-                        sentEventsTotal {
-                            sentEventsTotal
-                        }
-                    }
-                    metrics {
-                        __typename
-                        receivedBytesTotal {
-                            receivedBytesTotal
-                        }
-                        receivedEventsTotal {
-                            receivedEventsTotal
-                        }
-                        sentEventsTotal {
-                            sentEventsTotal
-                        }
-                    }
-                }
-                ... on Transform {
-                    outputs {
-                        outputId
-                        sentEventsTotal {
-                            sentEventsTotal
-                        }
-                    }
-                    metrics {
-                        __typename
-                        receivedEventsTotal {
-                            receivedEventsTotal
-                        }
-                        sentEventsTotal {
-                            sentEventsTotal
-                        }
-                    }
-                }
-                ... on Sink {
-                    metrics {
-                        __typename
-                        receivedEventsTotal {
-                            receivedEventsTotal
-                        }
-                        sentBytesTotal {
-                            sentBytesTotal
-                        }
-                        sentEventsTotal {
-                            sentEventsTotal
-                        }
-                    }
-                }
-            }
-        }
-    }
-}
diff --git a/lib/vector-api-client/graphql/queries/health.graphql b/lib/vector-api-client/graphql/queries/health.graphql
deleted file mode 100644
index 6d4aa89849307..0000000000000
--- a/lib/vector-api-client/graphql/queries/health.graphql
+++ /dev/null
@@ -1,3 +0,0 @@
-query HealthQuery {
-  health
-}
diff --git a/lib/vector-api-client/graphql/queries/meta_version_string.graphql b/lib/vector-api-client/graphql/queries/meta_version_string.graphql
deleted file mode 100644
index 82f41372efa07..0000000000000
--- a/lib/vector-api-client/graphql/queries/meta_version_string.graphql
+++ /dev/null
@@ -1,5 +0,0 @@
-query MetaVersionStringQuery {
-    meta {
-        versionString
-    }
-}
diff --git a/lib/vector-api-client/graphql/schema.json b/lib/vector-api-client/graphql/schema.json
deleted file mode 100644
index 034780a80d718..0000000000000
--- a/lib/vector-api-client/graphql/schema.json
+++ /dev/null
@@ -1,7206 +0,0 @@
-{
-  "data": {
-    "__schema": {
-      "queryType": {
-        "name": "Query"
-      },
-      "mutationType": null,
-      "subscriptionType": {
-        "name": "Subscription"
-      },
-      "types": [
-        {
-          "kind": "OBJECT",
-          "name": "AllocatedBytes",
-          "description": null,
-          "fields": [
-            {
-              "name": "timestamp",
-              "description": "Metric timestamp",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "DateTime",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "allocatedBytes",
-              "description": "Allocated bytes",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "SCALAR",
-          "name": "Boolean",
-          "description": "The `Boolean` scalar type represents `true` or `false`.",
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INTERFACE",
-          "name": "Component",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentType",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": [
-            {
-              "kind": "OBJECT",
-              "name": "Source",
-              "ofType": null
-            },
-            {
-              "kind": "OBJECT",
-              "name": "Transform",
-              "ofType": null
-            },
-            {
-              "kind": "OBJECT",
-              "name": "Sink",
-              "ofType": null
-            }
-          ]
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentAllocatedBytes",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Component id",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "metric",
-              "description": "Allocated bytes metric",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "AllocatedBytes",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentConnection",
-          "description": null,
-          "fields": [
-            {
-              "name": "pageInfo",
-              "description": "Information to aid in pagination.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "PageInfo",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "edges",
-              "description": "A list of edges.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "ComponentEdge",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "nodes",
-              "description": "A list of nodes.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "INTERFACE",
-                      "name": "Component",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "totalCount",
-              "description": "Total result set count",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentEdge",
-          "description": "An edge in a connection.",
-          "fields": [
-            {
-              "name": "cursor",
-              "description": "A cursor for use in pagination",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "node",
-              "description": "The item at the end of the edge",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "INTERFACE",
-                  "name": "Component",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentErrorsTotal",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Component id",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "metric",
-              "description": "Errors processed metric",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "ErrorsTotal",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "ENUM",
-          "name": "ComponentKind",
-          "description": null,
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "SOURCE",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "TRANSFORM",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "SINK",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "ComponentKindFilter",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "equals",
-              "description": null,
-              "type": {
-                "kind": "ENUM",
-                "name": "ComponentKind",
-                "ofType": null
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "notEquals",
-              "description": null,
-              "type": {
-                "kind": "ENUM",
-                "name": "ComponentKind",
-                "ofType": null
-              },
-              "defaultValue": null
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentReceivedBytesThroughput",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Component ID.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "throughput",
-              "description": "Throughput of bytes sent.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentReceivedBytesTotal",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Component ID.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "metric",
-              "description": "Metric for total bytes received.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "ReceivedBytesTotal",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentReceivedEventsThroughput",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Component id",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "throughput",
-              "description": "Received events throughput",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentReceivedEventsTotal",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Component id",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "metric",
-              "description": "Total received events metric",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "ReceivedEventsTotal",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentSentBytesThroughput",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Component ID.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "throughput",
-              "description": "Throughput of bytes sent.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentSentBytesTotal",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Component ID.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "metric",
-              "description": "Metric for total bytes sent.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "SentBytesTotal",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentSentEventsThroughput",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Component id",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "throughput",
-              "description": "Total events processed throughput",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "outputs",
-              "description": "Output streams with throughputs",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "OutputThroughput",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ComponentSentEventsTotal",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Component id",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "metric",
-              "description": "Total outgoing events metric",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "SentEventsTotal",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "outputs",
-              "description": "Output streams with outgoing events metrics",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Output",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "ComponentsFilter",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "componentId",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "StringFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "componentKind",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "ComponentKindFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "or",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "ComponentsFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "ComponentsSortField",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "field",
-              "description": null,
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "ComponentsSortFieldName",
-                  "ofType": null
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "direction",
-              "description": null,
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "Direction",
-                  "ofType": null
-                }
-              },
-              "defaultValue": "ASC"
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "ENUM",
-          "name": "ComponentsSortFieldName",
-          "description": null,
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "COMPONENT_KEY",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "COMPONENT_KIND",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "CpuMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "cpuSecondsTotal",
-              "description": "CPU seconds total",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "SCALAR",
-          "name": "DateTime",
-          "description": "Implement the DateTime<Utc> scalar\n\nThe input/output is a string in RFC3339 format.",
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "ENUM",
-          "name": "Direction",
-          "description": null,
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "ASC",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "DESC",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "DiskMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "readBytesTotal",
-              "description": "Total bytes read",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "readsCompletedTotal",
-              "description": "Total reads completed",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "writtenBytesTotal",
-              "description": "Total bytes written",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "writesCompletedTotal",
-              "description": "Total writes completed",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ErrorsTotal",
-          "description": null,
-          "fields": [
-            {
-              "name": "timestamp",
-              "description": "Metric timestamp",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "DateTime",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "errorsTotal",
-              "description": "Total error count",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "ENUM",
-          "name": "EventEncodingType",
-          "description": "Encoding format for the event",
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "JSON",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "YAML",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "LOGFMT",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "EventNotification",
-          "description": "A notification regarding events observation",
-          "fields": [
-            {
-              "name": "notification",
-              "description": "Notification details",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "UNION",
-                  "name": "Notification",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "message",
-              "description": "The human-readable message associated with the notification",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "FileSourceMetricFile",
-          "description": null,
-          "fields": [
-            {
-              "name": "name",
-              "description": "File name",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "receivedBytesTotal",
-              "description": "Metric indicating bytes received for the current file",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedBytesTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "receivedEventsTotal",
-              "description": "Metric indicating received events for the current file",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentEventsTotal",
-              "description": "Metric indicating outgoing events for the current file",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "SentEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "FileSourceMetricFileConnection",
-          "description": null,
-          "fields": [
-            {
-              "name": "pageInfo",
-              "description": "Information to aid in pagination.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "PageInfo",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "edges",
-              "description": "A list of edges.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "FileSourceMetricFileEdge",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "nodes",
-              "description": "A list of nodes.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "FileSourceMetricFile",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "totalCount",
-              "description": "Total result set count",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "FileSourceMetricFileEdge",
-          "description": "An edge in a connection.",
-          "fields": [
-            {
-              "name": "cursor",
-              "description": "A cursor for use in pagination",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "node",
-              "description": "The item at the end of the edge",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "FileSourceMetricFile",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "FileSourceMetricFilesSortField",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "field",
-              "description": null,
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "FileSourceMetricFilesSortFieldName",
-                  "ofType": null
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "direction",
-              "description": null,
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "Direction",
-                  "ofType": null
-                }
-              },
-              "defaultValue": "ASC"
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "ENUM",
-          "name": "FileSourceMetricFilesSortFieldName",
-          "description": null,
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "NAME",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "RECEIVED_BYTES_TOTAL",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "RECEIVED_EVENTS_TOTAL",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "SENT_EVENTS_TOTAL",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "FileSourceMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "files",
-              "description": "File metrics",
-              "args": [
-                {
-                  "name": "after",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "before",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "first",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "last",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "filter",
-                  "description": null,
-                  "type": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "FileSourceMetricsFilesFilter",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "sort",
-                  "description": null,
-                  "type": {
-                    "kind": "LIST",
-                    "name": null,
-                    "ofType": {
-                      "kind": "NON_NULL",
-                      "name": null,
-                      "ofType": {
-                        "kind": "INPUT_OBJECT",
-                        "name": "FileSourceMetricFilesSortField",
-                        "ofType": null
-                      }
-                    }
-                  },
-                  "defaultValue": null
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "FileSourceMetricFileConnection",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "receivedBytesTotal",
-              "description": "Total received bytes for the current file source",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedBytesTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "receivedEventsTotal",
-              "description": "Total received events for the current file source",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentEventsTotal",
-              "description": "Total sent events for the current file source",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "SentEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [
-            {
-              "kind": "INTERFACE",
-              "name": "SourceMetrics",
-              "ofType": null
-            }
-          ],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "FileSourceMetricsFilesFilter",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "name",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "StringFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "or",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "FileSourceMetricsFilesFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "FileSystemMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "freeBytes",
-              "description": "Free bytes",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "totalBytes",
-              "description": "Total bytes",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "usedBytes",
-              "description": "Used bytes",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "SCALAR",
-          "name": "Float",
-          "description": "The `Float` scalar type represents signed double-precision fractional values as specified by [IEEE 754](https://en.wikipedia.org/wiki/IEEE_floating_point).",
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "GenericSinkMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "receivedEventsTotal",
-              "description": "Total received events for the current sink",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentBytesTotal",
-              "description": "Total sent bytes for the current sink",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "SentBytesTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentEventsTotal",
-              "description": "Total sent events for the current sink",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "SentEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [
-            {
-              "kind": "INTERFACE",
-              "name": "SinkMetrics",
-              "ofType": null
-            }
-          ],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "GenericSourceMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "receivedBytesTotal",
-              "description": "Total received bytes for the current source",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedBytesTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "receivedEventsTotal",
-              "description": "Total received events for the current source",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentEventsTotal",
-              "description": "Total sent events for the current source",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "SentEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [
-            {
-              "kind": "INTERFACE",
-              "name": "SourceMetrics",
-              "ofType": null
-            }
-          ],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "GenericTransformMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "receivedEventsTotal",
-              "description": "Total received events for the current transform",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentEventsTotal",
-              "description": "Total sent events for the current transform",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "SentEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [
-            {
-              "kind": "INTERFACE",
-              "name": "TransformMetrics",
-              "ofType": null
-            }
-          ],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Heartbeat",
-          "description": null,
-          "fields": [
-            {
-              "name": "utc",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "DateTime",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "HostMetrics",
-          "description": "Vector host metrics",
-          "fields": [
-            {
-              "name": "memory",
-              "description": "Memory metrics",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "MemoryMetrics",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "swap",
-              "description": "Swap metrics",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "SwapMetrics",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "cpu",
-              "description": "CPU metrics",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "CpuMetrics",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "loadAverage",
-              "description": "Load average metrics (*nix only)",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "LoadAverageMetrics",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "network",
-              "description": "Network metrics",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "NetworkMetrics",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "filesystem",
-              "description": "Filesystem metrics",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "FileSystemMetrics",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "disk",
-              "description": "Disk metrics",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "DiskMetrics",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "SCALAR",
-          "name": "ID",
-          "description": null,
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "SCALAR",
-          "name": "Int",
-          "description": "The `Int` scalar type represents non-fractional whole numeric values.",
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "InvalidMatch",
-          "description": "The pattern matched source(s) which cannot be tapped for inputs or sink(s)\nwhich cannot be tapped for outputs",
-          "fields": [
-            {
-              "name": "pattern",
-              "description": "Pattern that raised the notification",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "invalidMatches",
-              "description": "Any invalid matches for the pattern",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "String",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "LoadAverageMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "load1",
-              "description": "Load 1 average",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "load5",
-              "description": "Load 5 average",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "load15",
-              "description": "Load 15 average",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Log",
-          "description": "Log event with fields for querying log data",
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Id of the component associated with the log event",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentType",
-              "description": "Type of component associated with the log event",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentKind",
-              "description": "Kind of component associated with the log event",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "message",
-              "description": "Log message",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "timestamp",
-              "description": "Log timestamp",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "DateTime",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "string",
-              "description": "Log event as an encoded string format",
-              "args": [
-                {
-                  "name": "encoding",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "ENUM",
-                      "name": "EventEncodingType",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": null
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "json",
-              "description": "Get JSON field data on the log event, by field name",
-              "args": [
-                {
-                  "name": "field",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "String",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": null
-                }
-              ],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Matched",
-          "description": "A component was found that matched the provided pattern",
-          "fields": [
-            {
-              "name": "pattern",
-              "description": "Pattern that raised the notification",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "MemoryMetrics",
-          "description": "Host memory metrics",
-          "fields": [
-            {
-              "name": "totalBytes",
-              "description": "Total bytes",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "freeBytes",
-              "description": "Free bytes",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "availableBytes",
-              "description": "Available bytes",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "activeBytes",
-              "description": "Active bytes (Linux/macOS only)",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Float",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "buffersBytes",
-              "description": "Buffers bytes (Linux only)",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Float",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "cachedBytes",
-              "description": "Cached bytes (Linux only)",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Float",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sharedBytes",
-              "description": "Shared bytes (Linux only)",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Float",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "usedBytes",
-              "description": "Used bytes (Linux only)",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Float",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "inactiveBytes",
-              "description": "Inactive bytes (macOS only)",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Float",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "wiredBytes",
-              "description": "Wired bytes (macOS only)",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Float",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Meta",
-          "description": null,
-          "fields": [
-            {
-              "name": "versionString",
-              "description": "Vector version",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "hostname",
-              "description": "Hostname",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Metric",
-          "description": "Metric event with fields for querying metric data",
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Id of the component associated with the metric event",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentType",
-              "description": "Type of component associated with the metric event",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentKind",
-              "description": "Kind of component associated with the metric event",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "timestamp",
-              "description": "Metric timestamp",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "DateTime",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "name",
-              "description": "Metric name",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "namespace",
-              "description": "Metric namespace",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "kind",
-              "description": "Metric kind",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "MetricKind",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "valueType",
-              "description": "Metric type",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "value",
-              "description": "Metric value in human readable form",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "tags",
-              "description": "Metric tags",
-              "args": [],
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "OBJECT",
-                    "name": "MetricTag",
-                    "ofType": null
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "string",
-              "description": "Metric event as an encoded string format",
-              "args": [
-                {
-                  "name": "encoding",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "ENUM",
-                      "name": "EventEncodingType",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": null
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "ENUM",
-          "name": "MetricKind",
-          "description": null,
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "INCREMENTAL",
-              "description": "Incremental metrics update previous values",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "ABSOLUTE",
-              "description": "Absolute metrics set the reference value for future updates",
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "MetricTag",
-          "description": null,
-          "fields": [
-            {
-              "name": "key",
-              "description": "Metric tag key",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "value",
-              "description": "Metric tag value",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INTERFACE",
-          "name": "MetricType",
-          "description": null,
-          "fields": [
-            {
-              "name": "timestamp",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "DateTime",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": [
-            {
-              "kind": "OBJECT",
-              "name": "Uptime",
-              "ofType": null
-            }
-          ]
-        },
-        {
-          "kind": "OBJECT",
-          "name": "NetworkMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "receiveBytesTotal",
-              "description": "Total bytes received",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "receiveErrsTotal",
-              "description": "Total errors received",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "receivePacketsTotal",
-              "description": "Total packets received",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "transmitBytesTotal",
-              "description": "Total bytes transmitted",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "transmitErrsTotal",
-              "description": "Total errors transmitted",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "transmitPacketsDropTotal",
-              "description": "Total transmission packets dropped (Linux/Windows only)",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Float",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "transmitPacketsTotal",
-              "description": "Total transmission packets (Linux/Windows only)",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Float",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "NotMatched",
-          "description": "There isn't currently a component that matches this pattern",
-          "fields": [
-            {
-              "name": "pattern",
-              "description": "Pattern that raised the notification",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "UNION",
-          "name": "Notification",
-          "description": "A specific kind of notification with additional details",
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": [
-            {
-              "kind": "OBJECT",
-              "name": "Matched",
-              "ofType": null
-            },
-            {
-              "kind": "OBJECT",
-              "name": "NotMatched",
-              "ofType": null
-            },
-            {
-              "kind": "OBJECT",
-              "name": "InvalidMatch",
-              "ofType": null
-            }
-          ]
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Output",
-          "description": null,
-          "fields": [
-            {
-              "name": "outputId",
-              "description": "Id of the output stream",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentEventsTotal",
-              "description": "Total sent events for the current output stream",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "SentEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "UNION",
-          "name": "OutputEventsPayload",
-          "description": "An event or a notification",
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": [
-            {
-              "kind": "OBJECT",
-              "name": "Log",
-              "ofType": null
-            },
-            {
-              "kind": "OBJECT",
-              "name": "Metric",
-              "ofType": null
-            },
-            {
-              "kind": "OBJECT",
-              "name": "EventNotification",
-              "ofType": null
-            },
-            {
-              "kind": "OBJECT",
-              "name": "Trace",
-              "ofType": null
-            }
-          ]
-        },
-        {
-          "kind": "OBJECT",
-          "name": "OutputThroughput",
-          "description": null,
-          "fields": [
-            {
-              "name": "outputId",
-              "description": "Id of the output stream",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "throughput",
-              "description": "Throughput for the output stream",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "PageInfo",
-          "description": "Information about pagination in a connection",
-          "fields": [
-            {
-              "name": "hasPreviousPage",
-              "description": "When paginating backwards, are there more items?",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Boolean",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "hasNextPage",
-              "description": "When paginating forwards, are there more items?",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Boolean",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "startCursor",
-              "description": "When paginating backwards, the cursor to continue.",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "endCursor",
-              "description": "When paginating forwards, the cursor to continue.",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Query",
-          "description": null,
-          "fields": [
-            {
-              "name": "health",
-              "description": "Returns `true` to denote the GraphQL server is reachable",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Boolean",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "components",
-              "description": "Configured components (sources/transforms/sinks)",
-              "args": [
-                {
-                  "name": "after",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "before",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "first",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "last",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "filter",
-                  "description": null,
-                  "type": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "ComponentsFilter",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "sort",
-                  "description": null,
-                  "type": {
-                    "kind": "LIST",
-                    "name": null,
-                    "ofType": {
-                      "kind": "NON_NULL",
-                      "name": null,
-                      "ofType": {
-                        "kind": "INPUT_OBJECT",
-                        "name": "ComponentsSortField",
-                        "ofType": null
-                      }
-                    }
-                  },
-                  "defaultValue": null
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "ComponentConnection",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sources",
-              "description": "Configured sources",
-              "args": [
-                {
-                  "name": "after",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "before",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "first",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "last",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "filter",
-                  "description": null,
-                  "type": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "SourcesFilter",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "sort",
-                  "description": null,
-                  "type": {
-                    "kind": "LIST",
-                    "name": null,
-                    "ofType": {
-                      "kind": "NON_NULL",
-                      "name": null,
-                      "ofType": {
-                        "kind": "INPUT_OBJECT",
-                        "name": "SourcesSortField",
-                        "ofType": null
-                      }
-                    }
-                  },
-                  "defaultValue": null
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "SourceConnection",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "transforms",
-              "description": "Configured transforms",
-              "args": [
-                {
-                  "name": "after",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "before",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "first",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "last",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "filter",
-                  "description": null,
-                  "type": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "TransformsFilter",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "sort",
-                  "description": null,
-                  "type": {
-                    "kind": "LIST",
-                    "name": null,
-                    "ofType": {
-                      "kind": "NON_NULL",
-                      "name": null,
-                      "ofType": {
-                        "kind": "INPUT_OBJECT",
-                        "name": "TransformsSortField",
-                        "ofType": null
-                      }
-                    }
-                  },
-                  "defaultValue": null
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "TransformConnection",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sinks",
-              "description": "Configured sinks",
-              "args": [
-                {
-                  "name": "after",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "before",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "first",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "last",
-                  "description": null,
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "filter",
-                  "description": null,
-                  "type": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "SinksFilter",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "sort",
-                  "description": null,
-                  "type": {
-                    "kind": "LIST",
-                    "name": null,
-                    "ofType": {
-                      "kind": "NON_NULL",
-                      "name": null,
-                      "ofType": {
-                        "kind": "INPUT_OBJECT",
-                        "name": "SinksSortField",
-                        "ofType": null
-                      }
-                    }
-                  },
-                  "defaultValue": null
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "SinkConnection",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentByComponentKey",
-              "description": "Gets a configured component by component_key",
-              "args": [
-                {
-                  "name": "componentId",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "String",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": null
-                }
-              ],
-              "type": {
-                "kind": "INTERFACE",
-                "name": "Component",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "hostMetrics",
-              "description": "Vector host metrics",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "HostMetrics",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "meta",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "Meta",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ReceivedBytesTotal",
-          "description": null,
-          "fields": [
-            {
-              "name": "timestamp",
-              "description": "Metric timestamp.",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "DateTime",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "receivedBytesTotal",
-              "description": "Total number of bytes received.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "ReceivedEventsTotal",
-          "description": null,
-          "fields": [
-            {
-              "name": "timestamp",
-              "description": "Metric timestamp",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "DateTime",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "receivedEventsTotal",
-              "description": "Total incoming events",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "SentBytesTotal",
-          "description": null,
-          "fields": [
-            {
-              "name": "timestamp",
-              "description": "Metric timestamp.",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "DateTime",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentBytesTotal",
-              "description": "Total number of bytes sent.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "SentEventsTotal",
-          "description": null,
-          "fields": [
-            {
-              "name": "timestamp",
-              "description": "Metric timestamp",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "DateTime",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentEventsTotal",
-              "description": "Total sent events",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Sink",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Sink component_id",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentType",
-              "description": "Sink type",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sources",
-              "description": "Source inputs",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Source",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "transforms",
-              "description": "Transform inputs",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Transform",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "metrics",
-              "description": "Sink metrics",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "INTERFACE",
-                  "name": "SinkMetrics",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [
-            {
-              "kind": "INTERFACE",
-              "name": "Component",
-              "ofType": null
-            }
-          ],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "SinkConnection",
-          "description": null,
-          "fields": [
-            {
-              "name": "pageInfo",
-              "description": "Information to aid in pagination.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "PageInfo",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "edges",
-              "description": "A list of edges.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "SinkEdge",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "nodes",
-              "description": "A list of nodes.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Sink",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "totalCount",
-              "description": "Total result set count",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "SinkEdge",
-          "description": "An edge in a connection.",
-          "fields": [
-            {
-              "name": "cursor",
-              "description": "A cursor for use in pagination",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "node",
-              "description": "The item at the end of the edge",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "Sink",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INTERFACE",
-          "name": "SinkMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "receivedEventsTotal",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentBytesTotal",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "SentBytesTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentEventsTotal",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "SentEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": [
-            {
-              "kind": "OBJECT",
-              "name": "GenericSinkMetrics",
-              "ofType": null
-            }
-          ]
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "SinksFilter",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "componentId",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "StringFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "componentType",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "StringFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "or",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "SinksFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "SinksSortField",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "field",
-              "description": null,
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "SinksSortFieldName",
-                  "ofType": null
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "direction",
-              "description": null,
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "Direction",
-                  "ofType": null
-                }
-              },
-              "defaultValue": "ASC"
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "ENUM",
-          "name": "SinksSortFieldName",
-          "description": null,
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "COMPONENT_KEY",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "COMPONENT_TYPE",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Source",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Source component_id",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentType",
-              "description": "Source type",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "outputTypes",
-              "description": "Source output type",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "ENUM",
-                      "name": "SourceOutputType",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "outputs",
-              "description": "Source output streams",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Output",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "transforms",
-              "description": "Transform outputs",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Transform",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sinks",
-              "description": "Sink outputs",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Sink",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "metrics",
-              "description": "Source metrics",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "INTERFACE",
-                  "name": "SourceMetrics",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [
-            {
-              "kind": "INTERFACE",
-              "name": "Component",
-              "ofType": null
-            }
-          ],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "SourceConnection",
-          "description": null,
-          "fields": [
-            {
-              "name": "pageInfo",
-              "description": "Information to aid in pagination.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "PageInfo",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "edges",
-              "description": "A list of edges.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "SourceEdge",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "nodes",
-              "description": "A list of nodes.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Source",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "totalCount",
-              "description": "Total result set count",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "SourceEdge",
-          "description": "An edge in a connection.",
-          "fields": [
-            {
-              "name": "cursor",
-              "description": "A cursor for use in pagination",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "node",
-              "description": "The item at the end of the edge",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "Source",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INTERFACE",
-          "name": "SourceMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "receivedBytesTotal",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedBytesTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "receivedEventsTotal",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentEventsTotal",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "SentEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": [
-            {
-              "kind": "OBJECT",
-              "name": "GenericSourceMetrics",
-              "ofType": null
-            },
-            {
-              "kind": "OBJECT",
-              "name": "FileSourceMetrics",
-              "ofType": null
-            }
-          ]
-        },
-        {
-          "kind": "ENUM",
-          "name": "SourceOutputType",
-          "description": null,
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "LOG",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "METRIC",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "TRACE",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "SourceOutputTypeFilter",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "equals",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "ENUM",
-                    "name": "SourceOutputType",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "notEquals",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "ENUM",
-                    "name": "SourceOutputType",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "contains",
-              "description": null,
-              "type": {
-                "kind": "ENUM",
-                "name": "SourceOutputType",
-                "ofType": null
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "notContains",
-              "description": null,
-              "type": {
-                "kind": "ENUM",
-                "name": "SourceOutputType",
-                "ofType": null
-              },
-              "defaultValue": null
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "SourcesFilter",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "componentId",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "StringFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "componentType",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "StringFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "outputType",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "SourceOutputTypeFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "or",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "SourcesFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "SourcesSortField",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "field",
-              "description": null,
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "SourcesSortFieldName",
-                  "ofType": null
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "direction",
-              "description": null,
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "Direction",
-                  "ofType": null
-                }
-              },
-              "defaultValue": "ASC"
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "ENUM",
-          "name": "SourcesSortFieldName",
-          "description": null,
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "COMPONENT_KEY",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "COMPONENT_TYPE",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "OUTPUT_TYPE",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        },
-        {
-          "kind": "SCALAR",
-          "name": "String",
-          "description": "The `String` scalar type represents textual data, represented as UTF-8\ncharacter sequences. The String type is most often used by GraphQL to\nrepresent free-form human-readable text.",
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "StringFilter",
-          "description": "Filter for String values",
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "equals",
-              "description": null,
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "notEquals",
-              "description": null,
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "contains",
-              "description": null,
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "notContains",
-              "description": null,
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "startsWith",
-              "description": null,
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "endsWith",
-              "description": null,
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "defaultValue": null
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Subscription",
-          "description": null,
-          "fields": [
-            {
-              "name": "heartbeat",
-              "description": "Heartbeat, containing the UTC timestamp of the last server-sent payload",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "Heartbeat",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "uptime",
-              "description": "Metrics for how long the Vector instance has been running",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "Uptime",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "receivedEventsTotal",
-              "description": "Total received events metrics",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "ReceivedEventsTotal",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": true,
-              "deprecationReason": "Use component_received_events_totals instead"
-            },
-            {
-              "name": "receivedEventsThroughput",
-              "description": "Total received events throughput sampled over the provided millisecond `interval`",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": true,
-              "deprecationReason": "Use component_received_events_throughputs instead"
-            },
-            {
-              "name": "componentReceivedEventsThroughputs",
-              "description": "Total incoming component events throughput metrics over `interval`",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "ComponentReceivedEventsThroughput",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentReceivedEventsTotals",
-              "description": "Total received component event metrics over `interval`",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "ComponentReceivedEventsTotal",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentEventsTotal",
-              "description": "Total sent events metrics",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "SentEventsTotal",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": true,
-              "deprecationReason": "Use component_sent_events_totals instead"
-            },
-            {
-              "name": "sentEventsThroughput",
-              "description": "Total outgoing events throughput sampled over the provided millisecond `interval`",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": true,
-              "deprecationReason": "Use component_sent_events_throughputs instead"
-            },
-            {
-              "name": "componentSentEventsThroughputs",
-              "description": "Total outgoing component event throughput metrics over `interval`",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "ComponentSentEventsThroughput",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentSentEventsTotals",
-              "description": "Total outgoing component event metrics over `interval`",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "ComponentSentEventsTotal",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentReceivedBytesTotals",
-              "description": "Component bytes received metrics over `interval`.",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "ComponentReceivedBytesTotal",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentReceivedBytesThroughputs",
-              "description": "Component bytes received throughput over `interval`",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "ComponentReceivedBytesThroughput",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentSentBytesTotals",
-              "description": "Component bytes sent metrics over `interval`.",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "ComponentSentBytesTotal",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentSentBytesThroughputs",
-              "description": "Component bytes sent throughput over `interval`",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "ComponentSentBytesThroughput",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "errorsTotal",
-              "description": "Total error metrics.",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "ErrorsTotal",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "allocatedBytes",
-              "description": "Allocated bytes metrics.",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "AllocatedBytes",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentAllocatedBytes",
-              "description": "Component allocation metrics",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "ComponentAllocatedBytes",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentErrorsTotals",
-              "description": "Component error metrics over `interval`.",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "ComponentErrorsTotal",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "metrics",
-              "description": "All metrics.",
-              "args": [
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "1000"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "INTERFACE",
-                  "name": "MetricType",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentAdded",
-              "description": "Subscribes to all newly added components",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "INTERFACE",
-                  "name": "Component",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentRemoved",
-              "description": "Subscribes to all removed components",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "INTERFACE",
-                  "name": "Component",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "outputEventsByComponentIdPatterns",
-              "description": "A stream of events emitted from matched component ID patterns",
-              "args": [
-                {
-                  "name": "outputsPatterns",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "LIST",
-                      "name": null,
-                      "ofType": {
-                        "kind": "NON_NULL",
-                        "name": null,
-                        "ofType": {
-                          "kind": "SCALAR",
-                          "name": "String",
-                          "ofType": null
-                        }
-                      }
-                    }
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "inputsPatterns",
-                  "description": null,
-                  "type": {
-                    "kind": "LIST",
-                    "name": null,
-                    "ofType": {
-                      "kind": "NON_NULL",
-                      "name": null,
-                      "ofType": {
-                        "kind": "SCALAR",
-                        "name": "String",
-                        "ofType": null
-                      }
-                    }
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "interval",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "500"
-                },
-                {
-                  "name": "limit",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Int",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "100"
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "UNION",
-                      "name": "OutputEventsPayload",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "SwapMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "freeBytes",
-              "description": "Swap free bytes",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "totalBytes",
-              "description": "Swap total bytes",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "usedBytes",
-              "description": "Swap used bytes",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "swappedInBytesTotal",
-              "description": "Swapped in bytes total (not available on Windows)",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Float",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "swappedOutBytesTotal",
-              "description": "Swapped out bytes total (not available on Windows)",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Float",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Trace",
-          "description": "Trace event with fields for querying trace data",
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Id of the component associated with the trace event",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentType",
-              "description": "Type of component associated with the trace event",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentKind",
-              "description": "Kind of component associated with the trace event",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "string",
-              "description": "Trace event as an encoded string format",
-              "args": [
-                {
-                  "name": "encoding",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "ENUM",
-                      "name": "EventEncodingType",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": null
-                }
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "json",
-              "description": "Get JSON field data on the trace event, by field name",
-              "args": [
-                {
-                  "name": "field",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "String",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": null
-                }
-              ],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Transform",
-          "description": null,
-          "fields": [
-            {
-              "name": "componentId",
-              "description": "Transform component_id",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "componentType",
-              "description": "Transform type",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "outputs",
-              "description": "Transform output streams",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Output",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sources",
-              "description": "Source inputs",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Source",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "transforms",
-              "description": "Transform outputs",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Transform",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sinks",
-              "description": "Sink outputs",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Sink",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "metrics",
-              "description": "Transform metrics",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "INTERFACE",
-                  "name": "TransformMetrics",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [
-            {
-              "kind": "INTERFACE",
-              "name": "Component",
-              "ofType": null
-            }
-          ],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "TransformConnection",
-          "description": null,
-          "fields": [
-            {
-              "name": "pageInfo",
-              "description": "Information to aid in pagination.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "PageInfo",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "edges",
-              "description": "A list of edges.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "TransformEdge",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "nodes",
-              "description": "A list of nodes.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "Transform",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "totalCount",
-              "description": "Total result set count",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Int",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "TransformEdge",
-          "description": "An edge in a connection.",
-          "fields": [
-            {
-              "name": "cursor",
-              "description": "A cursor for use in pagination",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "node",
-              "description": "The item at the end of the edge",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "Transform",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INTERFACE",
-          "name": "TransformMetrics",
-          "description": null,
-          "fields": [
-            {
-              "name": "receivedEventsTotal",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "ReceivedEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "sentEventsTotal",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "SentEventsTotal",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": [
-            {
-              "kind": "OBJECT",
-              "name": "GenericTransformMetrics",
-              "ofType": null
-            }
-          ]
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "TransformsFilter",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "componentId",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "StringFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "componentType",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "StringFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "or",
-              "description": null,
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "INPUT_OBJECT",
-                    "name": "TransformsFilter",
-                    "ofType": null
-                  }
-                }
-              },
-              "defaultValue": null
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "INPUT_OBJECT",
-          "name": "TransformsSortField",
-          "description": null,
-          "fields": null,
-          "inputFields": [
-            {
-              "name": "field",
-              "description": null,
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "TransformsSortFieldName",
-                  "ofType": null
-                }
-              },
-              "defaultValue": null
-            },
-            {
-              "name": "direction",
-              "description": null,
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "Direction",
-                  "ofType": null
-                }
-              },
-              "defaultValue": "ASC"
-            }
-          ],
-          "interfaces": null,
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "ENUM",
-          "name": "TransformsSortFieldName",
-          "description": null,
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "COMPONENT_KEY",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "COMPONENT_TYPE",
-              "description": null,
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "Uptime",
-          "description": null,
-          "fields": [
-            {
-              "name": "timestamp",
-              "description": "Metric timestamp",
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "DateTime",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "seconds",
-              "description": "Number of seconds the Vector instance has been alive",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Float",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [
-            {
-              "kind": "INTERFACE",
-              "name": "MetricType",
-              "ofType": null
-            }
-          ],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "__Directive",
-          "description": "A Directive provides a way to describe alternate runtime execution and type\nvalidation behavior in a GraphQL document.\n\nIn some cases, you need to provide options to alter GraphQL's execution\nbehavior in ways field arguments will not suffice, such as conditionally\nincluding or skipping a field. Directives provide this by describing\nadditional information to the executor.",
-          "fields": [
-            {
-              "name": "name",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "description",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "locations",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "ENUM",
-                      "name": "__DirectiveLocation",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "args",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "__InputValue",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "isRepeatable",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Boolean",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "ENUM",
-          "name": "__DirectiveLocation",
-          "description": "A Directive can be adjacent to many parts of the GraphQL language, a\n__DirectiveLocation describes one such possible adjacencies.",
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "QUERY",
-              "description": "Location adjacent to a query operation.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "MUTATION",
-              "description": "Location adjacent to a mutation operation.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "SUBSCRIPTION",
-              "description": "Location adjacent to a subscription operation.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "FIELD",
-              "description": "Location adjacent to a field.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "FRAGMENT_DEFINITION",
-              "description": "Location adjacent to a fragment definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "FRAGMENT_SPREAD",
-              "description": "Location adjacent to a fragment spread.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "INLINE_FRAGMENT",
-              "description": "Location adjacent to an inline fragment.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "VARIABLE_DEFINITION",
-              "description": "Location adjacent to a variable definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "SCHEMA",
-              "description": "Location adjacent to a schema definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "SCALAR",
-              "description": "Location adjacent to a scalar definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "OBJECT",
-              "description": "Location adjacent to an object type definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "FIELD_DEFINITION",
-              "description": "Location adjacent to a field definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "ARGUMENT_DEFINITION",
-              "description": "Location adjacent to an argument definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "INTERFACE",
-              "description": "Location adjacent to an interface definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "UNION",
-              "description": "Location adjacent to a union definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "ENUM",
-              "description": "Location adjacent to an enum definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "ENUM_VALUE",
-              "description": "Location adjacent to an enum value definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "INPUT_OBJECT",
-              "description": "Location adjacent to an input object type definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "INPUT_FIELD_DEFINITION",
-              "description": "Location adjacent to an input object field definition.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "__EnumValue",
-          "description": "One possible value for a given Enum. Enum values are unique values, not a\nplaceholder for a string or numeric value. However an Enum value is returned\nin a JSON response as a string.",
-          "fields": [
-            {
-              "name": "name",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "description",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "isDeprecated",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Boolean",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "deprecationReason",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "__Field",
-          "description": "Object and Interface types are described by a list of Fields, each of which\nhas a name, potentially a list of arguments, and a return type.",
-          "fields": [
-            {
-              "name": "name",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "description",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "args",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "__InputValue",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "type",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "__Type",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "isDeprecated",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Boolean",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "deprecationReason",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "__InputValue",
-          "description": "Arguments provided to Fields or Directives and the input fields of an\nInputObject are represented as Input Values which describe their type and\noptionally a default value.",
-          "fields": [
-            {
-              "name": "name",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "description",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "type",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "__Type",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "defaultValue",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "__Schema",
-          "description": "A GraphQL Schema defines the capabilities of a GraphQL server. It exposes\nall available types and directives on the server, as well as the entry\npoints for query, mutation, and subscription operations.",
-          "fields": [
-            {
-              "name": "types",
-              "description": "A list of all types supported by this server.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "__Type",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "queryType",
-              "description": "The type that query operations will be rooted at.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "__Type",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "mutationType",
-              "description": "If this server supports mutation, the type that mutation operations will\nbe rooted at.",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "__Type",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "subscriptionType",
-              "description": "If this server support subscription, the type that subscription\noperations will be rooted at.",
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "__Type",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "directives",
-              "description": "A list of all directives supported by this server.",
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "LIST",
-                  "name": null,
-                  "ofType": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "OBJECT",
-                      "name": "__Directive",
-                      "ofType": null
-                    }
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "__Type",
-          "description": "The fundamental unit of any GraphQL Schema is the type. There are many kinds\nof types in GraphQL as represented by the `__TypeKind` enum.\n\nDepending on the kind of a type, certain fields describe information about\nthat type. Scalar types provide no information beyond a name and\ndescription, while Enum types provide their values. Object and Interface\ntypes provide the fields they describe. Abstract types, Union and Interface,\nprovide the Object types possible at runtime. List and NonNull types compose\nother types.",
-          "fields": [
-            {
-              "name": "kind",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "ENUM",
-                  "name": "__TypeKind",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "name",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "description",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "fields",
-              "description": null,
-              "args": [
-                {
-                  "name": "includeDeprecated",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Boolean",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "false"
-                }
-              ],
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "OBJECT",
-                    "name": "__Field",
-                    "ofType": null
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "interfaces",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "OBJECT",
-                    "name": "__Type",
-                    "ofType": null
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "possibleTypes",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "OBJECT",
-                    "name": "__Type",
-                    "ofType": null
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "enumValues",
-              "description": null,
-              "args": [
-                {
-                  "name": "includeDeprecated",
-                  "description": null,
-                  "type": {
-                    "kind": "NON_NULL",
-                    "name": null,
-                    "ofType": {
-                      "kind": "SCALAR",
-                      "name": "Boolean",
-                      "ofType": null
-                    }
-                  },
-                  "defaultValue": "false"
-                }
-              ],
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "OBJECT",
-                    "name": "__EnumValue",
-                    "ofType": null
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "inputFields",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "NON_NULL",
-                  "name": null,
-                  "ofType": {
-                    "kind": "OBJECT",
-                    "name": "__InputValue",
-                    "ofType": null
-                  }
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "ofType",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "OBJECT",
-                "name": "__Type",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "specifiedByURL",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "String",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "isOneOf",
-              "description": null,
-              "args": [],
-              "type": {
-                "kind": "SCALAR",
-                "name": "Boolean",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "ENUM",
-          "name": "__TypeKind",
-          "description": "An enum describing what kind of type a given `__Type` is.",
-          "fields": null,
-          "inputFields": null,
-          "interfaces": null,
-          "enumValues": [
-            {
-              "name": "SCALAR",
-              "description": "Indicates this type is a scalar.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "OBJECT",
-              "description": "Indicates this type is an object. `fields` and `interfaces` are valid\nfields.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "INTERFACE",
-              "description": "Indicates this type is an interface. `fields` and `possibleTypes` are\nvalid fields.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "UNION",
-              "description": "Indicates this type is a union. `possibleTypes` is a valid field.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "ENUM",
-              "description": "Indicates this type is an enum. `enumValues` is a valid field.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "INPUT_OBJECT",
-              "description": "Indicates this type is an input object. `inputFields` is a valid field.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "LIST",
-              "description": "Indicates this type is a list. `ofType` is a valid field.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "NON_NULL",
-              "description": "Indicates this type is a non-null. `ofType` is a valid field.",
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "possibleTypes": null
-        }
-      ],
-      "directives": [
-        {
-          "name": "include",
-          "description": "Directs the executor to include this field or fragment only when the `if` argument is true.",
-          "locations": [
-            "FIELD",
-            "FRAGMENT_SPREAD",
-            "INLINE_FRAGMENT"
-          ],
-          "args": [
-            {
-              "name": "if",
-              "description": "Included when true.",
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Boolean",
-                  "ofType": null
-                }
-              },
-              "defaultValue": null
-            }
-          ]
-        },
-        {
-          "name": "skip",
-          "description": "Directs the executor to skip this field or fragment when the `if` argument is true.",
-          "locations": [
-            "FIELD",
-            "FRAGMENT_SPREAD",
-            "INLINE_FRAGMENT"
-          ],
-          "args": [
-            {
-              "name": "if",
-              "description": "Skipped when true.",
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "Boolean",
-                  "ofType": null
-                }
-              },
-              "defaultValue": null
-            }
-          ]
-        }
-      ]
-    }
-  }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_added.graphql b/lib/vector-api-client/graphql/subscriptions/component_added.graphql
deleted file mode 100644
index 9197209bc053b..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_added.graphql
+++ /dev/null
@@ -1,7 +0,0 @@
-subscription ComponentAddedSubscription {
-  componentAdded {
-    __typename
-    componentId
-    componentType
-  }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_allocated_bytes.graphql b/lib/vector-api-client/graphql/subscriptions/component_allocated_bytes.graphql
deleted file mode 100644
index 2624d3dc8dc75..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_allocated_bytes.graphql
+++ /dev/null
@@ -1,8 +0,0 @@
-subscription ComponentAllocatedBytesSubscription ($interval: Int!) {
-    componentAllocatedBytes(interval: $interval)  {
-        componentId
-        metric {
-            allocatedBytes
-        }
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_errors_totals.graphql b/lib/vector-api-client/graphql/subscriptions/component_errors_totals.graphql
deleted file mode 100644
index d8e0b2554e74f..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_errors_totals.graphql
+++ /dev/null
@@ -1,8 +0,0 @@
-subscription ComponentErrorsTotalsSubscription ($interval: Int!) {
-    componentErrorsTotals(interval: $interval) {
-        componentId
-        metric {
-            errorsTotal
-        }
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_received_bytes_throughputs.graphql b/lib/vector-api-client/graphql/subscriptions/component_received_bytes_throughputs.graphql
deleted file mode 100644
index ec1b018d27107..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_received_bytes_throughputs.graphql
+++ /dev/null
@@ -1,6 +0,0 @@
-subscription ComponentReceivedBytesThroughputsSubscription($interval: Int!) {
-    componentReceivedBytesThroughputs(interval: $interval) {
-        componentId
-        throughput
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_received_bytes_totals.graphql b/lib/vector-api-client/graphql/subscriptions/component_received_bytes_totals.graphql
deleted file mode 100644
index 748b8930fb087..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_received_bytes_totals.graphql
+++ /dev/null
@@ -1,8 +0,0 @@
-subscription ComponentReceivedBytesTotalsSubscription($interval: Int!) {
-    componentReceivedBytesTotals(interval: $interval) {
-        componentId
-        metric {
-            receivedBytesTotal
-        }
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_received_events_throughputs.graphql b/lib/vector-api-client/graphql/subscriptions/component_received_events_throughputs.graphql
deleted file mode 100644
index 6ddea6400db92..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_received_events_throughputs.graphql
+++ /dev/null
@@ -1,6 +0,0 @@
-subscription ComponentReceivedEventsThroughputsSubscription($interval: Int!) {
-    componentReceivedEventsThroughputs(interval: $interval) {
-        componentId
-        throughput
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_received_events_totals.graphql b/lib/vector-api-client/graphql/subscriptions/component_received_events_totals.graphql
deleted file mode 100644
index 59bb58a614067..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_received_events_totals.graphql
+++ /dev/null
@@ -1,8 +0,0 @@
-subscription ComponentReceivedEventsTotalsSubscription($interval: Int!) {
-    componentReceivedEventsTotals(interval: $interval) {
-        componentId
-        metric {
-            receivedEventsTotal
-        }
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_removed.graphql b/lib/vector-api-client/graphql/subscriptions/component_removed.graphql
deleted file mode 100644
index 7232522a20498..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_removed.graphql
+++ /dev/null
@@ -1,6 +0,0 @@
-subscription ComponentRemovedSubscription {
-    componentRemoved {
-        __typename
-        componentId
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_sent_bytes_throughputs.graphql b/lib/vector-api-client/graphql/subscriptions/component_sent_bytes_throughputs.graphql
deleted file mode 100644
index a1b4f54c1a300..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_sent_bytes_throughputs.graphql
+++ /dev/null
@@ -1,6 +0,0 @@
-subscription ComponentSentBytesThroughputsSubscription($interval: Int!) {
-    componentSentBytesThroughputs(interval: $interval) {
-        componentId
-        throughput
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_sent_bytes_totals.graphql b/lib/vector-api-client/graphql/subscriptions/component_sent_bytes_totals.graphql
deleted file mode 100644
index aa2c2f6dd0832..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_sent_bytes_totals.graphql
+++ /dev/null
@@ -1,8 +0,0 @@
-subscription ComponentSentBytesTotalsSubscription($interval: Int!) {
-    componentSentBytesTotals(interval: $interval) {
-        componentId
-        metric {
-            sentBytesTotal
-        }
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_sent_events_throughputs.graphql b/lib/vector-api-client/graphql/subscriptions/component_sent_events_throughputs.graphql
deleted file mode 100644
index fe6c86298b0af..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_sent_events_throughputs.graphql
+++ /dev/null
@@ -1,10 +0,0 @@
-subscription ComponentSentEventsThroughputsSubscription($interval: Int!) {
-    componentSentEventsThroughputs(interval: $interval) {
-        componentId
-        outputs {
-            outputId
-            throughput
-        }
-        throughput
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/component_sent_events_totals.graphql b/lib/vector-api-client/graphql/subscriptions/component_sent_events_totals.graphql
deleted file mode 100644
index 9951c53e3ab16..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/component_sent_events_totals.graphql
+++ /dev/null
@@ -1,14 +0,0 @@
-subscription ComponentSentEventsTotalsSubscription($interval: Int!) {
-    componentSentEventsTotals(interval: $interval) {
-        componentId
-        outputs {
-            outputId
-            sentEventsTotal {
-                sentEventsTotal
-            }
-        }
-        metric {
-            sentEventsTotal
-        }
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/heartbeat.graphql b/lib/vector-api-client/graphql/subscriptions/heartbeat.graphql
deleted file mode 100644
index f5ae0b40f6d6b..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/heartbeat.graphql
+++ /dev/null
@@ -1,5 +0,0 @@
-subscription HeartbeatSubscription($interval: Int!) {
-  heartbeat(interval: $interval) {
-    utc
-  }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/output_events_by_component_id_patterns.graphql b/lib/vector-api-client/graphql/subscriptions/output_events_by_component_id_patterns.graphql
deleted file mode 100644
index 6c17e197b8e7e..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/output_events_by_component_id_patterns.graphql
+++ /dev/null
@@ -1,30 +0,0 @@
-subscription OutputEventsByComponentIdPatternsSubscription(
-    $outputsPatterns: [String!]!, $inputsPatterns: [String!], $limit: Int!, $interval: Int!, $encoding: EventEncodingType!){
-    outputEventsByComponentIdPatterns(outputsPatterns: $outputsPatterns, inputsPatterns: $inputsPatterns, limit: $limit, interval: $interval) {
-        __typename
-        ... on Log {
-            componentId
-            componentType
-            componentKind
-            message
-            timestamp
-            string(encoding: $encoding)
-        }
-        ... on Metric {
-            componentId
-            componentType
-            componentKind
-            timestamp
-            string(encoding: $encoding)
-        }
-        ... on Trace {
-            componentId
-            componentType
-            componentKind
-            string(encoding: $encoding)
-        }
-        ... on EventNotification {
-            message
-        }
-    }
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/processed_bytes_throughput.graphql b/lib/vector-api-client/graphql/subscriptions/processed_bytes_throughput.graphql
deleted file mode 100644
index d8dabdecc5ed4..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/processed_bytes_throughput.graphql
+++ /dev/null
@@ -1,3 +0,0 @@
-subscription ProcessedBytesThroughputSubscription($interval: Int!) {
-    processedBytesThroughput(interval: $interval)
-}
diff --git a/lib/vector-api-client/graphql/subscriptions/uptime.graphql b/lib/vector-api-client/graphql/subscriptions/uptime.graphql
deleted file mode 100644
index 187d1e861877a..0000000000000
--- a/lib/vector-api-client/graphql/subscriptions/uptime.graphql
+++ /dev/null
@@ -1,5 +0,0 @@
-subscription UptimeSubscription {
-  uptime {
-    seconds
-  }
-}
diff --git a/lib/vector-api-client/src/client.rs b/lib/vector-api-client/src/client.rs
index 941ffa7963f27..d4991efef0894 100644
--- a/lib/vector-api-client/src/client.rs
+++ b/lib/vector-api-client/src/client.rs
@@ -1,57 +1,182 @@
-use anyhow::Context;
-use graphql_client::GraphQLQuery;
-use url::Url;
+use http::Uri;
+use tokio_stream::{Stream, StreamExt};
+use tonic::transport::{Channel, Endpoint};
 
-use crate::gql::HealthQueryExt;
+use crate::{
+    error::{Error, Result},
+    proto::{
+        GetComponentsRequest, GetComponentsResponse, GetMetaRequest, GetMetaResponse,
+        HealthRequest, HealthResponse, MetricName, StreamComponentAllocatedBytesRequest,
+        StreamComponentAllocatedBytesResponse, StreamComponentMetricsRequest,
+        StreamComponentMetricsResponse, StreamHeartbeatRequest, StreamHeartbeatResponse,
+        StreamOutputEventsRequest, StreamOutputEventsResponse, StreamUptimeRequest,
+        StreamUptimeResponse, observability_service_client::ObservabilityServiceClient,
+    },
+};
 
-/// Wrapped `Result` type, that returns deserialized GraphQL response data.
-pub type QueryResult<T> =
-    anyhow::Result<graphql_client::Response<<T as GraphQLQuery>::ResponseData>>;
-
-/// GraphQL query client over HTTP.
-#[derive(Debug)]
+/// gRPC client for the Vector observability API
+#[derive(Debug, Clone)]
 pub struct Client {
-    url: Url,
+    endpoint: Endpoint,
+    client: Option<ObservabilityServiceClient<Channel>>,
 }
 
 impl Client {
-    /// Returns a new GraphQL query client, bound to the provided URL.
-    pub fn new(url: Url) -> Self {
-        Self { url }
-    }
-
-    /// Send a health query
-    pub async fn healthcheck(&self) -> Result<(), ()> {
-        self.health_query().await.map(|_| ()).map_err(|_| ())
-    }
-
-    /// Issue a GraphQL query using Reqwest, serializing the response to the associated
-    /// GraphQL type for the given `request_body`.
-    pub async fn query<T: GraphQLQuery>(
-        &self,
-        request_body: &graphql_client::QueryBody<T::Variables>,
-    ) -> QueryResult<T> {
-        let client = reqwest::Client::new();
-
-        client
-            .post(self.url.clone())
-            .json(request_body)
-            .send()
-            .await
-            .with_context(|| {
-                format!(
-                    "Couldn't send '{}' query to {}",
-                    request_body.operation_name,
-                    &self.url.as_str()
-                )
-            })?
-            .json()
-            .await
-            .with_context(|| {
-                format!(
-                    "Couldn't serialize the response for '{}' query: {:?}",
-                    request_body.operation_name, request_body.query
-                )
+    /// Create a new gRPC client
+    ///
+    /// The client is not connected until `connect()` is called.
+    ///
+    /// # Arguments
+    ///
+    /// * `uri` - The gRPC server URI (e.g., `"http://localhost:9999".parse().unwrap()`)
+    pub fn new(uri: Uri) -> Self {
+        Self {
+            endpoint: Endpoint::from(uri),
+            client: None,
+        }
+    }
+
+    /// Connect to the gRPC server
+    pub async fn connect(&mut self) -> Result<()> {
+        let channel = self.endpoint.connect().await?;
+        self.client = Some(ObservabilityServiceClient::new(channel));
+        Ok(())
+    }
+
+    /// Ensure the client is connected
+    fn ensure_connected(&mut self) -> Result<&mut ObservabilityServiceClient<Channel>> {
+        self.client.as_mut().ok_or(Error::NotConnected)
+    }
+
+    // ========== Unary RPCs ==========
+
+    /// Check if the API server is healthy
+    pub async fn health(&mut self) -> Result<HealthResponse> {
+        let client = self.ensure_connected()?;
+        let response = client.health(HealthRequest {}).await?;
+        Ok(response.into_inner())
+    }
+
+    /// Get metadata about the Vector instance
+    pub async fn get_meta(&mut self) -> Result<GetMetaResponse> {
+        let client = self.ensure_connected()?;
+        let response = client.get_meta(GetMetaRequest {}).await?;
+        Ok(response.into_inner())
+    }
+
+    /// Get information about configured components
+    ///
+    /// # Arguments
+    ///
+    /// * `limit` - Maximum number of components to return (0 = no limit)
+    pub async fn get_components(&mut self, limit: i32) -> Result<GetComponentsResponse> {
+        let client = self.ensure_connected()?;
+        let response = client
+            .get_components(GetComponentsRequest { limit })
+            .await?;
+        Ok(response.into_inner())
+    }
+
+    // ========== Streaming RPCs ==========
+
+    /// Stream periodic heartbeat timestamps
+    ///
+    /// # Arguments
+    ///
+    /// * `interval_ms` - Update interval in milliseconds
+    pub async fn stream_heartbeat(
+        &mut self,
+        interval_ms: i32,
+    ) -> Result<impl Stream<Item = Result<StreamHeartbeatResponse>>> {
+        let client = self.ensure_connected()?;
+        let response = client
+            .stream_heartbeat(StreamHeartbeatRequest { interval_ms })
+            .await?;
+        Ok(response.into_inner().map(|r| r.map_err(Error::from)))
+    }
+
+    /// Stream uptime in seconds
+    ///
+    /// # Arguments
+    ///
+    /// * `interval_ms` - Update interval in milliseconds
+    pub async fn stream_uptime(
+        &mut self,
+        interval_ms: i32,
+    ) -> Result<impl Stream<Item = Result<StreamUptimeResponse>>> {
+        let client = self.ensure_connected()?;
+        let response = client
+            .stream_uptime(StreamUptimeRequest { interval_ms })
+            .await?;
+        Ok(response.into_inner().map(|r| r.map_err(Error::from)))
+    }
+
+    /// Stream memory allocated per component
+    ///
+    /// # Arguments
+    ///
+    /// * `interval_ms` - Update interval in milliseconds
+    pub async fn stream_component_allocated_bytes(
+        &mut self,
+        interval_ms: i32,
+    ) -> Result<impl Stream<Item = Result<StreamComponentAllocatedBytesResponse>>> {
+        let client = self.ensure_connected()?;
+        let response = client
+            .stream_component_allocated_bytes(StreamComponentAllocatedBytesRequest { interval_ms })
+            .await?;
+        Ok(response.into_inner().map(|r| r.map_err(Error::from)))
+    }
+
+    /// Stream per-component metrics for a chosen metric name.
+    ///
+    /// # Arguments
+    ///
+    /// * `metric` - Which metric to stream
+    /// * `interval_ms` - Update interval in milliseconds
+    pub async fn stream_component_metrics(
+        &mut self,
+        metric: MetricName,
+        interval_ms: i32,
+    ) -> Result<impl Stream<Item = Result<StreamComponentMetricsResponse>>> {
+        let client = self.ensure_connected()?;
+        let response = client
+            .stream_component_metrics(StreamComponentMetricsRequest {
+                interval_ms,
+                metric: metric as i32,
             })
+            .await?;
+        Ok(response.into_inner().map(|r| r.map_err(Error::from)))
+    }
+
+    /// Stream events from components matching patterns
+    ///
+    /// This is used by `vector tap` to capture events.
+    pub async fn stream_output_events(
+        &mut self,
+        request: StreamOutputEventsRequest,
+    ) -> Result<impl Stream<Item = Result<StreamOutputEventsResponse>> + use<>> {
+        let client = self.ensure_connected()?;
+        let response = client.stream_output_events(request).await?;
+        Ok(response.into_inner().map(|r| r.map_err(Error::from)))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_not_connected_error() {
+        let mut client = Client::new("http://localhost:9999".parse().unwrap());
+        let result = client.health().await;
+        assert!(matches!(result, Err(Error::NotConnected)));
+    }
+
+    #[test]
+    fn test_ensure_connected() {
+        let mut client = Client::new("http://localhost:9999".parse().unwrap());
+        let result = client.ensure_connected();
+        assert!(result.is_err());
+        assert!(matches!(result.unwrap_err(), Error::NotConnected));
     }
 }
diff --git a/lib/vector-api-client/src/error.rs b/lib/vector-api-client/src/error.rs
new file mode 100644
index 0000000000000..65fcfd80b511f
--- /dev/null
+++ b/lib/vector-api-client/src/error.rs
@@ -0,0 +1,77 @@
+use snafu::Snafu;
+
+/// Error types for the gRPC client
+#[derive(Debug, Snafu)]
+#[snafu(visibility(pub))]
+pub enum Error {
+    #[snafu(display("Connection error: {}", source))]
+    Connection { source: tonic::transport::Error },
+
+    #[snafu(display("gRPC error: {}", source))]
+    Grpc { source: tonic::Status },
+
+    #[snafu(display("Invalid URL: {}", message))]
+    InvalidUrl { message: String },
+
+    #[snafu(display("Not connected to gRPC server"))]
+    NotConnected,
+
+    #[snafu(display("Stream error: {}", message))]
+    Stream { message: String },
+}
+
+impl Error {
+    /// Returns true if this error is permanent and should not be retried.
+    pub fn is_fatal(&self) -> bool {
+        match self {
+            Error::InvalidUrl { .. } => true,
+            Error::Grpc { source } => matches!(
+                source.code(),
+                tonic::Code::InvalidArgument
+                    | tonic::Code::OutOfRange
+                    | tonic::Code::NotFound
+                    | tonic::Code::PermissionDenied
+                    | tonic::Code::Unauthenticated
+                    | tonic::Code::Unimplemented
+            ),
+            _ => false,
+        }
+    }
+}
+
+impl From<tonic::Status> for Error {
+    fn from(source: tonic::Status) -> Self {
+        Error::Grpc { source }
+    }
+}
+
+impl From<tonic::transport::Error> for Error {
+    fn from(source: tonic::transport::Error) -> Self {
+        Error::Connection { source }
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_error_display() {
+        let err = Error::NotConnected;
+        assert_eq!(err.to_string(), "Not connected to gRPC server");
+
+        let err = Error::InvalidUrl {
+            message: "invalid format".to_string(),
+        };
+        assert_eq!(err.to_string(), "Invalid URL: invalid format");
+    }
+
+    #[test]
+    fn test_error_from_tonic_status() {
+        let status = tonic::Status::unavailable("service down");
+        let err: Error = status.into();
+        assert!(matches!(err, Error::Grpc { .. }));
+    }
+}
diff --git a/lib/vector-api-client/src/gql/components.rs b/lib/vector-api-client/src/gql/components.rs
deleted file mode 100644
index d278b30c317c8..0000000000000
--- a/lib/vector-api-client/src/gql/components.rs
+++ /dev/null
@@ -1,224 +0,0 @@
-use std::fmt;
-
-use graphql_client::GraphQLQuery;
-
-use crate::{BoxedSubscription, QueryResult};
-
-/// Components query for returning sources, transforms, and sinks
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/queries/components.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentsQuery;
-
-/// Components subscription for notification when a component has been added
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_added.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentAddedSubscription;
-
-/// Components subscription for notification when a component has been removed
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_removed.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentRemovedSubscription;
-
-pub trait ComponentsQueryExt {
-    async fn components_query(&self, first: i64) -> crate::QueryResult<ComponentsQuery>;
-}
-
-impl ComponentsQueryExt for crate::Client {
-    async fn components_query(&self, first: i64) -> QueryResult<ComponentsQuery> {
-        let request_body = ComponentsQuery::build_query(components_query::Variables { first });
-        self.query::<ComponentsQuery>(&request_body).await
-    }
-}
-
-pub trait ComponentsSubscriptionExt {
-    fn component_added(&self) -> crate::BoxedSubscription<ComponentAddedSubscription>;
-    fn component_removed(&self) -> crate::BoxedSubscription<ComponentRemovedSubscription>;
-}
-
-impl ComponentsSubscriptionExt for crate::SubscriptionClient {
-    /// Subscription for when a component has been added
-    fn component_added(&self) -> BoxedSubscription<ComponentAddedSubscription> {
-        let request_body =
-            ComponentAddedSubscription::build_query(component_added_subscription::Variables);
-
-        self.start::<ComponentAddedSubscription>(&request_body)
-    }
-
-    /// Subscription for when a component has been removed
-    fn component_removed(&self) -> BoxedSubscription<ComponentRemovedSubscription> {
-        let request_body =
-            ComponentRemovedSubscription::build_query(component_removed_subscription::Variables);
-
-        self.start::<ComponentRemovedSubscription>(&request_body)
-    }
-}
-
-impl components_query::ComponentsQueryComponentsEdgesNodeOn {
-    pub fn received_bytes_total(&self) -> i64 {
-        // This is network bytes received, and only sources can receive events.
-        match self {
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Source(s) => s
-                .metrics
-                .received_bytes_total
-                .as_ref()
-                .map(|p| p.received_bytes_total as i64)
-                .unwrap_or(0),
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Transform(_) => 0,
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Sink(_) => 0,
-        }
-    }
-
-    pub fn received_events_total(&self) -> i64 {
-        match self {
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Source(s) => s
-                .metrics
-                .received_events_total
-                .as_ref()
-                .map(|p| p.received_events_total as i64)
-                .unwrap_or(0),
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Transform(t) => t
-                .metrics
-                .received_events_total
-                .as_ref()
-                .map(|p| p.received_events_total as i64)
-                .unwrap_or(0),
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Sink(s) => s
-                .metrics
-                .received_events_total
-                .as_ref()
-                .map(|p| p.received_events_total as i64)
-                .unwrap_or(0),
-        }
-    }
-
-    pub fn sent_bytes_total(&self) -> i64 {
-        // This is network bytes sent, and only sinks can send out events.
-        match self {
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Source(_) => 0,
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Transform(_) => 0,
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Sink(s) => s
-                .metrics
-                .sent_bytes_total
-                .as_ref()
-                .map(|p| p.sent_bytes_total as i64)
-                .unwrap_or(0),
-        }
-    }
-
-    pub fn sent_events_total(&self) -> i64 {
-        match self {
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Source(s) => s
-                .metrics
-                .sent_events_total
-                .as_ref()
-                .map(|p| p.sent_events_total as i64)
-                .unwrap_or(0),
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Transform(t) => t
-                .metrics
-                .sent_events_total
-                .as_ref()
-                .map(|p| p.sent_events_total as i64)
-                .unwrap_or(0),
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Sink(s) => s
-                .metrics
-                .sent_events_total
-                .as_ref()
-                .map(|p| p.sent_events_total as i64)
-                .unwrap_or(0),
-        }
-    }
-
-    pub fn outputs(&self) -> Vec<(String, i64)> {
-        match self {
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Source(s) => s
-                .outputs
-                .iter()
-                .map(|o| {
-                    (
-                        o.output_id.clone(),
-                        o.sent_events_total
-                            .as_ref()
-                            .map(|p| p.sent_events_total as i64)
-                            .unwrap_or(0),
-                    )
-                })
-                .collect(),
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Transform(t) => t
-                .outputs
-                .iter()
-                .map(|o| {
-                    (
-                        o.output_id.clone(),
-                        o.sent_events_total
-                            .as_ref()
-                            .map(|p| p.sent_events_total as i64)
-                            .unwrap_or(0),
-                    )
-                })
-                .collect(),
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Sink(_) => vec![],
-        }
-    }
-}
-
-impl fmt::Display for components_query::ComponentsQueryComponentsEdgesNodeOn {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        let res = match self {
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Source(_) => "source",
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Transform(_) => "transform",
-            components_query::ComponentsQueryComponentsEdgesNodeOn::Sink(_) => "sink",
-        };
-
-        write!(f, "{res}")
-    }
-}
-
-impl fmt::Display for component_added_subscription::ComponentAddedSubscriptionComponentAddedOn {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        let res = match self {
-            component_added_subscription::ComponentAddedSubscriptionComponentAddedOn::Source => {
-                "source"
-            }
-            component_added_subscription::ComponentAddedSubscriptionComponentAddedOn::Transform => {
-                "transform"
-            }
-            component_added_subscription::ComponentAddedSubscriptionComponentAddedOn::Sink => {
-                "sink"
-            }
-        };
-
-        write!(f, "{res}")
-    }
-}
-
-impl fmt::Display
-    for component_removed_subscription::ComponentRemovedSubscriptionComponentRemovedOn
-{
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        let res = match self {
-            component_removed_subscription::ComponentRemovedSubscriptionComponentRemovedOn::Source => {
-                "source"
-            }
-            component_removed_subscription::ComponentRemovedSubscriptionComponentRemovedOn::Transform => {
-                "transform"
-            }
-            component_removed_subscription::ComponentRemovedSubscriptionComponentRemovedOn::Sink => {
-                "sink"
-            }
-        };
-
-        write!(f, "{res}")
-    }
-}
diff --git a/lib/vector-api-client/src/gql/health.rs b/lib/vector-api-client/src/gql/health.rs
deleted file mode 100644
index f3bd4968c8b30..0000000000000
--- a/lib/vector-api-client/src/gql/health.rs
+++ /dev/null
@@ -1,64 +0,0 @@
-//! Health queries/subscriptions, for asserting a GraphQL API server is alive.
-
-use graphql_client::GraphQLQuery;
-
-/// Shorthand for a Chrono datetime, set to UTC.
-type DateTime = chrono::DateTime<chrono::Utc>;
-
-/// HealthQuery is generally used to assert that the GraphQL API server is alive.
-/// The `health` field returns true.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/queries/health.graphql",
-    response_derives = "Debug"
-)]
-pub struct HealthQuery;
-
-/// HeartbeatSubscription is a subscription that returns a 'heartbeat' in the form
-/// of a UTC timestamp. The use-case is allowing a client to assert that the server is
-/// sending regular payloads, by using the timestamp to determine when the last healthcheck
-/// was successful.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/heartbeat.graphql",
-    response_derives = "Debug"
-)]
-pub struct HeartbeatSubscription;
-
-/// Extension methods for health queries.
-pub trait HealthQueryExt {
-    /// Executes a health query.
-    async fn health_query(&self) -> crate::QueryResult<HealthQuery>;
-}
-
-impl HealthQueryExt for crate::Client {
-    /// Executes a health query.
-    async fn health_query(&self) -> crate::QueryResult<HealthQuery> {
-        self.query::<HealthQuery>(&HealthQuery::build_query(health_query::Variables))
-            .await
-    }
-}
-
-/// Extension methods for health subscriptions
-pub trait HealthSubscriptionExt {
-    /// Executes a heartbeat subscription, on a millisecond `interval`.
-    fn heartbeat_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<HeartbeatSubscription>;
-}
-
-impl HealthSubscriptionExt for crate::SubscriptionClient {
-    /// Executes a heartbeat subscription, on a millisecond `interval`.
-    fn heartbeat_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<HeartbeatSubscription> {
-        let request_body =
-            HeartbeatSubscription::build_query(heartbeat_subscription::Variables { interval });
-
-        self.start::<HeartbeatSubscription>(&request_body)
-    }
-}
diff --git a/lib/vector-api-client/src/gql/meta.rs b/lib/vector-api-client/src/gql/meta.rs
deleted file mode 100644
index d8d9a734342f3..0000000000000
--- a/lib/vector-api-client/src/gql/meta.rs
+++ /dev/null
@@ -1,26 +0,0 @@
-use graphql_client::GraphQLQuery;
-
-/// MetaVersionStringQuery returns the version string of the queried Vector instance.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/queries/meta_version_string.graphql",
-    response_derives = "Debug"
-)]
-pub struct MetaVersionStringQuery;
-
-/// Extension methods for meta queries.
-pub trait MetaQueryExt {
-    /// Executes a meta version string query.
-    async fn meta_version_string(&self) -> crate::QueryResult<MetaVersionStringQuery>;
-}
-
-impl MetaQueryExt for crate::Client {
-    /// Executes a meta version string query.
-    async fn meta_version_string(&self) -> crate::QueryResult<MetaVersionStringQuery> {
-        self.query::<MetaVersionStringQuery>(&MetaVersionStringQuery::build_query(
-            meta_version_string_query::Variables,
-        ))
-        .await
-    }
-}
diff --git a/lib/vector-api-client/src/gql/metrics.rs b/lib/vector-api-client/src/gql/metrics.rs
deleted file mode 100644
index a9df90f7c0bd7..0000000000000
--- a/lib/vector-api-client/src/gql/metrics.rs
+++ /dev/null
@@ -1,341 +0,0 @@
-//! Metrics queries/subscriptions.
-
-use graphql_client::GraphQLQuery;
-
-use crate::BoxedSubscription;
-
-/// UptimeSubscription returns uptime metrics to determine how long the Vector
-/// instance has been running.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/uptime.graphql",
-    response_derives = "Debug"
-)]
-pub struct UptimeSubscription;
-
-/// ComponentAllocatedBytesSubscription contains metrics on the number of allocated bytes
-/// that have been processed by a Vector instance, against specific components.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_allocated_bytes.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentAllocatedBytesSubscription;
-
-/// ComponentReceivedBytesThroughputsSubscription contains metrics on the number of bytes
-/// that have been received between `interval` samples, against specific components.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_received_bytes_throughputs.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentReceivedBytesThroughputsSubscription;
-
-/// ComponentReceivedBytesTotalsSubscription contains metrics on the number of bytes
-/// that have been received by a Vector instance, against a specific component.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_received_bytes_totals.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentReceivedBytesTotalsSubscription;
-
-/// ComponentReceivedEventsThroughputsSubscription contains metrics on the number of events
-/// that have been accepted for processing between `interval` samples, against specific components.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_received_events_throughputs.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentReceivedEventsThroughputsSubscription;
-
-/// ComponentReceivedEventsTotalsSubscription contains metrics on the number of events
-/// that have been accepted for processing by a Vector instance, against specific components.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_received_events_totals.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentReceivedEventsTotalsSubscription;
-
-/// ComponentSentBytesThroughputsSubscription contains metrics on the number of bytes
-/// that have been received between `interval` samples, against specific components.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_sent_bytes_throughputs.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentSentBytesThroughputsSubscription;
-
-/// ComponentSentBytesTotalsSubscription contains metrics on the number of bytes
-/// that have been received by a Vector instance, against a specific component.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_sent_bytes_totals.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentSentBytesTotalsSubscription;
-
-/// ComponentSentEventsThroughputsSubscription contains metrics on the number of events
-/// that have been emitted between `interval` samples, against specific components.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_sent_events_throughputs.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentSentEventsThroughputsSubscription;
-
-/// ComponentSentEventsTotalsSubscription contains metrics on the number of events
-/// that have been emitted by a Vector instance, against specific components.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_sent_events_totals.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentSentEventsTotalsSubscription;
-
-impl component_sent_events_totals_subscription::ComponentSentEventsTotalsSubscriptionComponentSentEventsTotals {
-    pub fn outputs(&self) -> Vec<(String, i64)> {
-        self.outputs
-            .iter()
-            .map(|output| {
-                (
-                    output.output_id.clone(),
-                    output
-                        .sent_events_total
-                        .as_ref()
-                        .map(|p| p.sent_events_total as i64)
-                        .unwrap_or(0),
-                )
-            })
-            .collect()
-    }
-}
-
-impl component_sent_events_throughputs_subscription::ComponentSentEventsThroughputsSubscriptionComponentSentEventsThroughputs {
-    pub fn outputs(&self) -> Vec<(String, i64)> {
-        self.outputs
-            .iter()
-            .map(|output| {
-                (
-                    output.output_id.clone(),
-                    output.throughput,
-                )
-            })
-            .collect()
-    }
-
-}
-
-/// ComponentErrorsTotalsSubscription contains metrics on the number of errors
-/// (metrics ending in `_errors_total`), against specific components.
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/component_errors_totals.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentErrorsTotalsSubscription;
-
-/// Extension methods for metrics subscriptions
-pub trait MetricsSubscriptionExt {
-    /// Executes an uptime metrics subscription.
-    fn uptime_subscription(&self) -> crate::BoxedSubscription<UptimeSubscription>;
-
-    /// Executes an all component allocated bytes subscription.
-    fn component_allocated_bytes_subscription(
-        &self,
-        interval: i64,
-    ) -> BoxedSubscription<ComponentAllocatedBytesSubscription>;
-
-    /// Executes a component bytes received totals subscription.
-    fn component_received_bytes_totals_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ComponentReceivedBytesTotalsSubscription>;
-
-    /// Executes a component bytes received throughput subscription.
-    fn component_received_bytes_throughputs_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ComponentReceivedBytesThroughputsSubscription>;
-
-    /// Executes a component received events totals subscription.
-    fn component_received_events_totals_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ComponentReceivedEventsTotalsSubscription>;
-
-    /// Executes an component events in throughputs subscription.
-    fn component_received_events_throughputs_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ComponentReceivedEventsThroughputsSubscription>;
-
-    /// Executes a component bytes sent totals subscription.
-    fn component_sent_bytes_totals_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ComponentSentBytesTotalsSubscription>;
-
-    /// Executes a component bytes sent throughput subscription.
-    fn component_sent_bytes_throughputs_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ComponentSentBytesThroughputsSubscription>;
-
-    /// Executes a component events totals subscription.
-    fn component_sent_events_totals_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ComponentSentEventsTotalsSubscription>;
-
-    /// Executes a component sent events throughputs subscription.
-    fn component_sent_events_throughputs_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ComponentSentEventsThroughputsSubscription>;
-
-    fn component_errors_totals_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ComponentErrorsTotalsSubscription>;
-}
-
-impl MetricsSubscriptionExt for crate::SubscriptionClient {
-    /// Executes an uptime metrics subscription.
-    fn uptime_subscription(&self) -> BoxedSubscription<UptimeSubscription> {
-        let request_body = UptimeSubscription::build_query(uptime_subscription::Variables);
-
-        self.start::<UptimeSubscription>(&request_body)
-    }
-
-    /// Executes an all component allocated bytes subscription.
-    fn component_allocated_bytes_subscription(
-        &self,
-        interval: i64,
-    ) -> BoxedSubscription<ComponentAllocatedBytesSubscription> {
-        let request_body = ComponentAllocatedBytesSubscription::build_query(
-            component_allocated_bytes_subscription::Variables { interval },
-        );
-
-        self.start::<ComponentAllocatedBytesSubscription>(&request_body)
-    }
-
-    /// Executes an all component bytes received totals subscription.
-    fn component_received_bytes_totals_subscription(
-        &self,
-        interval: i64,
-    ) -> BoxedSubscription<ComponentReceivedBytesTotalsSubscription> {
-        let request_body = ComponentReceivedBytesTotalsSubscription::build_query(
-            component_received_bytes_totals_subscription::Variables { interval },
-        );
-
-        self.start::<ComponentReceivedBytesTotalsSubscription>(&request_body)
-    }
-
-    /// Executes a component bytes received throughput subscription.
-    fn component_received_bytes_throughputs_subscription(
-        &self,
-        interval: i64,
-    ) -> BoxedSubscription<ComponentReceivedBytesThroughputsSubscription> {
-        let request_body = ComponentReceivedBytesThroughputsSubscription::build_query(
-            component_received_bytes_throughputs_subscription::Variables { interval },
-        );
-
-        self.start::<ComponentReceivedBytesThroughputsSubscription>(&request_body)
-    }
-
-    /// Executes an all component received events totals subscription.
-    fn component_received_events_totals_subscription(
-        &self,
-        interval: i64,
-    ) -> BoxedSubscription<ComponentReceivedEventsTotalsSubscription> {
-        let request_body = ComponentReceivedEventsTotalsSubscription::build_query(
-            component_received_events_totals_subscription::Variables { interval },
-        );
-
-        self.start::<ComponentReceivedEventsTotalsSubscription>(&request_body)
-    }
-
-    /// Executes an all component received events throughputs subscription.
-    fn component_received_events_throughputs_subscription(
-        &self,
-        interval: i64,
-    ) -> BoxedSubscription<ComponentReceivedEventsThroughputsSubscription> {
-        let request_body = ComponentReceivedEventsThroughputsSubscription::build_query(
-            component_received_events_throughputs_subscription::Variables { interval },
-        );
-
-        self.start::<ComponentReceivedEventsThroughputsSubscription>(&request_body)
-    }
-
-    /// Executes an all component bytes sent totals subscription.
-    fn component_sent_bytes_totals_subscription(
-        &self,
-        interval: i64,
-    ) -> BoxedSubscription<ComponentSentBytesTotalsSubscription> {
-        let request_body = ComponentSentBytesTotalsSubscription::build_query(
-            component_sent_bytes_totals_subscription::Variables { interval },
-        );
-
-        self.start::<ComponentSentBytesTotalsSubscription>(&request_body)
-    }
-
-    /// Executes a component bytes sent throughput subscription.
-    fn component_sent_bytes_throughputs_subscription(
-        &self,
-        interval: i64,
-    ) -> BoxedSubscription<ComponentSentBytesThroughputsSubscription> {
-        let request_body = ComponentSentBytesThroughputsSubscription::build_query(
-            component_sent_bytes_throughputs_subscription::Variables { interval },
-        );
-
-        self.start::<ComponentSentBytesThroughputsSubscription>(&request_body)
-    }
-
-    /// Executes a component sent events totals subscription.
-    fn component_sent_events_totals_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ComponentSentEventsTotalsSubscription> {
-        let request_body = ComponentSentEventsTotalsSubscription::build_query(
-            component_sent_events_totals_subscription::Variables { interval },
-        );
-
-        self.start::<ComponentSentEventsTotalsSubscription>(&request_body)
-    }
-
-    /// Executes a component sent events throughputs subscription.
-    fn component_sent_events_throughputs_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ComponentSentEventsThroughputsSubscription> {
-        let request_body = ComponentSentEventsThroughputsSubscription::build_query(
-            component_sent_events_throughputs_subscription::Variables { interval },
-        );
-
-        self.start::<ComponentSentEventsThroughputsSubscription>(&request_body)
-    }
-
-    fn component_errors_totals_subscription(
-        &self,
-        interval: i64,
-    ) -> BoxedSubscription<ComponentErrorsTotalsSubscription> {
-        let request_body = ComponentErrorsTotalsSubscription::build_query(
-            component_errors_totals_subscription::Variables { interval },
-        );
-
-        self.start::<ComponentErrorsTotalsSubscription>(&request_body)
-    }
-}
diff --git a/lib/vector-api-client/src/gql/mod.rs b/lib/vector-api-client/src/gql/mod.rs
deleted file mode 100644
index 6a690768f5ee9..0000000000000
--- a/lib/vector-api-client/src/gql/mod.rs
+++ /dev/null
@@ -1,14 +0,0 @@
-//! Queries, subscriptions, and extension methods for executing them
-
-mod components;
-mod health;
-mod meta;
-mod metrics;
-mod tap;
-
-pub use components::*;
-pub use health::*;
-pub use metrics::*;
-pub use tap::*;
-
-pub use self::meta::*;
diff --git a/lib/vector-api-client/src/gql/tap.rs b/lib/vector-api-client/src/gql/tap.rs
deleted file mode 100644
index 1aef36838175c..0000000000000
--- a/lib/vector-api-client/src/gql/tap.rs
+++ /dev/null
@@ -1,90 +0,0 @@
-#![allow(clippy::upper_case_acronyms)]
-
-use graphql_client::GraphQLQuery;
-
-use crate::BoxedSubscription;
-
-/// Shorthand for a Chrono datetime, set to UTC.
-type DateTime = chrono::DateTime<chrono::Utc>;
-
-/// OutputEventsByComponentIdPatternsSubscription allows observability into the events that are
-/// generated from component(s).
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "graphql/subscriptions/output_events_by_component_id_patterns.graphql",
-    response_derives = "Debug"
-)]
-pub struct OutputEventsByComponentIdPatternsSubscription;
-
-/// Tap encoding format type that is more convenient to use for public clients than the
-/// generated `output_events_by_component_id_patterns_subscription::EventEncodingType`.
-#[derive(clap::ValueEnum, Debug, Clone, Copy)]
-pub enum TapEncodingFormat {
-    Json,
-    Yaml,
-    Logfmt,
-}
-
-/// String -> TapEncodingFormat, typically for parsing user input.
-impl std::str::FromStr for TapEncodingFormat {
-    type Err = String;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        match s {
-            "json" => Ok(Self::Json),
-            "yaml" => Ok(Self::Yaml),
-            "logfmt" => Ok(Self::Logfmt),
-            _ => Err("Invalid encoding format".to_string()),
-        }
-    }
-}
-
-/// Map the public-facing `TapEncodingFormat` to the internal `EventEncodingType`.
-impl From<TapEncodingFormat>
-    for output_events_by_component_id_patterns_subscription::EventEncodingType
-{
-    fn from(encoding: TapEncodingFormat) -> Self {
-        match encoding {
-            TapEncodingFormat::Json => Self::JSON,
-            TapEncodingFormat::Yaml => Self::YAML,
-            TapEncodingFormat::Logfmt => Self::LOGFMT,
-        }
-    }
-}
-
-pub trait TapSubscriptionExt {
-    /// Executes an output events subscription.
-    fn output_events_by_component_id_patterns_subscription(
-        &self,
-        outputs_patterns: Vec<String>,
-        inputs_patterns: Vec<String>,
-        encoding: TapEncodingFormat,
-        limit: i64,
-        interval: i64,
-    ) -> crate::BoxedSubscription<OutputEventsByComponentIdPatternsSubscription>;
-}
-
-impl TapSubscriptionExt for crate::SubscriptionClient {
-    /// Executes an output events subscription.
-    fn output_events_by_component_id_patterns_subscription(
-        &self,
-        outputs_patterns: Vec<String>,
-        inputs_patterns: Vec<String>,
-        encoding: TapEncodingFormat,
-        limit: i64,
-        interval: i64,
-    ) -> BoxedSubscription<OutputEventsByComponentIdPatternsSubscription> {
-        let request_body = OutputEventsByComponentIdPatternsSubscription::build_query(
-            output_events_by_component_id_patterns_subscription::Variables {
-                outputs_patterns,
-                inputs_patterns: Some(inputs_patterns),
-                limit,
-                interval,
-                encoding: encoding.into(),
-            },
-        );
-
-        self.start::<OutputEventsByComponentIdPatternsSubscription>(&request_body)
-    }
-}
diff --git a/lib/vector-api-client/src/lib.rs b/lib/vector-api-client/src/lib.rs
index e9850b80c235c..a05002ebb3e61 100644
--- a/lib/vector-api-client/src/lib.rs
+++ b/lib/vector-api-client/src/lib.rs
@@ -1,23 +1,43 @@
-//! Vector GraphQL client library, for the Vector GraphQL API server.
+//! Vector gRPC API client library
 //!
-//! Contains:
+//! This library provides a Rust client for the Vector gRPC observability API.
 //!
-//! 1. A GraphQL query client, for queries/mutations over HTTP(s)
-//! 2. A GraphQL subscription client, for long-lived, multiplexed subscriptions over WebSockets
-//! 3. GraphQL queries/mutations/subscriptions, defined in `graphql/**/*.graphql` files
-//! 4. Extension methods for each client, for executing queries/subscriptions, and returning
-//!    deserialized JSON responses
+//! # Example
 //!
-
-#![deny(warnings)]
-#![deny(missing_debug_implementations, missing_copy_implementations)]
-#![allow(async_fn_in_trait)]
+//! ```no_run
+//! use vector_api_client::Client;
+//!
+//! # async fn example() -> Result<(), Box<dyn std::error::Error>> {
+//! let mut client = Client::new("http://localhost:9999".parse().unwrap());
+//! client.connect().await?;
+//!
+//! // Check health
+//! let health = client.health().await?;
+//! println!("Healthy: {}", health.healthy);
+//!
+//! // Get components
+//! let components = client.get_components(0).await?;
+//! for component in components.components {
+//!     println!("Component: {}", component.component_id);
+//! }
+//! # Ok(())
+//! # }
+//! ```
 
 mod client;
-/// GraphQL queries
-pub mod gql;
-mod subscription;
-pub mod test;
+mod error;
+
+pub use client::Client;
+pub use error::{Error, Result};
+
+/// How long (ms) to wait before attempting to reconnect to the Vector API after a disconnect.
+pub const RECONNECT_DELAY_MS: u64 = 5000;
+
+/// Re-export generated protobuf types
+pub mod proto {
+    pub mod event {
+        tonic::include_proto!("event");
+    }
 
-pub use client::*;
-pub use subscription::*;
+    tonic::include_proto!("vector.observability.v1");
+}
diff --git a/lib/vector-api-client/src/subscription.rs b/lib/vector-api-client/src/subscription.rs
deleted file mode 100644
index 0a4308c6ed7ae..0000000000000
--- a/lib/vector-api-client/src/subscription.rs
+++ /dev/null
@@ -1,199 +0,0 @@
-use std::{
-    collections::HashMap,
-    pin::Pin,
-    sync::{Arc, Mutex},
-};
-
-use futures::SinkExt;
-use graphql_client::GraphQLQuery;
-use serde::{Deserialize, Serialize};
-use serde_json::json;
-use tokio::sync::{
-    broadcast::{self, Sender},
-    mpsc, oneshot,
-};
-use tokio_stream::{Stream, StreamExt, wrappers::BroadcastStream};
-use tokio_tungstenite::{connect_async, tungstenite::Message};
-use url::Url;
-use uuid::Uuid;
-
-/// Subscription GraphQL response, returned from an active stream.
-pub type BoxedSubscription<T> = Pin<
-    Box<
-        dyn Stream<Item = Option<graphql_client::Response<<T as GraphQLQuery>::ResponseData>>>
-            + Send
-            + Sync,
-    >,
->;
-
-/// Payload contains the raw data received back from a GraphQL subscription. At the point
-/// of receiving data, the only known fields are { id, type }; what's contained inside the
-/// `payload` field is unknown until we attempt to deserialize it against a generated
-/// GraphQLQuery::ResponseData later.
-#[derive(Serialize, Deserialize, Debug, Clone)]
-pub struct Payload {
-    id: Uuid,
-    #[serde(rename = "type")]
-    payload_type: String,
-    payload: serde_json::Value,
-}
-
-impl Payload {
-    /// Returns a "start" payload necessary for starting a new subscription.
-    pub fn start<T: GraphQLQuery + Send + Sync>(
-        id: Uuid,
-        payload: &graphql_client::QueryBody<T::Variables>,
-    ) -> Self {
-        Self {
-            id,
-            payload_type: "start".to_owned(),
-            payload: json!(payload),
-        }
-    }
-
-    /// Returns a "stop" payload for terminating the subscription in the GraphQL server.
-    fn stop(id: Uuid) -> Self {
-        Self {
-            id,
-            payload_type: "stop".to_owned(),
-            payload: serde_json::Value::Null,
-        }
-    }
-
-    /// Attempts to return a definitive ResponseData on the `payload` field, matched against
-    /// a generated `GraphQLQuery`.
-    fn response<T: GraphQLQuery + Send + Sync>(
-        &self,
-    ) -> Option<graphql_client::Response<T::ResponseData>> {
-        serde_json::from_value::<graphql_client::Response<T::ResponseData>>(self.payload.clone())
-            .ok()
-    }
-}
-
-/// A single `SubscriptionClient` enables subscription multiplexing.
-#[derive(Debug)]
-pub struct SubscriptionClient {
-    tx: mpsc::UnboundedSender<Payload>,
-    subscriptions: Arc<Mutex<HashMap<Uuid, Sender<Payload>>>>,
-    _shutdown_tx: oneshot::Sender<()>,
-}
-
-impl SubscriptionClient {
-    /// Create a new subscription client. `tx` is a channel for sending `Payload`s to the
-    /// GraphQL server; `rx` is a channel for `Payload` back.
-    fn new(tx: mpsc::UnboundedSender<Payload>, mut rx: mpsc::UnboundedReceiver<Payload>) -> Self {
-        // Oneshot channel for cancelling the listener if SubscriptionClient is dropped
-        let (_shutdown_tx, mut shutdown_rx) = oneshot::channel::<()>();
-
-        let subscriptions = Arc::new(Mutex::new(HashMap::new()));
-        let subscriptions_clone = Arc::clone(&subscriptions);
-
-        // Spawn a handler for shutdown, and relaying received `Payload`s back to the relevant
-        // subscription.
-        let tx_clone = tx.clone();
-        tokio::spawn(async move {
-            loop {
-                tokio::select! {
-                    // Break the loop if shutdown is triggered. This happens implicitly once
-                    // the client goes out of scope
-                    _ = &mut shutdown_rx => {
-                        let subscriptions = subscriptions_clone.lock().unwrap();
-                        for id in subscriptions.keys() {
-                            _ = tx_clone.send(Payload::stop(*id));
-                        }
-                        break
-                    },
-
-                    // Handle receiving payloads back _from_ the server
-                    message = rx.recv() => {
-                        match message {
-                            Some(p) => {
-                                let subscriptions = subscriptions_clone.lock().unwrap();
-                                let s: Option<&Sender<Payload>> = subscriptions.get::<Uuid>(&p.id);
-                                if let Some(s) = s {
-                                    _ = s.send(p);
-                                }
-                            }
-                            None => {
-                                subscriptions_clone.lock().unwrap().clear();
-                                break;
-                            },
-                        }
-                    }
-                }
-            }
-        });
-
-        Self {
-            tx,
-            subscriptions,
-            _shutdown_tx,
-        }
-    }
-
-    /// Start a new subscription request.
-    pub fn start<T>(
-        &self,
-        request_body: &graphql_client::QueryBody<T::Variables>,
-    ) -> BoxedSubscription<T>
-    where
-        T: GraphQLQuery + Send + Sync,
-        <T as GraphQLQuery>::ResponseData: Unpin + Send + Sync + 'static,
-    {
-        // Generate a unique ID for the subscription. Subscriptions can be multiplexed
-        // over a single connection, so we'll keep a copy of this against the client to
-        // handling routing responses back to the relevant subscriber.
-        let id = Uuid::new_v4();
-
-        let (tx, rx) = broadcast::channel::<Payload>(100);
-
-        self.subscriptions.lock().unwrap().insert(id, tx);
-
-        // Send start subscription command with the relevant control messages.
-        _ = self.tx.send(Payload::start::<T>(id, request_body));
-
-        Box::pin(
-            BroadcastStream::new(rx)
-                .filter(Result::is_ok)
-                .map(|p| p.unwrap().response::<T>()),
-        )
-    }
-}
-
-/// Connect to a new WebSocket GraphQL server endpoint, and return a `SubscriptionClient`.
-/// This method will a) connect to a ws(s):// endpoint, and perform the initial handshake, and b)
-/// set up channel forwarding to expose just the returned `Payload`s to the client.
-pub async fn connect_subscription_client(
-    url: Url,
-) -> Result<SubscriptionClient, tokio_tungstenite::tungstenite::Error> {
-    let (ws, _) = connect_async(url).await?;
-    let (mut ws_tx, mut ws_rx) = futures::StreamExt::split(ws);
-
-    let (send_tx, mut send_rx) = mpsc::unbounded_channel::<Payload>();
-    let (recv_tx, recv_rx) = mpsc::unbounded_channel::<Payload>();
-
-    // Initialize the connection
-    _ = ws_tx
-        .send(Message::Text(r#"{"type":"connection_init"}"#.to_string()))
-        .await;
-
-    // Forwarded received messages back upstream to the GraphQL server
-    tokio::spawn(async move {
-        while let Some(p) = send_rx.recv().await {
-            _ = ws_tx
-                .send(Message::Text(serde_json::to_string(&p).unwrap()))
-                .await;
-        }
-    });
-
-    // Forward received messages to the receiver channel.
-    tokio::spawn(async move {
-        while let Some(Ok(Message::Text(m))) = ws_rx.next().await {
-            if let Ok(p) = serde_json::from_str::<Payload>(&m) {
-                _ = recv_tx.send(p);
-            }
-        }
-    });
-
-    Ok(SubscriptionClient::new(send_tx, recv_rx))
-}
diff --git a/lib/vector-api-client/src/test/mod.rs b/lib/vector-api-client/src/test/mod.rs
deleted file mode 100644
index 1f7716d96214f..0000000000000
--- a/lib/vector-api-client/src/test/mod.rs
+++ /dev/null
@@ -1,160 +0,0 @@
-use graphql_client::GraphQLQuery;
-
-use crate::{BoxedSubscription, QueryResult};
-
-/// Component links query for returning linked components for sources, transforms, and sinks
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "tests/queries/component_links.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentLinksQuery;
-
-/// Errors total subscription
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "tests/subscriptions/errors_total.graphql",
-    response_derives = "Debug"
-)]
-pub struct ErrorsTotalSubscription;
-
-/// File source metrics query
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "tests/queries/file_source_metrics.graphql",
-    response_derives = "Debug"
-)]
-pub struct FileSourceMetricsQuery;
-
-/// Component by id query
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "tests/queries/component_by_component_key.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentByComponentKeyQuery;
-
-/// Component by id query
-#[derive(GraphQLQuery, Debug, Copy, Clone)]
-#[graphql(
-    schema_path = "graphql/schema.json",
-    query_path = "tests/queries/components_connection.graphql",
-    response_derives = "Debug"
-)]
-pub struct ComponentsConnectionQuery;
-
-pub trait TestQueryExt {
-    async fn component_links_query(
-        &self,
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i64>,
-        last: Option<i64>,
-    ) -> crate::QueryResult<ComponentLinksQuery>;
-    async fn file_source_metrics_query(
-        &self,
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i64>,
-        last: Option<i64>,
-    ) -> crate::QueryResult<FileSourceMetricsQuery>;
-    async fn component_by_component_key_query(
-        &self,
-        component_id: &str,
-    ) -> crate::QueryResult<ComponentByComponentKeyQuery>;
-    async fn components_connection_query(
-        &self,
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i64>,
-        last: Option<i64>,
-    ) -> crate::QueryResult<ComponentsConnectionQuery>;
-}
-
-impl TestQueryExt for crate::Client {
-    async fn component_links_query(
-        &self,
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i64>,
-        last: Option<i64>,
-    ) -> QueryResult<ComponentLinksQuery> {
-        let request_body = ComponentLinksQuery::build_query(component_links_query::Variables {
-            after,
-            before,
-            first,
-            last,
-        });
-        self.query::<ComponentLinksQuery>(&request_body).await
-    }
-
-    async fn file_source_metrics_query(
-        &self,
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i64>,
-        last: Option<i64>,
-    ) -> QueryResult<FileSourceMetricsQuery> {
-        let request_body =
-            FileSourceMetricsQuery::build_query(file_source_metrics_query::Variables {
-                after,
-                before,
-                first,
-                last,
-            });
-        self.query::<FileSourceMetricsQuery>(&request_body).await
-    }
-
-    async fn component_by_component_key_query(
-        &self,
-        component_id: &str,
-    ) -> QueryResult<ComponentByComponentKeyQuery> {
-        let request_body = ComponentByComponentKeyQuery::build_query(
-            component_by_component_key_query::Variables {
-                component_id: component_id.to_string(),
-            },
-        );
-        self.query::<ComponentByComponentKeyQuery>(&request_body)
-            .await
-    }
-
-    async fn components_connection_query(
-        &self,
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i64>,
-        last: Option<i64>,
-    ) -> QueryResult<ComponentsConnectionQuery> {
-        let request_body =
-            ComponentsConnectionQuery::build_query(components_connection_query::Variables {
-                after,
-                before,
-                first,
-                last,
-            });
-        self.query::<ComponentsConnectionQuery>(&request_body).await
-    }
-}
-
-pub trait TestSubscriptionExt {
-    fn errors_total_subscription(
-        &self,
-        interval: i64,
-    ) -> crate::BoxedSubscription<ErrorsTotalSubscription>;
-}
-
-impl TestSubscriptionExt for crate::SubscriptionClient {
-    fn errors_total_subscription(
-        &self,
-        interval: i64,
-    ) -> BoxedSubscription<ErrorsTotalSubscription> {
-        let request_body =
-            ErrorsTotalSubscription::build_query(errors_total_subscription::Variables { interval });
-
-        self.start::<ErrorsTotalSubscription>(&request_body)
-    }
-}
diff --git a/lib/vector-api-client/tests/queries/component_by_component_key.graphql b/lib/vector-api-client/tests/queries/component_by_component_key.graphql
deleted file mode 100644
index e29946f9148c3..0000000000000
--- a/lib/vector-api-client/tests/queries/component_by_component_key.graphql
+++ /dev/null
@@ -1,6 +0,0 @@
-query ComponentByComponentKeyQuery($componentId: String!) {
-    componentByComponentKey(componentId: $componentId) {
-        __typename
-        componentId
-    }
-}
diff --git a/lib/vector-api-client/tests/queries/component_links.graphql b/lib/vector-api-client/tests/queries/component_links.graphql
deleted file mode 100644
index 3259b6c9b6661..0000000000000
--- a/lib/vector-api-client/tests/queries/component_links.graphql
+++ /dev/null
@@ -1,45 +0,0 @@
-query ComponentLinksQuery($after: String, $before: String, $first: Int, $last: Int) {
-    sources(after: $after, before: $before, first: $first, last: $last) {
-        edges {
-            node {
-                componentId
-                transforms {
-                    componentId
-                }
-                sinks {
-                    componentId
-                }
-            }
-        }
-    }
-    transforms(after: $after, before: $before, first: $first, last: $last) {
-        edges {
-            node {
-                componentId
-                sources {
-                    componentId
-                }
-                transforms {
-                    componentId
-                }
-                sinks {
-                    componentId
-                }
-            }
-        }
-    }
-    sinks(after: $after, before: $before, first: $first, last: $last) {
-        edges {
-            node {
-                componentId
-                sources {
-                    componentId
-                }
-                transforms {
-                    componentId
-                }
-            }
-        }
-    }
-}
-
diff --git a/lib/vector-api-client/tests/queries/components_connection.graphql b/lib/vector-api-client/tests/queries/components_connection.graphql
deleted file mode 100644
index 835908282634d..0000000000000
--- a/lib/vector-api-client/tests/queries/components_connection.graphql
+++ /dev/null
@@ -1,18 +0,0 @@
-query ComponentsConnectionQuery($after: String, $before: String, $first: Int, $last: Int) {
-    components(after: $after, before: $before, first: $first, last: $last) {
-        edges {
-            cursor
-            node {
-                __typename
-                componentId
-            }
-        }
-        pageInfo {
-            hasNextPage
-            hasPreviousPage
-            startCursor
-            endCursor
-        }
-        totalCount
-    }
-}
diff --git a/lib/vector-api-client/tests/queries/file_source_metrics.graphql b/lib/vector-api-client/tests/queries/file_source_metrics.graphql
deleted file mode 100644
index 7b9d2afb0f10e..0000000000000
--- a/lib/vector-api-client/tests/queries/file_source_metrics.graphql
+++ /dev/null
@@ -1,25 +0,0 @@
-query FileSourceMetricsQuery($after: String, $before: String, $first: Int, $last: Int) {
-    sources {
-        __typename
-        edges {
-            node {
-                metrics {
-                    __typename
-                    ...on FileSourceMetrics {
-                        __typename
-                        files(after: $after, before: $before, first: $first, last: $last) {
-                            edges {
-                                node {
-                                    name
-                                    receivedEventsTotal {
-                                        receivedEventsTotal
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        }
-    }
-}
diff --git a/lib/vector-api-client/tests/subscriptions/errors_total.graphql b/lib/vector-api-client/tests/subscriptions/errors_total.graphql
deleted file mode 100644
index b0e18d07f76b0..0000000000000
--- a/lib/vector-api-client/tests/subscriptions/errors_total.graphql
+++ /dev/null
@@ -1,5 +0,0 @@
-subscription ErrorsTotalSubscription($interval: Int!) {
-    errorsTotal(interval: $interval) {
-        errorsTotal
-    }
-}
diff --git a/lib/vector-core/src/config/mod.rs b/lib/vector-core/src/config/mod.rs
index c86848d7b0be5..4e822bd84f59c 100644
--- a/lib/vector-core/src/config/mod.rs
+++ b/lib/vector-core/src/config/mod.rs
@@ -27,7 +27,7 @@ pub const MEMORY_BUFFER_DEFAULT_MAX_EVENTS: NonZeroUsize =
     vector_buffers::config::memory_buffer_default_max_events();
 
 // This enum should be kept alphabetically sorted as the bitmask value is used when
-// sorting sources by data type in the GraphQL API.
+// sorting sources by data type in the API.
 #[bitmask(u8)]
 #[bitmask_config(flags_iter)]
 pub enum DataType {
diff --git a/lib/vector-tap/Cargo.toml b/lib/vector-tap/Cargo.toml
index 976233f446915..127c2e1ea32bd 100644
--- a/lib/vector-tap/Cargo.toml
+++ b/lib/vector-tap/Cargo.toml
@@ -7,24 +7,43 @@ publish = false
 license = "MPL-2.0"
 
 [features]
-api = ["dep:async-graphql"]
+api = [
+    "dep:bytes",
+    "dep:clap",
+    "dep:codecs",
+    "dep:colored",
+    "dep:prost",
+    "dep:serde_json",
+    "dep:serde_yaml",
+    "dep:tokio-stream",
+    "dep:tokio-util",
+    "dep:url",
+    "dep:vector-api-client",
+]
 
 [dependencies]
-async-graphql = { version = "7.0.17", default-features = false, features = ["playground"], optional = true }
-colored.workspace = true
+# Server-side (always compiled)
 futures.workspace = true
 glob.workspace = true
-serde_yaml.workspace = true
 tokio = { workspace = true, features = ["time"] }
-tokio-stream = { workspace = true, features = ["sync"] }
-tokio-tungstenite.workspace = true
 tracing.workspace = true
-url = { version = "2.5.4", default-features = false }
 uuid.workspace = true
-vector-api-client = { path = "../vector-api-client" }
+vector-buffers = { path = "../vector-buffers" }
 vector-common = { path = "../vector-common" }
 vector-core = { path = "../vector-core" }
-vector-buffers = { path = "../vector-buffers" }
+
+# Client-side (gated behind the `api` feature)
+bytes = { workspace = true, optional = true }
+clap = { workspace = true, optional = true }
+codecs = { path = "../codecs", optional = true }
+colored = { workspace = true, optional = true }
+prost = { workspace = true, optional = true }
+serde_json = { workspace = true, optional = true }
+serde_yaml = { workspace = true, optional = true }
+tokio-stream = { workspace = true, features = ["sync"], optional = true }
+tokio-util = { version = "0.7", default-features = false, features = ["codec"], optional = true }
+url = { version = "2.5.4", default-features = false, optional = true }
+vector-api-client = { path = "../vector-api-client", optional = true }
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["test-util"] }
diff --git a/lib/vector-tap/src/controller.rs b/lib/vector-tap/src/controller.rs
index dba9a7ec7b885..2a8208179f3e8 100644
--- a/lib/vector-tap/src/controller.rs
+++ b/lib/vector-tap/src/controller.rs
@@ -306,6 +306,7 @@ async fn tap_handler(
                     source_keys,
                     sink_keys,
                     removals,
+                    ..
                 } = watch_rx.borrow().clone();
 
                 // Remove tap sinks from components that have gone away/can no longer match.
diff --git a/lib/vector-tap/src/lib.rs b/lib/vector-tap/src/lib.rs
index 30ec0eca2aa3a..46291301a079d 100644
--- a/lib/vector-tap/src/lib.rs
+++ b/lib/vector-tap/src/lib.rs
@@ -7,255 +7,7 @@ pub mod controller;
 pub mod notification;
 pub mod topology;
 
-use std::{borrow::Cow, collections::BTreeMap};
-
-use colored::{ColoredString, Colorize};
-use tokio::{
-    sync::mpsc as tokio_mpsc,
-    time::{Duration, Instant, timeout},
-};
-use tokio_stream::StreamExt;
-use url::Url;
-use vector_api_client::{
-    connect_subscription_client,
-    gql::{
-        TapEncodingFormat, TapSubscriptionExt,
-        output_events_by_component_id_patterns_subscription::OutputEventsByComponentIdPatternsSubscriptionOutputEventsByComponentIdPatterns as GraphQLTapOutputEvent,
-    },
-};
-
-#[derive(Clone, Debug)]
-pub struct EventFormatter {
-    meta: bool,
-    format: TapEncodingFormat,
-    component_id_label: ColoredString,
-    component_kind_label: ColoredString,
-    component_type_label: ColoredString,
-}
-
-impl EventFormatter {
-    pub fn new(meta: bool, format: TapEncodingFormat) -> Self {
-        Self {
-            meta,
-            format,
-            component_id_label: "component_id".green(),
-            component_kind_label: "component_kind".green(),
-            component_type_label: "component_type".green(),
-        }
-    }
-
-    pub fn format<'a>(
-        &self,
-        component_id: &str,
-        component_kind: &str,
-        component_type: &str,
-        event: &'a str,
-    ) -> Cow<'a, str> {
-        if self.meta {
-            match self.format {
-                TapEncodingFormat::Json => format!(
-                    r#"{{"{}":"{}","{}":"{}","{}":"{}","event":{}}}"#,
-                    self.component_id_label,
-                    component_id.green(),
-                    self.component_kind_label,
-                    component_kind.green(),
-                    self.component_type_label,
-                    component_type.green(),
-                    event
-                )
-                .into(),
-                TapEncodingFormat::Yaml => {
-                    let mut value: BTreeMap<String, serde_yaml::Value> = BTreeMap::new();
-                    value.insert("event".to_string(), serde_yaml::from_str(event).unwrap());
-                    // We interpolate to include component_id rather than
-                    // include it in the map to correctly preserve color
-                    // formatting
-                    format!(
-                        "{}{}: {}\n{}: {}\n{}: {}\n",
-                        serde_yaml::to_string(&value).unwrap(),
-                        self.component_id_label,
-                        component_id.green(),
-                        self.component_kind_label,
-                        component_kind.green(),
-                        self.component_type_label,
-                        component_type.green()
-                    )
-                    .into()
-                }
-                TapEncodingFormat::Logfmt => format!(
-                    "{}={} {}={} {}={} {}",
-                    self.component_id_label,
-                    component_id.green(),
-                    self.component_kind_label,
-                    component_kind.green(),
-                    self.component_type_label,
-                    component_type.green(),
-                    event
-                )
-                .into(),
-            }
-        } else {
-            event.into()
-        }
-    }
-}
-
-#[derive(Clone, Debug)]
-pub enum OutputChannel {
-    Stdout(EventFormatter),
-    AsyncChannel(tokio_mpsc::Sender<Vec<GraphQLTapOutputEvent>>),
-}
-
-/// Error type for DNS message parsing
-#[derive(Debug)]
-pub enum TapExecutorError {
-    ConnectionFailure(tokio_tungstenite::tungstenite::Error),
-    GraphQLError,
-}
-
-#[derive(Debug)]
-pub struct TapRunner<'a> {
-    url: &'a Url,
-    input_patterns: Vec<String>,
-    output_patterns: Vec<String>,
-    output_channel: &'a OutputChannel,
-    format: TapEncodingFormat,
-}
-
-impl<'a> TapRunner<'a> {
-    pub fn new(
-        url: &'a Url,
-        input_patterns: Vec<String>,
-        output_patterns: Vec<String>,
-        output_channel: &'a OutputChannel,
-        format: TapEncodingFormat,
-    ) -> Self {
-        TapRunner {
-            url,
-            input_patterns,
-            output_patterns,
-            output_channel,
-            format,
-        }
-    }
-
-    pub async fn run_tap(
-        &self,
-        interval: i64,
-        limit: i64,
-        duration_ms: Option<u64>,
-        quiet: bool,
-    ) -> Result<(), TapExecutorError> {
-        let subscription_client = connect_subscription_client((*self.url).clone())
-            .await
-            .map_err(TapExecutorError::ConnectionFailure)?;
-
-        tokio::pin! {
-            let stream = subscription_client.output_events_by_component_id_patterns_subscription(
-                self.output_patterns.clone(),
-                self.input_patterns.clone(),
-                self.format,
-                limit,
-                interval,
-            );
-        }
-
-        let start_time = Instant::now();
-        let stream_duration = duration_ms
-            .map(Duration::from_millis)
-            .unwrap_or(Duration::MAX);
-
-        // Loop over the returned results, printing out tap events.
-        loop {
-            let time_elapsed = start_time.elapsed();
-            if time_elapsed >= stream_duration {
-                return Ok(());
-            }
-
-            let message = timeout(stream_duration - time_elapsed, stream.next()).await;
-            match message {
-                Ok(Some(Some(res))) => {
-                    if let Some(d) = res.data {
-                        let output_events: Vec<GraphQLTapOutputEvent> = d
-                            .output_events_by_component_id_patterns
-                            .into_iter()
-                            .filter(|event| {
-                                !matches!(
-                                    (quiet, event),
-                                    (true, GraphQLTapOutputEvent::EventNotification(_))
-                                )
-                            })
-                            .collect();
-
-                        match &self.output_channel {
-                            OutputChannel::Stdout(formatter) => {
-                                self.output_event_stdout(&output_events, formatter);
-                            }
-                            OutputChannel::AsyncChannel(sender_tx) => {
-                                if let Err(error) = sender_tx.send(output_events).await {
-                                    error!("Could not send tap events: {error}");
-                                }
-                            }
-                        }
-                    }
-                }
-                Err(_) =>
-                // If the stream times out, that indicates the duration specified by the user
-                // has elapsed. We should exit gracefully.
-                {
-                    return Ok(());
-                }
-                Ok(_) => return Err(TapExecutorError::GraphQLError),
-            }
-        }
-    }
-
-    #[allow(clippy::print_stdout)]
-    fn output_event_stdout(
-        &self,
-        output_events: &[GraphQLTapOutputEvent],
-        formatter: &EventFormatter,
-    ) {
-        for tap_event in output_events.iter() {
-            match tap_event {
-                GraphQLTapOutputEvent::Log(ev) => {
-                    println!(
-                        "{}",
-                        formatter.format(
-                            ev.component_id.as_ref(),
-                            ev.component_kind.as_ref(),
-                            ev.component_type.as_ref(),
-                            ev.string.as_ref()
-                        )
-                    );
-                }
-                GraphQLTapOutputEvent::Metric(ev) => {
-                    println!(
-                        "{}",
-                        formatter.format(
-                            ev.component_id.as_ref(),
-                            ev.component_kind.as_ref(),
-                            ev.component_type.as_ref(),
-                            ev.string.as_ref()
-                        )
-                    );
-                }
-                GraphQLTapOutputEvent::Trace(ev) => {
-                    println!(
-                        "{}",
-                        formatter.format(
-                            ev.component_id.as_ref(),
-                            ev.component_kind.as_ref(),
-                            ev.component_type.as_ref(),
-                            ev.string.as_ref()
-                        )
-                    );
-                }
-                #[allow(clippy::print_stderr)]
-                GraphQLTapOutputEvent::EventNotification(ev) => {
-                    eprintln!("{}", ev.message);
-                }
-            }
-        }
-    }
-}
+#[cfg(feature = "api")]
+mod runner;
+#[cfg(feature = "api")]
+pub use runner::{EventFormatter, OutputChannel, TapEncodingFormat, TapExecutorError, TapRunner};
diff --git a/lib/vector-tap/src/notification.rs b/lib/vector-tap/src/notification.rs
index 04ba715718993..785e780147ebc 100644
--- a/lib/vector-tap/src/notification.rs
+++ b/lib/vector-tap/src/notification.rs
@@ -1,11 +1,6 @@
-#[cfg(feature = "api")]
-use async_graphql::{SimpleObject, Union};
-
 #[derive(Debug, Clone, PartialEq, Eq)]
-#[cfg_attr(feature = "api", derive(SimpleObject))]
 /// A component was found that matched the provided pattern
 pub struct Matched {
-    #[cfg_attr(feature = "api", graphql(skip))]
     message: String,
     /// Pattern that raised the notification
     pub pattern: String,
@@ -21,10 +16,8 @@ impl Matched {
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-#[cfg_attr(feature = "api", derive(SimpleObject))]
 /// There isn't currently a component that matches this pattern
 pub struct NotMatched {
-    #[cfg_attr(feature = "api", graphql(skip))]
     message: String,
     /// Pattern that raised the notification
     pub pattern: String,
@@ -42,11 +35,9 @@ impl NotMatched {
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-#[cfg_attr(feature = "api", derive(SimpleObject))]
 /// The pattern matched source(s) which cannot be tapped for inputs or sink(s)
 /// which cannot be tapped for outputs
 pub struct InvalidMatch {
-    #[cfg_attr(feature = "api", graphql(skip))]
     message: String,
     /// Pattern that raised the notification
     pattern: String,
@@ -65,7 +56,6 @@ impl InvalidMatch {
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-#[cfg_attr(feature = "api", derive(Union))]
 /// A specific kind of notification with additional details
 pub enum Notification {
     Matched(Matched),
diff --git a/lib/vector-tap/src/runner.rs b/lib/vector-tap/src/runner.rs
new file mode 100644
index 0000000000000..8c6ab815a8bf8
--- /dev/null
+++ b/lib/vector-tap/src/runner.rs
@@ -0,0 +1,344 @@
+use std::{borrow::Cow, collections::BTreeMap};
+
+use bytes::Bytes;
+use colored::{ColoredString, Colorize};
+use prost::Message;
+use tokio::{
+    sync::mpsc as tokio_mpsc,
+    time::{Duration, Instant, timeout},
+};
+use tokio_stream::StreamExt;
+use tokio_util::codec::Encoder;
+use url::Url;
+use vector_api_client::{
+    Client,
+    proto::{StreamOutputEventsRequest, StreamOutputEventsResponse},
+};
+use vector_core::event::Event;
+
+#[derive(Clone, Copy, Debug, clap::ValueEnum)]
+pub enum TapEncodingFormat {
+    Json,
+    Yaml,
+    Logfmt,
+}
+
+// Note: TapEncodingFormat is kept for CLI compatibility but not used in the gRPC API
+// The server now sends proto events directly, which clients serialize as needed
+
+#[derive(Clone, Debug)]
+pub struct EventFormatter {
+    meta: bool,
+    format: TapEncodingFormat,
+    component_id_label: ColoredString,
+    component_kind_label: ColoredString,
+    component_type_label: ColoredString,
+}
+
+impl EventFormatter {
+    pub fn new(meta: bool, format: TapEncodingFormat) -> Self {
+        Self {
+            meta,
+            format,
+            component_id_label: "component_id".green(),
+            component_kind_label: "component_kind".green(),
+            component_type_label: "component_type".green(),
+        }
+    }
+
+    pub fn format<'a>(
+        &self,
+        component_id: &str,
+        component_kind: &str,
+        component_type: &str,
+        event: &'a str,
+    ) -> Cow<'a, str> {
+        if self.meta {
+            match self.format {
+                TapEncodingFormat::Json => format!(
+                    r#"{{"{}":"{}","{}":"{}","{}":"{}","event":{}}}"#,
+                    self.component_id_label,
+                    component_id.green(),
+                    self.component_kind_label,
+                    component_kind.green(),
+                    self.component_type_label,
+                    component_type.green(),
+                    event
+                )
+                .into(),
+                TapEncodingFormat::Yaml => {
+                    let mut value: BTreeMap<String, serde_yaml::Value> = BTreeMap::new();
+                    value.insert("event".to_string(), serde_yaml::from_str(event).unwrap());
+                    // We interpolate to include component_id rather than
+                    // include it in the map to correctly preserve color
+                    // formatting
+                    format!(
+                        "{}{}: {}\n{}: {}\n{}: {}\n",
+                        serde_yaml::to_string(&value).unwrap(),
+                        self.component_id_label,
+                        component_id.green(),
+                        self.component_kind_label,
+                        component_kind.green(),
+                        self.component_type_label,
+                        component_type.green()
+                    )
+                    .into()
+                }
+                TapEncodingFormat::Logfmt => format!(
+                    "{}={} {}={} {}={} {}",
+                    self.component_id_label,
+                    component_id.green(),
+                    self.component_kind_label,
+                    component_kind.green(),
+                    self.component_type_label,
+                    component_type.green(),
+                    event
+                )
+                .into(),
+            }
+        } else {
+            event.into()
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+pub enum OutputChannel {
+    Stdout(EventFormatter),
+    AsyncChannel(tokio_mpsc::Sender<Vec<StreamOutputEventsResponse>>),
+}
+
+/// Error type for tap execution
+#[derive(Debug)]
+pub enum TapExecutorError {
+    ConnectionFailure(String),
+    GrpcError(String),
+    /// Permanent error that should not trigger a reconnect (e.g. invalid arguments).
+    Fatal(String),
+}
+
+impl TapExecutorError {
+    pub fn is_fatal(&self) -> bool {
+        matches!(self, TapExecutorError::Fatal(_))
+    }
+}
+
+impl From<vector_api_client::Error> for TapExecutorError {
+    fn from(err: vector_api_client::Error) -> Self {
+        if err.is_fatal() {
+            TapExecutorError::Fatal(format!("{}", err))
+        } else {
+            TapExecutorError::GrpcError(format!("{}", err))
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct TapRunner<'a> {
+    url: &'a Url,
+    input_patterns: Vec<String>,
+    output_patterns: Vec<String>,
+    output_channel: &'a OutputChannel,
+}
+
+impl<'a> TapRunner<'a> {
+    pub fn new(
+        url: &'a Url,
+        input_patterns: Vec<String>,
+        output_patterns: Vec<String>,
+        output_channel: &'a OutputChannel,
+    ) -> Self {
+        TapRunner {
+            url,
+            input_patterns,
+            output_patterns,
+            output_channel,
+        }
+    }
+
+    pub async fn run_tap(
+        &self,
+        interval: i64,
+        limit: i64,
+        duration_ms: Option<u64>,
+        quiet: bool,
+    ) -> Result<(), TapExecutorError> {
+        let uri = self
+            .url
+            .as_str()
+            .parse()
+            .map_err(|e| TapExecutorError::Fatal(format!("Invalid URL: {e}")))?;
+        let mut client = Client::new(uri);
+        client.connect().await?;
+        self.run_tap_with_client(client, interval, limit, duration_ms, quiet)
+            .await
+    }
+
+    /// Run tap using a pre-connected client (avoids an extra connection round-trip when the
+    /// caller has already connected and health-checked the client).
+    pub async fn run_tap_with_client(
+        &self,
+        mut client: Client,
+        interval: i64,
+        limit: i64,
+        duration_ms: Option<u64>,
+        quiet: bool,
+    ) -> Result<(), TapExecutorError> {
+        let request = StreamOutputEventsRequest {
+            outputs_patterns: self.output_patterns.clone(),
+            inputs_patterns: self.input_patterns.clone(),
+            limit: limit as i32,
+            interval_ms: interval as i32,
+        };
+
+        let mut stream = client.stream_output_events(request).await?;
+
+        let start_time = Instant::now();
+        let stream_duration = duration_ms
+            .map(Duration::from_millis)
+            .unwrap_or(Duration::MAX);
+
+        // Loop over the returned results, processing tap events
+        loop {
+            let time_elapsed = start_time.elapsed();
+            if time_elapsed >= stream_duration {
+                return Ok(());
+            }
+
+            let message = timeout(stream_duration - time_elapsed, stream.next()).await;
+            match message {
+                Ok(Some(Ok(output_event))) => {
+                    // Filter out notifications if quiet mode is enabled
+                    if quiet
+                        && matches!(
+                            output_event.event,
+                            Some(
+                                vector_api_client::proto::stream_output_events_response::Event::Notification(
+                                    _
+                                )
+                            )
+                        )
+                    {
+                        continue;
+                    }
+
+                    match &self.output_channel {
+                        OutputChannel::Stdout(formatter) => {
+                            self.output_event_stdout(&output_event, formatter);
+                        }
+                        OutputChannel::AsyncChannel(sender_tx) => {
+                            if let Err(error) = sender_tx.send(vec![output_event]).await {
+                                error!("Could not send tap events: {error}");
+                            }
+                        }
+                    }
+                }
+                Err(_) =>
+                // If the stream times out, that indicates the duration specified by the user
+                // has elapsed. We should exit gracefully.
+                {
+                    return Ok(());
+                }
+                Ok(None) => {
+                    return Err(TapExecutorError::GrpcError(
+                        "Stream ended unexpectedly".to_string(),
+                    ));
+                }
+                Ok(Some(Err(err))) => return Err(TapExecutorError::from(err)),
+            }
+        }
+    }
+
+    /// Convert and serialize a protobuf EventWrapper to the requested format
+    fn serialize_event(
+        event_wrapper: &vector_api_client::proto::event::EventWrapper,
+        format: TapEncodingFormat,
+    ) -> Result<String, String> {
+        // INTENTIONAL round-trip through protobuf bytes: `vector_api_client` compiles
+        // `event.proto` independently to avoid taking a dependency on `vector_core` (a large
+        // crate with many features). Both types share the same proto schema, so encoding one
+        // and decoding the other is always safe. If the schemas ever diverge this will surface
+        // as a runtime decode error.
+        let bytes = event_wrapper.encode_to_vec();
+
+        let core_event_wrapper =
+            vector_core::event::proto::EventWrapper::decode(Bytes::from(bytes))
+                .map_err(|e| format!("Failed to decode event: {}", e))?;
+
+        // Convert to vector-core Event (which has Serialize)
+        let event: Event = core_event_wrapper.into();
+
+        // Serialize based on format
+        match format {
+            TapEncodingFormat::Json => serde_json::to_string(&event)
+                .map_err(|e| format!("JSON serialization failed: {}", e)),
+            TapEncodingFormat::Yaml => serde_yaml::to_string(&event)
+                .map_err(|e| format!("YAML serialization failed: {}", e)),
+            TapEncodingFormat::Logfmt => {
+                // For logfmt, we need to extract the log event and serialize it
+                match event {
+                    Event::Log(log_event) => {
+                        let mut serializer =
+                            codecs::encoding::format::LogfmtSerializerConfig.build();
+                        let mut bytes = bytes::BytesMut::new();
+                        // Wrap the LogEvent back into Event for the serializer
+                        serializer
+                            .encode(Event::Log(log_event), &mut bytes)
+                            .map_err(|e| format!("Logfmt serialization failed: {}", e))?;
+                        String::from_utf8(bytes.to_vec())
+                            .map_err(|e| format!("UTF-8 conversion failed: {}", e))
+                    }
+                    Event::Metric(_) => {
+                        Err("logfmt format is only supported for log events".to_string())
+                    }
+                    Event::Trace(_) => {
+                        Err("logfmt format is only supported for log events".to_string())
+                    }
+                }
+            }
+        }
+    }
+
+    #[allow(clippy::print_stdout)]
+    fn output_event_stdout(
+        &self,
+        output_event: &StreamOutputEventsResponse,
+        formatter: &EventFormatter,
+    ) {
+        use vector_api_client::proto::stream_output_events_response::Event as OutputEventType;
+
+        match &output_event.event {
+            Some(OutputEventType::TappedEvent(ev)) => {
+                // Format the proto event for display
+                let encoded_string = if let Some(ref event_wrapper) = ev.event {
+                    match Self::serialize_event(event_wrapper, formatter.format) {
+                        Ok(s) => s,
+                        Err(e) => {
+                            error!(message = "Failed to serialize event.", error = %e);
+                            format!("{:?}", event_wrapper)
+                        }
+                    }
+                } else {
+                    "No event data".to_string()
+                };
+
+                println!(
+                    "{}",
+                    formatter.format(
+                        &ev.component_id,
+                        &ev.component_kind,
+                        &ev.component_type,
+                        &encoded_string
+                    )
+                );
+            }
+            #[allow(clippy::print_stderr)]
+            Some(OutputEventType::Notification(ev)) => {
+                eprintln!("{}", ev.message);
+            }
+            None => {
+                error!("Received StreamOutputEventsResponse with no event data");
+            }
+        }
+    }
+}
diff --git a/lib/vector-tap/src/topology.rs b/lib/vector-tap/src/topology.rs
index 7b281f7c47151..eb13e93e2a9fe 100644
--- a/lib/vector-tap/src/topology.rs
+++ b/lib/vector-tap/src/topology.rs
@@ -26,6 +26,24 @@ pub struct TapResource {
     pub sink_keys: Vec<String>,
     // Components removed on a reload (used to drop TapSinks)
     pub removals: HashSet<ComponentKey>,
+    // Plugin type name for every component (e.g. "demo_logs", "remap", "console")
+    pub type_names: HashMap<String, String>,
+}
+
+impl TapResource {
+    /// Returns each component's output port names, derived from the full `outputs` snapshot.
+    ///
+    /// Keys are all components that have at least one output (sources and transforms).
+    /// The port value is `None` for the default output and `Some(name)` for named ports.
+    pub fn output_ports_by_component(&self) -> HashMap<&ComponentKey, Vec<Option<&str>>> {
+        let mut map: HashMap<&ComponentKey, Vec<Option<&str>>> = HashMap::new();
+        for tap_output in self.outputs.keys() {
+            map.entry(&tap_output.output_id.component)
+                .or_default()
+                .push(tap_output.output_id.port.as_deref());
+        }
+        map
+    }
 }
 
 // Watcher types for topology changes.
diff --git a/lib/vector-top/Cargo.toml b/lib/vector-top/Cargo.toml
index c0da764b4de51..869fec71484f1 100644
--- a/lib/vector-top/Cargo.toml
+++ b/lib/vector-top/Cargo.toml
@@ -22,6 +22,7 @@ unit-prefix = { version = "0.5.2", default-features = false, features = ["std"]
 num-format = { version = "0.4.4", default-features = false, features = ["with-num-bigint"] }
 ratatui = { version = "0.30.0", default-features = false, features = ["crossterm", "layout-cache"] }
 regex.workspace = true
+http = { version = "0.2", default-features = false }
 vector-common = { path = "../vector-common" }
 vector-api-client = { path = "../vector-api-client" }
 
diff --git a/lib/vector-top/src/metrics.rs b/lib/vector-top/src/metrics.rs
index 89012f80030ff..52cf46beff244 100644
--- a/lib/vector-top/src/metrics.rs
+++ b/lib/vector-top/src/metrics.rs
@@ -1,14 +1,16 @@
 use std::{
-    collections::{BTreeMap, HashMap},
+    collections::{BTreeMap, HashSet},
     sync::Arc,
+    time::Duration,
 };
 
 use glob::Pattern;
+use http::Uri;
 use tokio::task::JoinHandle;
 use tokio_stream::StreamExt;
 use vector_api_client::{
-    Client, SubscriptionClient,
-    gql::{ComponentsQueryExt, ComponentsSubscriptionExt, MetricsSubscriptionExt},
+    Client,
+    proto::{Component, ComponentType, MetricName, stream_component_metrics_response::Value},
 };
 
 use crate::state::{self, OutputMetrics, SentEventsMetric};
@@ -24,526 +26,546 @@ fn component_matches_patterns(component_id: &str, components_patterns: &[Pattern
         .any(|pattern| pattern.matches(component_id))
 }
 
-/// Components that have been added
-async fn component_added(
-    client: Arc<SubscriptionClient>,
+/// Component polling task
+///
+/// Polls for component changes every interval and diffs to detect adds/removes.
+async fn poll_components(
+    mut client: Client,
     tx: state::EventTx,
+    interval_ms: i64,
     components_patterns: Arc<Vec<Pattern>>,
+    initial_components: HashSet<String>,
 ) {
-    tokio::pin! {
-        let stream = client.component_added();
-    };
+    let mut known_components = initial_components;
+    let poll_interval = Duration::from_millis(interval_ms as u64);
+    let mut consecutive_errors = 0;
+    const MAX_CONSECUTIVE_ERRORS: u32 = 3;
+
+    loop {
+        tokio::time::sleep(poll_interval).await;
+
+        // Fetch current components
+        let Ok(response) = client.get_components(0).await else {
+            consecutive_errors += 1;
+            if consecutive_errors >= MAX_CONSECUTIVE_ERRORS {
+                // Exit to trigger reconnection after sustained failures
+                return;
+            }
+            continue;
+        };
+        consecutive_errors = 0;
+
+        let current_components: std::collections::HashSet<String> = response
+            .components
+            .iter()
+            .map(|c| c.component_id.clone())
+            .collect();
+
+        // Detect added components
+        for component in &response.components {
+            let component_id = &component.component_id;
+            if !known_components.contains(component_id)
+                && component_matches_patterns(component_id, &components_patterns)
+            {
+                let row = component_to_row(component);
+                _ = tx.send(state::EventType::ComponentAdded(row)).await;
+            }
+        }
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_added;
-            let component_id = c.component_id;
-            if !component_matches_patterns(&component_id, &components_patterns) {
-                continue;
+        // Detect removed components
+        for old_id in &known_components {
+            if !current_components.contains(old_id)
+                && component_matches_patterns(old_id, &components_patterns)
+            {
+                let key = ComponentKey::from(old_id.as_str());
+                _ = tx.send(state::EventType::ComponentRemoved(key)).await;
             }
-            let key = ComponentKey::from(component_id);
-            _ = tx
-                .send(state::EventType::ComponentAdded(state::ComponentRow {
-                    key,
-                    kind: c.on.to_string(),
-                    component_type: c.component_type,
-                    outputs: HashMap::new(),
-                    received_bytes_total: 0,
-                    received_bytes_throughput_sec: 0,
-                    received_events_total: 0,
-                    received_events_throughput_sec: 0,
-                    sent_bytes_total: 0,
-                    sent_bytes_throughput_sec: 0,
-                    sent_events_total: 0,
-                    sent_events_throughput_sec: 0,
-                    #[cfg(feature = "allocation-tracing")]
-                    allocated_bytes: 0,
-                    errors: 0,
-                }))
-                .await;
         }
+
+        known_components = current_components;
+    }
+}
+
+fn component_to_row(component: &Component) -> state::ComponentRow {
+    let key = ComponentKey::from(component.component_id.as_str());
+    let metrics = component.metrics.as_ref();
+
+    state::ComponentRow {
+        key: key.clone(),
+        kind: match component.component_type() {
+            ComponentType::Unspecified => "unknown",
+            ComponentType::Source => "source",
+            ComponentType::Transform => "transform",
+            ComponentType::Sink => "sink",
+        }
+        .to_string(),
+        component_type: component.on_type.clone(), // actual plugin type e.g. "demo_logs", "kafka"
+        outputs: component
+            .outputs
+            .iter()
+            .map(|o| {
+                (
+                    o.output_id.clone(),
+                    OutputMetrics::from(o.sent_events_total),
+                )
+            })
+            .collect(),
+        received_bytes_total: metrics.and_then(|m| m.received_bytes_total).unwrap_or(0),
+        received_bytes_throughput_sec: 0,
+        received_events_total: metrics.and_then(|m| m.received_events_total).unwrap_or(0),
+        received_events_throughput_sec: 0,
+        sent_bytes_total: metrics.and_then(|m| m.sent_bytes_total).unwrap_or(0),
+        sent_bytes_throughput_sec: 0,
+        sent_events_total: metrics.and_then(|m| m.sent_events_total).unwrap_or(0),
+        sent_events_throughput_sec: 0,
+        #[cfg(feature = "allocation-tracing")]
+        allocated_bytes: 0,
+        errors: 0,
     }
 }
 
 /// Allocated bytes per component
 #[cfg(feature = "allocation-tracing")]
 async fn allocated_bytes(
-    client: Arc<SubscriptionClient>,
+    mut client: Client,
     tx: state::EventTx,
     interval: i64,
     components_patterns: Arc<Vec<Pattern>>,
 ) {
-    tokio::pin! {
-        let stream = client.component_allocated_bytes_subscription(interval);
+    let Ok(mut stream) = client
+        .stream_component_allocated_bytes(interval as i32)
+        .await
+    else {
+        // Failed to establish stream, will retry on reconnection
+        return;
     };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_allocated_bytes;
-            _ = tx
-                .send(state::EventType::AllocatedBytes(
-                    c.into_iter()
-                        .filter(|c| {
-                            component_matches_patterns(&c.component_id, &components_patterns)
-                        })
-                        .map(|c| {
-                            (
-                                ComponentKey::from(c.component_id),
-                                c.metric.allocated_bytes as i64,
-                            )
-                        })
-                        .collect(),
-                ))
-                .await;
+    while let Some(Ok(response)) = stream.next().await {
+        let component_id = &response.component_id;
+        if !component_matches_patterns(component_id, &components_patterns) {
+            continue;
         }
-    }
-}
-/// Components that have been removed
-async fn component_removed(
-    client: Arc<SubscriptionClient>,
-    tx: state::EventTx,
-    components_patterns: Arc<Vec<Pattern>>,
-) {
-    tokio::pin! {
-        let stream = client.component_removed();
-    };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_removed;
-            let component_id = c.component_id;
-            if !component_matches_patterns(&component_id, &components_patterns) {
-                continue;
-            }
-            let id = ComponentKey::from(component_id);
-            _ = tx.send(state::EventType::ComponentRemoved(id)).await;
-        }
+        _ = tx
+            .send(state::EventType::AllocatedBytes(vec![(
+                ComponentKey::from(component_id.as_str()),
+                response.allocated_bytes,
+            )]))
+            .await;
     }
 }
 
 async fn received_bytes_totals(
-    client: Arc<SubscriptionClient>,
+    mut client: Client,
     tx: state::EventTx,
     interval: i64,
     components_patterns: Arc<Vec<Pattern>>,
 ) {
-    tokio::pin! {
-        let stream = client.component_received_bytes_totals_subscription(interval);
+    let Ok(mut stream) = client
+        .stream_component_metrics(MetricName::ReceivedBytesTotal, interval as i32)
+        .await
+    else {
+        return;
     };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_received_bytes_totals;
-
+    while let Some(Ok(response)) = stream.next().await {
+        let component_id = &response.component_id;
+        if !component_matches_patterns(component_id, &components_patterns) {
+            continue;
+        }
+        if let Some(Value::Total(total)) = response.value {
             _ = tx
-                .send(state::EventType::ReceivedBytesTotals(
-                    c.into_iter()
-                        .filter(|c| {
-                            component_matches_patterns(&c.component_id, &components_patterns)
-                        })
-                        .map(|c| {
-                            (
-                                ComponentKey::from(c.component_id),
-                                c.metric.received_bytes_total as i64,
-                            )
-                        })
-                        .collect(),
-                ))
+                .send(state::EventType::ReceivedBytesTotals(vec![(
+                    ComponentKey::from(component_id.as_str()),
+                    total.value,
+                )]))
                 .await;
         }
     }
 }
 
 async fn received_bytes_throughputs(
-    client: Arc<SubscriptionClient>,
+    mut client: Client,
     tx: state::EventTx,
     interval: i64,
     components_patterns: Arc<Vec<Pattern>>,
 ) {
-    tokio::pin! {
-        let stream = client.component_received_bytes_throughputs_subscription(interval);
+    let Ok(mut stream) = client
+        .stream_component_metrics(MetricName::ReceivedBytesThroughput, interval as i32)
+        .await
+    else {
+        return;
     };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_received_bytes_throughputs;
+    while let Some(Ok(response)) = stream.next().await {
+        let component_id = &response.component_id;
+        if !component_matches_patterns(component_id, &components_patterns) {
+            continue;
+        }
+        if let Some(Value::Throughput(tp)) = response.value {
             _ = tx
-                .send(state::EventType::ReceivedBytesThroughputs(
-                    interval,
-                    c.into_iter()
-                        .filter(|c| {
-                            component_matches_patterns(&c.component_id, &components_patterns)
-                        })
-                        .map(|c| (ComponentKey::from(c.component_id), c.throughput))
-                        .collect(),
-                ))
+                .send(state::EventType::ReceivedBytesThroughputs(vec![(
+                    ComponentKey::from(component_id.as_str()),
+                    tp.value as i64,
+                )]))
                 .await;
         }
     }
 }
 
 async fn received_events_totals(
-    client: Arc<SubscriptionClient>,
+    mut client: Client,
     tx: state::EventTx,
     interval: i64,
     components_patterns: Arc<Vec<Pattern>>,
 ) {
-    tokio::pin! {
-        let stream = client.component_received_events_totals_subscription(interval);
+    let Ok(mut stream) = client
+        .stream_component_metrics(MetricName::ReceivedEventsTotal, interval as i32)
+        .await
+    else {
+        return;
     };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_received_events_totals;
+    while let Some(Ok(response)) = stream.next().await {
+        let component_id = &response.component_id;
+        if !component_matches_patterns(component_id, &components_patterns) {
+            continue;
+        }
+        if let Some(Value::Total(total)) = response.value {
             _ = tx
-                .send(state::EventType::ReceivedEventsTotals(
-                    c.into_iter()
-                        .filter(|c| {
-                            component_matches_patterns(&c.component_id, &components_patterns)
-                        })
-                        .map(|c| {
-                            (
-                                ComponentKey::from(c.component_id),
-                                c.metric.received_events_total as i64,
-                            )
-                        })
-                        .collect(),
-                ))
+                .send(state::EventType::ReceivedEventsTotals(vec![(
+                    ComponentKey::from(component_id.as_str()),
+                    total.value,
+                )]))
                 .await;
         }
     }
 }
 
 async fn received_events_throughputs(
-    client: Arc<SubscriptionClient>,
+    mut client: Client,
     tx: state::EventTx,
     interval: i64,
     components_patterns: Arc<Vec<Pattern>>,
 ) {
-    tokio::pin! {
-        let stream = client.component_received_events_throughputs_subscription(interval);
+    let Ok(mut stream) = client
+        .stream_component_metrics(MetricName::ReceivedEventsThroughput, interval as i32)
+        .await
+    else {
+        return;
     };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_received_events_throughputs;
+    while let Some(Ok(response)) = stream.next().await {
+        let component_id = &response.component_id;
+        if !component_matches_patterns(component_id, &components_patterns) {
+            continue;
+        }
+        if let Some(Value::Throughput(tp)) = response.value {
             _ = tx
-                .send(state::EventType::ReceivedEventsThroughputs(
-                    interval,
-                    c.into_iter()
-                        .filter(|c| {
-                            component_matches_patterns(&c.component_id, &components_patterns)
-                        })
-                        .map(|c| (ComponentKey::from(c.component_id), c.throughput))
-                        .collect(),
-                ))
+                .send(state::EventType::ReceivedEventsThroughputs(vec![(
+                    ComponentKey::from(component_id.as_str()),
+                    tp.value as i64,
+                )]))
                 .await;
         }
     }
 }
 
 async fn sent_bytes_totals(
-    client: Arc<SubscriptionClient>,
+    mut client: Client,
     tx: state::EventTx,
     interval: i64,
     components_patterns: Arc<Vec<Pattern>>,
 ) {
-    tokio::pin! {
-        let stream = client.component_sent_bytes_totals_subscription(interval);
+    let Ok(mut stream) = client
+        .stream_component_metrics(MetricName::SentBytesTotal, interval as i32)
+        .await
+    else {
+        return;
     };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_sent_bytes_totals;
+    while let Some(Ok(response)) = stream.next().await {
+        let component_id = &response.component_id;
+        if !component_matches_patterns(component_id, &components_patterns) {
+            continue;
+        }
+        if let Some(Value::Total(total)) = response.value {
             _ = tx
-                .send(state::EventType::SentBytesTotals(
-                    c.into_iter()
-                        .filter(|c| {
-                            component_matches_patterns(&c.component_id, &components_patterns)
-                        })
-                        .map(|c| {
-                            (
-                                ComponentKey::from(c.component_id),
-                                c.metric.sent_bytes_total as i64,
-                            )
-                        })
-                        .collect(),
-                ))
+                .send(state::EventType::SentBytesTotals(vec![(
+                    ComponentKey::from(component_id.as_str()),
+                    total.value,
+                )]))
                 .await;
         }
     }
 }
 
 async fn sent_bytes_throughputs(
-    client: Arc<SubscriptionClient>,
+    mut client: Client,
     tx: state::EventTx,
     interval: i64,
     components_patterns: Arc<Vec<Pattern>>,
 ) {
-    tokio::pin! {
-        let stream = client.component_sent_bytes_throughputs_subscription(interval);
+    let Ok(mut stream) = client
+        .stream_component_metrics(MetricName::SentBytesThroughput, interval as i32)
+        .await
+    else {
+        return;
     };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_sent_bytes_throughputs;
+    while let Some(Ok(response)) = stream.next().await {
+        let component_id = &response.component_id;
+        if !component_matches_patterns(component_id, &components_patterns) {
+            continue;
+        }
+        if let Some(Value::Throughput(tp)) = response.value {
             _ = tx
-                .send(state::EventType::SentBytesThroughputs(
-                    interval,
-                    c.into_iter()
-                        .filter(|c| {
-                            component_matches_patterns(&c.component_id, &components_patterns)
-                        })
-                        .map(|c| (ComponentKey::from(c.component_id), c.throughput))
-                        .collect(),
-                ))
+                .send(state::EventType::SentBytesThroughputs(vec![(
+                    ComponentKey::from(component_id.as_str()),
+                    tp.value as i64,
+                )]))
                 .await;
         }
     }
 }
 
 async fn sent_events_totals(
-    client: Arc<SubscriptionClient>,
+    mut client: Client,
     tx: state::EventTx,
     interval: i64,
     components_patterns: Arc<Vec<Pattern>>,
 ) {
-    tokio::pin! {
-        let stream = client.component_sent_events_totals_subscription(interval);
+    let Ok(mut stream) = client
+        .stream_component_metrics(MetricName::SentEventsTotal, interval as i32)
+        .await
+    else {
+        return;
     };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_sent_events_totals;
+    while let Some(Ok(response)) = stream.next().await {
+        let component_id = &response.component_id;
+        if !component_matches_patterns(component_id, &components_patterns) {
+            continue;
+        }
+        if let Some(Value::Total(total)) = response.value {
             _ = tx
-                .send(state::EventType::SentEventsTotals(
-                    c.into_iter()
-                        .filter(|c| {
-                            component_matches_patterns(&c.component_id, &components_patterns)
-                        })
-                        .map(|c| SentEventsMetric {
-                            key: ComponentKey::from(c.component_id.as_str()),
-                            total: c.metric.sent_events_total as i64,
-                            outputs: c.outputs().into_iter().collect(),
-                        })
-                        .collect(),
-                ))
+                .send(state::EventType::SentEventsTotals(vec![SentEventsMetric {
+                    key: ComponentKey::from(component_id.as_str()),
+                    total: total.value,
+                    outputs: total.output_totals.into_iter().collect(),
+                }]))
                 .await;
         }
     }
 }
 
 async fn sent_events_throughputs(
-    client: Arc<SubscriptionClient>,
+    mut client: Client,
     tx: state::EventTx,
     interval: i64,
     components_patterns: Arc<Vec<Pattern>>,
 ) {
-    tokio::pin! {
-        let stream = client.component_sent_events_throughputs_subscription(interval);
+    let Ok(mut stream) = client
+        .stream_component_metrics(MetricName::SentEventsThroughput, interval as i32)
+        .await
+    else {
+        return;
     };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_sent_events_throughputs;
+    while let Some(Ok(response)) = stream.next().await {
+        let component_id = &response.component_id;
+        if !component_matches_patterns(component_id, &components_patterns) {
+            continue;
+        }
+        if let Some(Value::Throughput(tp)) = response.value {
             _ = tx
-                .send(state::EventType::SentEventsThroughputs(
-                    interval,
-                    c.into_iter()
-                        .filter(|c| {
-                            component_matches_patterns(&c.component_id, &components_patterns)
-                        })
-                        .map(|c| SentEventsMetric {
-                            key: ComponentKey::from(c.component_id.as_str()),
-                            total: c.throughput,
-                            outputs: c.outputs().into_iter().collect(),
-                        })
-                        .collect(),
-                ))
+                .send(state::EventType::SentEventsThroughputs(vec![
+                    SentEventsMetric {
+                        key: ComponentKey::from(component_id.as_str()),
+                        total: tp.value as i64,
+                        outputs: tp
+                            .output_throughputs
+                            .into_iter()
+                            .map(|(k, v)| (k, v as i64))
+                            .collect(),
+                    },
+                ]))
                 .await;
         }
     }
 }
 
 async fn errors_totals(
-    client: Arc<SubscriptionClient>,
+    mut client: Client,
     tx: state::EventTx,
     interval: i64,
     components_patterns: Arc<Vec<Pattern>>,
 ) {
-    tokio::pin! {
-        let stream = client.component_errors_totals_subscription(interval);
+    let Ok(mut stream) = client
+        .stream_component_metrics(MetricName::ErrorsTotal, interval as i32)
+        .await
+    else {
+        return;
     };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            let c = d.component_errors_totals;
+    while let Some(Ok(response)) = stream.next().await {
+        let component_id = &response.component_id;
+        if !component_matches_patterns(component_id, &components_patterns) {
+            continue;
+        }
+        if let Some(Value::Total(total)) = response.value {
             _ = tx
-                .send(state::EventType::ErrorsTotals(
-                    c.into_iter()
-                        .filter(|c| {
-                            component_matches_patterns(&c.component_id, &components_patterns)
-                        })
-                        .map(|c| {
-                            (
-                                ComponentKey::from(c.component_id.as_str()),
-                                c.metric.errors_total as i64,
-                            )
-                        })
-                        .collect(),
-                ))
+                .send(state::EventType::ErrorsTotals(vec![(
+                    ComponentKey::from(component_id.as_str()),
+                    total.value,
+                )]))
                 .await;
         }
     }
 }
 
-async fn uptime_changed(client: Arc<SubscriptionClient>, tx: state::EventTx) {
-    tokio::pin! {
-        let stream = client.uptime_subscription();
+async fn uptime_changed(mut client: Client, tx: state::EventTx, interval: i64) {
+    let Ok(mut stream) = client.stream_uptime(interval as i32).await else {
+        return;
     };
 
-    while let Some(Some(res)) = stream.next().await {
-        if let Some(d) = res.data {
-            _ = tx
-                .send(state::EventType::UptimeChanged(d.uptime.seconds))
-                .await;
-        }
+    while let Some(Ok(response)) = stream.next().await {
+        _ = tx
+            .send(state::EventType::UptimeChanged(
+                response.uptime_seconds as f64,
+            ))
+            .await;
     }
 }
 
-/// Subscribe to each metrics channel through a separate client. This is a temporary workaround
-/// until client multiplexing is fixed. In future, we should be able to use a single client
-pub fn subscribe(
-    client: SubscriptionClient,
+/// Handles returned by [`subscribe`], split by lifecycle.
+pub struct SubscribeHandles {
+    /// Metric stream tasks — exit when a gRPC stream closes or errors.
+    /// `cmd.rs` joins these to detect connection loss and trigger reconnection.
+    pub metric_handles: Vec<JoinHandle<()>>,
+    /// Polls `get_components` for topology changes. Designed to run indefinitely
+    /// while the server is healthy, so it must be aborted separately rather than
+    /// joined alongside the metric handles.
+    pub poll_handle: JoinHandle<()>,
+}
+
+/// Subscribe to each metrics stream, all sharing a single underlying gRPC connection.
+/// HTTP/2 multiplexes the concurrent streams — cloning a connected `Client` is cheap
+/// (the tonic `Channel` is Arc-backed) and avoids redundant TCP/HTTP2 handshakes.
+pub async fn subscribe(
+    uri: Uri,
     tx: state::EventTx,
     interval: i64,
     components_patterns: Vec<Pattern>,
-) -> Vec<JoinHandle<()>> {
-    let client = Arc::new(client);
+    initial_components: HashSet<String>,
+) -> Result<SubscribeHandles, vector_api_client::Error> {
     let components_patterns = Arc::new(components_patterns);
-    vec![
-        tokio::spawn(component_added(
-            Arc::clone(&client),
-            tx.clone(),
-            Arc::clone(&components_patterns),
-        )),
-        tokio::spawn(component_removed(
-            Arc::clone(&client),
-            tx.clone(),
-            Arc::clone(&components_patterns),
-        )),
+
+    let mut client = Client::new(uri);
+    client.connect().await?;
+
+    let poll_handle = tokio::spawn(poll_components(
+        client.clone(),
+        tx.clone(),
+        interval,
+        Arc::clone(&components_patterns),
+        initial_components,
+    ));
+
+    #[cfg_attr(not(feature = "allocation-tracing"), allow(unused_mut))]
+    let mut metric_handles = vec![
         tokio::spawn(received_bytes_totals(
-            Arc::clone(&client),
+            client.clone(),
             tx.clone(),
             interval,
             Arc::clone(&components_patterns),
         )),
         tokio::spawn(received_bytes_throughputs(
-            Arc::clone(&client),
+            client.clone(),
             tx.clone(),
             interval,
             Arc::clone(&components_patterns),
         )),
         tokio::spawn(received_events_totals(
-            Arc::clone(&client),
+            client.clone(),
             tx.clone(),
             interval,
             Arc::clone(&components_patterns),
         )),
         tokio::spawn(received_events_throughputs(
-            Arc::clone(&client),
+            client.clone(),
             tx.clone(),
             interval,
             Arc::clone(&components_patterns),
         )),
         tokio::spawn(sent_bytes_totals(
-            Arc::clone(&client),
+            client.clone(),
             tx.clone(),
             interval,
             Arc::clone(&components_patterns),
         )),
         tokio::spawn(sent_bytes_throughputs(
-            Arc::clone(&client),
+            client.clone(),
             tx.clone(),
             interval,
             Arc::clone(&components_patterns),
         )),
         tokio::spawn(sent_events_totals(
-            Arc::clone(&client),
+            client.clone(),
             tx.clone(),
             interval,
             Arc::clone(&components_patterns),
         )),
         tokio::spawn(sent_events_throughputs(
-            Arc::clone(&client),
-            tx.clone(),
-            interval,
-            Arc::clone(&components_patterns),
-        )),
-        #[cfg(feature = "allocation-tracing")]
-        tokio::spawn(allocated_bytes(
-            Arc::clone(&client),
+            client.clone(),
             tx.clone(),
             interval,
             Arc::clone(&components_patterns),
         )),
         tokio::spawn(errors_totals(
-            Arc::clone(&client),
+            client.clone(),
             tx.clone(),
             interval,
             Arc::clone(&components_patterns),
         )),
-        tokio::spawn(uptime_changed(Arc::clone(&client), tx)),
-    ]
+        tokio::spawn(uptime_changed(client.clone(), tx.clone(), interval)),
+    ];
+
+    #[cfg(feature = "allocation-tracing")]
+    metric_handles.push(tokio::spawn(allocated_bytes(
+        client,
+        tx,
+        interval,
+        Arc::clone(&components_patterns),
+    )));
+
+    Ok(SubscribeHandles {
+        metric_handles,
+        poll_handle,
+    })
 }
 
 /// Retrieve the initial components/metrics for first paint. Further updating the metrics
 /// will be handled by subscriptions.
 pub async fn init_components(
-    client: &Client,
+    uri: Uri,
     components_patterns: &[Pattern],
-) -> Result<state::State, ()> {
-    // Execute a query to get the latest components, and aggregate metrics for each resource.
-    // Since we don't know currently have a mechanism for scrolling/paging through results,
-    // we're using an artificially high page size to capture all likely component configurations.
-    let rows = client
-        .components_query(i16::MAX as i64)
-        .await
-        .map_err(|_| ())?
-        .data
-        .ok_or(())?
+) -> Result<state::State, vector_api_client::Error> {
+    let mut client = Client::new(uri);
+    client.connect().await?;
+
+    // Get all components
+    let response = client.get_components(0).await?;
+
+    let rows = response
         .components
-        .edges
         .into_iter()
-        .filter(|edge| component_matches_patterns(&edge.node.component_id, components_patterns))
-        .map(|edge| {
-            let d = edge.node;
-            let key = ComponentKey::from(d.component_id);
-            (
-                key.clone(),
-                state::ComponentRow {
-                    key,
-                    kind: d.on.to_string(),
-                    component_type: d.component_type,
-                    outputs: d
-                        .on
-                        .outputs()
-                        .into_iter()
-                        .map(|(id, sent_events_total)| (id, OutputMetrics::from(sent_events_total)))
-                        .collect(),
-                    received_bytes_total: d.on.received_bytes_total(),
-                    received_bytes_throughput_sec: 0,
-                    received_events_total: d.on.received_events_total(),
-                    received_events_throughput_sec: 0,
-                    sent_bytes_total: d.on.sent_bytes_total(),
-                    sent_bytes_throughput_sec: 0,
-                    sent_events_total: d.on.sent_events_total(),
-                    sent_events_throughput_sec: 0,
-                    #[cfg(feature = "allocation-tracing")]
-                    allocated_bytes: 0,
-                    errors: 0,
-                },
-            )
+        .filter(|component| {
+            component_matches_patterns(&component.component_id, components_patterns)
+        })
+        .map(|component| {
+            let row = component_to_row(&component);
+            (row.key.clone(), row)
         })
         .collect::<BTreeMap<_, _>>();
 
diff --git a/lib/vector-top/src/state.rs b/lib/vector-top/src/state.rs
index e4c535f7851f0..a954c804ce467 100644
--- a/lib/vector-top/src/state.rs
+++ b/lib/vector-top/src/state.rs
@@ -21,7 +21,7 @@ use crate::dashboard::columns;
 
 type IdentifiedMetric = (ComponentKey, i64);
 
-#[derive(Debug)]
+#[derive(Debug, Clone)]
 pub struct SentEventsMetric {
     pub key: ComponentKey,
     pub total: i64,
@@ -33,18 +33,18 @@ pub enum EventType {
     InitializeState(State),
     UptimeChanged(f64),
     ReceivedBytesTotals(Vec<IdentifiedMetric>),
-    /// Interval + identified metric
-    ReceivedBytesThroughputs(i64, Vec<IdentifiedMetric>),
+    /// Throughput values already normalized to per-second by the server
+    ReceivedBytesThroughputs(Vec<IdentifiedMetric>),
     ReceivedEventsTotals(Vec<IdentifiedMetric>),
-    /// Interval in ms + identified metric
-    ReceivedEventsThroughputs(i64, Vec<IdentifiedMetric>),
+    /// Throughput values already normalized to per-second by the server
+    ReceivedEventsThroughputs(Vec<IdentifiedMetric>),
     SentBytesTotals(Vec<IdentifiedMetric>),
-    /// Interval + identified metric
-    SentBytesThroughputs(i64, Vec<IdentifiedMetric>),
+    /// Throughput values already normalized to per-second by the server
+    SentBytesThroughputs(Vec<IdentifiedMetric>),
     // Identified overall metric + output-specific metrics
     SentEventsTotals(Vec<SentEventsMetric>),
-    /// Interval in ms + identified overall metric + output-specific metrics
-    SentEventsThroughputs(i64, Vec<SentEventsMetric>),
+    /// Throughput values already normalized to per-second by the server
+    SentEventsThroughputs(Vec<SentEventsMetric>),
     ErrorsTotals(Vec<IdentifiedMetric>),
     #[cfg(feature = "allocation-tracing")]
     AllocatedBytes(Vec<IdentifiedMetric>),
@@ -437,11 +437,10 @@ pub async fn updater(mut event_rx: EventRx, mut state: State) -> StateRx {
                         }
                     }
                 }
-                EventType::ReceivedBytesThroughputs(interval, rows) => {
+                EventType::ReceivedBytesThroughputs(rows) => {
                     for (key, v) in rows {
                         if let Some(r) = state.components.get_mut(&key) {
-                            r.received_bytes_throughput_sec =
-                                (v as f64 * (1000.0 / interval as f64)) as i64;
+                            r.received_bytes_throughput_sec = v;
                         }
                     }
                 }
@@ -452,11 +451,10 @@ pub async fn updater(mut event_rx: EventRx, mut state: State) -> StateRx {
                         }
                     }
                 }
-                EventType::ReceivedEventsThroughputs(interval, rows) => {
+                EventType::ReceivedEventsThroughputs(rows) => {
                     for (key, v) in rows {
                         if let Some(r) = state.components.get_mut(&key) {
-                            r.received_events_throughput_sec =
-                                (v as f64 * (1000.0 / interval as f64)) as i64;
+                            r.received_events_throughput_sec = v;
                         }
                     }
                 }
@@ -467,11 +465,10 @@ pub async fn updater(mut event_rx: EventRx, mut state: State) -> StateRx {
                         }
                     }
                 }
-                EventType::SentBytesThroughputs(interval, rows) => {
+                EventType::SentBytesThroughputs(rows) => {
                     for (key, v) in rows {
                         if let Some(r) = state.components.get_mut(&key) {
-                            r.sent_bytes_throughput_sec =
-                                (v as f64 * (1000.0 / interval as f64)) as i64;
+                            r.sent_bytes_throughput_sec = v;
                         }
                     }
                 }
@@ -488,17 +485,15 @@ pub async fn updater(mut event_rx: EventRx, mut state: State) -> StateRx {
                         }
                     }
                 }
-                EventType::SentEventsThroughputs(interval, rows) => {
+                EventType::SentEventsThroughputs(rows) => {
                     for m in rows {
                         if let Some(r) = state.components.get_mut(&m.key) {
-                            r.sent_events_throughput_sec =
-                                (m.total as f64 * (1000.0 / interval as f64)) as i64;
+                            r.sent_events_throughput_sec = m.total;
                             for (id, v) in m.outputs {
-                                let throughput = (v as f64 * (1000.0 / interval as f64)) as i64;
                                 r.outputs
                                     .entry(id)
                                     .or_insert_with(OutputMetrics::default)
-                                    .sent_events_throughput_sec = throughput;
+                                    .sent_events_throughput_sec = v;
                             }
                         }
                     }
diff --git a/proto/vector/observability.proto b/proto/vector/observability.proto
new file mode 100644
index 0000000000000..1c1d508e5d26c
--- /dev/null
+++ b/proto/vector/observability.proto
@@ -0,0 +1,203 @@
+syntax = "proto3";
+package vector.observability.v1;
+
+import "google/protobuf/timestamp.proto";
+import "event.proto";
+
+// Observability service for monitoring Vector instances.
+service ObservabilityService {
+  // ========== Simple Queries ==========
+
+  // Check if the API server is healthy and responding
+  rpc Health(HealthRequest) returns (HealthResponse);
+
+  // Get metadata about the Vector instance (version, hostname)
+  rpc GetMeta(GetMetaRequest) returns (GetMetaResponse);
+
+  // Get information about configured components (sources, transforms, sinks)
+  rpc GetComponents(GetComponentsRequest) returns (GetComponentsResponse);
+
+  // ========== Real-time Metric Streams ==========
+  // All streaming RPCs send periodic updates at the specified interval
+
+  // Stream periodic heartbeat timestamps
+  rpc StreamHeartbeat(StreamHeartbeatRequest) returns (stream StreamHeartbeatResponse);
+
+  // Stream uptime in seconds
+  rpc StreamUptime(StreamUptimeRequest) returns (stream StreamUptimeResponse);
+
+  // Stream memory allocated per component
+  rpc StreamComponentAllocatedBytes(StreamComponentAllocatedBytesRequest) returns (stream StreamComponentAllocatedBytesResponse);
+
+  // Stream per-component metrics (throughput or totals) for a chosen metric.
+  // Replaces the former 9 per-metric streaming RPCs with a single unified endpoint.
+  rpc StreamComponentMetrics(StreamComponentMetricsRequest) returns (stream StreamComponentMetricsResponse);
+
+  // ========== Event Tapping ==========
+
+  // Stream events from components matching the specified patterns (replaces vector tap)
+  rpc StreamOutputEvents(StreamOutputEventsRequest) returns (stream StreamOutputEventsResponse);
+}
+
+// ========== Health & Meta Messages ==========
+
+message HealthRequest {}
+
+message HealthResponse {
+  bool healthy = 1;
+}
+
+message GetMetaRequest {}
+
+message GetMetaResponse {
+  string version = 1;
+  string hostname = 2;
+}
+
+// ========== Component Messages ==========
+
+message GetComponentsRequest {
+  // Maximum number of components to return (0 = no limit)
+  int32 limit = 1;
+}
+
+message GetComponentsResponse {
+  repeated Component components = 1;
+}
+
+message Component {
+  string component_id = 1;
+  ComponentType component_type = 2;
+  string on_type = 3; // The specific component type name (e.g., "file", "http")
+  repeated Output outputs = 4;
+  ComponentMetrics metrics = 5;
+}
+
+enum ComponentType {
+  COMPONENT_TYPE_UNSPECIFIED = 0;
+  COMPONENT_TYPE_SOURCE = 1;
+  COMPONENT_TYPE_TRANSFORM = 2;
+  COMPONENT_TYPE_SINK = 3;
+}
+
+message Output {
+  string output_id = 1;
+  int64 sent_events_total = 2;
+}
+
+message ComponentMetrics {
+  optional int64 received_bytes_total = 1;
+  optional int64 received_events_total = 2;
+  optional int64 sent_bytes_total = 3;
+  optional int64 sent_events_total = 4;
+}
+
+// ========== Streaming Metrics Messages ==========
+
+message StreamComponentAllocatedBytesRequest {
+  // Update interval in milliseconds
+  int32 interval_ms = 1;
+}
+
+// Identifies which per-component metric to stream via StreamComponentMetrics.
+enum MetricName {
+  METRIC_NAME_UNSPECIFIED = 0;
+  METRIC_NAME_RECEIVED_EVENTS_THROUGHPUT = 1;
+  METRIC_NAME_SENT_EVENTS_THROUGHPUT = 2;
+  METRIC_NAME_RECEIVED_BYTES_THROUGHPUT = 3;
+  METRIC_NAME_SENT_BYTES_THROUGHPUT = 4;
+  METRIC_NAME_RECEIVED_EVENTS_TOTAL = 5;
+  METRIC_NAME_SENT_EVENTS_TOTAL = 6;
+  METRIC_NAME_RECEIVED_BYTES_TOTAL = 7;
+  METRIC_NAME_SENT_BYTES_TOTAL = 8;
+  METRIC_NAME_ERRORS_TOTAL = 9;
+}
+
+message StreamComponentMetricsRequest {
+  // Update interval in milliseconds
+  int32 interval_ms = 1;
+  MetricName metric = 2;
+}
+
+// Cumulative total value for a component metric.
+// output_totals is only populated for METRIC_NAME_SENT_EVENTS_TOTAL.
+message TotalMetric {
+  int64 value = 1;
+  map<string, int64> output_totals = 2;
+}
+
+// Throughput value (per-second rate) for a component metric.
+// output_throughputs is only populated for METRIC_NAME_SENT_EVENTS_THROUGHPUT.
+message ThroughputMetric {
+  double value = 1;
+  map<string, double> output_throughputs = 2;
+}
+
+message StreamComponentMetricsResponse {
+  string component_id = 1;
+  oneof value {
+    TotalMetric total = 2;
+    ThroughputMetric throughput = 3;
+  }
+}
+
+message StreamHeartbeatRequest {
+  // Update interval in milliseconds
+  int32 interval_ms = 1;
+}
+
+message StreamHeartbeatResponse {
+  google.protobuf.Timestamp utc = 1;
+}
+
+message StreamUptimeRequest {
+  // Update interval in milliseconds
+  int32 interval_ms = 1;
+}
+
+message StreamUptimeResponse {
+  int64 uptime_seconds = 1;
+}
+
+message StreamComponentAllocatedBytesResponse {
+  string component_id = 1;
+  int64 allocated_bytes = 2;
+}
+
+// ========== Event Tapping Messages ==========
+
+message StreamOutputEventsRequest {
+  // Glob patterns for output component IDs to match
+  repeated string outputs_patterns = 1;
+
+  // Glob patterns for input component IDs to match (optional)
+  repeated string inputs_patterns = 2;
+
+  // Maximum number of events to sample per interval. Must be >= 1.
+  // Unlike GetComponents, 0 is not valid here: limit controls both the
+  // reservoir size and the internal channel capacity, which require a
+  // positive value.
+  int32 limit = 3;
+
+  // Sampling interval in milliseconds
+  int32 interval_ms = 4;
+}
+
+message StreamOutputEventsResponse {
+  oneof event {
+    TappedEvent tapped_event = 1;
+    EventNotification notification = 2;
+  }
+}
+
+// Event captured from a component with metadata about where it came from
+message TappedEvent {
+  string component_id = 1;
+  string component_type = 2;
+  string component_kind = 3;
+  event.EventWrapper event = 4;  // The actual event data (uses canonical proto definition)
+}
+
+message EventNotification {
+  string message = 1;
+}
diff --git a/src/api/grpc/mod.rs b/src/api/grpc/mod.rs
new file mode 100644
index 0000000000000..f3df61dc08da2
--- /dev/null
+++ b/src/api/grpc/mod.rs
@@ -0,0 +1,3 @@
+mod service;
+
+pub use service::ObservabilityService;
diff --git a/src/api/grpc/service.rs b/src/api/grpc/service.rs
new file mode 100644
index 0000000000000..171f65853cc91
--- /dev/null
+++ b/src/api/grpc/service.rs
@@ -0,0 +1,863 @@
+use std::collections::{HashMap, HashSet};
+use std::pin::Pin;
+// std::sync::Mutex is intentional: the lock is never held across an .await point
+// (only used in synchronous map updates inside IntervalStream closures), so the
+// cheaper std mutex is correct here. tokio::sync::Mutex is only needed when the
+// critical section itself contains .await.
+use std::sync::{
+    Arc, Mutex,
+    atomic::{AtomicBool, Ordering},
+};
+use std::time::Duration;
+
+use futures::{StreamExt as FuturesStreamExt, stream};
+use rand::{Rng, SeedableRng as _, rngs::SmallRng};
+use tokio::select;
+use tokio::sync::mpsc;
+use tokio::time::{self, interval};
+use tokio_stream::{
+    Stream,
+    wrappers::{IntervalStream, ReceiverStream},
+};
+use tonic::{Request, Response, Status};
+use vector_lib::tap::{
+    controller::{TapController, TapPatterns, TapPayload},
+    topology::WatchRx,
+};
+
+use crate::event::{Metric, MetricValue};
+use crate::metrics::Controller;
+use crate::proto::observability::{
+    self, Component as ProtoComponent, ComponentType, EventNotification, TappedEvent, *,
+};
+
+type BoxStream<T> = Pin<Box<dyn Stream<Item = Result<T, Status>> + Send>>;
+
+/// Helper function to extract metric value as f64
+fn get_metric_value(metric: &Metric) -> Option<f64> {
+    match metric.value() {
+        MetricValue::Counter { value } => Some(*value),
+        MetricValue::Gauge { value } => Some(*value),
+        _ => None,
+    }
+}
+
+/// Helper function to filter metrics by name and group by component_id tag
+fn filter_and_group_metrics(metrics: &[Metric], metric_name: &str) -> HashMap<String, f64> {
+    let mut result = HashMap::new();
+
+    for metric in metrics.iter().filter(|m| m.name() == metric_name) {
+        if let Some(tags) = metric.tags()
+            && let Some(component_id) = tags.get("component_id")
+            && let Some(value) = get_metric_value(metric)
+        {
+            *result.entry(component_id.to_string()).or_insert(0.0) += value;
+        }
+    }
+
+    result
+}
+
+/// Filter metrics by name and group by (component_id, output) tag pair.
+/// Used to populate per-output metrics in GetComponents responses.
+fn filter_and_group_metrics_by_output(
+    metrics: &[Metric],
+    metric_name: &str,
+) -> HashMap<(String, String), f64> {
+    let mut result = HashMap::new();
+
+    for metric in metrics.iter().filter(|m| m.name() == metric_name) {
+        if let Some(tags) = metric.tags()
+            && let Some(component_id) = tags.get("component_id")
+            && let Some(value) = get_metric_value(metric)
+        {
+            let output = tags.get("output").unwrap_or("_default").to_string();
+            *result
+                .entry((component_id.to_string(), output))
+                .or_insert(0.0) += value;
+        }
+    }
+
+    result
+}
+
+/// Extract all component metrics and group by component_id
+fn extract_component_metrics(metrics: &[Metric]) -> HashMap<String, ComponentMetrics> {
+    let received_bytes = filter_and_group_metrics(metrics, "component_received_bytes_total");
+    let received_events = filter_and_group_metrics(metrics, "component_received_events_total");
+    let sent_bytes = filter_and_group_metrics(metrics, "component_sent_bytes_total");
+    let sent_events = filter_and_group_metrics(metrics, "component_sent_events_total");
+
+    let mut all_component_ids = HashSet::new();
+    all_component_ids.extend(received_bytes.keys().cloned());
+    all_component_ids.extend(received_events.keys().cloned());
+    all_component_ids.extend(sent_bytes.keys().cloned());
+    all_component_ids.extend(sent_events.keys().cloned());
+
+    let mut result = HashMap::new();
+    for component_id in all_component_ids {
+        result.insert(
+            component_id.clone(),
+            ComponentMetrics {
+                received_bytes_total: received_bytes.get(&component_id).map(|v| *v as i64),
+                received_events_total: received_events.get(&component_id).map(|v| *v as i64),
+                sent_bytes_total: sent_bytes.get(&component_id).map(|v| *v as i64),
+                sent_events_total: sent_events.get(&component_id).map(|v| *v as i64),
+            },
+        );
+    }
+
+    result
+}
+
+/// Helper function to calculate throughput by comparing current and previous values
+fn calculate_throughput(
+    current: &HashMap<String, f64>,
+    previous: &HashMap<String, f64>,
+    interval_secs: f64,
+) -> HashMap<String, f64> {
+    let mut result = HashMap::new();
+
+    for (component_id, current_value) in current {
+        if let Some(previous_value) = previous.get(component_id) {
+            let delta = current_value - previous_value;
+            let throughput = if interval_secs > 0.0 {
+                delta / interval_secs
+            } else {
+                0.0
+            };
+            result.insert(component_id.clone(), throughput.max(0.0));
+        }
+    }
+
+    result
+}
+
+/// Helper function to calculate throughput for per-output metrics by comparing
+/// current and previous values keyed by `(component_id, output)`.
+fn calculate_throughput_by_output(
+    current: &HashMap<(String, String), f64>,
+    previous: &HashMap<(String, String), f64>,
+    interval_secs: f64,
+) -> HashMap<(String, String), f64> {
+    let mut result = HashMap::new();
+
+    for (key, current_value) in current {
+        if let Some(previous_value) = previous.get(key) {
+            let delta = current_value - previous_value;
+            let throughput = if interval_secs > 0.0 {
+                delta / interval_secs
+            } else {
+                0.0
+            };
+            result.insert(key.clone(), throughput.max(0.0));
+        }
+    }
+
+    result
+}
+
+/// Minimum allowed polling interval for metric streams (100 ms).
+///
+/// Prevents clients from setting `interval_ms=1` and hammering `capture_metrics()`
+/// at 1 kHz, which would cause high CPU load across concurrent subscriptions.
+const MIN_INTERVAL_MS: i32 = 100;
+
+/// Validates `interval_ms` from a streaming request, returning the value as `u64`
+/// or a gRPC error if it is out of range.
+fn validate_interval_ms(interval_ms: i32) -> Result<u64, Status> {
+    if interval_ms < MIN_INTERVAL_MS {
+        return Err(Status::invalid_argument(format!(
+            "interval_ms must be >= {MIN_INTERVAL_MS}"
+        )));
+    }
+    Ok(interval_ms as u64)
+}
+
+fn get_controller() -> Result<&'static Controller, Status> {
+    Controller::get().map_err(|_| Status::internal("Metrics system not initialized"))
+}
+
+/// Builds a stream that emits per-component totals for `metric_name` every `duration`.
+fn metric_totals_stream(
+    duration: Duration,
+    metric_name: &'static str,
+) -> Result<BoxStream<StreamComponentMetricsResponse>, Status> {
+    let controller = get_controller()?;
+    Ok(Box::pin(
+        tokio_stream::StreamExt::map(IntervalStream::new(interval(duration)), move |_| {
+            let metrics = controller.capture_metrics();
+            let component_metrics = filter_and_group_metrics(&metrics, metric_name);
+            tokio_stream::iter(
+                component_metrics
+                    .into_iter()
+                    .map(|(component_id, total)| {
+                        Ok(StreamComponentMetricsResponse {
+                            component_id,
+                            value: Some(stream_component_metrics_response::Value::Total(
+                                TotalMetric {
+                                    value: total as i64,
+                                    output_totals: Default::default(),
+                                },
+                            )),
+                        })
+                    })
+                    .collect::<Vec<_>>(),
+            )
+        })
+        .flatten(),
+    ))
+}
+
+/// Builds a stream that emits per-component throughputs for `metric_name` every `duration`.
+fn metric_throughput_stream(
+    duration: Duration,
+    metric_name: &'static str,
+) -> Result<BoxStream<StreamComponentMetricsResponse>, Status> {
+    let controller = get_controller()?;
+    let interval_secs = duration.as_secs_f64();
+    let previous_values = Arc::new(Mutex::new(HashMap::new()));
+    Ok(Box::pin(
+        tokio_stream::StreamExt::map(IntervalStream::new(interval(duration)), move |_| {
+            let metrics = controller.capture_metrics();
+            let current_values = filter_and_group_metrics(&metrics, metric_name);
+            let mut prev = match previous_values.lock() {
+                Ok(guard) => guard,
+                Err(poisoned) => {
+                    error!("Mutex poisoned for metric throughput, recovering.");
+                    poisoned.into_inner()
+                }
+            };
+            let throughputs = calculate_throughput(&current_values, &prev, interval_secs);
+            *prev = current_values;
+            tokio_stream::iter(
+                throughputs
+                    .into_iter()
+                    .map(|(component_id, throughput)| {
+                        Ok(StreamComponentMetricsResponse {
+                            component_id,
+                            value: Some(stream_component_metrics_response::Value::Throughput(
+                                ThroughputMetric {
+                                    value: throughput,
+                                    output_throughputs: Default::default(),
+                                },
+                            )),
+                        })
+                    })
+                    .collect::<Vec<_>>(),
+            )
+        })
+        .flatten(),
+    ))
+}
+
+/// Builds a stream that emits per-component sent_events totals with per-output breakdown.
+fn sent_events_totals_stream(
+    duration: Duration,
+) -> Result<BoxStream<StreamComponentMetricsResponse>, Status> {
+    let controller = get_controller()?;
+    Ok(Box::pin(
+        tokio_stream::StreamExt::map(IntervalStream::new(interval(duration)), move |_| {
+            let metrics = controller.capture_metrics();
+            let component_totals =
+                filter_and_group_metrics(&metrics, "component_sent_events_total");
+            let by_output =
+                filter_and_group_metrics_by_output(&metrics, "component_sent_events_total");
+
+            // Group per-output values by component_id
+            let mut output_by_component: HashMap<String, HashMap<String, i64>> = HashMap::new();
+            for ((component_id, output), value) in by_output {
+                output_by_component
+                    .entry(component_id)
+                    .or_default()
+                    .insert(output, value as i64);
+            }
+
+            tokio_stream::iter(
+                component_totals
+                    .into_iter()
+                    .map(|(component_id, total)| {
+                        let output_totals = output_by_component
+                            .remove(&component_id)
+                            .unwrap_or_default()
+                            .into_iter()
+                            .collect();
+                        Ok(StreamComponentMetricsResponse {
+                            component_id,
+                            value: Some(stream_component_metrics_response::Value::Total(
+                                TotalMetric {
+                                    value: total as i64,
+                                    output_totals,
+                                },
+                            )),
+                        })
+                    })
+                    .collect::<Vec<_>>(),
+            )
+        })
+        .flatten(),
+    ))
+}
+
+/// Builds a stream that emits per-component sent_events throughputs with per-output breakdown.
+fn sent_events_throughput_stream(
+    duration: Duration,
+) -> Result<BoxStream<StreamComponentMetricsResponse>, Status> {
+    let controller = get_controller()?;
+    let interval_secs = duration.as_secs_f64();
+    let previous_totals = Arc::new(Mutex::new(HashMap::<String, f64>::new()));
+    let previous_outputs = Arc::new(Mutex::new(HashMap::<(String, String), f64>::new()));
+    Ok(Box::pin(
+        tokio_stream::StreamExt::map(IntervalStream::new(interval(duration)), move |_| {
+            let metrics = controller.capture_metrics();
+            let current_totals = filter_and_group_metrics(&metrics, "component_sent_events_total");
+            let current_outputs =
+                filter_and_group_metrics_by_output(&metrics, "component_sent_events_total");
+
+            let mut prev_t = match previous_totals.lock() {
+                Ok(guard) => guard,
+                Err(poisoned) => {
+                    error!("Mutex poisoned for sent_events throughput totals, recovering.");
+                    poisoned.into_inner()
+                }
+            };
+            let mut prev_o = match previous_outputs.lock() {
+                Ok(guard) => guard,
+                Err(poisoned) => {
+                    error!("Mutex poisoned for sent_events throughput outputs, recovering.");
+                    poisoned.into_inner()
+                }
+            };
+
+            let throughputs = calculate_throughput(&current_totals, &prev_t, interval_secs);
+            let output_throughputs_flat =
+                calculate_throughput_by_output(&current_outputs, &prev_o, interval_secs);
+
+            *prev_t = current_totals;
+            *prev_o = current_outputs;
+
+            // Group per-output throughputs by component_id
+            let mut output_by_component: HashMap<String, HashMap<String, f64>> = HashMap::new();
+            for ((component_id, output), tp) in output_throughputs_flat {
+                output_by_component
+                    .entry(component_id)
+                    .or_default()
+                    .insert(output, tp);
+            }
+
+            tokio_stream::iter(
+                throughputs
+                    .into_iter()
+                    .map(|(component_id, throughput)| {
+                        let output_throughputs = output_by_component
+                            .remove(&component_id)
+                            .unwrap_or_default()
+                            .into_iter()
+                            .collect();
+                        Ok(StreamComponentMetricsResponse {
+                            component_id,
+                            value: Some(stream_component_metrics_response::Value::Throughput(
+                                ThroughputMetric {
+                                    value: throughput,
+                                    output_throughputs,
+                                },
+                            )),
+                        })
+                    })
+                    .collect::<Vec<_>>(),
+            )
+        })
+        .flatten(),
+    ))
+}
+
+/// Converts a component's output port names into proto `Output` messages,
+/// populating `sent_events_total` from the per-output metric snapshot.
+///
+/// `None` port means the default output (represented as `"_default"`).
+fn ports_to_proto_outputs(
+    ports: &[Option<&str>],
+    component_id: &str,
+    sent_events_by_output: &HashMap<(String, String), f64>,
+) -> Vec<Output> {
+    ports
+        .iter()
+        .map(|port| {
+            let output_id = port.unwrap_or("_default").to_string();
+            let sent_events_total = sent_events_by_output
+                .get(&(component_id.to_string(), output_id.clone()))
+                .copied()
+                .unwrap_or(0.0) as i64;
+            Output {
+                output_id,
+                sent_events_total,
+            }
+        })
+        .collect()
+}
+
+/// gRPC observability service implementation.
+pub struct ObservabilityService {
+    watch_rx: WatchRx,
+    running: Arc<AtomicBool>,
+}
+
+impl ObservabilityService {
+    pub const fn new(watch_rx: WatchRx, running: Arc<AtomicBool>) -> Self {
+        Self { watch_rx, running }
+    }
+}
+
+#[tonic::async_trait]
+impl observability::Service for ObservabilityService {
+    // ========== Simple Queries ==========
+
+    async fn health(
+        &self,
+        _request: Request<HealthRequest>,
+    ) -> Result<Response<HealthResponse>, Status> {
+        if self.running.load(Ordering::Relaxed) {
+            Ok(Response::new(HealthResponse { healthy: true }))
+        } else {
+            Err(Status::unavailable("Vector is shutting down"))
+        }
+    }
+
+    async fn get_meta(
+        &self,
+        _request: Request<GetMetaRequest>,
+    ) -> Result<Response<GetMetaResponse>, Status> {
+        let version = crate::get_version().to_string();
+        let hostname = hostname::get()
+            .ok()
+            .and_then(|h| h.into_string().ok())
+            .unwrap_or_else(|| "unknown".to_string());
+
+        Ok(Response::new(GetMetaResponse { version, hostname }))
+    }
+
+    async fn get_components(
+        &self,
+        request: Request<GetComponentsRequest>,
+    ) -> Result<Response<GetComponentsResponse>, Status> {
+        let limit = request.into_inner().limit;
+
+        // Get the current topology snapshot
+        let tap_resource = self.watch_rx.borrow().clone();
+
+        // Get metrics for all components
+        let controller =
+            Controller::get().map_err(|_| Status::internal("Metrics system not initialized"))?;
+        let metrics = controller.capture_metrics();
+        let component_metrics_map = extract_component_metrics(&metrics);
+        let sent_events_by_output =
+            filter_and_group_metrics_by_output(&metrics, "component_sent_events_total");
+
+        let type_map = &tap_resource.type_names;
+
+        // `tap_resource.outputs` and `tap_resource.inputs` are both full topology snapshots,
+        // maintained incrementally on RunningTopology. `source_keys`/`sink_keys` are diff-only
+        // (changed/added in the last reload) and must not be used for enumeration here.
+        //
+        // Component kind is determined by set membership:
+        //   source    = has outputs, no inputs
+        //   transform = has outputs AND inputs
+        //   sink      = has inputs, no outputs
+        let output_ports = tap_resource.output_ports_by_component();
+
+        let mut components = Vec::new();
+
+        // Sources: present in `output_ports` but not in `inputs`.
+        // `output_ports` is keyed by component, so no duplicates.
+        for (key, ports) in &output_ports {
+            if tap_resource.inputs.contains_key(*key) {
+                continue; // transform or sink, handled below
+            }
+            let key_str = key.to_string();
+            let on_type = type_map
+                .get(&key_str)
+                .cloned()
+                .unwrap_or_else(|| "unknown".to_string());
+            components.push(ProtoComponent {
+                component_id: key_str.clone(),
+                component_type: ComponentType::Source as i32,
+                on_type,
+                outputs: ports_to_proto_outputs(ports, &key_str, &sent_events_by_output),
+                metrics: component_metrics_map.get(&key_str).cloned(),
+            });
+        }
+
+        // Transforms and sinks: present in `inputs` (full snapshot)
+        for component_key in tap_resource.inputs.keys() {
+            let key_str = component_key.to_string();
+            let (component_type, outputs) = if let Some(ports) = output_ports.get(component_key) {
+                (
+                    ComponentType::Transform,
+                    ports_to_proto_outputs(ports, &key_str, &sent_events_by_output),
+                )
+            } else {
+                (ComponentType::Sink, vec![])
+            };
+            let on_type = type_map
+                .get(&key_str)
+                .cloned()
+                .unwrap_or_else(|| "unknown".to_string());
+            components.push(ProtoComponent {
+                component_id: key_str.clone(),
+                component_type: component_type as i32,
+                on_type,
+                outputs,
+                metrics: component_metrics_map.get(&key_str).cloned(),
+            });
+        }
+
+        // Sort alphabetically for stable, deterministic ordering before applying limit
+        components.sort_unstable_by(|a, b| a.component_id.cmp(&b.component_id));
+        if limit > 0 {
+            components.truncate(limit as usize);
+        }
+
+        Ok(Response::new(GetComponentsResponse { components }))
+    }
+
+    // ========== Streaming Metrics ==========
+
+    type StreamHeartbeatStream = BoxStream<StreamHeartbeatResponse>;
+
+    async fn stream_heartbeat(
+        &self,
+        request: Request<StreamHeartbeatRequest>,
+    ) -> Result<Response<Self::StreamHeartbeatStream>, Status> {
+        let duration =
+            Duration::from_millis(validate_interval_ms(request.into_inner().interval_ms)?);
+        let stream = tokio_stream::StreamExt::map(IntervalStream::new(interval(duration)), |_| {
+            let utc = Some(prost_types::Timestamp {
+                seconds: chrono::Utc::now().timestamp(),
+                nanos: 0,
+            });
+            Ok(StreamHeartbeatResponse { utc })
+        });
+
+        Ok(Response::new(Box::pin(stream)))
+    }
+
+    type StreamUptimeStream = BoxStream<StreamUptimeResponse>;
+
+    async fn stream_uptime(
+        &self,
+        request: Request<StreamUptimeRequest>,
+    ) -> Result<Response<Self::StreamUptimeStream>, Status> {
+        let duration =
+            Duration::from_millis(validate_interval_ms(request.into_inner().interval_ms)?);
+        let controller = get_controller()?;
+        let stream =
+            tokio_stream::StreamExt::map(IntervalStream::new(interval(duration)), move |_| {
+                let metrics = controller.capture_metrics();
+                let uptime_seconds = metrics
+                    .iter()
+                    .find(|m| m.name() == "uptime_seconds")
+                    .and_then(get_metric_value)
+                    .unwrap_or(0.0) as i64;
+
+                Ok(StreamUptimeResponse { uptime_seconds })
+            });
+
+        Ok(Response::new(Box::pin(stream)))
+    }
+
+    type StreamComponentAllocatedBytesStream = BoxStream<StreamComponentAllocatedBytesResponse>;
+
+    async fn stream_component_allocated_bytes(
+        &self,
+        request: Request<StreamComponentAllocatedBytesRequest>,
+    ) -> Result<Response<Self::StreamComponentAllocatedBytesStream>, Status> {
+        let duration =
+            Duration::from_millis(validate_interval_ms(request.into_inner().interval_ms)?);
+        let controller = get_controller()?;
+        let stream =
+            tokio_stream::StreamExt::map(IntervalStream::new(interval(duration)), move |_| {
+                let metrics = controller.capture_metrics();
+                let component_metrics =
+                    filter_and_group_metrics(&metrics, "component_allocated_bytes");
+
+                tokio_stream::iter(
+                    component_metrics
+                        .into_iter()
+                        .map(|(component_id, allocated_bytes)| {
+                            Ok(StreamComponentAllocatedBytesResponse {
+                                component_id,
+                                allocated_bytes: allocated_bytes as i64,
+                            })
+                        })
+                        .collect::<Vec<_>>(),
+                )
+            })
+            .flatten();
+
+        Ok(Response::new(Box::pin(stream)))
+    }
+
+    type StreamComponentMetricsStream = BoxStream<StreamComponentMetricsResponse>;
+
+    async fn stream_component_metrics(
+        &self,
+        request: Request<StreamComponentMetricsRequest>,
+    ) -> Result<Response<Self::StreamComponentMetricsStream>, Status> {
+        let req = request.into_inner();
+        let duration = Duration::from_millis(validate_interval_ms(req.interval_ms)?);
+        let metric = MetricName::try_from(req.metric)
+            .map_err(|_| Status::invalid_argument("Unknown metric value"))?;
+
+        let stream: BoxStream<StreamComponentMetricsResponse> = match metric {
+            MetricName::Unspecified => {
+                return Err(Status::invalid_argument("metric must be specified"));
+            }
+            MetricName::ReceivedEventsTotal => {
+                metric_totals_stream(duration, "component_received_events_total")?
+            }
+            MetricName::SentEventsTotal => sent_events_totals_stream(duration)?,
+            MetricName::ReceivedBytesTotal => {
+                metric_totals_stream(duration, "component_received_bytes_total")?
+            }
+            MetricName::SentBytesTotal => {
+                metric_totals_stream(duration, "component_sent_bytes_total")?
+            }
+            MetricName::ErrorsTotal => metric_totals_stream(duration, "component_errors_total")?,
+            MetricName::ReceivedEventsThroughput => {
+                metric_throughput_stream(duration, "component_received_events_total")?
+            }
+            MetricName::SentEventsThroughput => sent_events_throughput_stream(duration)?,
+            MetricName::ReceivedBytesThroughput => {
+                metric_throughput_stream(duration, "component_received_bytes_total")?
+            }
+            MetricName::SentBytesThroughput => {
+                metric_throughput_stream(duration, "component_sent_bytes_total")?
+            }
+        };
+
+        Ok(Response::new(stream))
+    }
+
+    // ========== Event Tapping ==========
+
+    type StreamOutputEventsStream = BoxStream<StreamOutputEventsResponse>;
+
+    async fn stream_output_events(
+        &self,
+        request: Request<StreamOutputEventsRequest>,
+    ) -> Result<Response<Self::StreamOutputEventsStream>, Status> {
+        let req = request.into_inner();
+
+        // Validate before casting to prevent negative values from becoming large positive values
+        if req.limit <= 0 {
+            return Err(Status::invalid_argument(
+                "limit must be >= 1 (controls reservoir size and channel capacity)",
+            ));
+        }
+
+        const MAX_TAP_LIMIT: i32 = 100_000;
+        if req.limit > MAX_TAP_LIMIT {
+            return Err(Status::invalid_argument(format!(
+                "limit must be <= {MAX_TAP_LIMIT}"
+            )));
+        }
+
+        let interval_ms = validate_interval_ms(req.interval_ms)?;
+        let limit = req.limit as usize;
+
+        let patterns = TapPatterns {
+            for_outputs: req.outputs_patterns.into_iter().collect(),
+            for_inputs: req.inputs_patterns.into_iter().collect(),
+        };
+
+        // Channel for receiving tap payloads
+        let (tap_tx, tap_rx) = mpsc::channel(limit);
+
+        // Channel for sending events to the client
+        let (event_tx, event_rx) = mpsc::channel::<Vec<StreamOutputEventsResponse>>(10);
+
+        let watch_rx = self.watch_rx.clone();
+
+        tokio::spawn(async move {
+            let _tap_controller = TapController::new(watch_rx, tap_tx, patterns);
+            let mut tap_rx = ReceiverStream::new(tap_rx);
+            let mut interval = time::interval(time::Duration::from_millis(interval_ms));
+            let mut reservoir = Reservoir::new(limit);
+
+            loop {
+                select! {
+                    Some(tap_payload) = tokio_stream::StreamExt::next(&mut tap_rx) => {
+                        if reservoir.handle_payload(tap_payload, &event_tx).await.is_err() {
+                            break;
+                        }
+                    }
+                    _ = interval.tick() => {
+                        if event_tx.is_closed() || reservoir.flush(&event_tx).await.is_err() {
+                            break;
+                        }
+                    }
+                }
+            }
+        });
+
+        let stream = FuturesStreamExt::flat_map(ReceiverStream::new(event_rx), |events| {
+            stream::iter(events.into_iter().map(Ok))
+        });
+
+        Ok(Response::new(Box::pin(stream)))
+    }
+}
+
+/// Reservoir sampler for tap events, batched and flushed on an interval.
+struct Reservoir {
+    events: Vec<(usize, StreamOutputEventsResponse)>,
+    rng: SmallRng,
+    batch: usize,
+    limit: usize,
+}
+
+impl Reservoir {
+    fn new(limit: usize) -> Self {
+        Self {
+            events: Vec::with_capacity(limit),
+            rng: SmallRng::from_rng(&mut rand::rng()),
+            batch: 0,
+            limit,
+        }
+    }
+
+    /// Process a tap payload: notifications are forwarded immediately; data events
+    /// are reservoir-sampled (Algorithm R) for the next flush.
+    async fn handle_payload(
+        &mut self,
+        payload: TapPayload,
+        tx: &mpsc::Sender<Vec<StreamOutputEventsResponse>>,
+    ) -> Result<(), ()> {
+        for event in tap_payload_to_output_events(payload) {
+            if matches!(
+                event.event,
+                Some(stream_output_events_response::Event::Notification(_))
+            ) {
+                tx.send(vec![event]).await.map_err(|err| {
+                    debug!(message = "Couldn't send notification.", error = ?err);
+                })?;
+            } else {
+                // Reservoir sampling (Algorithm R).
+                // Draw from 0..=batch (inclusive) so that event i has
+                // exactly limit/(i+1) probability of entering the reservoir.
+                // Using 0..batch (exclusive) would guarantee replacement on
+                // the first post-fill event (100% instead of limit/(limit+1)).
+                if self.limit > self.events.len() {
+                    self.events.push((self.batch, event));
+                } else {
+                    let idx = self.rng.random_range(0..=self.batch);
+                    if idx < self.events.len() {
+                        self.events[idx] = (self.batch, event);
+                    }
+                }
+                self.batch += 1;
+            }
+        }
+        Ok(())
+    }
+
+    /// Flush sampled events to the client, sorted by arrival order.
+    async fn flush(
+        &mut self,
+        tx: &mpsc::Sender<Vec<StreamOutputEventsResponse>>,
+    ) -> Result<(), ()> {
+        if self.events.is_empty() {
+            return Ok(());
+        }
+        self.batch = 0;
+        self.events.sort_by_key(|(batch, _)| *batch);
+        let events = self.events.drain(..).map(|(_, e)| e).collect();
+        tx.send(events).await.map_err(|err| {
+            debug!(message = "Couldn't send events.", error = ?err);
+        })
+    }
+}
+
+/// Convert TapPayload to gRPC StreamOutputEventsResponse(s)
+fn tap_payload_to_output_events(payload: TapPayload) -> Vec<StreamOutputEventsResponse> {
+    use crate::event::proto::{Event, EventWrapper};
+
+    match payload {
+        TapPayload::Log(output, log_array) => log_array
+            .into_iter()
+            .map(|log_event| {
+                // Convert Vector's internal LogEvent to proto Log (metadata is preserved in Log.metadata_full)
+                let proto_log: crate::event::proto::Log = log_event.into();
+                let event_wrapper = Some(EventWrapper {
+                    event: Some(Event::Log(proto_log)),
+                });
+
+                StreamOutputEventsResponse {
+                    event: Some(stream_output_events_response::Event::TappedEvent(
+                        TappedEvent {
+                            component_id: output.output_id.component.id().to_string(),
+                            component_type: output.component_type.to_string(),
+                            component_kind: output.component_kind.to_string(),
+                            event: event_wrapper,
+                        },
+                    )),
+                }
+            })
+            .collect(),
+        TapPayload::Metric(output, metric_array) => metric_array
+            .into_iter()
+            .map(|metric_event| {
+                // Convert Vector's internal Metric to proto Metric
+                let proto_metric: crate::event::proto::Metric = metric_event.into();
+                let event_wrapper = Some(EventWrapper {
+                    event: Some(Event::Metric(proto_metric)),
+                });
+
+                StreamOutputEventsResponse {
+                    event: Some(stream_output_events_response::Event::TappedEvent(
+                        TappedEvent {
+                            component_id: output.output_id.component.id().to_string(),
+                            component_type: output.component_type.to_string(),
+                            component_kind: output.component_kind.to_string(),
+                            event: event_wrapper,
+                        },
+                    )),
+                }
+            })
+            .collect(),
+        TapPayload::Trace(output, trace_array) => trace_array
+            .into_iter()
+            .map(|trace_event| {
+                // Convert Vector's internal TraceEvent to proto Trace
+                let proto_trace: crate::event::proto::Trace = trace_event.into();
+                let event_wrapper = Some(EventWrapper {
+                    event: Some(Event::Trace(proto_trace)),
+                });
+
+                StreamOutputEventsResponse {
+                    event: Some(stream_output_events_response::Event::TappedEvent(
+                        TappedEvent {
+                            component_id: output.output_id.component.id().to_string(),
+                            component_type: output.component_type.to_string(),
+                            component_kind: output.component_kind.to_string(),
+                            event: event_wrapper,
+                        },
+                    )),
+                }
+            })
+            .collect(),
+        TapPayload::Notification(notification) => {
+            vec![create_notification_event(notification.as_str())]
+        }
+    }
+}
+
+fn create_notification_event(message: &str) -> StreamOutputEventsResponse {
+    StreamOutputEventsResponse {
+        event: Some(stream_output_events_response::Event::Notification(
+            EventNotification {
+                message: message.to_string(),
+            },
+        )),
+    }
+}
diff --git a/src/api/grpc_server.rs b/src/api/grpc_server.rs
new file mode 100644
index 0000000000000..714459cd39b79
--- /dev/null
+++ b/src/api/grpc_server.rs
@@ -0,0 +1,96 @@
+use std::{
+    error::Error as StdError,
+    net::SocketAddr,
+    sync::{Arc, atomic::AtomicBool},
+};
+use tokio::sync::oneshot;
+use tokio_stream::wrappers::TcpListenerStream;
+use tonic::transport::Server as TonicServer;
+use vector_lib::tap::topology::WatchRx;
+
+use super::grpc::ObservabilityService;
+use crate::{config::Config, proto::observability::Server as ObservabilityServer};
+
+/// gRPC API server for Vector observability.
+pub struct GrpcServer {
+    _shutdown: oneshot::Sender<()>,
+    addr: SocketAddr,
+}
+
+impl GrpcServer {
+    /// Start the gRPC API server.
+    ///
+    /// This creates a new gRPC server listening on the configured address and spawns
+    /// it in the background. The server will shut down gracefully when this struct
+    /// is dropped.
+    ///
+    /// Returns an error if the server fails to bind to the configured address.
+    pub async fn start(
+        config: &Config,
+        watch_rx: WatchRx,
+        running: Arc<AtomicBool>,
+    ) -> crate::Result<Self> {
+        let addr = config.api.address.ok_or_else(|| {
+            crate::Error::from("API address not configured in config.api.address")
+        })?;
+
+        // Bind the TCP listener first to ensure the port is available
+        // This will fail fast if the address is already in use
+        let listener = tokio::net::TcpListener::bind(addr).await.map_err(|e| {
+            crate::Error::from(format!("Failed to bind gRPC API server to {}: {}", addr, e))
+        })?;
+
+        let actual_addr = listener
+            .local_addr()
+            .map_err(|e| crate::Error::from(format!("Failed to get local address: {}", e)))?;
+
+        info!("GRPC API server bound to {}.", actual_addr);
+
+        let service = ObservabilityService::new(watch_rx, running);
+
+        let (_shutdown, rx) = oneshot::channel();
+
+        // Spawn the server with the already-bound listener
+        tokio::spawn(async move {
+            let incoming = TcpListenerStream::new(listener);
+
+            // Build reflection service for tools like grpcurl
+            let reflection_service = tonic_reflection::server::Builder::configure()
+                .register_encoded_file_descriptor_set(
+                    crate::proto::observability::FILE_DESCRIPTOR_SET,
+                )
+                .build()
+                .expect("Failed to build reflection service");
+
+            let result = TonicServer::builder()
+                .add_service(ObservabilityServer::new(service))
+                .add_service(reflection_service)
+                .serve_with_incoming_shutdown(incoming, async {
+                    rx.await.ok();
+                    info!("GRPC API server shutting down.");
+                })
+                .await;
+
+            if let Err(e) = result {
+                error!(
+                    message = "GRPC server encountered an error.",
+                    error = %e,
+                    error_source = ?e.source(),
+                    bind_addr = %actual_addr,
+                );
+            }
+        });
+
+        info!("GRPC API server started on {}.", actual_addr);
+
+        Ok(Self {
+            _shutdown,
+            addr: actual_addr,
+        })
+    }
+
+    /// Get the address the server is listening on
+    pub const fn addr(&self) -> SocketAddr {
+        self.addr
+    }
+}
diff --git a/src/api/handler.rs b/src/api/handler.rs
deleted file mode 100644
index 72ecfce87c1dc..0000000000000
--- a/src/api/handler.rs
+++ /dev/null
@@ -1,23 +0,0 @@
-use std::sync::{
-    Arc,
-    atomic::{self, AtomicBool},
-};
-
-use serde_json::json;
-use warp::{Rejection, Reply, reply::json};
-
-// Health handler, responds with '{ ok: true }' when running and '{ ok: false}'
-// when shutting down
-pub(super) async fn health(running: Arc<AtomicBool>) -> Result<impl Reply, Rejection> {
-    if running.load(atomic::Ordering::Relaxed) {
-        Ok(warp::reply::with_status(
-            json(&json!({"ok": true})),
-            warp::http::StatusCode::OK,
-        ))
-    } else {
-        Ok(warp::reply::with_status(
-            json(&json!({"ok": false})),
-            warp::http::StatusCode::SERVICE_UNAVAILABLE,
-        ))
-    }
-}
diff --git a/src/api/mod.rs b/src/api/mod.rs
index 947321277e728..f1992193e685a 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -1,9 +1,5 @@
 #![allow(missing_docs)]
-mod handler;
-mod schema;
-mod server;
-#[cfg(all(test, feature = "vector-api-tests"))]
-mod tests;
+mod grpc;
+mod grpc_server;
 
-pub use schema::build_schema;
-pub use server::Server;
+pub use grpc_server::GrpcServer;
diff --git a/src/api/schema/components/mod.rs b/src/api/schema/components/mod.rs
deleted file mode 100644
index 69d509e449a50..0000000000000
--- a/src/api/schema/components/mod.rs
+++ /dev/null
@@ -1,577 +0,0 @@
-pub mod sink;
-pub mod source;
-pub mod state;
-pub mod transform;
-
-use std::{
-    cmp,
-    collections::{HashMap, HashSet},
-    sync::LazyLock,
-};
-
-use async_graphql::{Enum, InputObject, Interface, Object, Subscription};
-use tokio_stream::{Stream, StreamExt, wrappers::BroadcastStream};
-use vector_lib::internal_event::DEFAULT_OUTPUT;
-
-use crate::{
-    api::schema::{
-        components::state::component_by_component_key,
-        filter::{self, filter_items},
-        relay, sort,
-    },
-    config::{ComponentKey, Config, get_transform_output_ids},
-    filter_check,
-};
-
-#[allow(clippy::duplicated_attributes)] // False positive caused by `ty = "String"`
-#[derive(Debug, Clone, Interface)]
-#[graphql(
-    field(name = "component_id", ty = "String"),
-    field(name = "component_type", ty = "String")
-)]
-pub enum Component {
-    Source(source::Source),
-    Transform(transform::Transform),
-    Sink(sink::Sink),
-}
-
-#[derive(Enum, Copy, Clone, Eq, PartialEq, Ord, PartialOrd)]
-pub enum ComponentKind {
-    Source,
-    Transform,
-    Sink,
-}
-
-impl Component {
-    const fn get_component_key(&self) -> &ComponentKey {
-        match self {
-            Component::Source(c) => &c.0.component_key,
-            Component::Transform(c) => &c.0.component_key,
-            Component::Sink(c) => &c.0.component_key,
-        }
-    }
-
-    const fn get_component_kind(&self) -> ComponentKind {
-        match self {
-            Component::Source(_) => ComponentKind::Source,
-            Component::Transform(_) => ComponentKind::Transform,
-            Component::Sink(_) => ComponentKind::Sink,
-        }
-    }
-}
-
-#[derive(Default, InputObject)]
-pub struct ComponentsFilter {
-    component_id: Option<Vec<filter::StringFilter>>,
-    component_kind: Option<Vec<filter::EqualityFilter<ComponentKind>>>,
-    or: Option<Vec<Self>>,
-}
-
-impl filter::CustomFilter<Component> for ComponentsFilter {
-    fn matches(&self, component: &Component) -> bool {
-        filter_check!(
-            self.component_id.as_ref().map(|f| f
-                .iter()
-                .all(|f| f.filter_value(&component.get_component_key().to_string()))),
-            self.component_kind.as_ref().map(|f| f
-                .iter()
-                .all(|f| f.filter_value(component.get_component_kind())))
-        );
-        true
-    }
-
-    fn or(&self) -> Option<&Vec<Self>> {
-        self.or.as_ref()
-    }
-}
-
-#[derive(Enum, Copy, Clone, Eq, PartialEq)]
-pub enum ComponentsSortFieldName {
-    ComponentKey,
-    ComponentKind,
-}
-
-impl sort::SortableByField<ComponentsSortFieldName> for Component {
-    fn sort(&self, rhs: &Self, field: &ComponentsSortFieldName) -> cmp::Ordering {
-        match field {
-            ComponentsSortFieldName::ComponentKey => {
-                Ord::cmp(&self.get_component_key(), &rhs.get_component_key())
-            }
-            ComponentsSortFieldName::ComponentKind => {
-                Ord::cmp(&self.get_component_kind(), &rhs.get_component_kind())
-            }
-        }
-    }
-}
-
-#[derive(Default)]
-pub struct ComponentsQuery;
-
-#[allow(clippy::too_many_arguments)]
-#[Object]
-impl ComponentsQuery {
-    /// Configured components (sources/transforms/sinks)
-    async fn components(
-        &self,
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i32>,
-        last: Option<i32>,
-        filter: Option<ComponentsFilter>,
-        sort: Option<Vec<sort::SortField<ComponentsSortFieldName>>>,
-    ) -> relay::ConnectionResult<Component> {
-        let filter = filter.unwrap_or_default();
-        let mut components = filter_items(state::get_components().into_iter(), &filter);
-
-        if let Some(sort_fields) = sort {
-            sort::by_fields(&mut components, &sort_fields);
-        }
-
-        relay::query(
-            components.into_iter(),
-            relay::Params::new(after, before, first, last),
-            10,
-        )
-        .await
-    }
-
-    /// Configured sources
-    async fn sources(
-        &self,
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i32>,
-        last: Option<i32>,
-        filter: Option<source::SourcesFilter>,
-        sort: Option<Vec<sort::SortField<source::SourcesSortFieldName>>>,
-    ) -> relay::ConnectionResult<source::Source> {
-        let filter = filter.unwrap_or_default();
-        let mut sources = filter_items(state::get_sources().into_iter(), &filter);
-
-        if let Some(sort_fields) = sort {
-            sort::by_fields(&mut sources, &sort_fields);
-        }
-
-        relay::query(
-            sources.into_iter(),
-            relay::Params::new(after, before, first, last),
-            10,
-        )
-        .await
-    }
-
-    /// Configured transforms
-    async fn transforms(
-        &self,
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i32>,
-        last: Option<i32>,
-        filter: Option<transform::TransformsFilter>,
-        sort: Option<Vec<sort::SortField<transform::TransformsSortFieldName>>>,
-    ) -> relay::ConnectionResult<transform::Transform> {
-        let filter = filter.unwrap_or_default();
-        let mut transforms = filter_items(state::get_transforms().into_iter(), &filter);
-
-        if let Some(sort_fields) = sort {
-            sort::by_fields(&mut transforms, &sort_fields);
-        }
-
-        relay::query(
-            transforms.into_iter(),
-            relay::Params::new(after, before, first, last),
-            10,
-        )
-        .await
-    }
-
-    /// Configured sinks
-    async fn sinks(
-        &self,
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i32>,
-        last: Option<i32>,
-        filter: Option<sink::SinksFilter>,
-        sort: Option<Vec<sort::SortField<sink::SinksSortFieldName>>>,
-    ) -> relay::ConnectionResult<sink::Sink> {
-        let filter = filter.unwrap_or_default();
-        let mut sinks = filter_items(state::get_sinks().into_iter(), &filter);
-
-        if let Some(sort_fields) = sort {
-            sort::by_fields(&mut sinks, &sort_fields);
-        }
-
-        relay::query(
-            sinks.into_iter(),
-            relay::Params::new(after, before, first, last),
-            10,
-        )
-        .await
-    }
-
-    /// Gets a configured component by component_key
-    async fn component_by_component_key(&self, component_id: String) -> Option<Component> {
-        let key = ComponentKey::from(component_id);
-        component_by_component_key(&key)
-    }
-}
-
-#[derive(Clone, Debug)]
-enum ComponentChanged {
-    Added(Component),
-    Removed(Component),
-}
-
-static COMPONENT_CHANGED: LazyLock<tokio::sync::broadcast::Sender<ComponentChanged>> =
-    LazyLock::new(|| {
-        let (tx, _) = tokio::sync::broadcast::channel(10);
-        tx
-    });
-
-#[derive(Debug, Default)]
-pub struct ComponentsSubscription;
-
-#[Subscription]
-impl ComponentsSubscription {
-    /// Subscribes to all newly added components
-    async fn component_added(&self) -> impl Stream<Item = Component> + use<> {
-        BroadcastStream::new(COMPONENT_CHANGED.subscribe()).filter_map(|c| match c {
-            Ok(ComponentChanged::Added(c)) => Some(c),
-            _ => None,
-        })
-    }
-
-    /// Subscribes to all removed components
-    async fn component_removed(&self) -> impl Stream<Item = Component> + use<> {
-        BroadcastStream::new(COMPONENT_CHANGED.subscribe()).filter_map(|c| match c {
-            Ok(ComponentChanged::Removed(c)) => Some(c),
-            _ => None,
-        })
-    }
-}
-
-/// Update the 'global' configuration that will be consumed by component queries
-pub fn update_config(config: &Config) {
-    let mut new_components = HashMap::new();
-
-    // Sources
-    let table_sources = config
-        .enrichment_tables()
-        .filter_map(|(k, e)| e.as_source(k))
-        .collect::<Vec<_>>();
-    for (component_key, source) in config
-        .sources()
-        .chain(table_sources.iter().map(|(k, s)| (k, s)))
-    {
-        new_components.insert(
-            component_key.clone(),
-            Component::Source(source::Source(source::Data {
-                component_key: component_key.clone(),
-                component_type: source.inner.get_component_name().to_string(),
-                // TODO(#10745): This is obviously wrong, but there are a lot of assumptions in the
-                // API modules about `output_type` as it's a sortable field, etc. This is a stopgap
-                // until we decide how we want to change the rest of the usages.
-                output_type: source
-                    .inner
-                    .outputs(config.schema.log_namespace())
-                    .pop()
-                    .unwrap()
-                    .ty,
-                outputs: source
-                    .inner
-                    .outputs(config.schema.log_namespace())
-                    .into_iter()
-                    .map(|output| output.port.unwrap_or_else(|| DEFAULT_OUTPUT.to_string()))
-                    .collect(),
-            })),
-        );
-    }
-
-    // Transforms
-    for (component_key, transform) in config.transforms() {
-        new_components.insert(
-            component_key.clone(),
-            Component::Transform(transform::Transform(transform::Data {
-                component_key: component_key.clone(),
-                component_type: transform.inner.get_component_name().to_string(),
-                inputs: transform.inputs.clone(),
-                outputs: get_transform_output_ids(
-                    transform.inner.as_ref(),
-                    "".into(),
-                    config.schema.log_namespace(),
-                )
-                .map(|output| output.port.unwrap_or_else(|| DEFAULT_OUTPUT.to_string()))
-                .collect(),
-            })),
-        );
-    }
-
-    // Sinks
-    let table_sinks = config
-        .enrichment_tables()
-        .filter_map(|(k, e)| e.as_sink(k))
-        .collect::<Vec<_>>();
-    for (component_key, sink) in config
-        .sinks()
-        .chain(table_sinks.iter().map(|(k, s)| (k, s)))
-    {
-        new_components.insert(
-            component_key.clone(),
-            Component::Sink(sink::Sink(sink::Data {
-                component_key: component_key.clone(),
-                component_type: sink.inner.get_component_name().to_string(),
-                inputs: sink.inputs.clone(),
-            })),
-        );
-    }
-
-    // Get the component_ids of existing components
-    let existing_component_keys = state::get_component_keys();
-    let new_component_keys = new_components
-        .keys()
-        .cloned()
-        .collect::<HashSet<ComponentKey>>();
-
-    // Publish all components that have been removed
-    existing_component_keys
-        .difference(&new_component_keys)
-        .for_each(|component_key| {
-            _ = COMPONENT_CHANGED.send(ComponentChanged::Removed(
-                state::component_by_component_key(component_key)
-                    .expect("Couldn't get component by key"),
-            ));
-        });
-
-    // Publish all components that have been added
-    new_component_keys
-        .difference(&existing_component_keys)
-        .for_each(|component_key| {
-            _ = COMPONENT_CHANGED.send(ComponentChanged::Added(
-                new_components.get(component_key).unwrap().clone(),
-            ));
-        });
-
-    // Override the old component state
-    state::update(new_components);
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{
-        api::schema::sort,
-        config::{ComponentKey, DataType, OutputId},
-    };
-
-    /// Generate component fixes for use with tests
-    fn component_fixtures() -> Vec<Component> {
-        vec![
-            Component::Source(source::Source(source::Data {
-                component_key: ComponentKey::from("gen1"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            })),
-            Component::Source(source::Source(source::Data {
-                component_key: ComponentKey::from("gen2"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            })),
-            Component::Source(source::Source(source::Data {
-                component_key: ComponentKey::from("gen3"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            })),
-            Component::Transform(transform::Transform(transform::Data {
-                component_key: ComponentKey::from("parse_json"),
-                component_type: "json".to_string(),
-                inputs: vec![OutputId::from("gen1"), OutputId::from("gen2")].into(),
-                outputs: vec![],
-            })),
-            Component::Sink(sink::Sink(sink::Data {
-                component_key: ComponentKey::from("devnull"),
-                component_type: "blackhole".to_string(),
-                inputs: vec![OutputId::from("gen3"), OutputId::from("parse_json")].into(),
-            })),
-        ]
-    }
-
-    #[test]
-    fn components_filter_contains() {
-        let filter = ComponentsFilter {
-            component_id: Some(vec![filter::StringFilter {
-                contains: Some("gen".to_string()),
-                ..Default::default()
-            }]),
-            ..Default::default()
-        };
-
-        let components = filter_items(component_fixtures().into_iter(), &filter);
-
-        assert_eq!(components.len(), 3);
-    }
-
-    #[test]
-    fn components_filter_equals_or() {
-        let filter = ComponentsFilter {
-            component_id: Some(vec![filter::StringFilter {
-                equals: Some("gen1".to_string()),
-                ..Default::default()
-            }]),
-            or: Some(vec![ComponentsFilter {
-                component_id: Some(vec![filter::StringFilter {
-                    equals: Some("devnull".to_string()),
-                    ..Default::default()
-                }]),
-                ..Default::default()
-            }]),
-            ..Default::default()
-        };
-
-        let components = filter_items(component_fixtures().into_iter(), &filter);
-
-        assert_eq!(components.len(), 2);
-    }
-
-    #[test]
-    fn components_filter_and() {
-        let filter = ComponentsFilter {
-            component_id: Some(vec![filter::StringFilter {
-                equals: Some("gen1".to_string()),
-                ..Default::default()
-            }]),
-            component_kind: Some(vec![filter::EqualityFilter {
-                equals: Some(ComponentKind::Source),
-                not_equals: None,
-            }]),
-            ..Default::default()
-        };
-
-        let components = filter_items(component_fixtures().into_iter(), &filter);
-
-        assert_eq!(components.len(), 1);
-    }
-
-    #[test]
-    fn components_filter_and_or() {
-        let filter = ComponentsFilter {
-            component_id: Some(vec![filter::StringFilter {
-                equals: Some("gen1".to_string()),
-                ..Default::default()
-            }]),
-            component_kind: Some(vec![filter::EqualityFilter {
-                equals: Some(ComponentKind::Source),
-                not_equals: None,
-            }]),
-            or: Some(vec![ComponentsFilter {
-                component_kind: Some(vec![filter::EqualityFilter {
-                    equals: Some(ComponentKind::Sink),
-                    not_equals: None,
-                }]),
-                ..Default::default()
-            }]),
-        };
-
-        let components = filter_items(component_fixtures().into_iter(), &filter);
-
-        assert_eq!(components.len(), 2);
-    }
-
-    #[test]
-    fn components_sort_asc() {
-        let mut components = component_fixtures();
-        let fields = vec![sort::SortField::<ComponentsSortFieldName> {
-            field: ComponentsSortFieldName::ComponentKey,
-            direction: sort::Direction::Asc,
-        }];
-        sort::by_fields(&mut components, &fields);
-
-        let expectations = ["devnull", "gen1", "gen2", "gen3", "parse_json"];
-
-        for (i, component_id) in expectations.iter().enumerate() {
-            assert_eq!(components[i].get_component_key().id(), *component_id);
-        }
-    }
-
-    #[test]
-    fn components_sort_desc() {
-        let mut components = component_fixtures();
-        let fields = vec![sort::SortField::<ComponentsSortFieldName> {
-            field: ComponentsSortFieldName::ComponentKey,
-            direction: sort::Direction::Desc,
-        }];
-        sort::by_fields(&mut components, &fields);
-
-        let expectations = ["parse_json", "gen3", "gen2", "gen1", "devnull"];
-
-        for (i, component_id) in expectations.iter().enumerate() {
-            assert_eq!(components[i].get_component_key().id(), *component_id);
-        }
-    }
-
-    #[test]
-    fn components_sort_multi() {
-        let mut components = vec![
-            Component::Sink(sink::Sink(sink::Data {
-                component_key: ComponentKey::from("a"),
-                component_type: "blackhole".to_string(),
-                inputs: vec![OutputId::from("gen3"), OutputId::from("parse_json")].into(),
-            })),
-            Component::Sink(sink::Sink(sink::Data {
-                component_key: ComponentKey::from("b"),
-                component_type: "blackhole".to_string(),
-                inputs: vec![OutputId::from("gen3"), OutputId::from("parse_json")].into(),
-            })),
-            Component::Transform(transform::Transform(transform::Data {
-                component_key: ComponentKey::from("c"),
-                component_type: "json".to_string(),
-                inputs: vec![OutputId::from("gen1"), OutputId::from("gen2")].into(),
-                outputs: vec![],
-            })),
-            Component::Source(source::Source(source::Data {
-                component_key: ComponentKey::from("e"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            })),
-            Component::Source(source::Source(source::Data {
-                component_key: ComponentKey::from("d"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            })),
-            Component::Source(source::Source(source::Data {
-                component_key: ComponentKey::from("g"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            })),
-            Component::Source(source::Source(source::Data {
-                component_key: ComponentKey::from("f"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            })),
-        ];
-
-        let fields = vec![
-            sort::SortField::<ComponentsSortFieldName> {
-                field: ComponentsSortFieldName::ComponentKind,
-                direction: sort::Direction::Asc,
-            },
-            sort::SortField::<ComponentsSortFieldName> {
-                field: ComponentsSortFieldName::ComponentKey,
-                direction: sort::Direction::Asc,
-            },
-        ];
-        sort::by_fields(&mut components, &fields);
-
-        let expectations = ["d", "e", "f", "g", "c", "a", "b"];
-        for (i, component_id) in expectations.iter().enumerate() {
-            assert_eq!(components[i].get_component_key().id(), *component_id);
-        }
-    }
-}
diff --git a/src/api/schema/components/sink.rs b/src/api/schema/components/sink.rs
deleted file mode 100644
index 99bcca38cc634..0000000000000
--- a/src/api/schema/components/sink.rs
+++ /dev/null
@@ -1,202 +0,0 @@
-use std::cmp;
-
-use async_graphql::{Enum, InputObject, Object};
-
-use super::{Component, source, state, transform};
-use crate::{
-    api::schema::{
-        filter,
-        metrics::{self, IntoSinkMetrics},
-        sort,
-    },
-    config::{ComponentKey, Inputs, OutputId},
-    filter_check,
-};
-
-#[derive(Debug, Clone)]
-pub struct Data {
-    pub component_key: ComponentKey,
-    pub component_type: String,
-    pub inputs: Inputs<OutputId>,
-}
-
-#[derive(Debug, Clone)]
-pub struct Sink(pub Data);
-
-impl Sink {
-    pub const fn get_component_key(&self) -> &ComponentKey {
-        &self.0.component_key
-    }
-
-    pub const fn get_component_type(&self) -> &str {
-        self.0.component_type.as_str()
-    }
-}
-
-#[derive(Default, InputObject)]
-pub struct SinksFilter {
-    component_id: Option<Vec<filter::StringFilter>>,
-    component_type: Option<Vec<filter::StringFilter>>,
-    or: Option<Vec<Self>>,
-}
-
-impl filter::CustomFilter<Sink> for SinksFilter {
-    fn matches(&self, sink: &Sink) -> bool {
-        filter_check!(
-            self.component_id.as_ref().map(|f| f
-                .iter()
-                .all(|f| f.filter_value(&sink.get_component_key().to_string()))),
-            self.component_type
-                .as_ref()
-                .map(|f| f.iter().all(|f| f.filter_value(sink.get_component_type())))
-        );
-        true
-    }
-
-    fn or(&self) -> Option<&Vec<Self>> {
-        self.or.as_ref()
-    }
-}
-
-#[derive(Enum, Copy, Clone, Eq, PartialEq)]
-pub enum SinksSortFieldName {
-    ComponentKey,
-    ComponentType,
-}
-
-impl sort::SortableByField<SinksSortFieldName> for Sink {
-    fn sort(&self, rhs: &Self, field: &SinksSortFieldName) -> cmp::Ordering {
-        match field {
-            SinksSortFieldName::ComponentKey => {
-                Ord::cmp(self.get_component_key(), rhs.get_component_key())
-            }
-            SinksSortFieldName::ComponentType => {
-                Ord::cmp(self.get_component_type(), rhs.get_component_type())
-            }
-        }
-    }
-}
-
-#[Object]
-impl Sink {
-    /// Sink component_id
-    pub async fn component_id(&self) -> &str {
-        self.get_component_key().id()
-    }
-
-    /// Sink type
-    pub async fn component_type(&self) -> &str {
-        self.get_component_type()
-    }
-
-    /// Source inputs
-    pub async fn sources(&self) -> Vec<source::Source> {
-        self.0
-            .inputs
-            .iter()
-            .filter_map(|output_id| match state::component_by_output_id(output_id) {
-                Some(Component::Source(s)) => Some(s),
-                _ => None,
-            })
-            .collect()
-    }
-
-    /// Transform inputs
-    pub async fn transforms(&self) -> Vec<transform::Transform> {
-        self.0
-            .inputs
-            .iter()
-            .filter_map(|output_id| match state::component_by_output_id(output_id) {
-                Some(Component::Transform(t)) => Some(t),
-                _ => None,
-            })
-            .collect()
-    }
-
-    /// Sink metrics
-    pub async fn metrics(&self) -> metrics::SinkMetrics {
-        metrics::by_component_key(self.get_component_key())
-            .into_sink_metrics(self.get_component_type())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn sink_fixtures() -> Vec<Sink> {
-        vec![
-            Sink(Data {
-                component_key: ComponentKey::from("webserver"),
-                component_type: "http".to_string(),
-                inputs: Inputs::default(),
-            }),
-            Sink(Data {
-                component_key: ComponentKey::from("db"),
-                component_type: "clickhouse".to_string(),
-                inputs: Inputs::default(),
-            }),
-            Sink(Data {
-                component_key: ComponentKey::from("zip_drive"),
-                component_type: "file".to_string(),
-                inputs: Inputs::default(),
-            }),
-        ]
-    }
-
-    #[test]
-    fn sort_component_id_asc() {
-        let mut sinks = sink_fixtures();
-        let fields = vec![sort::SortField::<SinksSortFieldName> {
-            field: SinksSortFieldName::ComponentKey,
-            direction: sort::Direction::Asc,
-        }];
-        sort::by_fields(&mut sinks, &fields);
-
-        for (i, component_id) in ["db", "webserver", "zip_drive"].iter().enumerate() {
-            assert_eq!(sinks[i].get_component_key().to_string(), *component_id);
-        }
-    }
-
-    #[test]
-    fn sort_component_id_desc() {
-        let mut sinks = sink_fixtures();
-        let fields = vec![sort::SortField::<SinksSortFieldName> {
-            field: SinksSortFieldName::ComponentKey,
-            direction: sort::Direction::Desc,
-        }];
-        sort::by_fields(&mut sinks, &fields);
-
-        for (i, component_id) in ["zip_drive", "webserver", "db"].iter().enumerate() {
-            assert_eq!(sinks[i].get_component_key().to_string(), *component_id);
-        }
-    }
-
-    #[test]
-    fn sort_component_type_asc() {
-        let mut sinks = sink_fixtures();
-        let fields = vec![sort::SortField::<SinksSortFieldName> {
-            field: SinksSortFieldName::ComponentType,
-            direction: sort::Direction::Asc,
-        }];
-        sort::by_fields(&mut sinks, &fields);
-
-        for (i, component_id) in ["db", "zip_drive", "webserver"].iter().enumerate() {
-            assert_eq!(sinks[i].get_component_key().to_string(), *component_id);
-        }
-    }
-
-    #[test]
-    fn sort_component_type_desc() {
-        let mut sinks = sink_fixtures();
-        let fields = vec![sort::SortField::<SinksSortFieldName> {
-            field: SinksSortFieldName::ComponentType,
-            direction: sort::Direction::Desc,
-        }];
-        sort::by_fields(&mut sinks, &fields);
-
-        for (i, component_id) in ["webserver", "zip_drive", "db"].iter().enumerate() {
-            assert_eq!(sinks[i].get_component_key().to_string(), *component_id);
-        }
-    }
-}
diff --git a/src/api/schema/components/source.rs b/src/api/schema/components/source.rs
deleted file mode 100644
index c2289c4b6a15b..0000000000000
--- a/src/api/schema/components/source.rs
+++ /dev/null
@@ -1,403 +0,0 @@
-use std::cmp;
-
-use async_graphql::{Enum, InputObject, Object};
-
-use super::{Component, sink, state, transform};
-use crate::{
-    api::schema::{
-        filter,
-        metrics::{self, IntoSourceMetrics, Output, outputs_by_component_key},
-        sort,
-    },
-    config::{ComponentKey, DataType, OutputId},
-    filter_check,
-};
-
-#[derive(Debug, Enum, Eq, PartialEq, Copy, Clone, Ord, PartialOrd)]
-pub enum SourceOutputType {
-    Log,
-    Metric,
-    Trace,
-}
-
-#[derive(Debug, Clone)]
-pub struct Data {
-    pub component_key: ComponentKey,
-    pub component_type: String,
-    pub output_type: DataType,
-    pub outputs: Vec<String>,
-}
-
-#[derive(Enum, Copy, Clone, Eq, PartialEq)]
-pub enum SourcesSortFieldName {
-    ComponentKey,
-    ComponentType,
-    OutputType,
-}
-
-#[derive(Debug, Clone)]
-pub struct Source(pub Data);
-
-impl Source {
-    #[allow(clippy::missing_const_for_fn)] // const cannot run destructor
-    pub fn get_component_key(&self) -> &ComponentKey {
-        &self.0.component_key
-    }
-    pub const fn get_component_type(&self) -> &str {
-        self.0.component_type.as_str()
-    }
-    pub fn get_output_types(&self) -> Vec<SourceOutputType> {
-        [
-            SourceOutputType::Log,
-            SourceOutputType::Metric,
-            SourceOutputType::Trace,
-        ]
-        .iter()
-        .copied()
-        .filter(|s| self.0.output_type.contains(s.into()))
-        .collect()
-    }
-
-    pub fn get_outputs(&self) -> &[String] {
-        self.0.outputs.as_ref()
-    }
-}
-
-impl From<&SourceOutputType> for DataType {
-    fn from(s: &SourceOutputType) -> Self {
-        match s {
-            SourceOutputType::Log => DataType::Log,
-            SourceOutputType::Metric => DataType::Metric,
-            SourceOutputType::Trace => DataType::Trace,
-        }
-    }
-}
-
-impl sort::SortableByField<SourcesSortFieldName> for Source {
-    fn sort(&self, rhs: &Self, field: &SourcesSortFieldName) -> cmp::Ordering {
-        match field {
-            SourcesSortFieldName::ComponentKey => {
-                Ord::cmp(self.get_component_key(), rhs.get_component_key())
-            }
-            SourcesSortFieldName::ComponentType => {
-                Ord::cmp(self.get_component_type(), rhs.get_component_type())
-            }
-            SourcesSortFieldName::OutputType => {
-                Ord::cmp(&u8::from(self.0.output_type), &u8::from(rhs.0.output_type))
-            }
-        }
-    }
-}
-
-#[Object]
-impl Source {
-    /// Source component_id
-    pub async fn component_id(&self) -> &str {
-        self.0.component_key.id()
-    }
-
-    /// Source type
-    pub async fn component_type(&self) -> &str {
-        self.get_component_type()
-    }
-
-    /// Source output type
-    pub async fn output_types(&self) -> Vec<SourceOutputType> {
-        self.get_output_types()
-    }
-
-    /// Source output streams
-    pub async fn outputs(&self) -> Vec<Output> {
-        outputs_by_component_key(self.get_component_key(), self.get_outputs())
-    }
-
-    /// Transform outputs
-    pub async fn transforms(&self) -> Vec<transform::Transform> {
-        state::filter_components(|(_component_key, components)| match components {
-            Component::Transform(t)
-                if t.0.inputs.contains(&OutputId::from(&self.0.component_key)) =>
-            {
-                Some(t.clone())
-            }
-            _ => None,
-        })
-    }
-
-    /// Sink outputs
-    pub async fn sinks(&self) -> Vec<sink::Sink> {
-        state::filter_components(|(_component_key, components)| match components {
-            Component::Sink(s) if s.0.inputs.contains(&OutputId::from(&self.0.component_key)) => {
-                Some(s.clone())
-            }
-            _ => None,
-        })
-    }
-
-    /// Source metrics
-    pub async fn metrics(&self) -> metrics::SourceMetrics {
-        metrics::by_component_key(&self.0.component_key)
-            .into_source_metrics(self.get_component_type())
-    }
-}
-
-#[derive(Default, InputObject)]
-pub(super) struct SourcesFilter {
-    component_id: Option<Vec<filter::StringFilter>>,
-    component_type: Option<Vec<filter::StringFilter>>,
-    output_type: Option<Vec<filter::ListFilter<SourceOutputType>>>,
-    or: Option<Vec<Self>>,
-}
-
-impl filter::CustomFilter<Source> for SourcesFilter {
-    fn matches(&self, source: &Source) -> bool {
-        filter_check!(
-            self.component_id.as_ref().map(|f| f
-                .iter()
-                .all(|f| f.filter_value(&source.get_component_key().to_string()))),
-            self.component_type.as_ref().map(|f| f
-                .iter()
-                .all(|f| f.filter_value(source.get_component_type()))),
-            self.output_type
-                .as_ref()
-                .map(|f| f.iter().all(|f| f.filter_value(source.get_output_types())))
-        );
-        true
-    }
-
-    fn or(&self) -> Option<&Vec<Self>> {
-        self.or.as_ref()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::config::DataType;
-
-    /// Generate component fixes for use with tests
-    fn source_fixtures() -> Vec<Source> {
-        vec![
-            Source(Data {
-                component_key: ComponentKey::from("gen1"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Log | DataType::Metric,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen2"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Log,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen3"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            }),
-        ]
-    }
-
-    #[test]
-    fn filter_output_type() {
-        struct Test {
-            component_id: &'static str,
-            output_types: Vec<SourceOutputType>,
-        }
-
-        let tests = vec![
-            Test {
-                component_id: "gen1",
-                output_types: vec![SourceOutputType::Log, SourceOutputType::Metric],
-            },
-            Test {
-                component_id: "gen2",
-                output_types: vec![SourceOutputType::Log],
-            },
-            Test {
-                component_id: "gen3",
-                output_types: vec![SourceOutputType::Metric],
-            },
-        ];
-
-        for t in tests {
-            let filter = SourcesFilter {
-                component_id: Some(vec![filter::StringFilter {
-                    equals: Some(t.component_id.to_string()),
-                    ..Default::default()
-                }]),
-                output_type: Some(vec![filter::ListFilter::<SourceOutputType> {
-                    equals: Some(t.output_types),
-                    not_equals: None,
-                    contains: None,
-                    not_contains: None,
-                }]),
-                ..Default::default()
-            };
-
-            let sources = filter::filter_items(source_fixtures().into_iter(), &filter);
-            assert_eq!(sources.len(), 1);
-        }
-    }
-
-    #[test]
-    fn sort_component_id_desc() {
-        let mut sources = source_fixtures();
-        let fields = vec![sort::SortField::<SourcesSortFieldName> {
-            field: SourcesSortFieldName::ComponentKey,
-            direction: sort::Direction::Desc,
-        }];
-        sort::by_fields(&mut sources, &fields);
-
-        for (i, component_id) in ["gen3", "gen2", "gen1"].iter().enumerate() {
-            assert_eq!(sources[i].get_component_key().to_string(), *component_id);
-        }
-    }
-
-    #[test]
-    fn sort_component_type_asc() {
-        let mut sources = vec![
-            Source(Data {
-                component_key: ComponentKey::from("gen2"),
-                component_type: "file".to_string(),
-                output_type: DataType::Log | DataType::Metric,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen3"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Log,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen1"),
-                component_type: "docker_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            }),
-        ];
-
-        let fields = vec![sort::SortField::<SourcesSortFieldName> {
-            field: SourcesSortFieldName::ComponentType,
-            direction: sort::Direction::Asc,
-        }];
-        sort::by_fields(&mut sources, &fields);
-
-        for (i, component_id) in ["gen3", "gen1", "gen2"].iter().enumerate() {
-            assert_eq!(sources[i].get_component_key().to_string(), *component_id);
-        }
-    }
-
-    #[test]
-    fn sort_component_type_desc() {
-        let mut sources = vec![
-            Source(Data {
-                component_key: ComponentKey::from("gen3"),
-                component_type: "file".to_string(),
-                output_type: DataType::Log | DataType::Metric,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen2"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Log,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen1"),
-                component_type: "docker_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            }),
-        ];
-
-        let fields = vec![sort::SortField::<SourcesSortFieldName> {
-            field: SourcesSortFieldName::ComponentType,
-            direction: sort::Direction::Desc,
-        }];
-        sort::by_fields(&mut sources, &fields);
-
-        for (i, component_id) in ["gen3", "gen1", "gen2"].iter().enumerate() {
-            assert_eq!(sources[i].get_component_key().to_string(), *component_id);
-        }
-    }
-
-    #[test]
-    fn sort_output_type_asc() {
-        let mut sources = vec![
-            Source(Data {
-                component_key: ComponentKey::from("gen4"),
-                component_type: "demo_trace".to_string(),
-                output_type: DataType::Trace,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen1"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen2"),
-                component_type: "file".to_string(),
-                output_type: DataType::Log,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen3"),
-                component_type: "multiple_type".to_string(),
-                output_type: DataType::Log | DataType::Metric | DataType::Trace,
-                outputs: vec![],
-            }),
-        ];
-
-        let fields = vec![sort::SortField::<SourcesSortFieldName> {
-            field: SourcesSortFieldName::OutputType,
-            direction: sort::Direction::Asc,
-        }];
-        sort::by_fields(&mut sources, &fields);
-
-        for (i, component_id) in ["gen2", "gen1", "gen4", "gen3"].iter().enumerate() {
-            assert_eq!(sources[i].get_component_key().to_string(), *component_id);
-        }
-    }
-
-    #[test]
-    fn sort_output_type_desc() {
-        let mut sources = vec![
-            Source(Data {
-                component_key: ComponentKey::from("gen4"),
-                component_type: "demo_trace".to_string(),
-                output_type: DataType::Trace,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen1"),
-                component_type: "demo_logs".to_string(),
-                output_type: DataType::Metric,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen2"),
-                component_type: "file".to_string(),
-                output_type: DataType::Log,
-                outputs: vec![],
-            }),
-            Source(Data {
-                component_key: ComponentKey::from("gen3"),
-                component_type: "multiple_type".to_string(),
-                output_type: DataType::Log | DataType::Metric | DataType::Trace,
-                outputs: vec![],
-            }),
-        ];
-
-        let fields = vec![sort::SortField::<SourcesSortFieldName> {
-            field: SourcesSortFieldName::OutputType,
-            direction: sort::Direction::Desc,
-        }];
-        sort::by_fields(&mut sources, &fields);
-        for (i, component_id) in ["gen3", "gen4", "gen1", "gen2"].iter().enumerate() {
-            assert_eq!(sources[i].get_component_key().to_string(), *component_id);
-        }
-    }
-}
diff --git a/src/api/schema/components/state.rs b/src/api/schema/components/state.rs
deleted file mode 100644
index 1bb04894d81a9..0000000000000
--- a/src/api/schema/components/state.rs
+++ /dev/null
@@ -1,89 +0,0 @@
-use std::{
-    collections::{HashMap, HashSet},
-    sync::{Arc, LazyLock, RwLock},
-};
-
-use super::{Component, sink, source, transform};
-use crate::config::{ComponentKey, OutputId};
-
-pub const INVARIANT: &str = "Couldn't acquire lock on Vector components. Please report this.";
-
-pub static COMPONENTS: LazyLock<Arc<RwLock<HashMap<ComponentKey, Component>>>> =
-    LazyLock::new(|| Arc::new(RwLock::new(HashMap::new())));
-
-/// Filter components with the provided `map_func`
-pub fn filter_components<T>(map_func: impl Fn((&ComponentKey, &Component)) -> Option<T>) -> Vec<T> {
-    COMPONENTS
-        .read()
-        .expect(INVARIANT)
-        .iter()
-        .filter_map(map_func)
-        .collect()
-}
-
-/// Returns all components
-pub fn get_components() -> Vec<Component> {
-    filter_components(|(_component_key, components)| Some(components.clone()))
-}
-
-/// Filters components, and returns a clone of sources
-pub fn get_sources() -> Vec<source::Source> {
-    filter_components(|(_, components)| match components {
-        Component::Source(s) => Some(s.clone()),
-        _ => None,
-    })
-}
-
-/// Filters components, and returns a clone of transforms
-pub fn get_transforms() -> Vec<transform::Transform> {
-    filter_components(|(_, components)| match components {
-        Component::Transform(t) => Some(t.clone()),
-        _ => None,
-    })
-}
-
-/// Filters components, and returns a clone of sinks
-pub fn get_sinks() -> Vec<sink::Sink> {
-    filter_components(|(_, components)| match components {
-        Component::Sink(s) => Some(s.clone()),
-        _ => None,
-    })
-}
-
-/// Returns the current component component_keys as a HashSet
-pub fn get_component_keys() -> HashSet<ComponentKey> {
-    COMPONENTS
-        .read()
-        .expect(INVARIANT)
-        .keys()
-        .cloned()
-        .collect::<HashSet<ComponentKey>>()
-}
-
-/// Gets a component by component_key
-pub fn component_by_component_key(component_key: &ComponentKey) -> Option<Component> {
-    Some(
-        COMPONENTS
-            .read()
-            .expect(INVARIANT)
-            .get(component_key)?
-            .clone(),
-    )
-}
-
-/// Gets a component by output_id
-pub fn component_by_output_id(output_id: &OutputId) -> Option<Component> {
-    filter_components(|(key, component)| {
-        if key == &output_id.component {
-            Some(component.clone())
-        } else {
-            None
-        }
-    })
-    .pop()
-}
-
-/// Overwrites component state with new components.
-pub fn update(new_components: HashMap<ComponentKey, Component>) {
-    *COMPONENTS.write().expect(INVARIANT) = new_components
-}
diff --git a/src/api/schema/components/transform.rs b/src/api/schema/components/transform.rs
deleted file mode 100644
index 7fe95238b7dda..0000000000000
--- a/src/api/schema/components/transform.rs
+++ /dev/null
@@ -1,223 +0,0 @@
-use std::cmp;
-
-use async_graphql::{Enum, InputObject, Object};
-
-use super::{Component, sink, source, state};
-use crate::{
-    api::schema::{
-        filter,
-        metrics::{self, IntoTransformMetrics, Output, outputs_by_component_key},
-        sort,
-    },
-    config::{ComponentKey, Inputs, OutputId},
-    filter_check,
-};
-
-#[derive(Debug, Clone)]
-pub struct Data {
-    pub component_key: ComponentKey,
-    pub component_type: String,
-    pub inputs: Inputs<OutputId>,
-    pub outputs: Vec<String>,
-}
-
-#[derive(Debug, Clone)]
-pub struct Transform(pub Data);
-
-impl Transform {
-    pub const fn get_component_key(&self) -> &ComponentKey {
-        &self.0.component_key
-    }
-    pub const fn get_component_type(&self) -> &str {
-        self.0.component_type.as_str()
-    }
-    pub fn get_outputs(&self) -> &[String] {
-        self.0.outputs.as_ref()
-    }
-}
-
-#[derive(Enum, Copy, Clone, Eq, PartialEq)]
-pub enum TransformsSortFieldName {
-    ComponentKey,
-    ComponentType,
-}
-
-impl sort::SortableByField<TransformsSortFieldName> for Transform {
-    fn sort(&self, rhs: &Self, field: &TransformsSortFieldName) -> cmp::Ordering {
-        match field {
-            TransformsSortFieldName::ComponentKey => {
-                Ord::cmp(self.get_component_key(), rhs.get_component_key())
-            }
-            TransformsSortFieldName::ComponentType => {
-                Ord::cmp(self.get_component_type(), rhs.get_component_type())
-            }
-        }
-    }
-}
-
-#[Object]
-impl Transform {
-    /// Transform component_id
-    pub async fn component_id(&self) -> &str {
-        self.0.component_key.id()
-    }
-
-    /// Transform type
-    pub async fn component_type(&self) -> &str {
-        self.get_component_type()
-    }
-
-    /// Transform output streams
-    pub async fn outputs(&self) -> Vec<Output> {
-        outputs_by_component_key(self.get_component_key(), self.get_outputs())
-    }
-
-    /// Source inputs
-    pub async fn sources(&self) -> Vec<source::Source> {
-        self.0
-            .inputs
-            .iter()
-            .filter_map(|output_id| match state::component_by_output_id(output_id) {
-                Some(Component::Source(s)) => Some(s),
-                _ => None,
-            })
-            .collect()
-    }
-
-    /// Transform outputs
-    pub async fn transforms(&self) -> Vec<Transform> {
-        state::filter_components(|(_component_key, components)| match components {
-            Component::Transform(t)
-                if t.0.inputs.contains(&OutputId::from(&self.0.component_key)) =>
-            {
-                Some(t.clone())
-            }
-            _ => None,
-        })
-    }
-
-    /// Sink outputs
-    pub async fn sinks(&self) -> Vec<sink::Sink> {
-        state::filter_components(|(_component_key, components)| match components {
-            Component::Sink(s) if s.0.inputs.contains(&OutputId::from(&self.0.component_key)) => {
-                Some(s.clone())
-            }
-            _ => None,
-        })
-    }
-
-    /// Transform metrics
-    pub async fn metrics(&self) -> metrics::TransformMetrics {
-        metrics::by_component_key(&self.0.component_key)
-            .into_transform_metrics(self.get_component_type())
-    }
-}
-
-#[derive(Default, InputObject)]
-pub struct TransformsFilter {
-    component_id: Option<Vec<filter::StringFilter>>,
-    component_type: Option<Vec<filter::StringFilter>>,
-    or: Option<Vec<Self>>,
-}
-
-impl filter::CustomFilter<Transform> for TransformsFilter {
-    fn matches(&self, transform: &Transform) -> bool {
-        filter_check!(
-            self.component_id.as_ref().map(|f| f
-                .iter()
-                .all(|f| f.filter_value(&transform.get_component_key().to_string()))),
-            self.component_type.as_ref().map(|f| f
-                .iter()
-                .all(|f| f.filter_value(transform.get_component_type())))
-        );
-        true
-    }
-
-    fn or(&self) -> Option<&Vec<Self>> {
-        self.or.as_ref()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn transform_fixtures() -> Vec<Transform> {
-        vec![
-            Transform(Data {
-                component_key: ComponentKey::from("parse_json"),
-                component_type: "json".to_string(),
-                inputs: Inputs::default(),
-                outputs: vec![],
-            }),
-            Transform(Data {
-                component_key: ComponentKey::from("field_adder"),
-                component_type: "add_fields".to_string(),
-                inputs: Inputs::default(),
-                outputs: vec![],
-            }),
-            Transform(Data {
-                component_key: ComponentKey::from("append"),
-                component_type: "concat".to_string(),
-                inputs: Inputs::default(),
-                outputs: vec![],
-            }),
-        ]
-    }
-
-    #[test]
-    fn sort_component_id_asc() {
-        let mut transforms = transform_fixtures();
-        let fields = vec![sort::SortField::<TransformsSortFieldName> {
-            field: TransformsSortFieldName::ComponentKey,
-            direction: sort::Direction::Asc,
-        }];
-        sort::by_fields(&mut transforms, &fields);
-
-        for (i, component_id) in ["append", "field_adder", "parse_json"].iter().enumerate() {
-            assert_eq!(transforms[i].get_component_key().to_string(), *component_id);
-        }
-    }
-
-    #[test]
-    fn sort_component_id_desc() {
-        let mut transforms = transform_fixtures();
-        let fields = vec![sort::SortField::<TransformsSortFieldName> {
-            field: TransformsSortFieldName::ComponentKey,
-            direction: sort::Direction::Desc,
-        }];
-        sort::by_fields(&mut transforms, &fields);
-
-        for (i, component_id) in ["parse_json", "field_adder", "append"].iter().enumerate() {
-            assert_eq!(transforms[i].get_component_key().to_string(), *component_id);
-        }
-    }
-
-    #[test]
-    fn sort_component_type_asc() {
-        let mut transforms = transform_fixtures();
-        let fields = vec![sort::SortField::<TransformsSortFieldName> {
-            field: TransformsSortFieldName::ComponentType,
-            direction: sort::Direction::Asc,
-        }];
-        sort::by_fields(&mut transforms, &fields);
-
-        for (i, component_id) in ["field_adder", "append", "parse_json"].iter().enumerate() {
-            assert_eq!(transforms[i].get_component_key().to_string(), *component_id);
-        }
-    }
-
-    #[test]
-    fn sort_component_type_desc() {
-        let mut transforms = transform_fixtures();
-        let fields = vec![sort::SortField::<TransformsSortFieldName> {
-            field: TransformsSortFieldName::ComponentType,
-            direction: sort::Direction::Desc,
-        }];
-        sort::by_fields(&mut transforms, &fields);
-
-        for (i, component_id) in ["parse_json", "append", "field_adder"].iter().enumerate() {
-            assert_eq!(transforms[i].get_component_key().to_string(), *component_id);
-        }
-    }
-}
diff --git a/src/api/schema/events/encoding.rs b/src/api/schema/events/encoding.rs
deleted file mode 100644
index 4b455b5e2a2fc..0000000000000
--- a/src/api/schema/events/encoding.rs
+++ /dev/null
@@ -1,9 +0,0 @@
-use async_graphql::Enum;
-
-#[derive(Enum, Copy, Clone, PartialEq, Eq)]
-/// Encoding format for the event
-pub enum EventEncodingType {
-    Json,
-    Yaml,
-    Logfmt,
-}
diff --git a/src/api/schema/events/log.rs b/src/api/schema/events/log.rs
deleted file mode 100644
index a06a3ff5f5eab..0000000000000
--- a/src/api/schema/events/log.rs
+++ /dev/null
@@ -1,77 +0,0 @@
-use std::borrow::Cow;
-
-use async_graphql::Object;
-use chrono::{DateTime, Utc};
-use vector_lib::{encode_logfmt, event, tap::topology::TapOutput};
-use vrl::event_path;
-
-use super::EventEncodingType;
-
-#[derive(Debug, Clone)]
-pub struct Log {
-    output: TapOutput,
-    event: event::LogEvent,
-}
-
-impl Log {
-    pub const fn new(output: TapOutput, event: event::LogEvent) -> Self {
-        Self { output, event }
-    }
-
-    pub fn get_message(&self) -> Option<Cow<'_, str>> {
-        Some(self.event.get(event_path!("message"))?.to_string_lossy())
-    }
-
-    pub fn get_timestamp(&self) -> Option<&DateTime<Utc>> {
-        self.event.get(event_path!("timestamp"))?.as_timestamp()
-    }
-}
-
-#[Object]
-/// Log event with fields for querying log data
-impl Log {
-    /// Id of the component associated with the log event
-    async fn component_id(&self) -> &str {
-        self.output.output_id.component.id()
-    }
-
-    /// Type of component associated with the log event
-    async fn component_type(&self) -> &str {
-        self.output.component_type.as_ref()
-    }
-
-    /// Kind of component associated with the log event
-    async fn component_kind(&self) -> &str {
-        self.output.component_kind
-    }
-
-    /// Log message
-    async fn message(&self) -> Option<String> {
-        self.get_message().map(Into::into)
-    }
-
-    /// Log timestamp
-    async fn timestamp(&self) -> Option<&DateTime<Utc>> {
-        self.get_timestamp()
-    }
-
-    /// Log event as an encoded string format
-    async fn string(&self, encoding: EventEncodingType) -> String {
-        match encoding {
-            EventEncodingType::Json => serde_json::to_string(&self.event)
-                .expect("JSON serialization of log event failed. Please report."),
-            EventEncodingType::Yaml => serde_yaml::to_string(&self.event)
-                .expect("YAML serialization of log event failed. Please report."),
-            EventEncodingType::Logfmt => encode_logfmt::encode_value(self.event.value())
-                .expect("logfmt serialization of log event failed. Please report."),
-        }
-    }
-
-    /// Get JSON field data on the log event, by field name
-    async fn json(&self, field: String) -> Option<String> {
-        self.event.get(event_path!(field.as_str())).map(|field| {
-            serde_json::to_string(field)
-                .expect("JSON serialization of trace event field failed. Please report.")
-        })
-    }
-}
diff --git a/src/api/schema/events/metric.rs b/src/api/schema/events/metric.rs
deleted file mode 100644
index b9ae2a31a3d27..0000000000000
--- a/src/api/schema/events/metric.rs
+++ /dev/null
@@ -1,139 +0,0 @@
-use async_graphql::{Enum, Object};
-use chrono::{DateTime, Utc};
-use serde_json::Value;
-use vector_lib::{encode_logfmt, event, tap::topology::TapOutput};
-
-use super::EventEncodingType;
-
-#[derive(Debug, Clone)]
-pub struct Metric {
-    output: TapOutput,
-    event: event::Metric,
-}
-
-impl Metric {
-    pub const fn new(output: TapOutput, event: event::Metric) -> Self {
-        Self { output, event }
-    }
-}
-
-#[derive(Copy, Clone, Debug, PartialEq, Eq, Enum)]
-enum MetricKind {
-    /// Incremental metrics update previous values
-    Incremental,
-    /// Absolute metrics set the reference value for future updates
-    Absolute,
-}
-
-impl From<event::MetricKind> for MetricKind {
-    fn from(kind: event::MetricKind) -> Self {
-        match kind {
-            event::MetricKind::Incremental => Self::Incremental,
-            event::MetricKind::Absolute => Self::Absolute,
-        }
-    }
-}
-
-struct MetricTag {
-    key: String,
-    value: String,
-}
-
-#[Object]
-impl MetricTag {
-    /// Metric tag key
-    async fn key(&self) -> &str {
-        self.key.as_ref()
-    }
-
-    /// Metric tag value
-    async fn value(&self) -> &str {
-        self.value.as_ref()
-    }
-}
-
-#[Object]
-/// Metric event with fields for querying metric data
-impl Metric {
-    /// Id of the component associated with the metric event
-    async fn component_id(&self) -> &str {
-        self.output.output_id.component.id()
-    }
-
-    /// Type of component associated with the metric event
-    async fn component_type(&self) -> &str {
-        self.output.component_type.as_ref()
-    }
-
-    /// Kind of component associated with the metric event
-    async fn component_kind(&self) -> &str {
-        self.output.component_kind
-    }
-
-    /// Metric timestamp
-    async fn timestamp(&self) -> Option<&DateTime<Utc>> {
-        self.event.data().timestamp()
-    }
-
-    /// Metric name
-    async fn name(&self) -> &str {
-        self.event.name()
-    }
-
-    /// Metric namespace
-    async fn namespace(&self) -> Option<&str> {
-        self.event.namespace()
-    }
-
-    /// Metric kind
-    async fn kind(&self) -> MetricKind {
-        self.event.kind().into()
-    }
-
-    /// Metric type
-    async fn value_type(&self) -> &str {
-        self.event.value().as_name()
-    }
-
-    /// Metric value in human readable form
-    async fn value(&self) -> String {
-        self.event.value().to_string()
-    }
-
-    /// Metric tags
-    async fn tags(&self) -> Option<Vec<MetricTag>> {
-        self.event.tags().map(|tags| {
-            tags.iter_single()
-                .map(|(key, value)| MetricTag {
-                    key: key.to_owned(),
-                    value: value.to_owned(),
-                })
-                .collect()
-        })
-    }
-
-    /// Metric event as an encoded string format
-    async fn string(&self, encoding: EventEncodingType) -> String {
-        match encoding {
-            EventEncodingType::Json => serde_json::to_string(&self.event)
-                .expect("JSON serialization of metric event failed. Please report."),
-            EventEncodingType::Yaml => serde_yaml::to_string(&self.event)
-                .expect("YAML serialization of metric event failed. Please report."),
-            EventEncodingType::Logfmt => {
-                let json = serde_json::to_value(&self.event)
-                    .expect("logfmt serialization of metric event failed: conversion to serde Value failed. Please report.");
-                match json {
-                    Value::Object(map) => encode_logfmt::encode_map(
-                        &map.into_iter()
-                            .map(|(k, v)| (event::KeyString::from(k), v))
-                            .collect(),
-                    )
-                    .expect("logfmt serialization of metric event failed. Please report."),
-                    _ => panic!(
-                        "logfmt serialization of metric event failed: metric converted to unexpected serde Value. Please report."
-                    ),
-                }
-            }
-        }
-    }
-}
diff --git a/src/api/schema/events/mod.rs b/src/api/schema/events/mod.rs
deleted file mode 100644
index 9bebbdc194351..0000000000000
--- a/src/api/schema/events/mod.rs
+++ /dev/null
@@ -1,157 +0,0 @@
-pub mod encoding;
-pub mod log;
-pub mod metric;
-pub mod output;
-pub mod trace;
-
-use std::time::{SystemTime, UNIX_EPOCH};
-
-use async_graphql::{Context, Subscription};
-use encoding::EventEncodingType;
-use futures::{Stream, StreamExt, stream};
-use output::{OutputEventsPayload, from_tap_payload_to_output_events};
-use rand::{Rng, SeedableRng, rngs::SmallRng};
-use tokio::{select, sync::mpsc, time};
-use tokio_stream::wrappers::ReceiverStream;
-use vector_lib::tap::{
-    controller::{TapController, TapPatterns},
-    topology::WatchRx,
-};
-
-#[derive(Debug, Default)]
-pub struct EventsSubscription;
-
-#[Subscription]
-impl EventsSubscription {
-    /// A stream of events emitted from matched component ID patterns
-    pub async fn output_events_by_component_id_patterns<'a>(
-        &'a self,
-        ctx: &'a Context<'a>,
-        outputs_patterns: Vec<String>,
-        inputs_patterns: Option<Vec<String>>,
-        #[graphql(default = 500)] interval: u32,
-        #[graphql(default = 100, validator(minimum = 1, maximum = 10_000))] limit: u32,
-    ) -> impl Stream<Item = Vec<OutputEventsPayload>> + 'a {
-        let watch_rx = ctx.data_unchecked::<WatchRx>().clone();
-
-        let patterns = TapPatterns {
-            for_outputs: outputs_patterns.into_iter().collect(),
-            for_inputs: inputs_patterns.unwrap_or_default().into_iter().collect(),
-        };
-        // Client input is confined to `u32` to provide sensible bounds.
-        create_events_stream(watch_rx, patterns, interval as u64, limit as usize)
-    }
-}
-
-/// Creates an events stream based on component ids, and a provided interval. Will emit
-/// control messages that bubble up the application if the sink goes away. The stream contains
-/// all matching events; filtering should be done at the caller level.
-pub(crate) fn create_events_stream(
-    watch_rx: WatchRx,
-    patterns: TapPatterns,
-    interval: u64,
-    limit: usize,
-) -> impl Stream<Item = Vec<OutputEventsPayload>> {
-    // Channel for receiving individual tap payloads. Since we can process at most `limit` per
-    // interval, this is capped to the same value.
-    let (tap_tx, tap_rx) = mpsc::channel(limit);
-    let mut tap_rx = ReceiverStream::new(tap_rx)
-        .flat_map(|payload| stream::iter(from_tap_payload_to_output_events(payload)));
-
-    // The resulting vector of `Event` sent to the client. Only one result set will be streamed
-    // back to the client at a time. This value is set higher than `1` to prevent blocking the event
-    // pipeline on slower client connections, but low enough to apply a modest cap on mem usage.
-    let (event_tx, event_rx) = mpsc::channel::<Vec<OutputEventsPayload>>(10);
-
-    tokio::spawn(async move {
-        // Create a tap controller. When this drops out of scope, clean up will be performed on the
-        // event handlers and topology observation that the tap controller provides.
-        let _tap_controller = TapController::new(watch_rx, tap_tx, patterns);
-
-        // A tick interval to represent when to 'cut' the results back to the client.
-        let mut interval = time::interval(time::Duration::from_millis(interval));
-
-        // Temporary structure to hold sortable values of `Event`.
-        struct SortableOutputEventsPayload {
-            batch: usize,
-            payload: OutputEventsPayload,
-        }
-
-        // Collect a vector of results, with a capacity of `limit`. As new `Event`s come in,
-        // they will be sampled and added to results.
-        let mut results = Vec::<SortableOutputEventsPayload>::with_capacity(limit);
-
-        // Random number generator to allow for sampling. Speed trumps cryptographic security here.
-        // The RNG must be Send + Sync to use with the `select!` loop below, hence `SmallRng`.
-        let seed = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .unwrap()
-            .as_nanos() as u64;
-        let mut rng = SmallRng::seed_from_u64(seed);
-
-        // Keep a count of the batch size, which will be used as a seed for random eviction
-        // per the sampling strategy used below.
-        let mut batch = 0;
-
-        loop {
-            select! {
-                // Process `TapPayload`s. A tap payload could contain log/metric events or a
-                // notification. Notifications are emitted immediately; events buffer until
-                // the next `interval`.
-                Some(payload) = tap_rx.next() => {
-                    // Emit notifications immediately; these don't count as a 'batch'.
-                    if let OutputEventsPayload::Notification(_) = payload {
-                        // If an error occurs when sending, the subscription has likely gone
-                        // away. Break the loop to terminate the thread.
-                        if let Err(err) = event_tx.send(vec![payload]).await {
-                            debug!(message = "Couldn't send notification.", error = ?err);
-                            break;
-                        }
-                    } else {
-                        // Wrap tap in a 'sortable' wrapper, using the batch as a key, to
-                        // re-sort after random eviction.
-                        let payload = SortableOutputEventsPayload { batch, payload };
-
-                        // A simple implementation of "Algorithm R" per
-                        // https://en.wikipedia.org/wiki/Reservoir_sampling. As we're unable to
-                        // pluck the nth result, this is chosen over the more optimal "Algorithm L"
-                        // since discarding results isn't an option.
-                        if limit > results.len() {
-                            results.push(payload);
-                        } else {
-                            let random_number = rng.random_range(0..batch);
-                            if random_number < results.len() {
-                                results[random_number] = payload;
-                            }
-                        }
-                        // Increment the batch count, to be used for the next Algo R loop.
-                        batch += 1;
-                    }
-                }
-                _ = interval.tick() => {
-                    // If there are any existing results after the interval tick, emit.
-                    if !results.is_empty() {
-                        // Reset the batch count, to adjust sampling probability for the next round.
-                        batch = 0;
-
-                        // Since events will appear out of order per the random sampling
-                        // strategy, drain the existing results and sort by timestamp.
-                        results.sort_by_key(|r| r.batch);
-                        let results = results.drain(..)
-                            .map(|r| r.payload)
-                            .collect();
-
-                        // If we get an error here, it likely means that the subscription has
-                        // gone has away. This is a valid/common situation.
-                        if let Err(err) = event_tx.send(results).await {
-                            debug!(message = "Couldn't send events.", error = ?err);
-                            break;
-                        }
-                    }
-                }
-            }
-        }
-    });
-
-    ReceiverStream::new(event_rx)
-}
diff --git a/src/api/schema/events/output.rs b/src/api/schema/events/output.rs
deleted file mode 100644
index de54bfefaad39..0000000000000
--- a/src/api/schema/events/output.rs
+++ /dev/null
@@ -1,70 +0,0 @@
-use async_graphql::{Object, Union};
-use vector_lib::tap::{controller::TapPayload, notification::Notification};
-
-use crate::api::schema::events::{log::Log, metric::Metric, trace::Trace};
-
-/// This wrapper struct hoists `message` up from [`Notification`] for a more
-/// natural querying experience. While ideally [`Notification`] would be a
-/// GraphQL interface with a common `message` field, an interface cannot be
-/// directly nested into the union of [`super::OutputEventsPayload`].
-///
-/// The GraphQL specification forbids such a nesting:
-/// <http://spec.graphql.org/October2021/#sel-HAHdfFDABABkG3_I>
-#[derive(Debug, Clone)]
-pub struct EventNotification {
-    pub notification: Notification,
-}
-
-#[Object]
-/// A notification regarding events observation
-impl EventNotification {
-    /// Notification details
-    async fn notification(&self) -> &Notification {
-        &self.notification
-    }
-
-    /// The human-readable message associated with the notification
-    async fn message(&self) -> &str {
-        self.notification.as_str()
-    }
-}
-
-#[derive(Union, Debug, Clone)]
-#[allow(clippy::large_enum_variant)]
-/// An event or a notification
-pub enum OutputEventsPayload {
-    /// Log event
-    Log(Log),
-
-    /// Metric event
-    Metric(Metric),
-
-    // Notification
-    Notification(EventNotification),
-
-    /// Trace event
-    Trace(Trace),
-}
-
-/// Convert an `api::TapPayload` to the equivalent GraphQL type.
-pub(crate) fn from_tap_payload_to_output_events(t: TapPayload) -> Vec<OutputEventsPayload> {
-    match t {
-        TapPayload::Log(output, log_array) => log_array
-            .into_iter()
-            .map(|log| OutputEventsPayload::Log(Log::new(output.clone(), log)))
-            .collect(),
-        TapPayload::Metric(output, metric_array) => metric_array
-            .into_iter()
-            .map(|metric| OutputEventsPayload::Metric(Metric::new(output.clone(), metric)))
-            .collect(),
-        TapPayload::Notification(notification) => {
-            vec![OutputEventsPayload::Notification(EventNotification {
-                notification,
-            })]
-        }
-        TapPayload::Trace(output, trace_array) => trace_array
-            .into_iter()
-            .map(|trace| OutputEventsPayload::Trace(Trace::new(output.clone(), trace)))
-            .collect(),
-    }
-}
diff --git a/src/api/schema/events/trace.rs b/src/api/schema/events/trace.rs
deleted file mode 100644
index 35b697b351a9e..0000000000000
--- a/src/api/schema/events/trace.rs
+++ /dev/null
@@ -1,56 +0,0 @@
-use async_graphql::Object;
-use vector_lib::{encode_logfmt, event, tap::topology::TapOutput};
-use vrl::event_path;
-
-use super::EventEncodingType;
-
-#[derive(Debug, Clone)]
-pub struct Trace {
-    output: TapOutput,
-    event: event::TraceEvent,
-}
-
-impl Trace {
-    pub const fn new(output: TapOutput, event: event::TraceEvent) -> Self {
-        Self { output, event }
-    }
-}
-
-#[Object]
-/// Trace event with fields for querying trace data
-impl Trace {
-    /// Id of the component associated with the trace event
-    async fn component_id(&self) -> &str {
-        self.output.output_id.component.id()
-    }
-
-    /// Type of component associated with the trace event
-    async fn component_type(&self) -> &str {
-        self.output.component_type.as_ref()
-    }
-
-    /// Kind of component associated with the trace event
-    async fn component_kind(&self) -> &str {
-        self.output.component_kind
-    }
-
-    /// Trace event as an encoded string format
-    async fn string(&self, encoding: EventEncodingType) -> String {
-        match encoding {
-            EventEncodingType::Json => serde_json::to_string(&self.event)
-                .expect("JSON serialization of log event failed. Please report."),
-            EventEncodingType::Yaml => serde_yaml::to_string(&self.event)
-                .expect("YAML serialization of log event failed. Please report."),
-            EventEncodingType::Logfmt => encode_logfmt::encode_map(self.event.as_map())
-                .expect("logfmt serialization of log event failed. Please report."),
-        }
-    }
-
-    /// Get JSON field data on the trace event, by field name
-    async fn json(&self, field: String) -> Option<String> {
-        self.event.get(event_path!(field.as_str())).map(|field| {
-            serde_json::to_string(field)
-                .expect("JSON serialization of log event field failed. Please report.")
-        })
-    }
-}
diff --git a/src/api/schema/filter.rs b/src/api/schema/filter.rs
deleted file mode 100644
index ac8f7f551d2ae..0000000000000
--- a/src/api/schema/filter.rs
+++ /dev/null
@@ -1,219 +0,0 @@
-use std::collections::BTreeSet;
-
-use async_graphql::{InputObject, InputType};
-
-use super::components::{ComponentKind, source};
-
-/// Takes an `&Option<bool>` and returns early if false
-#[macro_export]
-macro_rules! filter_check {
-    ($($match:expr_2021),+) => {
-        $(
-            if matches!($match, Some(t) if !t) {
-                return false;
-            }
-        )+
-    }
-}
-
-#[derive(Default, InputObject)]
-/// Filter for String values
-pub struct StringFilter {
-    pub equals: Option<String>,
-    pub not_equals: Option<String>,
-    pub contains: Option<String>,
-    pub not_contains: Option<String>,
-    pub starts_with: Option<String>,
-    pub ends_with: Option<String>,
-}
-
-impl StringFilter {
-    pub fn filter_value(&self, value: &str) -> bool {
-        filter_check!(
-            // Equals
-            self.equals.as_ref().map(|s| value.eq(s)),
-            // Not equals
-            self.not_equals.as_ref().map(|s| !value.eq(s)),
-            // Contains
-            self.contains.as_ref().map(|s| value.contains(s)),
-            // Does not contain
-            self.not_contains.as_ref().map(|s| !value.contains(s)),
-            // Starts with
-            self.starts_with.as_ref().map(|s| value.starts_with(s)),
-            // Ends with
-            self.ends_with.as_ref().map(|s| value.ends_with(s))
-        );
-        true
-    }
-}
-
-#[derive(InputObject)]
-#[graphql(concrete(name = "SourceOutputTypeFilter", params(source::SourceOutputType)))]
-// Filter for GraphQL lists
-pub struct ListFilter<T: InputType + PartialEq + Eq + Ord> {
-    pub equals: Option<Vec<T>>,
-    pub not_equals: Option<Vec<T>>,
-    pub contains: Option<T>,
-    pub not_contains: Option<T>,
-}
-
-impl<T: InputType + PartialEq + Eq + Ord> ListFilter<T> {
-    pub fn filter_value(&self, value: Vec<T>) -> bool {
-        let val = BTreeSet::from_iter(value.iter());
-        filter_check!(
-            // Equals
-            self.equals
-                .as_ref()
-                .map(|s| BTreeSet::from_iter(s.iter()).eq(&val)),
-            // Not Equals
-            self.not_equals
-                .as_ref()
-                .map(|s| !BTreeSet::from_iter(s.iter()).eq(&val)),
-            // Contains
-            self.contains.as_ref().map(|s| val.contains(s)),
-            // Not Contains
-            self.not_contains.as_ref().map(|s| !val.contains(s))
-        );
-        true
-    }
-}
-
-#[derive(InputObject)]
-#[graphql(concrete(name = "ComponentKindFilter", params(ComponentKind)))]
-pub struct EqualityFilter<T: InputType + PartialEq + Eq> {
-    pub equals: Option<T>,
-    pub not_equals: Option<T>,
-}
-
-impl<T: InputType + PartialEq + Eq> EqualityFilter<T> {
-    pub fn filter_value(&self, value: T) -> bool {
-        filter_check!(
-            // Equals
-            self.equals.as_ref().map(|s| value.eq(s)),
-            // Not equals
-            self.not_equals.as_ref().map(|s| !value.eq(s))
-        );
-        true
-    }
-}
-
-/// CustomFilter trait to determine whether to include/exclude fields based on matches.
-pub trait CustomFilter<T> {
-    fn matches(&self, item: &T) -> bool;
-    fn or(&self) -> Option<&Vec<Self>>
-    where
-        Self: Sized;
-}
-
-/// Returns true if a provided `Item` passes all 'AND' or 'OR' filter rules, recursively.
-fn filter_item<Item, Filter>(item: &Item, f: &Filter) -> bool
-where
-    Filter: CustomFilter<Item>,
-{
-    f.matches(item)
-        || f.or()
-            .map_or_else(|| false, |f| f.iter().any(|f| filter_item(item, f)))
-}
-
-/// Filters items based on an implementation of `CustomFilter<T>`.
-pub fn filter_items<Item, Iter, Filter>(items: Iter, f: &Filter) -> Vec<Item>
-where
-    Iter: Iterator<Item = Item>,
-    Filter: CustomFilter<Item>,
-{
-    items.filter(|c| filter_item(c, f)).collect()
-}
-
-#[cfg(test)]
-mod test {
-    use super::StringFilter;
-
-    #[test]
-    fn string_equals() {
-        let value = "test";
-
-        let sf = StringFilter {
-            equals: value.to_string().into(),
-            ..Default::default()
-        };
-
-        assert!(sf.filter_value(value));
-        assert!(!sf.filter_value("not found"));
-    }
-
-    #[test]
-    fn string_not_equals() {
-        let value = "value";
-        let diff_value = "different value";
-
-        let sf = StringFilter {
-            not_equals: diff_value.to_string().into(),
-            ..Default::default()
-        };
-
-        assert!(sf.filter_value(value));
-        assert!(!sf.filter_value(diff_value));
-    }
-
-    #[test]
-    fn string_contains() {
-        let sf = StringFilter {
-            contains: "234".to_string().into(),
-            ..Default::default()
-        };
-
-        assert!(sf.filter_value("12345"));
-        assert!(!sf.filter_value("xxx"));
-    }
-
-    #[test]
-    fn string_not_contains() {
-        let contains = "xyz";
-
-        let sf = StringFilter {
-            not_contains: contains.to_string().into(),
-            ..Default::default()
-        };
-
-        assert!(sf.filter_value("abc"));
-        assert!(!sf.filter_value(contains));
-    }
-
-    #[test]
-    fn string_starts_with() {
-        let sf = StringFilter {
-            starts_with: "abc".to_string().into(),
-            ..Default::default()
-        };
-
-        assert!(sf.filter_value("abcdef"));
-        assert!(!sf.filter_value("xyz"));
-    }
-
-    #[test]
-    fn string_ends_with() {
-        let sf = StringFilter {
-            ends_with: "456".to_string().into(),
-            ..Default::default()
-        };
-
-        assert!(sf.filter_value("123456"));
-        assert!(!sf.filter_value("123"));
-    }
-
-    #[test]
-    fn string_multiple_all_match() {
-        let value = "123456";
-        let sf = StringFilter {
-            equals: value.to_string().into(),
-            not_equals: "xyz".to_string().into(),
-            contains: "234".to_string().into(),
-            not_contains: "678".to_string().into(),
-            starts_with: "123".to_string().into(),
-            ends_with: "456".to_string().into(),
-        };
-
-        assert!(sf.filter_value(value));
-        assert!(!sf.filter_value("should fail"));
-    }
-}
diff --git a/src/api/schema/gen.rs b/src/api/schema/gen.rs
deleted file mode 100644
index c359f0db3b640..0000000000000
--- a/src/api/schema/gen.rs
+++ /dev/null
@@ -1,116 +0,0 @@
-use std::fs;
-
-use indoc::indoc;
-use vector::api::build_schema;
-
-static INTROSPECTION_QUERY: &str = indoc! {r#"
-    query IntrospectionQuery {
-      __schema {
-        queryType {
-          name
-        }
-        mutationType {
-          name
-        }
-        subscriptionType {
-          name
-        }
-        types {
-          ...FullType
-        }
-        directives {
-          name
-          description
-          locations
-          args {
-            ...InputValue
-          }
-        }
-      }
-    }
-    fragment FullType on __Type {
-      kind
-      name
-      description
-      fields(includeDeprecated: true) {
-        name
-        description
-        args {
-          ...InputValue
-        }
-        type {
-          ...TypeRef
-        }
-        isDeprecated
-        deprecationReason
-      }
-      inputFields {
-        ...InputValue
-      }
-      interfaces {
-        ...TypeRef
-      }
-      enumValues(includeDeprecated: true) {
-        name
-        description
-        isDeprecated
-        deprecationReason
-      }
-      possibleTypes {
-        ...TypeRef
-      }
-    }
-    fragment InputValue on __InputValue {
-      name
-      description
-      type {
-        ...TypeRef
-      }
-      defaultValue
-    }
-    fragment TypeRef on __Type {
-      kind
-      name
-      ofType {
-        kind
-        name
-        ofType {
-          kind
-          name
-          ofType {
-            kind
-            name
-            ofType {
-              kind
-              name
-              ofType {
-                kind
-                name
-                ofType {
-                  kind
-                  name
-                  ofType {
-                    kind
-                    name
-                  }
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-"#};
-
-#[tokio::main]
-async fn main() {
-    let schema = build_schema().finish();
-    let res = schema.execute(INTROSPECTION_QUERY).await;
-    let json = serde_json::to_string_pretty(&res).unwrap();
-
-    fs::write(
-        "lib/vector-api-client/graphql/schema.json",
-        format!("{json}\n"),
-    )
-    .expect("Couldn't save schema file");
-}
diff --git a/src/api/schema/health.rs b/src/api/schema/health.rs
deleted file mode 100644
index 0ee3d1d897cb1..0000000000000
--- a/src/api/schema/health.rs
+++ /dev/null
@@ -1,43 +0,0 @@
-use async_graphql::{Object, SimpleObject, Subscription};
-use chrono::{DateTime, Utc};
-use tokio::time::Duration;
-use tokio_stream::{Stream, StreamExt, wrappers::IntervalStream};
-
-#[derive(SimpleObject)]
-pub struct Heartbeat {
-    utc: DateTime<Utc>,
-}
-
-impl Heartbeat {
-    fn new() -> Self {
-        Heartbeat { utc: Utc::now() }
-    }
-}
-
-#[derive(Default)]
-pub(super) struct HealthQuery;
-
-#[Object]
-impl HealthQuery {
-    /// Returns `true` to denote the GraphQL server is reachable
-    async fn health(&self) -> bool {
-        true
-    }
-}
-
-#[derive(Default)]
-pub struct HealthSubscription;
-
-#[Subscription]
-impl HealthSubscription {
-    /// Heartbeat, containing the UTC timestamp of the last server-sent payload
-    async fn heartbeat(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Heartbeat> + use<> {
-        IntervalStream::new(tokio::time::interval(Duration::from_millis(
-            interval as u64,
-        )))
-        .map(|_| Heartbeat::new())
-    }
-}
diff --git a/src/api/schema/meta.rs b/src/api/schema/meta.rs
deleted file mode 100644
index 76cbf2749c225..0000000000000
--- a/src/api/schema/meta.rs
+++ /dev/null
@@ -1,27 +0,0 @@
-use async_graphql::Object;
-
-#[derive(Default)]
-pub struct Meta;
-
-#[Object]
-impl Meta {
-    /// Vector version
-    async fn version_string(&self) -> String {
-        crate::get_version()
-    }
-
-    /// Hostname
-    async fn hostname(&self) -> Option<String> {
-        crate::get_hostname().ok()
-    }
-}
-
-#[derive(Default)]
-pub struct MetaQuery;
-
-#[Object]
-impl MetaQuery {
-    async fn meta(&self) -> Meta {
-        Meta
-    }
-}
diff --git a/src/api/schema/metrics/allocated_bytes.rs b/src/api/schema/metrics/allocated_bytes.rs
deleted file mode 100644
index 2f2f93ac833ad..0000000000000
--- a/src/api/schema/metrics/allocated_bytes.rs
+++ /dev/null
@@ -1,71 +0,0 @@
-use async_graphql::Object;
-use chrono::{DateTime, Utc};
-
-use crate::{
-    config::ComponentKey,
-    event::{Metric, MetricValue},
-};
-
-pub struct AllocatedBytes(Metric);
-
-impl AllocatedBytes {
-    pub const fn new(m: Metric) -> Self {
-        Self(m)
-    }
-}
-
-#[Object]
-impl AllocatedBytes {
-    /// Metric timestamp
-    pub async fn timestamp(&self) -> Option<DateTime<Utc>> {
-        self.0.timestamp()
-    }
-
-    /// Allocated bytes
-    pub async fn allocated_bytes(&self) -> f64 {
-        match self.0.value() {
-            MetricValue::Gauge { value } => *value,
-            _ => 0.00,
-        }
-    }
-}
-
-impl From<Metric> for AllocatedBytes {
-    fn from(m: Metric) -> Self {
-        Self(m)
-    }
-}
-
-pub struct ComponentAllocatedBytes {
-    component_key: ComponentKey,
-    metric: Metric,
-}
-
-impl ComponentAllocatedBytes {
-    /// Returns a new `ComponentAllocatedBytes` struct, which is a GraphQL type. The
-    /// component id is hoisted for clear field resolution in the resulting payload
-    pub fn new(metric: Metric) -> Self {
-        let component_key = metric.tag_value("component_id").expect(
-            "Returned a metric without a `component_id`, which shouldn't happen. Please report.",
-        );
-        let component_key = ComponentKey::from(component_key);
-
-        Self {
-            component_key,
-            metric,
-        }
-    }
-}
-
-#[Object]
-impl ComponentAllocatedBytes {
-    /// Component id
-    async fn component_id(&self) -> &str {
-        self.component_key.id()
-    }
-
-    /// Allocated bytes metric
-    async fn metric(&self) -> AllocatedBytes {
-        AllocatedBytes::new(self.metric.clone())
-    }
-}
diff --git a/src/api/schema/metrics/errors.rs b/src/api/schema/metrics/errors.rs
deleted file mode 100644
index acca7b74bdf26..0000000000000
--- a/src/api/schema/metrics/errors.rs
+++ /dev/null
@@ -1,71 +0,0 @@
-use async_graphql::Object;
-use chrono::{DateTime, Utc};
-
-use crate::{
-    config::ComponentKey,
-    event::{Metric, MetricValue},
-};
-
-pub struct ErrorsTotal(Metric);
-
-impl ErrorsTotal {
-    pub const fn new(m: Metric) -> Self {
-        Self(m)
-    }
-}
-
-#[Object]
-impl ErrorsTotal {
-    /// Metric timestamp
-    pub async fn timestamp(&self) -> Option<DateTime<Utc>> {
-        self.0.timestamp()
-    }
-
-    /// Total error count
-    pub async fn errors_total(&self) -> f64 {
-        match self.0.value() {
-            MetricValue::Counter { value } => *value,
-            _ => 0.00,
-        }
-    }
-}
-
-impl From<Metric> for ErrorsTotal {
-    fn from(m: Metric) -> Self {
-        Self(m)
-    }
-}
-
-pub struct ComponentErrorsTotal {
-    component_key: ComponentKey,
-    metric: Metric,
-}
-
-impl ComponentErrorsTotal {
-    /// Returns a new `ComponentErrorsTotal` struct, which is a GraphQL type. The
-    /// component id is hoisted for clear field resolution in the resulting payload
-    pub fn new(metric: Metric) -> Self {
-        let component_key = metric.tag_value("component_id").expect(
-            "Returned a metric without a `component_id`, which shouldn't happen. Please report.",
-        );
-        let component_key = ComponentKey::from(component_key);
-
-        Self {
-            component_key,
-            metric,
-        }
-    }
-}
-
-#[Object]
-impl ComponentErrorsTotal {
-    /// Component id
-    async fn component_id(&self) -> &str {
-        self.component_key.id()
-    }
-
-    /// Errors processed metric
-    async fn metric(&self) -> ErrorsTotal {
-        ErrorsTotal::new(self.metric.clone())
-    }
-}
diff --git a/src/api/schema/metrics/filter.rs b/src/api/schema/metrics/filter.rs
deleted file mode 100644
index c85379edeeff4..0000000000000
--- a/src/api/schema/metrics/filter.rs
+++ /dev/null
@@ -1,397 +0,0 @@
-use std::collections::{BTreeMap, HashSet};
-
-use async_stream::stream;
-use tokio::time::Duration;
-use tokio_stream::{Stream, StreamExt};
-
-use super::{
-    OutputThroughput, ReceivedBytesTotal, ReceivedEventsTotal, SentBytesTotal, SentEventsTotal,
-    filter_output_metric,
-};
-use crate::{
-    config::ComponentKey,
-    event::{Metric, MetricValue},
-    metrics::Controller,
-};
-
-fn get_controller() -> &'static Controller {
-    Controller::get().expect("Metrics system not initialized. Please report.")
-}
-
-/// Sums an iterable of `&Metric`, by folding metric values. Convenience function typically
-/// used to get aggregate metrics.
-pub fn sum_metrics<'a, I: IntoIterator<Item = &'a Metric>>(metrics: I) -> Option<Metric> {
-    let mut iter = metrics.into_iter();
-    let m = iter.next()?;
-
-    Some(iter.fold(
-        m.clone(),
-        |mut m1, m2| {
-            if m1.update(m2) { m1 } else { m2.clone() }
-        },
-    ))
-}
-
-/// Sums an iterable of `Metric`, by folding metric values. Convenience function typically
-/// used to get aggregate metrics.
-fn sum_metrics_owned<I: IntoIterator<Item = Metric>>(metrics: I) -> Option<Metric> {
-    let mut iter = metrics.into_iter();
-    let m = iter.next()?;
-
-    Some(iter.fold(m, |mut m1, m2| if m1.update(&m2) { m1 } else { m2 }))
-}
-
-pub trait MetricsFilter<'a> {
-    fn received_bytes_total(&self) -> Option<ReceivedBytesTotal>;
-    fn received_events_total(&self) -> Option<ReceivedEventsTotal>;
-    fn sent_bytes_total(&self) -> Option<SentBytesTotal>;
-    fn sent_events_total(&self) -> Option<SentEventsTotal>;
-}
-
-impl MetricsFilter<'_> for Vec<Metric> {
-    fn received_bytes_total(&self) -> Option<ReceivedBytesTotal> {
-        let sum = sum_metrics(
-            self.iter()
-                .filter(|m| m.name() == "component_received_bytes_total"),
-        )?;
-
-        Some(ReceivedBytesTotal::new(sum))
-    }
-
-    fn received_events_total(&self) -> Option<ReceivedEventsTotal> {
-        let sum = sum_metrics(
-            self.iter()
-                .filter(|m| m.name() == "component_received_events_total"),
-        )?;
-
-        Some(ReceivedEventsTotal::new(sum))
-    }
-
-    fn sent_bytes_total(&self) -> Option<SentBytesTotal> {
-        let sum = sum_metrics(
-            self.iter()
-                .filter(|m| m.name() == "component_sent_bytes_total"),
-        )?;
-
-        Some(SentBytesTotal::new(sum))
-    }
-
-    fn sent_events_total(&self) -> Option<SentEventsTotal> {
-        let sum = sum_metrics(
-            self.iter()
-                .filter(|m| m.name() == "component_sent_events_total"),
-        )?;
-
-        Some(SentEventsTotal::new(sum))
-    }
-}
-
-impl<'a> MetricsFilter<'a> for Vec<&'a Metric> {
-    fn received_bytes_total(&self) -> Option<ReceivedBytesTotal> {
-        let sum = sum_metrics(
-            self.iter()
-                .filter(|m| m.name() == "component_received_bytes_total")
-                .copied(),
-        )?;
-
-        Some(ReceivedBytesTotal::new(sum))
-    }
-
-    fn received_events_total(&self) -> Option<ReceivedEventsTotal> {
-        let sum = sum_metrics(
-            self.iter()
-                .filter(|m| m.name() == "component_received_events_total")
-                .copied(),
-        )?;
-
-        Some(ReceivedEventsTotal::new(sum))
-    }
-
-    fn sent_bytes_total(&self) -> Option<SentBytesTotal> {
-        let sum = sum_metrics(
-            self.iter()
-                .filter(|m| m.name() == "component_sent_bytes_total")
-                .copied(),
-        )?;
-
-        Some(SentBytesTotal::new(sum))
-    }
-
-    fn sent_events_total(&self) -> Option<SentEventsTotal> {
-        let sum = sum_metrics(
-            self.iter()
-                .filter(|m| m.name() == "component_sent_events_total")
-                .copied(),
-        )?;
-
-        Some(SentEventsTotal::new(sum))
-    }
-}
-
-/// Returns a stream of `Metric`s, collected at the provided millisecond interval.
-pub fn get_metrics(interval: i32) -> impl Stream<Item = Metric> {
-    let controller = get_controller();
-    let mut interval = tokio::time::interval(Duration::from_millis(interval as u64));
-
-    stream! {
-        loop {
-            interval.tick().await;
-            for m in controller.capture_metrics() {
-                yield m;
-            }
-        }
-    }
-}
-
-pub fn get_all_metrics(interval: i32) -> impl Stream<Item = Vec<Metric>> {
-    let controller = get_controller();
-    let mut interval = tokio::time::interval(Duration::from_millis(interval as u64));
-
-    stream! {
-        loop {
-            interval.tick().await;
-            yield controller.capture_metrics()
-        }
-    }
-}
-
-/// Return [`Vec<Metric>`] based on a component id tag.
-pub fn by_component_key(component_key: &ComponentKey) -> Vec<Metric> {
-    get_controller()
-        .capture_metrics()
-        .into_iter()
-        .filter_map(|m| {
-            m.tag_matches("component_id", component_key.id())
-                .then_some(m)
-        })
-        .collect()
-}
-
-type MetricFilterFn = dyn Fn(&Metric) -> bool + Send + Sync;
-
-/// Returns a stream of `Vec<Metric>`, where `metric_name` matches the name of the metric
-/// (e.g. "component_sent_events_total"), and the value is derived from `MetricValue::Counter`. Uses a
-/// local cache to match against the `component_id` of a metric, to return results only when
-/// the value of a current iteration is greater than the previous. This is useful for the client
-/// to be notified as metrics increase without returning 'empty' or identical results.
-pub fn component_counter_metrics(
-    interval: i32,
-    filter_fn: &'static MetricFilterFn,
-) -> impl Stream<Item = Vec<Metric>> {
-    let mut cache = BTreeMap::new();
-
-    component_to_filtered_metrics(interval, filter_fn).map(move |map| {
-        map.into_iter()
-            .filter_map(|(id, metrics)| {
-                let m = sum_metrics_owned(metrics)?;
-                match m.value() {
-                    MetricValue::Counter { value }
-                        if cache.insert(id, *value).unwrap_or(0.00) < *value =>
-                    {
-                        Some(m)
-                    }
-                    _ => None,
-                }
-            })
-            .collect()
-    })
-}
-
-/// Returns a stream of `Vec<Metric>`, where `metric_name` matches the name of the metric
-/// (e.g. "component_sent_events_total"), and the value is derived from `MetricValue::Gauge`. Uses a
-/// local cache to match against the `component_id` of a metric, to return results only when
-/// the value of a current iteration is greater than the previous. This is useful for the client
-/// to be notified as metrics increase without returning 'empty' or identical results.
-pub fn component_gauge_metrics(
-    interval: i32,
-    filter_fn: &'static MetricFilterFn,
-) -> impl Stream<Item = Vec<Metric>> {
-    let mut cache = BTreeMap::new();
-
-    component_to_filtered_metrics(interval, filter_fn).map(move |map| {
-        map.into_iter()
-            .filter_map(|(id, metrics)| {
-                let m = sum_metrics_owned(metrics)?;
-                match m.value() {
-                    MetricValue::Gauge { value }
-                        if cache.insert(id, *value).unwrap_or(0.00) < *value =>
-                    {
-                        Some(m)
-                    }
-                    _ => None,
-                }
-            })
-            .collect()
-    })
-}
-
-/// Returns the throughput of a 'counter' metric, sampled over `interval` milliseconds
-/// and filtered by the provided `filter_fn`.
-pub fn counter_throughput(
-    interval: i32,
-    filter_fn: &'static MetricFilterFn,
-) -> impl Stream<Item = (Metric, f64)> {
-    let mut last = 0.00;
-
-    get_metrics(interval)
-        .filter(filter_fn)
-        .filter_map(move |m| match m.value() {
-            MetricValue::Counter { value } if *value > last => {
-                let throughput = value - last;
-                last = *value;
-                Some((m, throughput))
-            }
-            _ => None,
-        })
-        // Ignore the first, since we only care about sampling between `interval`
-        .skip(1)
-}
-
-/// Returns the throughput of a 'counter' metric, sampled over `interval` milliseconds
-/// and filtered by the provided `filter_fn`, aggregated against each component.
-pub fn component_counter_throughputs(
-    interval: i32,
-    filter_fn: &'static MetricFilterFn,
-) -> impl Stream<Item = Vec<(Metric, f64)>> {
-    let mut cache = BTreeMap::new();
-
-    component_to_filtered_metrics(interval, filter_fn)
-        .map(move |map| {
-            map.into_iter()
-                .filter_map(|(id, metrics)| {
-                    let m = sum_metrics_owned(metrics)?;
-                    match m.value() {
-                        MetricValue::Counter { value } => {
-                            let last = cache.insert(id, *value).unwrap_or(0.00);
-                            let throughput = value - last;
-                            Some((m, throughput))
-                        }
-                        _ => None,
-                    }
-                })
-                .collect()
-        })
-        // Ignore the first, since we only care about sampling between `interval`
-        .skip(1)
-}
-
-/// Returns a stream of `Vec<(Metric, Vec<Metric>)>`, where `Metric` is the
-/// total `component_sent_events_total` metric for a component and `Vec<Metric>`
-/// is the `component_sent_events_total` metric split by output
-pub fn component_sent_events_totals_metrics_with_outputs(
-    interval: i32,
-) -> impl Stream<Item = Vec<(Metric, Vec<Metric>)>> {
-    let mut cache = BTreeMap::new();
-
-    component_to_filtered_metrics(interval, &|m| m.name() == "component_sent_events_total").map(
-        move |map| {
-            map.into_iter()
-                .filter_map(|(id, metrics)| {
-                    let outputs = metrics
-                        .iter()
-                        .filter_map(|m| m.tag_value("output"))
-                        .collect::<HashSet<_>>();
-
-                    let metric_by_outputs = outputs
-                        .iter()
-                        .filter_map(|output| {
-                            let m = filter_output_metric(metrics.as_ref(), output.as_ref())?;
-                            match m.value() {
-                                MetricValue::Counter { value }
-                                    if cache
-                                        .insert(format!("{id}.{output}"), *value)
-                                        .unwrap_or(0.00)
-                                        < *value =>
-                                {
-                                    Some(m)
-                                }
-                                _ => None,
-                            }
-                        })
-                        .collect();
-
-                    let sum = sum_metrics_owned(metrics)?;
-                    match sum.value() {
-                        MetricValue::Counter { value }
-                            if cache.insert(id, *value).unwrap_or(0.00) < *value =>
-                        {
-                            Some((sum, metric_by_outputs))
-                        }
-                        _ => None,
-                    }
-                })
-                .collect()
-        },
-    )
-}
-
-/// Returns the throughput of the 'component_sent_events_total' metric, sampled over `interval` milliseconds,
-/// for each component. Within a particular component, throughput per output stream is also included.
-pub fn component_sent_events_total_throughputs_with_outputs(
-    interval: i32,
-) -> impl Stream<Item = Vec<(ComponentKey, i64, Vec<OutputThroughput>)>> {
-    let mut cache = BTreeMap::new();
-
-    component_to_filtered_metrics(interval, &|m| m.name() == "component_sent_events_total")
-        .map(move |map| {
-            map.into_iter()
-                .filter_map(|(id, metrics)| {
-                    let outputs = metrics
-                        .iter()
-                        .filter_map(|m| m.tag_value("output"))
-                        .collect::<HashSet<_>>();
-
-                    let throughput_by_outputs = outputs
-                        .iter()
-                        .filter_map(|output| {
-                            let m = filter_output_metric(metrics.as_ref(), output.as_ref())?;
-                            let throughput = throughput(&m, format!("{id}.{output}"), &mut cache)?;
-                            Some(OutputThroughput::new(output.clone(), throughput as i64))
-                        })
-                        .collect::<Vec<_>>();
-
-                    let sum = sum_metrics_owned(metrics)?;
-                    let total_throughput = throughput(&sum, id.clone(), &mut cache)?;
-                    Some((
-                        ComponentKey::from(id),
-                        total_throughput as i64,
-                        throughput_by_outputs,
-                    ))
-                })
-                .collect()
-        })
-        // Ignore the first, since we only care about sampling between `interval`
-        .skip(1)
-}
-
-/// Returns a map of Component ID to list of metrics where metrics have been
-/// filtered by `filter_fn`
-fn component_to_filtered_metrics(
-    interval: i32,
-    filter_fn: &'static MetricFilterFn,
-) -> impl Stream<Item = BTreeMap<String, Vec<Metric>>> {
-    get_all_metrics(interval).map(move |m| {
-        m.into_iter()
-            .filter(filter_fn)
-            .filter_map(|m| m.tag_value("component_id").map(|id| (id, m)))
-            .fold(
-                BTreeMap::new(),
-                |mut map: BTreeMap<String, Vec<Metric>>, (id, m)| {
-                    map.entry(id).or_default().push(m);
-                    map
-                },
-            )
-    })
-}
-
-/// Returns throughput based on a metric and provided `cache` of previous values
-fn throughput(metric: &Metric, id: String, cache: &mut BTreeMap<String, f64>) -> Option<f64> {
-    match metric.value() {
-        MetricValue::Counter { value } => {
-            let last = cache.insert(id, *value).unwrap_or(0.00);
-            let throughput = value - last;
-            Some(throughput)
-        }
-        _ => None,
-    }
-}
diff --git a/src/api/schema/metrics/host.rs b/src/api/schema/metrics/host.rs
deleted file mode 100644
index 08a8fbcb973be..0000000000000
--- a/src/api/schema/metrics/host.rs
+++ /dev/null
@@ -1,373 +0,0 @@
-use async_graphql::Object;
-use cfg_if::cfg_if;
-
-use crate::{
-    event::{Metric, MetricValue},
-    sources::host_metrics,
-};
-
-pub struct MemoryMetrics(Vec<Metric>);
-
-#[Object]
-/// Host memory metrics
-impl MemoryMetrics {
-    /// Total bytes
-    async fn total_bytes(&self) -> f64 {
-        filter_host_metric(&self.0, "memory_total_bytes")
-    }
-
-    /// Free bytes
-    async fn free_bytes(&self) -> f64 {
-        filter_host_metric(&self.0, "memory_free_bytes")
-    }
-
-    /// Available bytes
-    async fn available_bytes(&self) -> f64 {
-        filter_host_metric(&self.0, "memory_available_bytes")
-    }
-
-    /// Active bytes (Linux/macOS only)
-    async fn active_bytes(&self) -> Option<f64> {
-        if cfg!(any(target_os = "linux", target_os = "macos")) {
-            Some(filter_host_metric(&self.0, "memory_active_bytes"))
-        } else {
-            None
-        }
-    }
-
-    /// Buffers bytes (Linux only)
-    async fn buffers_bytes(&self) -> Option<f64> {
-        if cfg!(target_os = "linux") {
-            Some(filter_host_metric(&self.0, "memory_buffers_bytes"))
-        } else {
-            None
-        }
-    }
-
-    /// Cached bytes (Linux only)
-    async fn cached_bytes(&self) -> Option<f64> {
-        if cfg!(target_os = "linux") {
-            Some(filter_host_metric(&self.0, "memory_cached_bytes"))
-        } else {
-            None
-        }
-    }
-
-    /// Shared bytes (Linux only)
-    async fn shared_bytes(&self) -> Option<f64> {
-        if cfg!(target_os = "linux") {
-            Some(filter_host_metric(&self.0, "memory_shared_bytes"))
-        } else {
-            None
-        }
-    }
-
-    /// Used bytes (Linux only)
-    async fn used_bytes(&self) -> Option<f64> {
-        if cfg!(target_os = "linux") {
-            Some(filter_host_metric(&self.0, "memory_used_bytes"))
-        } else {
-            None
-        }
-    }
-
-    /// Inactive bytes (macOS only)
-    async fn inactive_bytes(&self) -> Option<f64> {
-        if cfg!(target_os = "macos") {
-            Some(filter_host_metric(&self.0, "memory_inactive_bytes"))
-        } else {
-            None
-        }
-    }
-
-    /// Wired bytes (macOS only)
-    async fn wired_bytes(&self) -> Option<f64> {
-        if cfg!(target_os = "macos") {
-            Some(filter_host_metric(&self.0, "memory_wired_bytes"))
-        } else {
-            None
-        }
-    }
-}
-
-pub struct SwapMetrics(Vec<Metric>);
-
-#[Object]
-impl SwapMetrics {
-    /// Swap free bytes
-    async fn free_bytes(&self) -> f64 {
-        filter_host_metric(&self.0, "memory_swap_free_bytes")
-    }
-
-    /// Swap total bytes
-    async fn total_bytes(&self) -> f64 {
-        filter_host_metric(&self.0, "memory_swap_total_bytes")
-    }
-
-    /// Swap used bytes
-    async fn used_bytes(&self) -> f64 {
-        filter_host_metric(&self.0, "memory_swap_used_bytes")
-    }
-
-    /// Swapped in bytes total (not available on Windows)
-    async fn swapped_in_bytes_total(&self) -> Option<f64> {
-        if cfg!(not(windows)) {
-            Some(filter_host_metric(&self.0, "memory_swapped_in_bytes_total"))
-        } else {
-            None
-        }
-    }
-
-    /// Swapped out bytes total (not available on Windows)
-    async fn swapped_out_bytes_total(&self) -> Option<f64> {
-        if cfg!(not(windows)) {
-            Some(filter_host_metric(
-                &self.0,
-                "memory_swapped_out_bytes_total",
-            ))
-        } else {
-            None
-        }
-    }
-}
-
-pub struct CpuMetrics(Vec<Metric>);
-
-#[Object]
-impl CpuMetrics {
-    /// CPU seconds total
-    async fn cpu_seconds_total(&self) -> f64 {
-        filter_host_metric(&self.0, "cpu_seconds_total")
-    }
-}
-
-pub struct LoadAverageMetrics(Vec<Metric>);
-
-#[Object]
-impl LoadAverageMetrics {
-    /// Load 1 average
-    async fn load1(&self) -> f64 {
-        filter_host_metric(&self.0, "load1")
-    }
-
-    /// Load 5 average
-    async fn load5(&self) -> f64 {
-        filter_host_metric(&self.0, "load5")
-    }
-
-    /// Load 15 average
-    async fn load15(&self) -> f64 {
-        filter_host_metric(&self.0, "load15")
-    }
-}
-
-pub struct NetworkMetrics(Vec<Metric>);
-
-#[Object]
-impl NetworkMetrics {
-    /// Total bytes received
-    async fn receive_bytes_total(&self) -> f64 {
-        filter_host_metric(&self.0, "network_receive_bytes_total")
-    }
-
-    /// Total errors received
-    async fn receive_errs_total(&self) -> f64 {
-        filter_host_metric(&self.0, "network_receive_errs_total")
-    }
-
-    /// Total packets received
-    async fn receive_packets_total(&self) -> f64 {
-        filter_host_metric(&self.0, "network_receive_packets_total")
-    }
-
-    /// Total bytes transmitted
-    async fn transmit_bytes_total(&self) -> f64 {
-        filter_host_metric(&self.0, "network_transmit_bytes_total")
-    }
-
-    /// Total errors transmitted
-    async fn transmit_errs_total(&self) -> f64 {
-        filter_host_metric(&self.0, "network_transmit_errs_total")
-    }
-
-    /// Total transmission packets dropped (Linux/Windows only)
-    async fn transmit_packets_drop_total(&self) -> Option<f64> {
-        if cfg!(any(target_os = "linux", windows)) {
-            Some(filter_host_metric(
-                &self.0,
-                "network_transmit_packets_drop_total",
-            ))
-        } else {
-            None
-        }
-    }
-
-    /// Total transmission packets (Linux/Windows only)
-    async fn transmit_packets_total(&self) -> Option<f64> {
-        if cfg!(any(target_os = "linux", windows)) {
-            Some(filter_host_metric(
-                &self.0,
-                "network_transmit_packets_total",
-            ))
-        } else {
-            None
-        }
-    }
-}
-
-pub struct FileSystemMetrics(Vec<Metric>);
-
-#[Object]
-impl FileSystemMetrics {
-    /// Free bytes
-    async fn free_bytes(&self) -> f64 {
-        filter_host_metric(&self.0, "filesystem_free_bytes")
-    }
-
-    /// Total bytes
-    async fn total_bytes(&self) -> f64 {
-        filter_host_metric(&self.0, "filesystem_total_bytes")
-    }
-
-    /// Used bytes
-    async fn used_bytes(&self) -> f64 {
-        filter_host_metric(&self.0, "filesystem_used_bytes")
-    }
-}
-
-pub struct DiskMetrics(Vec<Metric>);
-
-#[Object]
-impl DiskMetrics {
-    /// Total bytes read
-    async fn read_bytes_total(&self) -> f64 {
-        filter_host_metric(&self.0, "disk_read_bytes_total")
-    }
-
-    /// Total reads completed
-    async fn reads_completed_total(&self) -> f64 {
-        filter_host_metric(&self.0, "disk_reads_completed_total")
-    }
-
-    /// Total bytes written
-    async fn written_bytes_total(&self) -> f64 {
-        filter_host_metric(&self.0, "disk_written_bytes_total")
-    }
-
-    /// Total writes completed
-    async fn writes_completed_total(&self) -> f64 {
-        filter_host_metric(&self.0, "disk_writes_completed_total")
-    }
-}
-
-cfg_if! {
-    if #[cfg(target_os = "linux")] {
-        pub struct TCPMetrics(Vec<Metric>);
-
-        #[Object]
-        impl TCPMetrics {
-            /// Total TCP connections
-            async fn tcp_conns_total(&self) -> f64 {
-                filter_host_metric(&self.0, "tcp_connections_total")
-            }
-
-            /// Total bytes in the send queue across all connections.
-            async fn tcp_tx_queued_bytes_total(&self) -> f64 {
-                filter_host_metric(&self.0, "tcp_tx_queued_bytes_total")
-            }
-
-            /// Total bytes in the receive queue across all connections.
-            async fn tcp_rx_queued_bytes_total(&self) -> f64 {
-                filter_host_metric(&self.0, "tcp_rx_queued_bytes_total")
-            }
-        }
-    }
-}
-
-pub struct HostMetrics(host_metrics::HostMetrics);
-
-impl HostMetrics {
-    /// Primes the host metrics pump by passing through a new `HostMetrics`
-    pub fn new() -> Self {
-        let config = host_metrics::HostMetricsConfig::default();
-        Self(host_metrics::HostMetrics::new(config))
-    }
-}
-
-#[Object]
-/// Vector host metrics
-impl HostMetrics {
-    /// Memory metrics
-    async fn memory(&self) -> MemoryMetrics {
-        let mut buffer = self.0.buffer();
-        self.0.memory_metrics(&mut buffer).await;
-        MemoryMetrics(buffer.metrics)
-    }
-
-    /// Swap metrics
-    async fn swap(&self) -> SwapMetrics {
-        let mut buffer = self.0.buffer();
-        self.0.swap_metrics(&mut buffer).await;
-        SwapMetrics(buffer.metrics)
-    }
-
-    /// CPU metrics
-    async fn cpu(&self) -> CpuMetrics {
-        let mut buffer = self.0.buffer();
-        self.0.cpu_metrics(&mut buffer).await;
-        CpuMetrics(buffer.metrics)
-    }
-
-    /// Load average metrics (*nix only)
-    async fn load_average(&self) -> Option<LoadAverageMetrics> {
-        if cfg!(unix) {
-            let mut buffer = self.0.buffer();
-            self.0.loadavg_metrics(&mut buffer).await;
-            Some(LoadAverageMetrics(buffer.metrics))
-        } else {
-            None
-        }
-    }
-
-    /// Network metrics
-    async fn network(&self) -> NetworkMetrics {
-        let mut buffer = self.0.buffer();
-        self.0.network_metrics(&mut buffer).await;
-        NetworkMetrics(buffer.metrics)
-    }
-
-    /// Filesystem metrics
-    async fn filesystem(&self) -> FileSystemMetrics {
-        let mut buffer = self.0.buffer();
-        self.0.filesystem_metrics(&mut buffer).await;
-        FileSystemMetrics(buffer.metrics)
-    }
-
-    /// Disk metrics
-    async fn disk(&self) -> DiskMetrics {
-        let mut buffer = self.0.buffer();
-        self.0.disk_metrics(&mut buffer).await;
-        DiskMetrics(buffer.metrics)
-    }
-
-    #[cfg(target_os = "linux")]
-    /// TCP metrics
-    async fn tcp(&self) -> TCPMetrics {
-        let mut buffer = self.0.buffer();
-        self.0.tcp_metrics(&mut buffer).await;
-        TCPMetrics(buffer.metrics)
-    }
-}
-
-/// Filters a [`Vec<Metric>`] by name, returning the inner `value` or 0.00 if not found
-fn filter_host_metric(metrics: &[Metric], name: &str) -> f64 {
-    metrics
-        .iter()
-        .find(|m| matches!(m.namespace(), Some(n) if n == "host") && m.name() == name)
-        .map(|m| match m.value() {
-            MetricValue::Gauge { value } => *value,
-            MetricValue::Counter { value } => *value,
-            _ => 0.00,
-        })
-        .unwrap_or_else(|| 0.00)
-}
diff --git a/src/api/schema/metrics/mod.rs b/src/api/schema/metrics/mod.rs
deleted file mode 100644
index 056b3c27a7986..0000000000000
--- a/src/api/schema/metrics/mod.rs
+++ /dev/null
@@ -1,284 +0,0 @@
-mod allocated_bytes;
-mod errors;
-pub mod filter;
-mod output;
-mod received_bytes;
-mod received_events;
-mod sent_bytes;
-mod sent_events;
-mod sink;
-pub mod source;
-mod transform;
-mod uptime;
-
-#[cfg(feature = "sources-host_metrics")]
-mod host;
-
-pub use allocated_bytes::{AllocatedBytes, ComponentAllocatedBytes};
-use async_graphql::{Interface, Subscription};
-use chrono::{DateTime, Utc};
-pub use errors::{ComponentErrorsTotal, ErrorsTotal};
-pub use filter::*;
-pub use output::*;
-pub use received_bytes::{
-    ComponentReceivedBytesThroughput, ComponentReceivedBytesTotal, ReceivedBytesTotal,
-};
-pub use received_events::{
-    ComponentReceivedEventsThroughput, ComponentReceivedEventsTotal, ReceivedEventsTotal,
-};
-pub use sent_bytes::{ComponentSentBytesThroughput, ComponentSentBytesTotal, SentBytesTotal};
-pub use sent_events::{ComponentSentEventsThroughput, ComponentSentEventsTotal, SentEventsTotal};
-pub use sink::{IntoSinkMetrics, SinkMetrics};
-pub use source::{IntoSourceMetrics, SourceMetrics};
-use tokio_stream::{Stream, StreamExt};
-pub use transform::{IntoTransformMetrics, TransformMetrics};
-pub use uptime::Uptime;
-
-use crate::config::ComponentKey;
-
-#[derive(Interface)]
-#[graphql(field(name = "timestamp", ty = "Option<DateTime<Utc>>"))]
-pub enum MetricType {
-    Uptime(Uptime),
-}
-
-#[cfg(feature = "sources-host_metrics")]
-#[derive(Default)]
-pub struct MetricsQuery;
-
-#[cfg(feature = "sources-host_metrics")]
-#[async_graphql::Object]
-impl MetricsQuery {
-    /// Vector host metrics
-    async fn host_metrics(&self) -> host::HostMetrics {
-        host::HostMetrics::new()
-    }
-}
-
-#[derive(Default)]
-pub struct MetricsSubscription;
-
-#[Subscription]
-impl MetricsSubscription {
-    /// Metrics for how long the Vector instance has been running
-    async fn uptime(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Uptime> + use<> {
-        get_metrics(interval).filter_map(|m| match m.name() {
-            "uptime_seconds" => Some(Uptime::new(m)),
-            _ => None,
-        })
-    }
-
-    /// Total received events metrics
-    #[graphql(deprecation = "Use component_received_events_totals instead")]
-    async fn received_events_total(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = ReceivedEventsTotal> + use<> {
-        get_metrics(interval).filter_map(|m| match m.name() {
-            "component_received_events_total" => Some(ReceivedEventsTotal::new(m)),
-            _ => None,
-        })
-    }
-
-    /// Total received events throughput sampled over the provided millisecond `interval`
-    #[graphql(deprecation = "Use component_received_events_throughputs instead")]
-    async fn received_events_throughput(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = i64> + use<> {
-        counter_throughput(interval, &|m| m.name() == "component_received_events_total")
-            .map(|(_, throughput)| throughput as i64)
-    }
-
-    /// Total incoming component events throughput metrics over `interval`
-    async fn component_received_events_throughputs(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Vec<ComponentReceivedEventsThroughput>> + use<> {
-        component_counter_throughputs(interval, &|m| m.name() == "component_received_events_total")
-            .map(|m| {
-                m.into_iter()
-                    .map(|(m, throughput)| {
-                        ComponentReceivedEventsThroughput::new(
-                            ComponentKey::from(m.tag_value("component_id").unwrap()),
-                            throughput as i64,
-                        )
-                    })
-                    .collect()
-            })
-    }
-
-    /// Total received component event metrics over `interval`
-    async fn component_received_events_totals(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Vec<ComponentReceivedEventsTotal>> + use<> {
-        component_counter_metrics(interval, &|m| m.name() == "component_received_events_total").map(
-            |m| {
-                m.into_iter()
-                    .map(ComponentReceivedEventsTotal::new)
-                    .collect()
-            },
-        )
-    }
-
-    /// Total sent events metrics
-    #[graphql(deprecation = "Use component_sent_events_totals instead")]
-    async fn sent_events_total(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = SentEventsTotal> + use<> {
-        get_metrics(interval).filter_map(|m| match m.name() {
-            "component_sent_events_total" => Some(SentEventsTotal::new(m)),
-            _ => None,
-        })
-    }
-
-    /// Total outgoing events throughput sampled over the provided millisecond `interval`
-    #[graphql(deprecation = "Use component_sent_events_throughputs instead")]
-    async fn sent_events_throughput(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = i64> + use<> {
-        counter_throughput(interval, &|m| m.name() == "component_sent_events_total")
-            .map(|(_, throughput)| throughput as i64)
-    }
-
-    /// Total outgoing component event throughput metrics over `interval`
-    async fn component_sent_events_throughputs(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Vec<ComponentSentEventsThroughput>> + use<> {
-        component_sent_events_total_throughputs_with_outputs(interval).map(|m| {
-            m.into_iter()
-                .map(|(key, total_throughput, outputs)| {
-                    ComponentSentEventsThroughput::new(key, total_throughput, outputs)
-                })
-                .collect()
-        })
-    }
-
-    /// Total outgoing component event metrics over `interval`
-    async fn component_sent_events_totals(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Vec<ComponentSentEventsTotal>> + use<> {
-        component_sent_events_totals_metrics_with_outputs(interval).map(|ms| {
-            ms.into_iter()
-                .map(|(m, m_by_outputs)| ComponentSentEventsTotal::new(m, m_by_outputs))
-                .collect()
-        })
-    }
-
-    /// Component bytes received metrics over `interval`.
-    async fn component_received_bytes_totals(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Vec<ComponentReceivedBytesTotal>> + use<> {
-        component_counter_metrics(interval, &|m| m.name() == "component_received_bytes_total").map(
-            |m| {
-                m.into_iter()
-                    .map(ComponentReceivedBytesTotal::new)
-                    .collect()
-            },
-        )
-    }
-
-    /// Component bytes received throughput over `interval`
-    async fn component_received_bytes_throughputs(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Vec<ComponentReceivedBytesThroughput>> + use<> {
-        component_counter_throughputs(interval, &|m| m.name() == "component_received_bytes_total")
-            .map(|m| {
-                m.into_iter()
-                    .map(|(m, throughput)| {
-                        ComponentReceivedBytesThroughput::new(
-                            ComponentKey::from(m.tag_value("component_id").unwrap()),
-                            throughput as i64,
-                        )
-                    })
-                    .collect()
-            })
-    }
-
-    /// Component bytes sent metrics over `interval`.
-    async fn component_sent_bytes_totals(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Vec<ComponentSentBytesTotal>> + use<> {
-        component_counter_metrics(interval, &|m| m.name() == "component_sent_bytes_total")
-            .map(|m| m.into_iter().map(ComponentSentBytesTotal::new).collect())
-    }
-
-    /// Component bytes sent throughput over `interval`
-    async fn component_sent_bytes_throughputs(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Vec<ComponentSentBytesThroughput>> + use<> {
-        component_counter_throughputs(interval, &|m| m.name() == "component_sent_bytes_total").map(
-            |m| {
-                m.into_iter()
-                    .map(|(m, throughput)| {
-                        ComponentSentBytesThroughput::new(
-                            ComponentKey::from(m.tag_value("component_id").unwrap()),
-                            throughput as i64,
-                        )
-                    })
-                    .collect()
-            },
-        )
-    }
-
-    /// Total error metrics.
-    async fn errors_total(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = ErrorsTotal> + use<> {
-        get_metrics(interval)
-            .filter(|m| m.name().ends_with("_errors_total"))
-            .map(ErrorsTotal::new)
-    }
-
-    /// Allocated bytes metrics.
-    async fn allocated_bytes(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = AllocatedBytes> + use<> {
-        get_metrics(interval)
-            .filter(|m| m.name() == "component_allocated_bytes")
-            .map(AllocatedBytes::new)
-    }
-
-    /// Component allocation metrics
-    async fn component_allocated_bytes(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Vec<ComponentAllocatedBytes>> + use<> {
-        component_gauge_metrics(interval, &|m| m.name() == "component_allocated_bytes")
-            .map(|m| m.into_iter().map(ComponentAllocatedBytes::new).collect())
-    }
-
-    /// Component error metrics over `interval`.
-    async fn component_errors_totals(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = Vec<ComponentErrorsTotal>> + use<> {
-        component_counter_metrics(interval, &|m| m.name().ends_with("_errors_total"))
-            .map(|m| m.into_iter().map(ComponentErrorsTotal::new).collect())
-    }
-
-    /// All metrics.
-    async fn metrics(
-        &self,
-        #[graphql(default = 1000, validator(minimum = 10, maximum = 60_000))] interval: i32,
-    ) -> impl Stream<Item = MetricType> + use<> {
-        get_metrics(interval).filter_map(|m| match m.name() {
-            "uptime_seconds" => Some(MetricType::Uptime(m.into())),
-            _ => None,
-        })
-    }
-}
diff --git a/src/api/schema/metrics/output.rs b/src/api/schema/metrics/output.rs
deleted file mode 100644
index e1fd0976e7b48..0000000000000
--- a/src/api/schema/metrics/output.rs
+++ /dev/null
@@ -1,88 +0,0 @@
-use async_graphql::Object;
-use vector_lib::config::ComponentKey;
-
-use super::{SentEventsTotal, by_component_key, sum_metrics};
-use crate::event::Metric;
-
-#[derive(Debug, Clone)]
-pub struct Output {
-    output_id: String,
-    sent_events_total: Option<Metric>,
-}
-
-impl Output {
-    pub const fn new(output_id: String, sent_events_total: Option<Metric>) -> Self {
-        Self {
-            output_id,
-            sent_events_total,
-        }
-    }
-}
-
-#[Object]
-impl Output {
-    /// Id of the output stream
-    pub async fn output_id(&self) -> &str {
-        self.output_id.as_ref()
-    }
-
-    /// Total sent events for the current output stream
-    pub async fn sent_events_total(&self) -> Option<SentEventsTotal> {
-        self.sent_events_total
-            .as_ref()
-            .map(|metric| SentEventsTotal::new(metric.clone()))
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct OutputThroughput {
-    output_id: String,
-    throughput: i64,
-}
-
-impl OutputThroughput {
-    pub const fn new(output_id: String, throughput: i64) -> Self {
-        Self {
-            output_id,
-            throughput,
-        }
-    }
-}
-
-#[Object]
-impl OutputThroughput {
-    /// Id of the output stream
-    pub async fn output_id(&self) -> &str {
-        self.output_id.as_ref()
-    }
-
-    /// Throughput for the output stream
-    pub async fn throughput(&self) -> i64 {
-        self.throughput
-    }
-}
-
-pub fn outputs_by_component_key(component_key: &ComponentKey, outputs: &[String]) -> Vec<Output> {
-    let metrics = by_component_key(component_key)
-        .into_iter()
-        .filter(|m| m.name() == "component_sent_events_total")
-        .collect::<Vec<_>>();
-
-    outputs
-        .iter()
-        .map(|output| {
-            Output::new(
-                output.clone(),
-                filter_output_metric(&metrics, output.as_ref()),
-            )
-        })
-        .collect::<Vec<_>>()
-}
-
-pub fn filter_output_metric(metrics: &[Metric], output_name: &str) -> Option<Metric> {
-    sum_metrics(
-        metrics
-            .iter()
-            .filter(|m| m.tag_matches("output", output_name)),
-    )
-}
diff --git a/src/api/schema/metrics/received_bytes.rs b/src/api/schema/metrics/received_bytes.rs
deleted file mode 100644
index 516631559cbae..0000000000000
--- a/src/api/schema/metrics/received_bytes.rs
+++ /dev/null
@@ -1,108 +0,0 @@
-use async_graphql::Object;
-use chrono::{DateTime, Utc};
-
-use crate::{
-    config::ComponentKey,
-    event::{Metric, MetricValue},
-};
-
-pub struct ReceivedBytesTotal(Metric);
-
-impl ReceivedBytesTotal {
-    pub const fn new(m: Metric) -> Self {
-        Self(m)
-    }
-
-    pub fn get_timestamp(&self) -> Option<DateTime<Utc>> {
-        self.0.timestamp()
-    }
-
-    pub fn get_received_bytes_total(&self) -> f64 {
-        match self.0.value() {
-            MetricValue::Counter { value } => *value,
-            _ => 0.00,
-        }
-    }
-}
-
-#[Object]
-impl ReceivedBytesTotal {
-    /// Metric timestamp.
-    pub async fn timestamp(&self) -> Option<DateTime<Utc>> {
-        self.get_timestamp()
-    }
-
-    /// Total number of bytes received.
-    pub async fn received_bytes_total(&self) -> f64 {
-        self.get_received_bytes_total()
-    }
-}
-
-impl From<Metric> for ReceivedBytesTotal {
-    fn from(m: Metric) -> Self {
-        Self(m)
-    }
-}
-
-pub struct ComponentReceivedBytesTotal {
-    component_key: ComponentKey,
-    metric: Metric,
-}
-
-impl ComponentReceivedBytesTotal {
-    /// Returns a new `ComponentReceivedBytesTotal`.
-    ///
-    /// Expects that the metric contains a tag for the component ID the metric is referenced to.
-    pub fn new(metric: Metric) -> Self {
-        let component_key = metric.tag_value("component_id").expect(
-            "Returned a metric without a `component_id`, which shouldn't happen. Please report.",
-        );
-        let component_key = ComponentKey::from(component_key);
-
-        Self {
-            component_key,
-            metric,
-        }
-    }
-}
-
-#[Object]
-impl ComponentReceivedBytesTotal {
-    /// Component ID.
-    async fn component_id(&self) -> &str {
-        self.component_key.id()
-    }
-
-    /// Metric for total bytes received.
-    async fn metric(&self) -> ReceivedBytesTotal {
-        ReceivedBytesTotal::new(self.metric.clone())
-    }
-}
-
-pub struct ComponentReceivedBytesThroughput {
-    component_key: ComponentKey,
-    throughput: i64,
-}
-
-impl ComponentReceivedBytesThroughput {
-    /// Returns a new `ComponentReceivedBytesThroughput` for the given component.
-    pub const fn new(component_key: ComponentKey, throughput: i64) -> Self {
-        Self {
-            component_key,
-            throughput,
-        }
-    }
-}
-
-#[Object]
-impl ComponentReceivedBytesThroughput {
-    /// Component ID.
-    async fn component_id(&self) -> &str {
-        self.component_key.id()
-    }
-
-    /// Throughput of bytes sent.
-    async fn throughput(&self) -> i64 {
-        self.throughput
-    }
-}
diff --git a/src/api/schema/metrics/received_events.rs b/src/api/schema/metrics/received_events.rs
deleted file mode 100644
index b313004a8ef72..0000000000000
--- a/src/api/schema/metrics/received_events.rs
+++ /dev/null
@@ -1,107 +0,0 @@
-use async_graphql::Object;
-use chrono::{DateTime, Utc};
-
-use crate::{
-    config::ComponentKey,
-    event::{Metric, MetricValue},
-};
-
-pub struct ReceivedEventsTotal(Metric);
-
-impl ReceivedEventsTotal {
-    pub const fn new(m: Metric) -> Self {
-        Self(m)
-    }
-
-    pub fn get_timestamp(&self) -> Option<DateTime<Utc>> {
-        self.0.timestamp()
-    }
-
-    pub fn get_received_events_total(&self) -> f64 {
-        match self.0.value() {
-            MetricValue::Counter { value } => *value,
-            _ => 0.00,
-        }
-    }
-}
-
-#[Object]
-impl ReceivedEventsTotal {
-    /// Metric timestamp
-    pub async fn timestamp(&self) -> Option<DateTime<Utc>> {
-        self.get_timestamp()
-    }
-
-    /// Total incoming events
-    pub async fn received_events_total(&self) -> f64 {
-        self.get_received_events_total()
-    }
-}
-
-impl From<Metric> for ReceivedEventsTotal {
-    fn from(m: Metric) -> Self {
-        Self(m)
-    }
-}
-
-pub struct ComponentReceivedEventsTotal {
-    component_key: ComponentKey,
-    metric: Metric,
-}
-
-impl ComponentReceivedEventsTotal {
-    /// Returns a new `ComponentReceivedEventsTotal` struct, which is a GraphQL type. The
-    /// component id is hoisted for clear field resolution in the resulting payload.
-    pub fn new(metric: Metric) -> Self {
-        let component_key = metric.tag_value("component_id").expect(
-            "Returned a metric without a `component_id`, which shouldn't happen. Please report.",
-        );
-        let component_key = ComponentKey::from(component_key);
-
-        Self {
-            component_key,
-            metric,
-        }
-    }
-}
-
-#[Object]
-impl ComponentReceivedEventsTotal {
-    /// Component id
-    async fn component_id(&self) -> &str {
-        self.component_key.id()
-    }
-
-    /// Total received events metric
-    async fn metric(&self) -> ReceivedEventsTotal {
-        ReceivedEventsTotal::new(self.metric.clone())
-    }
-}
-
-pub struct ComponentReceivedEventsThroughput {
-    component_key: ComponentKey,
-    throughput: i64,
-}
-
-impl ComponentReceivedEventsThroughput {
-    /// Returns a new `ComponentReceivedEventsThroughput`, set to the provided id/throughput values.
-    pub const fn new(component_key: ComponentKey, throughput: i64) -> Self {
-        Self {
-            component_key,
-            throughput,
-        }
-    }
-}
-
-#[Object]
-impl ComponentReceivedEventsThroughput {
-    /// Component id
-    async fn component_id(&self) -> &str {
-        self.component_key.id()
-    }
-
-    /// Received events throughput
-    async fn throughput(&self) -> i64 {
-        self.throughput
-    }
-}
diff --git a/src/api/schema/metrics/sent_bytes.rs b/src/api/schema/metrics/sent_bytes.rs
deleted file mode 100644
index 02fb833a39adc..0000000000000
--- a/src/api/schema/metrics/sent_bytes.rs
+++ /dev/null
@@ -1,108 +0,0 @@
-use async_graphql::Object;
-use chrono::{DateTime, Utc};
-
-use crate::{
-    config::ComponentKey,
-    event::{Metric, MetricValue},
-};
-
-pub struct SentBytesTotal(Metric);
-
-impl SentBytesTotal {
-    pub const fn new(m: Metric) -> Self {
-        Self(m)
-    }
-
-    pub fn get_timestamp(&self) -> Option<DateTime<Utc>> {
-        self.0.timestamp()
-    }
-
-    pub fn get_sent_bytes_total(&self) -> f64 {
-        match self.0.value() {
-            MetricValue::Counter { value } => *value,
-            _ => 0.00,
-        }
-    }
-}
-
-#[Object]
-impl SentBytesTotal {
-    /// Metric timestamp.
-    pub async fn timestamp(&self) -> Option<DateTime<Utc>> {
-        self.get_timestamp()
-    }
-
-    /// Total number of bytes sent.
-    pub async fn sent_bytes_total(&self) -> f64 {
-        self.get_sent_bytes_total()
-    }
-}
-
-impl From<Metric> for SentBytesTotal {
-    fn from(m: Metric) -> Self {
-        Self(m)
-    }
-}
-
-pub struct ComponentSentBytesTotal {
-    component_key: ComponentKey,
-    metric: Metric,
-}
-
-impl ComponentSentBytesTotal {
-    /// Returns a new `ComponentSentBytesTotal` for the given metric.
-    ///
-    /// Expects that the metric contains a tag for the component ID the metric is referenced to.
-    pub fn new(metric: Metric) -> Self {
-        let component_key = metric.tag_value("component_id").expect(
-            "Returned a metric without a `component_id`, which shouldn't happen. Please report.",
-        );
-        let component_key = ComponentKey::from(component_key);
-
-        Self {
-            component_key,
-            metric,
-        }
-    }
-}
-
-#[Object]
-impl ComponentSentBytesTotal {
-    /// Component ID.
-    async fn component_id(&self) -> &str {
-        self.component_key.id()
-    }
-
-    /// Metric for total bytes sent.
-    async fn metric(&self) -> SentBytesTotal {
-        SentBytesTotal::new(self.metric.clone())
-    }
-}
-
-pub struct ComponentSentBytesThroughput {
-    component_key: ComponentKey,
-    throughput: i64,
-}
-
-impl ComponentSentBytesThroughput {
-    /// Returns a new `ComponentSentBytesThroughput` for the given component.
-    pub const fn new(component_key: ComponentKey, throughput: i64) -> Self {
-        Self {
-            component_key,
-            throughput,
-        }
-    }
-}
-
-#[Object]
-impl ComponentSentBytesThroughput {
-    /// Component ID.
-    async fn component_id(&self) -> &str {
-        self.component_key.id()
-    }
-
-    /// Throughput of bytes sent.
-    async fn throughput(&self) -> i64 {
-        self.throughput
-    }
-}
diff --git a/src/api/schema/metrics/sent_events.rs b/src/api/schema/metrics/sent_events.rs
deleted file mode 100644
index 5085cebc05334..0000000000000
--- a/src/api/schema/metrics/sent_events.rs
+++ /dev/null
@@ -1,133 +0,0 @@
-use async_graphql::Object;
-use chrono::{DateTime, Utc};
-
-use super::{Output, OutputThroughput};
-use crate::{
-    config::ComponentKey,
-    event::{Metric, MetricValue},
-};
-
-pub struct SentEventsTotal(Metric);
-
-impl SentEventsTotal {
-    pub const fn new(m: Metric) -> Self {
-        Self(m)
-    }
-
-    pub fn get_timestamp(&self) -> Option<DateTime<Utc>> {
-        self.0.timestamp()
-    }
-
-    pub fn get_sent_events_total(&self) -> f64 {
-        match self.0.value() {
-            MetricValue::Counter { value } => *value,
-            _ => 0.00,
-        }
-    }
-}
-
-#[Object]
-impl SentEventsTotal {
-    /// Metric timestamp
-    pub async fn timestamp(&self) -> Option<DateTime<Utc>> {
-        self.get_timestamp()
-    }
-
-    /// Total sent events
-    pub async fn sent_events_total(&self) -> f64 {
-        self.get_sent_events_total()
-    }
-}
-
-impl From<Metric> for SentEventsTotal {
-    fn from(m: Metric) -> Self {
-        Self(m)
-    }
-}
-
-pub struct ComponentSentEventsTotal {
-    component_key: ComponentKey,
-    outputs: Vec<Output>,
-    metric: Metric,
-}
-
-impl ComponentSentEventsTotal {
-    /// Returns a new `ComponentSentEventsTotal` struct, which is a GraphQL type. The
-    /// component id is hoisted for clear field resolution in the resulting payload.
-    pub fn new(metric: Metric, metric_by_outputs: Vec<Metric>) -> Self {
-        let component_key = metric.tag_value("component_id").expect(
-            "Returned a metric without a `component_id`, which shouldn't happen. Please report.",
-        );
-        let component_key = ComponentKey::from(component_key);
-        let outputs = metric_by_outputs
-            .iter()
-            .filter_map(|m| {
-                m.tag_value("output")
-                    .map(|output_name| Output::new(output_name, Some(m.clone())))
-            })
-            .collect::<Vec<_>>();
-
-        Self {
-            component_key,
-            outputs,
-            metric,
-        }
-    }
-}
-
-#[Object]
-impl ComponentSentEventsTotal {
-    /// Component id
-    async fn component_id(&self) -> &str {
-        self.component_key.id()
-    }
-
-    /// Total outgoing events metric
-    async fn metric(&self) -> SentEventsTotal {
-        SentEventsTotal::new(self.metric.clone())
-    }
-
-    /// Output streams with outgoing events metrics
-    async fn outputs(&self) -> &Vec<Output> {
-        &self.outputs
-    }
-}
-
-pub struct ComponentSentEventsThroughput {
-    component_key: ComponentKey,
-    throughput: i64,
-    outputs: Vec<OutputThroughput>,
-}
-
-impl ComponentSentEventsThroughput {
-    /// Returns a new `ComponentSentEventsThroughput`, set to the provided id/throughput values
-    pub const fn new(
-        component_key: ComponentKey,
-        throughput: i64,
-        outputs: Vec<OutputThroughput>,
-    ) -> Self {
-        Self {
-            component_key,
-            throughput,
-            outputs,
-        }
-    }
-}
-
-#[Object]
-impl ComponentSentEventsThroughput {
-    /// Component id
-    async fn component_id(&self) -> &str {
-        self.component_key.id()
-    }
-
-    /// Total events processed throughput
-    async fn throughput(&self) -> i64 {
-        self.throughput
-    }
-
-    /// Output streams with throughputs
-    async fn outputs(&self) -> &Vec<OutputThroughput> {
-        &self.outputs
-    }
-}
diff --git a/src/api/schema/metrics/sink/generic.rs b/src/api/schema/metrics/sink/generic.rs
deleted file mode 100644
index 83c50bc6557b7..0000000000000
--- a/src/api/schema/metrics/sink/generic.rs
+++ /dev/null
@@ -1,33 +0,0 @@
-use async_graphql::Object;
-
-use crate::{
-    api::schema::metrics::{self, MetricsFilter},
-    event::Metric,
-};
-
-#[derive(Debug, Clone)]
-pub struct GenericSinkMetrics(Vec<Metric>);
-
-impl GenericSinkMetrics {
-    pub const fn new(metrics: Vec<Metric>) -> Self {
-        Self(metrics)
-    }
-}
-
-#[Object]
-impl GenericSinkMetrics {
-    /// Total received events for the current sink
-    pub async fn received_events_total(&self) -> Option<metrics::ReceivedEventsTotal> {
-        self.0.received_events_total()
-    }
-
-    /// Total sent bytes for the current sink
-    pub async fn sent_bytes_total(&self) -> Option<metrics::SentBytesTotal> {
-        self.0.sent_bytes_total()
-    }
-
-    /// Total sent events for the current sink
-    pub async fn sent_events_total(&self) -> Option<metrics::SentEventsTotal> {
-        self.0.sent_events_total()
-    }
-}
diff --git a/src/api/schema/metrics/sink/mod.rs b/src/api/schema/metrics/sink/mod.rs
deleted file mode 100644
index c864270834cec..0000000000000
--- a/src/api/schema/metrics/sink/mod.rs
+++ /dev/null
@@ -1,26 +0,0 @@
-mod generic;
-
-use async_graphql::Interface;
-
-use super::{ReceivedEventsTotal, SentBytesTotal, SentEventsTotal};
-use crate::event::Metric;
-
-#[derive(Debug, Clone, Interface)]
-#[graphql(
-    field(name = "received_events_total", ty = "Option<ReceivedEventsTotal>"),
-    field(name = "sent_bytes_total", ty = "Option<SentBytesTotal>"),
-    field(name = "sent_events_total", ty = "Option<SentEventsTotal>")
-)]
-pub enum SinkMetrics {
-    GenericSinkMetrics(generic::GenericSinkMetrics),
-}
-
-pub trait IntoSinkMetrics {
-    fn into_sink_metrics(self, component_type: &str) -> SinkMetrics;
-}
-
-impl IntoSinkMetrics for Vec<Metric> {
-    fn into_sink_metrics(self, _component_type: &str) -> SinkMetrics {
-        SinkMetrics::GenericSinkMetrics(generic::GenericSinkMetrics::new(self))
-    }
-}
diff --git a/src/api/schema/metrics/source/file.rs b/src/api/schema/metrics/source/file.rs
deleted file mode 100644
index 43c2a2751ceda..0000000000000
--- a/src/api/schema/metrics/source/file.rs
+++ /dev/null
@@ -1,351 +0,0 @@
-use std::{cmp::Ordering, collections::BTreeMap};
-
-use async_graphql::{Enum, InputObject, Object};
-
-use crate::{
-    api::schema::{
-        filter::{CustomFilter, StringFilter, filter_items},
-        metrics::{self, MetricsFilter},
-        relay, sort,
-    },
-    event::Metric,
-    filter_check,
-};
-
-#[derive(Clone)]
-pub struct FileSourceMetricFile<'a> {
-    name: String,
-    metrics: Vec<&'a Metric>,
-}
-
-impl<'a> FileSourceMetricFile<'a> {
-    /// Returns a new FileSourceMetricFile from a (name, Vec<&Metric>) tuple
-    #[allow(clippy::missing_const_for_fn)] // const cannot run destructor
-    fn from_tuple((name, metrics): (String, Vec<&'a Metric>)) -> Self {
-        Self { name, metrics }
-    }
-
-    pub const fn get_name(&self) -> &str {
-        self.name.as_str()
-    }
-}
-
-#[Object]
-impl FileSourceMetricFile<'_> {
-    /// File name
-    async fn name(&self) -> &str {
-        &*self.name
-    }
-
-    /// Metric indicating bytes received for the current file
-    async fn received_bytes_total(&self) -> Option<metrics::ReceivedBytesTotal> {
-        self.metrics.received_bytes_total()
-    }
-
-    /// Metric indicating received events for the current file
-    async fn received_events_total(&self) -> Option<metrics::ReceivedEventsTotal> {
-        self.metrics.received_events_total()
-    }
-
-    /// Metric indicating outgoing events for the current file
-    async fn sent_events_total(&self) -> Option<metrics::SentEventsTotal> {
-        self.metrics.sent_events_total()
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct FileSourceMetrics(Vec<Metric>);
-
-impl FileSourceMetrics {
-    pub const fn new(metrics: Vec<Metric>) -> Self {
-        Self(metrics)
-    }
-
-    pub fn get_files(&self) -> Vec<FileSourceMetricFile<'_>> {
-        self.0
-            .iter()
-            .filter_map(|m| m.tag_value("file").map(|file| (file, m)))
-            .fold(
-                BTreeMap::new(),
-                |mut map: BTreeMap<String, Vec<&Metric>>, (file, m)| {
-                    map.entry(file).or_default().push(m);
-                    map
-                },
-            )
-            .into_iter()
-            .map(FileSourceMetricFile::from_tuple)
-            .collect()
-    }
-}
-
-#[derive(Enum, Copy, Clone, Eq, PartialEq)]
-pub enum FileSourceMetricFilesSortFieldName {
-    Name,
-    ReceivedBytesTotal,
-    ReceivedEventsTotal,
-    SentEventsTotal,
-}
-
-impl sort::SortableByField<FileSourceMetricFilesSortFieldName> for FileSourceMetricFile<'_> {
-    fn sort(&self, rhs: &Self, field: &FileSourceMetricFilesSortFieldName) -> Ordering {
-        match field {
-            FileSourceMetricFilesSortFieldName::Name => Ord::cmp(&self.name, &rhs.name),
-            FileSourceMetricFilesSortFieldName::ReceivedBytesTotal => Ord::cmp(
-                &self
-                    .metrics
-                    .received_bytes_total()
-                    .map(|m| m.get_received_bytes_total() as i64)
-                    .unwrap_or(0),
-                &rhs.metrics
-                    .received_bytes_total()
-                    .map(|m| m.get_received_bytes_total() as i64)
-                    .unwrap_or(0),
-            ),
-            FileSourceMetricFilesSortFieldName::ReceivedEventsTotal => Ord::cmp(
-                &self
-                    .metrics
-                    .received_events_total()
-                    .map(|m| m.get_received_events_total() as i64)
-                    .unwrap_or(0),
-                &rhs.metrics
-                    .received_events_total()
-                    .map(|m| m.get_received_events_total() as i64)
-                    .unwrap_or(0),
-            ),
-            FileSourceMetricFilesSortFieldName::SentEventsTotal => Ord::cmp(
-                &self
-                    .metrics
-                    .sent_events_total()
-                    .map(|m| m.get_sent_events_total() as i64)
-                    .unwrap_or(0),
-                &rhs.metrics
-                    .sent_events_total()
-                    .map(|m| m.get_sent_events_total() as i64)
-                    .unwrap_or(0),
-            ),
-        }
-    }
-}
-
-#[derive(Default, InputObject)]
-pub struct FileSourceMetricsFilesFilter {
-    name: Option<Vec<StringFilter>>,
-    or: Option<Vec<Self>>,
-}
-
-impl CustomFilter<FileSourceMetricFile<'_>> for FileSourceMetricsFilesFilter {
-    fn matches(&self, file: &FileSourceMetricFile<'_>) -> bool {
-        filter_check!(
-            self.name
-                .as_ref()
-                .map(|f| f.iter().all(|f| f.filter_value(file.get_name())))
-        );
-        true
-    }
-
-    fn or(&self) -> Option<&Vec<Self>> {
-        self.or.as_ref()
-    }
-}
-
-#[allow(clippy::too_many_arguments)]
-#[Object]
-impl FileSourceMetrics {
-    /// File metrics
-    pub async fn files(
-        &self,
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i32>,
-        last: Option<i32>,
-        filter: Option<FileSourceMetricsFilesFilter>,
-        sort: Option<Vec<sort::SortField<FileSourceMetricFilesSortFieldName>>>,
-    ) -> relay::ConnectionResult<FileSourceMetricFile<'_>> {
-        let filter = filter.unwrap_or_default();
-        let mut files = filter_items(self.get_files().into_iter(), &filter);
-
-        if let Some(sort_fields) = sort {
-            sort::by_fields(&mut files, &sort_fields);
-        }
-
-        relay::query(
-            files.into_iter(),
-            relay::Params::new(after, before, first, last),
-            10,
-        )
-        .await
-    }
-
-    /// Total received bytes for the current file source
-    pub async fn received_bytes_total(&self) -> Option<metrics::ReceivedBytesTotal> {
-        self.0.received_bytes_total()
-    }
-
-    /// Total received events for the current file source
-    pub async fn received_events_total(&self) -> Option<metrics::ReceivedEventsTotal> {
-        self.0.received_events_total()
-    }
-
-    /// Total sent events for the current file source
-    pub async fn sent_events_total(&self) -> Option<metrics::SentEventsTotal> {
-        self.0.sent_events_total()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::{
-        api::schema::sort::SortField,
-        event::{MetricKind, MetricValue},
-    };
-
-    struct FileSourceMetricTest {
-        name: &'static str,
-        events_metric: Metric,
-        bytes_metric: Metric,
-    }
-
-    impl FileSourceMetricTest {
-        fn new(name: &'static str, events_processed: f64, bytes_processed: f64) -> Self {
-            Self {
-                name,
-                events_metric: metric("component_sent_events_total", events_processed),
-                bytes_metric: metric("component_received_bytes_total", bytes_processed),
-            }
-        }
-
-        fn get_metric(&self) -> FileSourceMetricFile<'_> {
-            FileSourceMetricFile::from_tuple((
-                self.name.to_string(),
-                vec![&self.bytes_metric, &self.events_metric],
-            ))
-        }
-    }
-
-    fn metric(name: &str, value: f64) -> Metric {
-        Metric::new(
-            name,
-            MetricKind::Incremental,
-            MetricValue::Counter { value },
-        )
-    }
-
-    fn by_name(name: &'static str) -> FileSourceMetricTest {
-        FileSourceMetricTest::new(name, 0.00, 0.00)
-    }
-
-    #[test]
-    fn sort_name_asc() {
-        let t1 = by_name("/path/to/file/2");
-        let t2 = by_name("/path/to/file/3");
-        let t3 = by_name("/path/to/file/1");
-
-        let mut files = vec![t1.get_metric(), t2.get_metric(), t3.get_metric()];
-        let fields = vec![SortField::<FileSourceMetricFilesSortFieldName> {
-            field: FileSourceMetricFilesSortFieldName::Name,
-            direction: sort::Direction::Asc,
-        }];
-
-        sort::by_fields(&mut files, &fields);
-
-        for (i, f) in ["1", "2", "3"].iter().enumerate() {
-            assert_eq!(files[i].name.as_str(), format!("/path/to/file/{f}"));
-        }
-    }
-
-    #[test]
-    fn sort_name_desc() {
-        let t1 = by_name("/path/to/file/2");
-        let t2 = by_name("/path/to/file/3");
-        let t3 = by_name("/path/to/file/1");
-
-        let mut files = vec![t1.get_metric(), t2.get_metric(), t3.get_metric()];
-        let fields = vec![SortField::<FileSourceMetricFilesSortFieldName> {
-            field: FileSourceMetricFilesSortFieldName::Name,
-            direction: sort::Direction::Desc,
-        }];
-
-        sort::by_fields(&mut files, &fields);
-
-        for (i, f) in ["3", "2", "1"].iter().enumerate() {
-            assert_eq!(files[i].name.as_str(), format!("/path/to/file/{f}"));
-        }
-    }
-
-    #[test]
-    fn processed_events_asc() {
-        let t1 = FileSourceMetricTest::new("a", 1000.00, 100.00);
-        let t2 = FileSourceMetricTest::new("b", 500.00, 300.00);
-        let t3 = FileSourceMetricTest::new("c", 250.00, 200.00);
-
-        let mut files = vec![t1.get_metric(), t2.get_metric(), t3.get_metric()];
-        let fields = vec![SortField::<FileSourceMetricFilesSortFieldName> {
-            field: FileSourceMetricFilesSortFieldName::SentEventsTotal,
-            direction: sort::Direction::Asc,
-        }];
-
-        sort::by_fields(&mut files, &fields);
-
-        for (i, f) in ["c", "b", "a"].iter().enumerate() {
-            assert_eq!(&files[i].name, *f);
-        }
-    }
-
-    #[test]
-    fn processed_events_desc() {
-        let t1 = FileSourceMetricTest::new("a", 1000.00, 100.00);
-        let t2 = FileSourceMetricTest::new("b", 500.00, 300.00);
-        let t3 = FileSourceMetricTest::new("c", 250.00, 200.00);
-
-        let mut files = vec![t1.get_metric(), t2.get_metric(), t3.get_metric()];
-        let fields = vec![SortField::<FileSourceMetricFilesSortFieldName> {
-            field: FileSourceMetricFilesSortFieldName::SentEventsTotal,
-            direction: sort::Direction::Desc,
-        }];
-
-        sort::by_fields(&mut files, &fields);
-
-        for (i, f) in ["a", "b", "c"].iter().enumerate() {
-            assert_eq!(&files[i].name, *f);
-        }
-    }
-
-    #[test]
-    fn received_bytes_asc() {
-        let t1 = FileSourceMetricTest::new("a", 1000.00, 100.00);
-        let t2 = FileSourceMetricTest::new("b", 500.00, 300.00);
-        let t3 = FileSourceMetricTest::new("c", 250.00, 200.00);
-
-        let mut files = vec![t1.get_metric(), t2.get_metric(), t3.get_metric()];
-        let fields = vec![SortField::<FileSourceMetricFilesSortFieldName> {
-            field: FileSourceMetricFilesSortFieldName::ReceivedBytesTotal,
-            direction: sort::Direction::Asc,
-        }];
-
-        sort::by_fields(&mut files, &fields);
-
-        for (i, f) in ["a", "c", "b"].iter().enumerate() {
-            assert_eq!(&files[i].name, *f);
-        }
-    }
-
-    #[test]
-    fn received_bytes_desc() {
-        let t1 = FileSourceMetricTest::new("a", 1000.00, 100.00);
-        let t2 = FileSourceMetricTest::new("b", 500.00, 300.00);
-        let t3 = FileSourceMetricTest::new("c", 250.00, 200.00);
-
-        let mut files = vec![t1.get_metric(), t2.get_metric(), t3.get_metric()];
-        let fields = vec![SortField::<FileSourceMetricFilesSortFieldName> {
-            field: FileSourceMetricFilesSortFieldName::ReceivedBytesTotal,
-            direction: sort::Direction::Desc,
-        }];
-
-        sort::by_fields(&mut files, &fields);
-
-        for (i, f) in ["b", "c", "a"].iter().enumerate() {
-            assert_eq!(&files[i].name, *f);
-        }
-    }
-}
diff --git a/src/api/schema/metrics/source/generic.rs b/src/api/schema/metrics/source/generic.rs
deleted file mode 100644
index 12435c1b36e90..0000000000000
--- a/src/api/schema/metrics/source/generic.rs
+++ /dev/null
@@ -1,33 +0,0 @@
-use async_graphql::Object;
-
-use crate::{
-    api::schema::metrics::{self, MetricsFilter},
-    event::Metric,
-};
-
-#[derive(Debug, Clone)]
-pub struct GenericSourceMetrics(Vec<Metric>);
-
-impl GenericSourceMetrics {
-    pub const fn new(metrics: Vec<Metric>) -> Self {
-        Self(metrics)
-    }
-}
-
-#[Object]
-impl GenericSourceMetrics {
-    /// Total received bytes for the current source
-    pub async fn received_bytes_total(&self) -> Option<metrics::ReceivedBytesTotal> {
-        self.0.received_bytes_total()
-    }
-
-    /// Total received events for the current source
-    pub async fn received_events_total(&self) -> Option<metrics::ReceivedEventsTotal> {
-        self.0.received_events_total()
-    }
-
-    /// Total sent events for the current source
-    pub async fn sent_events_total(&self) -> Option<metrics::SentEventsTotal> {
-        self.0.sent_events_total()
-    }
-}
diff --git a/src/api/schema/metrics/source/mod.rs b/src/api/schema/metrics/source/mod.rs
deleted file mode 100644
index fe5c40ff6c346..0000000000000
--- a/src/api/schema/metrics/source/mod.rs
+++ /dev/null
@@ -1,31 +0,0 @@
-pub mod file;
-mod generic;
-
-use async_graphql::Interface;
-
-use super::{ReceivedBytesTotal, ReceivedEventsTotal, SentEventsTotal};
-use crate::event::Metric;
-
-#[derive(Debug, Clone, Interface)]
-#[graphql(
-    field(name = "received_bytes_total", ty = "Option<ReceivedBytesTotal>"),
-    field(name = "received_events_total", ty = "Option<ReceivedEventsTotal>"),
-    field(name = "sent_events_total", ty = "Option<SentEventsTotal>")
-)]
-pub enum SourceMetrics {
-    GenericSourceMetrics(generic::GenericSourceMetrics),
-    FileSourceMetrics(file::FileSourceMetrics),
-}
-
-pub trait IntoSourceMetrics {
-    fn into_source_metrics(self, component_type: &str) -> SourceMetrics;
-}
-
-impl IntoSourceMetrics for Vec<Metric> {
-    fn into_source_metrics(self, component_type: &str) -> SourceMetrics {
-        match component_type {
-            "file" => SourceMetrics::FileSourceMetrics(file::FileSourceMetrics::new(self)),
-            _ => SourceMetrics::GenericSourceMetrics(generic::GenericSourceMetrics::new(self)),
-        }
-    }
-}
diff --git a/src/api/schema/metrics/transform/generic.rs b/src/api/schema/metrics/transform/generic.rs
deleted file mode 100644
index 854a845226cc1..0000000000000
--- a/src/api/schema/metrics/transform/generic.rs
+++ /dev/null
@@ -1,28 +0,0 @@
-use async_graphql::Object;
-
-use crate::{
-    api::schema::metrics::{self, MetricsFilter},
-    event::Metric,
-};
-
-#[derive(Debug, Clone)]
-pub struct GenericTransformMetrics(Vec<Metric>);
-
-impl GenericTransformMetrics {
-    pub const fn new(metrics: Vec<Metric>) -> Self {
-        Self(metrics)
-    }
-}
-
-#[Object]
-impl GenericTransformMetrics {
-    /// Total received events for the current transform
-    pub async fn received_events_total(&self) -> Option<metrics::ReceivedEventsTotal> {
-        self.0.received_events_total()
-    }
-
-    /// Total sent events for the current transform
-    pub async fn sent_events_total(&self) -> Option<metrics::SentEventsTotal> {
-        self.0.sent_events_total()
-    }
-}
diff --git a/src/api/schema/metrics/transform/mod.rs b/src/api/schema/metrics/transform/mod.rs
deleted file mode 100644
index 183a97907f592..0000000000000
--- a/src/api/schema/metrics/transform/mod.rs
+++ /dev/null
@@ -1,25 +0,0 @@
-mod generic;
-
-use async_graphql::Interface;
-
-use super::{ReceivedEventsTotal, SentEventsTotal};
-use crate::event::Metric;
-
-#[derive(Debug, Clone, Interface)]
-#[graphql(
-    field(name = "received_events_total", ty = "Option<ReceivedEventsTotal>"),
-    field(name = "sent_events_total", ty = "Option<SentEventsTotal>")
-)]
-pub enum TransformMetrics {
-    GenericTransformMetrics(generic::GenericTransformMetrics),
-}
-
-pub trait IntoTransformMetrics {
-    fn into_transform_metrics(self, component_type: &str) -> TransformMetrics;
-}
-
-impl IntoTransformMetrics for Vec<Metric> {
-    fn into_transform_metrics(self, _component_type: &str) -> TransformMetrics {
-        TransformMetrics::GenericTransformMetrics(generic::GenericTransformMetrics::new(self))
-    }
-}
diff --git a/src/api/schema/metrics/uptime.rs b/src/api/schema/metrics/uptime.rs
deleted file mode 100644
index 7c02c223e0859..0000000000000
--- a/src/api/schema/metrics/uptime.rs
+++ /dev/null
@@ -1,34 +0,0 @@
-use async_graphql::Object;
-use chrono::{DateTime, Utc};
-
-use crate::event::{Metric, MetricValue};
-
-pub struct Uptime(Metric);
-
-impl Uptime {
-    pub const fn new(m: Metric) -> Self {
-        Self(m)
-    }
-}
-
-#[Object]
-impl Uptime {
-    /// Metric timestamp
-    pub async fn timestamp(&self) -> Option<DateTime<Utc>> {
-        self.0.timestamp()
-    }
-
-    /// Number of seconds the Vector instance has been alive
-    pub async fn seconds(&self) -> f64 {
-        match self.0.value() {
-            MetricValue::Gauge { value } => *value,
-            _ => 0.00,
-        }
-    }
-}
-
-impl From<Metric> for Uptime {
-    fn from(m: Metric) -> Self {
-        Self(m)
-    }
-}
diff --git a/src/api/schema/mod.rs b/src/api/schema/mod.rs
deleted file mode 100644
index 58c22a03b687f..0000000000000
--- a/src/api/schema/mod.rs
+++ /dev/null
@@ -1,31 +0,0 @@
-pub mod components;
-pub mod events;
-pub mod filter;
-mod health;
-mod meta;
-mod metrics;
-mod relay;
-pub mod sort;
-
-use async_graphql::{EmptyMutation, MergedObject, MergedSubscription, Schema, SchemaBuilder};
-
-#[derive(MergedObject, Default)]
-pub struct Query(
-    health::HealthQuery,
-    components::ComponentsQuery,
-    #[cfg(feature = "sources-host_metrics")] metrics::MetricsQuery,
-    meta::MetaQuery,
-);
-
-#[derive(MergedSubscription, Default)]
-pub struct Subscription(
-    health::HealthSubscription,
-    metrics::MetricsSubscription,
-    components::ComponentsSubscription,
-    events::EventsSubscription,
-);
-
-/// Build a new GraphQL schema, comprised of Query, Mutation and Subscription types
-pub fn build_schema() -> SchemaBuilder<Query, EmptyMutation, Subscription> {
-    Schema::build(Query::default(), EmptyMutation, Subscription::default())
-}
diff --git a/src/api/schema/relay.rs b/src/api/schema/relay.rs
deleted file mode 100644
index 3124a2272a66e..0000000000000
--- a/src/api/schema/relay.rs
+++ /dev/null
@@ -1,168 +0,0 @@
-use std::convert::Infallible;
-
-use async_graphql::{
-    Result, SimpleObject,
-    connection::{self, Connection, CursorType, Edge, EmptyFields},
-};
-use base64::prelude::{BASE64_URL_SAFE_NO_PAD, Engine as _};
-
-/// Base64 invalid states, used by `Base64Cursor`.
-pub enum Base64CursorError {
-    /// Invalid cursor. This can happen if the base64 string is valid, but its contents don't
-    /// conform to the `name:index` pattern.
-    Invalid,
-    /// Decoding error. If this happens, the string isn't valid base64.
-    DecodeError(base64::DecodeError),
-}
-
-impl std::fmt::Display for Base64CursorError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "Invalid cursor")
-    }
-}
-
-/// Base64 cursor implementation
-pub struct Base64Cursor {
-    name: &'static str,
-    index: usize,
-}
-
-impl Base64Cursor {
-    const fn new(index: usize) -> Self {
-        Self {
-            name: "Cursor",
-            index,
-        }
-    }
-
-    /// Returns a base64 string representation of the cursor
-    fn encode(&self) -> String {
-        BASE64_URL_SAFE_NO_PAD.encode(format!("{}:{}", self.name, self.index))
-    }
-
-    /// Decodes a base64 string into a cursor result
-    fn decode(s: &str) -> Result<Self, Base64CursorError> {
-        let bytes = BASE64_URL_SAFE_NO_PAD
-            .decode(s)
-            .map_err(Base64CursorError::DecodeError)?;
-
-        let cursor = String::from_utf8(bytes).map_err(|_| Base64CursorError::Invalid)?;
-        let index = cursor
-            .split(':')
-            .next_back()
-            .map(|s| s.parse::<usize>())
-            .ok_or(Base64CursorError::Invalid)?
-            .map_err(|_| Base64CursorError::Invalid)?;
-
-        Ok(Self::new(index))
-    }
-
-    /// Increment and return the index. Uses saturating_add to avoid overflow
-    /// issues.
-    const fn increment(&self) -> usize {
-        self.index.saturating_add(1)
-    }
-}
-
-impl From<Base64Cursor> for usize {
-    fn from(cursor: Base64Cursor) -> Self {
-        cursor.index
-    }
-}
-
-/// Makes the `Base64Cursor` compatible with Relay connections
-impl CursorType for Base64Cursor {
-    type Error = Base64CursorError;
-
-    fn decode_cursor(s: &str) -> Result<Self, Self::Error> {
-        Base64Cursor::decode(s)
-    }
-
-    fn encode_cursor(&self) -> String {
-        self.encode()
-    }
-}
-
-/// Additional fields to attach to the connection
-#[derive(SimpleObject)]
-pub struct ConnectionFields {
-    /// Total result set count
-    total_count: usize,
-}
-
-/// Relay connection result
-pub type ConnectionResult<T> = Result<Connection<Base64Cursor, T, ConnectionFields, EmptyFields>>;
-
-/// Relay-compliant connection parameters to page results by cursor/page size
-pub struct Params {
-    after: Option<String>,
-    before: Option<String>,
-    first: Option<i32>,
-    last: Option<i32>,
-}
-
-impl Params {
-    pub const fn new(
-        after: Option<String>,
-        before: Option<String>,
-        first: Option<i32>,
-        last: Option<i32>,
-    ) -> Self {
-        Self {
-            after,
-            before,
-            first,
-            last,
-        }
-    }
-}
-
-/// Creates a new Relay-compliant connection. Iterator must implement `ExactSizeIterator` to
-/// determine page position in the total result set.
-pub async fn query<T: async_graphql::OutputType, I: ExactSizeIterator<Item = T>>(
-    iter: I,
-    p: Params,
-    default_page_size: usize,
-) -> ConnectionResult<T> {
-    connection::query::<_, _, Base64Cursor, _, _, ConnectionFields, _, _, _, Infallible>(
-        p.after,
-        p.before,
-        p.first,
-        p.last,
-        |after, before, first, last| async move {
-            let iter_len = iter.len();
-
-            let (start, end) = {
-                let after = after.map(|a| a.increment()).unwrap_or(0);
-                let before: usize = before.map(|b| b.into()).unwrap_or(iter_len);
-
-                // Calculate start/end based on the provided first/last. Note that async-graphql disallows
-                // providing both (returning an error), so we can safely assume we have, at most, one of
-                // first or last.
-                match (first, last) {
-                    // First
-                    (Some(first), _) => (after, (after.saturating_add(first)).min(before)),
-                    // Last
-                    (_, Some(last)) => ((before.saturating_sub(last)).max(after), before),
-                    // Default page size
-                    _ => (after, default_page_size.min(before)),
-                }
-            };
-
-            let mut connection = Connection::with_additional_fields(
-                start > 0,
-                end < iter_len,
-                ConnectionFields {
-                    total_count: iter_len,
-                },
-            );
-            connection.edges.extend(
-                (start..end)
-                    .zip(iter.skip(start))
-                    .map(|(cursor, node)| Edge::new(Base64Cursor::new(cursor), node)),
-            );
-            Ok(connection)
-        },
-    )
-    .await
-}
diff --git a/src/api/schema/sort.rs b/src/api/schema/sort.rs
deleted file mode 100644
index 8e40750c88a83..0000000000000
--- a/src/api/schema/sort.rs
+++ /dev/null
@@ -1,61 +0,0 @@
-use std::cmp::Ordering;
-
-use async_graphql::{Enum, InputObject, InputType};
-use itertools::{
-    FoldWhile::{Continue, Done},
-    Itertools,
-};
-
-use crate::api::schema::{
-    components::{
-        ComponentsSortFieldName, sink::SinksSortFieldName, source::SourcesSortFieldName,
-        transform::TransformsSortFieldName,
-    },
-    metrics::source::file::FileSourceMetricFilesSortFieldName,
-};
-
-#[derive(Enum, Copy, Clone, Default, PartialEq, Eq)]
-pub enum Direction {
-    #[default]
-    Asc,
-    Desc,
-}
-
-#[derive(InputObject)]
-#[graphql(concrete(name = "ComponentsSortField", params(ComponentsSortFieldName)))]
-#[graphql(concrete(name = "SourcesSortField", params(SourcesSortFieldName)))]
-#[graphql(concrete(name = "TransformsSortField", params(TransformsSortFieldName)))]
-#[graphql(concrete(name = "SinksSortField", params(SinksSortFieldName)))]
-#[graphql(concrete(
-    name = "FileSourceMetricFilesSortField",
-    params(FileSourceMetricFilesSortFieldName)
-))]
-pub struct SortField<T: InputType> {
-    pub field: T,
-    #[graphql(default_with = "Direction::default()")]
-    pub direction: Direction,
-}
-
-/// Defines a type as sortable by a given field
-pub trait SortableByField<T: InputType> {
-    fn sort(&self, rhs: &Self, field: &T) -> Ordering;
-}
-
-/// Performs an in-place sort against a slice of `Sortable<T>`, with the provided [`SortField<T>`]s
-pub fn by_fields<T: InputType>(f: &mut [impl SortableByField<T>], sort_fields: &[SortField<T>]) {
-    f.sort_by(|a, b| {
-        sort_fields
-            .iter()
-            .fold_while(Ordering::Equal, |cmp, f| match cmp {
-                Ordering::Equal => {
-                    let cmp = a.sort(b, &f.field);
-                    Continue(match f.direction {
-                        Direction::Desc => cmp.reverse(),
-                        _ => cmp,
-                    })
-                }
-                _ => Done(cmp),
-            })
-            .into_inner()
-    });
-}
diff --git a/src/api/server.rs b/src/api/server.rs
deleted file mode 100644
index 9ddbc407c7f22..0000000000000
--- a/src/api/server.rs
+++ /dev/null
@@ -1,204 +0,0 @@
-use std::{
-    convert::Infallible,
-    net::SocketAddr,
-    sync::{Arc, atomic::AtomicBool},
-};
-
-use async_graphql::{
-    Data, Request, Schema,
-    http::{GraphQLPlaygroundConfig, WebSocketProtocols, playground_source},
-};
-use async_graphql_warp::{GraphQLResponse, GraphQLWebSocket, graphql_protocol};
-use hyper::{Server as HyperServer, server::conn::AddrIncoming, service::make_service_fn};
-use tokio::{runtime::Handle, sync::oneshot};
-use tower::ServiceBuilder;
-use tracing::Span;
-use vector_lib::tap::topology;
-use warp::{Filter, Reply, filters::BoxedFilter, http::Response, ws::Ws};
-
-use super::{handler, schema};
-use crate::{
-    config::{self, api},
-    http::build_http_trace_layer,
-    internal_events::{SocketBindError, SocketMode},
-};
-
-pub struct Server {
-    _shutdown: oneshot::Sender<()>,
-    addr: SocketAddr,
-}
-
-impl Server {
-    /// Start the API server. This creates the routes and spawns a Warp server. The server is
-    /// gracefully shut down when Self falls out of scope by way of the oneshot sender closing.
-    pub fn start(
-        config: &config::Config,
-        watch_rx: topology::WatchRx,
-        running: Arc<AtomicBool>,
-        handle: &Handle,
-    ) -> crate::Result<Self> {
-        let routes = make_routes(config.api, watch_rx, running);
-
-        let (_shutdown, rx) = oneshot::channel();
-        // warp uses `tokio::spawn` and so needs us to enter the runtime context.
-        let _guard = handle.enter();
-
-        let addr = config.api.address.expect("No socket address");
-        let incoming = AddrIncoming::bind(&addr).inspect_err(|error| {
-            emit!(SocketBindError {
-                mode: SocketMode::Tcp,
-                error,
-            });
-        })?;
-
-        let span = Span::current();
-        let make_svc = make_service_fn(move |_conn| {
-            let svc = ServiceBuilder::new()
-                .layer(build_http_trace_layer(span.clone()))
-                .service(warp::service(routes.clone()));
-            futures_util::future::ok::<_, Infallible>(svc)
-        });
-
-        let server = async move {
-            HyperServer::builder(incoming)
-                .serve(make_svc)
-                .with_graceful_shutdown(async {
-                    rx.await.ok();
-                })
-                .await
-                .map_err(|err| {
-                    error!("An error occurred: {:?}.", err);
-                })
-        };
-
-        // Update component schema with the config before starting the server.
-        schema::components::update_config(config);
-
-        // Spawn the server in the background.
-        handle.spawn(server);
-
-        Ok(Self { _shutdown, addr })
-    }
-
-    /// Returns a copy of the SocketAddr that the server was started on.
-    pub const fn addr(&self) -> SocketAddr {
-        self.addr
-    }
-
-    /// Update the configuration of a running server. While this instance method doesn't
-    /// directly involve `self`, it provides a neater API to expose an internal implementation
-    /// detail than exposing the function of the sub-mod directly.
-    pub fn update_config(&self, config: &config::Config) {
-        schema::components::update_config(config)
-    }
-}
-
-fn make_routes(
-    api: api::Options,
-    watch_tx: topology::WatchRx,
-    running: Arc<AtomicBool>,
-) -> BoxedFilter<(impl Reply,)> {
-    // Routes...
-
-    // Health.
-    let health = warp::path("health")
-        .and(with_shared(running))
-        .and_then(handler::health);
-
-    // 404.
-    let not_found_graphql = warp::any().and_then(|| async { Err(warp::reject::not_found()) });
-    let not_found = warp::any().and_then(|| async { Err(warp::reject::not_found()) });
-
-    // GraphQL subscription handler. Creates a Warp WebSocket handler and for each connection,
-    // parses the required headers for GraphQL and builds per-connection context based on the
-    // provided `WatchTx` channel sender. This allows GraphQL resolvers to subscribe to
-    // topology changes.
-    let graphql_subscription_handler =
-        warp::ws()
-            .and(graphql_protocol())
-            .map(move |ws: Ws, protocol: WebSocketProtocols| {
-                let schema = schema::build_schema().finish();
-                let watch_tx = watch_tx.clone();
-
-                let reply = ws.on_upgrade(move |socket| {
-                    let mut data = Data::default();
-                    data.insert(watch_tx);
-
-                    GraphQLWebSocket::new(socket, schema, protocol)
-                        .with_data(data)
-                        .serve()
-                });
-
-                warp::reply::with_header(
-                    reply,
-                    "Sec-WebSocket-Protocol",
-                    protocol.sec_websocket_protocol(),
-                )
-            });
-
-    // Handle GraphQL queries. Headers will first be parsed to determine whether the query is
-    // a subscription and if so, an attempt will be made to upgrade the connection to WebSockets.
-    // All other queries will fall back to the default HTTP handler.
-    let graphql_handler = if api.graphql {
-        warp::path("graphql")
-            .and(graphql_subscription_handler.or(
-                async_graphql_warp::graphql(schema::build_schema().finish()).and_then(
-                    |(schema, request): (Schema<_, _, _>, Request)| async move {
-                        Ok::<_, Infallible>(GraphQLResponse::from(schema.execute(request).await))
-                    },
-                ),
-            ))
-            .boxed()
-    } else {
-        not_found_graphql.boxed()
-    };
-
-    // Provide a playground for executing GraphQL queries/mutations/subscriptions.
-    let graphql_playground = if api.playground && api.graphql {
-        warp::path("playground")
-            .map(move || {
-                Response::builder()
-                    .header("content-type", "text/html")
-                    .body(playground_source(
-                        GraphQLPlaygroundConfig::new("/graphql").subscription_endpoint("/graphql"),
-                    ))
-            })
-            .boxed()
-    } else {
-        not_found.boxed()
-    };
-
-    // Wire up the health + GraphQL endpoints. Provides a permissive CORS policy to allow for
-    // cross-origin interaction with the Vector API.
-    health
-        .or(graphql_handler)
-        .or(graphql_playground)
-        .or(not_found)
-        .with(
-            warp::cors()
-                .allow_any_origin()
-                .allow_headers(vec![
-                    "User-Agent",
-                    "Sec-Fetch-Mode",
-                    "Referer",
-                    "Origin",
-                    "Access-Control-Request-Method",
-                    "Access-Control-Allow-Origin",
-                    "Access-Control-Request-Headers",
-                    "Content-Type",
-                    "X-Apollo-Tracing", // for Apollo GraphQL clients
-                    "Pragma",
-                    "Host",
-                    "Connection",
-                    "Cache-Control",
-                ])
-                .allow_methods(vec!["POST", "GET"]),
-        )
-        .boxed()
-}
-
-fn with_shared(
-    shared: Arc<AtomicBool>,
-) -> impl Filter<Extract = (Arc<AtomicBool>,), Error = Infallible> + Clone {
-    warp::any().map(move || Arc::<AtomicBool>::clone(&shared))
-}
diff --git a/src/api/tests.rs b/src/api/tests.rs
deleted file mode 100644
index 56794376b2a25..0000000000000
--- a/src/api/tests.rs
+++ /dev/null
@@ -1,589 +0,0 @@
-use std::{
-    collections::{HashMap, HashSet},
-    time::Duration,
-};
-
-use futures::StreamExt;
-use tokio::sync::{mpsc, watch};
-use vector_lib::{
-    config::ComponentKey,
-    fanout,
-    tap::{
-        controller::{TapController, TapPatterns, TapPayload},
-        notification::{InvalidMatch, Matched, NotMatched, Notification},
-        topology::{TapOutput, TapResource},
-    },
-};
-
-use crate::{
-    api::schema::events::{create_events_stream, log, metric, output::OutputEventsPayload},
-    config::{Config, OutputId},
-    event::{LogEvent, Metric, MetricKind, MetricValue},
-    sinks::blackhole::BlackholeConfig,
-    sources::demo_logs::{DemoLogsConfig, OutputFormat},
-    test_util::{start_topology, trace_init},
-    transforms::{
-        log_to_metric::{LogToMetricConfig, MetricConfig, MetricTypeConfig},
-        remap::RemapConfig,
-    },
-};
-
-#[tokio::test]
-/// A tap sink should match a pattern, receive the correct notifications,
-/// and receive events
-async fn sink_events() {
-    let pattern_matched = "tes*";
-    let pattern_not_matched = "xyz";
-    let id = OutputId::from(&ComponentKey::from("test"));
-
-    let (mut fanout, control_tx) = fanout::Fanout::new();
-    let mut outputs = HashMap::new();
-    outputs.insert(
-        TapOutput {
-            output_id: id.clone(),
-            component_kind: "source",
-            component_type: "demo".to_string(),
-        },
-        control_tx,
-    );
-    let tap_resource = TapResource {
-        outputs,
-        inputs: HashMap::new(),
-        source_keys: Vec::new(),
-        sink_keys: Vec::new(),
-        removals: HashSet::new(),
-    };
-
-    let (watch_tx, watch_rx) = watch::channel(TapResource::default());
-    let (sink_tx, mut sink_rx) = mpsc::channel(10);
-
-    let _controller = TapController::new(
-        watch_rx,
-        sink_tx,
-        TapPatterns::new(
-            HashSet::from([pattern_matched.to_string(), pattern_not_matched.to_string()]),
-            HashSet::new(),
-        ),
-    );
-
-    // Add the outputs to trigger a change event.
-    watch_tx.send(tap_resource).unwrap();
-
-    // First two events should contain a notification that one pattern matched, and
-    // one that didn't.
-    #[allow(clippy::mixed_read_write_in_expression)]
-    let notifications = vec![sink_rx.recv().await, sink_rx.recv().await];
-
-    for notification in notifications.into_iter() {
-        match notification {
-            Some(TapPayload::Notification(Notification::Matched(matched)))
-                if matched.pattern == pattern_matched =>
-            {
-                continue;
-            }
-            Some(TapPayload::Notification(Notification::NotMatched(not_matched)))
-                if not_matched.pattern == pattern_not_matched =>
-            {
-                continue;
-            }
-            _ => panic!("unexpected payload"),
-        }
-    }
-
-    // Send some events down the wire. Waiting until the first notifications are in
-    // to ensure the event handler has been initialized.
-    let log_event = LogEvent::default();
-    let metric_event = Metric::new(
-        id.to_string(),
-        MetricKind::Incremental,
-        MetricValue::Counter { value: 1.0 },
-    );
-
-    fanout
-        .send(vec![metric_event].into(), None)
-        .await
-        .expect("should not fail");
-    fanout
-        .send(vec![log_event].into(), None)
-        .await
-        .expect("should not fail");
-
-    // 3rd payload should be the metric event
-    assert!(matches!(
-        sink_rx.recv().await,
-        Some(TapPayload::Metric(output, _)) if output.output_id == id
-    ));
-
-    // 4th payload should be the log event
-    assert!(matches!(
-        sink_rx.recv().await,
-        Some(TapPayload::Log(output, _)) if output.output_id == id
-    ));
-}
-
-fn assert_notification(payload: OutputEventsPayload) -> Notification {
-    if let OutputEventsPayload::Notification(event_notification) = payload {
-        event_notification.notification
-    } else {
-        panic!("Expected payload to be a Notification")
-    }
-}
-
-fn assert_log(payload: OutputEventsPayload) -> log::Log {
-    if let OutputEventsPayload::Log(log) = payload {
-        log
-    } else {
-        panic!("Expected payload to be a Log")
-    }
-}
-
-fn assert_metric(payload: OutputEventsPayload) -> metric::Metric {
-    if let OutputEventsPayload::Metric(metric) = payload {
-        metric
-    } else {
-        panic!("Expected payload to be a Metric")
-    }
-}
-
-#[tokio::test]
-async fn integration_test_source_log() {
-    trace_init();
-
-    let mut config = Config::builder();
-    config.add_source(
-        "in",
-        DemoLogsConfig {
-            interval: Duration::from_secs_f64(0.01),
-            count: 200,
-            format: OutputFormat::Json,
-            ..Default::default()
-        },
-    );
-    config.add_sink(
-        "out",
-        &["in"],
-        BlackholeConfig {
-            print_interval_secs: Duration::from_secs(1),
-            rate: None,
-            acknowledgements: Default::default(),
-        },
-    );
-
-    let (topology, _) = start_topology(config.build().unwrap(), false).await;
-
-    let source_tap_stream = create_events_stream(
-        topology.watch(),
-        TapPatterns::new(HashSet::from(["in".to_string()]), HashSet::new()),
-        500,
-        100,
-    );
-
-    let source_tap_events: Vec<_> = source_tap_stream.take(2).collect().await;
-
-    assert_eq!(
-        assert_notification(source_tap_events[0][0].clone()),
-        Notification::Matched(Matched::new("in".to_string()))
-    );
-    let _log = assert_log(source_tap_events[1][0].clone());
-}
-
-#[tokio::test]
-async fn integration_test_source_metric() {
-    trace_init();
-
-    let mut config = Config::builder();
-    config.add_source(
-        "in",
-        DemoLogsConfig {
-            interval: Duration::from_secs_f64(0.01),
-            count: 200,
-            format: OutputFormat::Shuffle {
-                sequence: false,
-                lines: vec!["1".to_string()],
-            },
-            ..Default::default()
-        },
-    );
-    config.add_transform(
-        "to_metric",
-        &["in"],
-        LogToMetricConfig {
-            metrics: Some(vec![MetricConfig {
-                field: "message".try_into().expect("Fixed template string"),
-                name: None,
-                namespace: None,
-                tags: None,
-                metric: MetricTypeConfig::Gauge,
-            }]),
-            all_metrics: None,
-        },
-    );
-    config.add_sink(
-        "out",
-        &["to_metric"],
-        BlackholeConfig {
-            print_interval_secs: Duration::from_secs(1),
-            rate: None,
-            acknowledgements: Default::default(),
-        },
-    );
-
-    let (topology, _) = start_topology(config.build().unwrap(), false).await;
-
-    let source_tap_stream = create_events_stream(
-        topology.watch(),
-        TapPatterns::new(HashSet::from(["to_metric".to_string()]), HashSet::new()),
-        500,
-        100,
-    );
-
-    let source_tap_events: Vec<_> = source_tap_stream.take(2).collect().await;
-
-    assert_eq!(
-        assert_notification(source_tap_events[0][0].clone()),
-        Notification::Matched(Matched::new("to_metric".to_string()))
-    );
-    assert_metric(source_tap_events[1][0].clone());
-}
-
-#[tokio::test]
-async fn integration_test_transform() {
-    trace_init();
-
-    let mut config = Config::builder();
-    config.add_source(
-        "in",
-        DemoLogsConfig {
-            interval: Duration::from_secs_f64(0.01),
-            count: 200,
-            format: OutputFormat::Json,
-            ..Default::default()
-        },
-    );
-    config.add_transform(
-        "transform",
-        &["in"],
-        RemapConfig {
-            source: Some("".to_string()),
-            ..Default::default()
-        },
-    );
-    config.add_sink(
-        "out",
-        &["transform"],
-        BlackholeConfig {
-            print_interval_secs: Duration::from_secs(1),
-            rate: None,
-            acknowledgements: Default::default(),
-        },
-    );
-
-    let (topology, _) = start_topology(config.build().unwrap(), false).await;
-
-    let transform_tap_stream = create_events_stream(
-        topology.watch(),
-        TapPatterns::new(HashSet::from(["transform".to_string()]), HashSet::new()),
-        500,
-        100,
-    );
-
-    let transform_tap_events: Vec<_> = transform_tap_stream.take(2).collect().await;
-
-    assert_eq!(
-        assert_notification(transform_tap_events[0][0].clone()),
-        Notification::Matched(Matched::new("transform".to_string()))
-    );
-    let _log = assert_log(transform_tap_events[1][0].clone());
-}
-
-#[tokio::test]
-async fn integration_test_transform_input() {
-    trace_init();
-
-    let mut config = Config::builder();
-    config.add_source(
-        "in",
-        DemoLogsConfig {
-            interval: Duration::from_secs_f64(0.01),
-            count: 200,
-            format: OutputFormat::Shuffle {
-                sequence: false,
-                lines: vec!["test".to_string()],
-            },
-            ..Default::default()
-        },
-    );
-    config.add_transform(
-        "transform",
-        &["in"],
-        RemapConfig {
-            source: Some(".message = \"new message\"".to_string()),
-            ..Default::default()
-        },
-    );
-    config.add_sink(
-        "out",
-        &["in"],
-        BlackholeConfig {
-            print_interval_secs: Duration::from_secs(1),
-            rate: None,
-            acknowledgements: Default::default(),
-        },
-    );
-
-    let (topology, _) = start_topology(config.build().unwrap(), false).await;
-
-    let tap_stream = create_events_stream(
-        topology.watch(),
-        TapPatterns::new(
-            HashSet::new(),
-            HashSet::from(["transform".to_string(), "in".to_string()]),
-        ),
-        500,
-        100,
-    );
-
-    let tap_events: Vec<_> = tap_stream.take(4).collect().await;
-
-    let notifications = [
-        assert_notification(tap_events[0][0].clone()),
-        assert_notification(tap_events[1][0].clone()),
-        assert_notification(tap_events[2][0].clone()),
-    ];
-    assert!(
-        notifications
-            .iter()
-            .any(|n| *n == Notification::Matched(Matched::new("transform".to_string())))
-    );
-    // "in" is not matched since it corresponds to a source
-    assert!(
-        notifications
-            .iter()
-            .any(|n| *n == Notification::NotMatched(NotMatched::new("in".to_string())))
-    );
-    // "in" generates an invalid match notification to warn against an
-    // attempt to tap the input of a source
-    assert!(notifications.iter().any(|n| *n
-            == Notification::InvalidMatch(InvalidMatch::new("[tap] Warning: source inputs cannot be tapped. Input pattern 'in' matches sources [\"in\"]".to_string(), "in".to_string(), vec!["in".to_string()]))));
-
-    assert_eq!(
-        assert_log(tap_events[3][0].clone())
-            .get_message()
-            .unwrap_or_default(),
-        "test"
-    );
-}
-
-#[tokio::test]
-async fn integration_test_sink() {
-    trace_init();
-
-    let mut config = Config::builder();
-    config.add_source(
-        "in",
-        DemoLogsConfig {
-            interval: Duration::from_secs_f64(0.01),
-            count: 200,
-            format: OutputFormat::Shuffle {
-                sequence: false,
-                lines: vec!["test".to_string()],
-            },
-            ..Default::default()
-        },
-    );
-    config.add_transform(
-        "transform",
-        &["in"],
-        RemapConfig {
-            source: Some(".message = \"new message\"".to_string()),
-            ..Default::default()
-        },
-    );
-    config.add_sink(
-        "out",
-        &["transform"],
-        BlackholeConfig {
-            print_interval_secs: Duration::from_secs(1),
-            rate: None,
-            acknowledgements: Default::default(),
-        },
-    );
-
-    let (topology, _) = start_topology(config.build().unwrap(), false).await;
-
-    let tap_stream = create_events_stream(
-        topology.watch(),
-        TapPatterns::new(HashSet::new(), HashSet::from(["out".to_string()])),
-        500,
-        100,
-    );
-
-    let tap_events: Vec<_> = tap_stream.take(2).collect().await;
-
-    assert_eq!(
-        assert_notification(tap_events[0][0].clone()),
-        Notification::Matched(Matched::new("out".to_string()))
-    );
-    assert_eq!(
-        assert_log(tap_events[1][0].clone())
-            .get_message()
-            .unwrap_or_default(),
-        "new message"
-    );
-}
-
-#[tokio::test]
-async fn integration_test_tap_non_default_output() {
-    trace_init();
-
-    let mut config = Config::builder();
-    config.add_source(
-        "in",
-        DemoLogsConfig {
-            interval: Duration::from_secs_f64(0.01),
-            count: 200,
-            format: OutputFormat::Shuffle {
-                sequence: false,
-                lines: vec!["test2".to_string()],
-            },
-            ..Default::default()
-        },
-    );
-    config.add_transform(
-        "transform",
-        &["in"],
-        RemapConfig {
-            source: Some("assert_eq!(.message, \"test1\")".to_string()),
-            drop_on_error: true,
-            reroute_dropped: true,
-            ..Default::default()
-        },
-    );
-    config.add_sink(
-        "out",
-        &["transform"],
-        BlackholeConfig {
-            print_interval_secs: Duration::from_secs(1),
-            rate: None,
-            acknowledgements: Default::default(),
-        },
-    );
-
-    let (topology, _) = start_topology(config.build().unwrap(), false).await;
-
-    let transform_tap_remap_dropped_stream = create_events_stream(
-        topology.watch(),
-        TapPatterns::new(
-            HashSet::from(["transform.dropped".to_string()]),
-            HashSet::new(),
-        ),
-        500,
-        100,
-    );
-
-    let transform_tap_events: Vec<_> = transform_tap_remap_dropped_stream.take(2).collect().await;
-
-    assert_eq!(
-        assert_notification(transform_tap_events[0][0].clone()),
-        Notification::Matched(Matched::new("transform.dropped".to_string()))
-    );
-    assert_eq!(
-        assert_log(transform_tap_events[1][0].clone())
-            .get_message()
-            .unwrap_or_default(),
-        "test2"
-    );
-}
-
-#[tokio::test]
-async fn integration_test_tap_multiple_outputs() {
-    trace_init();
-
-    let mut config = Config::builder();
-    config.add_source(
-        "in-test1",
-        DemoLogsConfig {
-            interval: Duration::from_secs_f64(0.01),
-            count: 1,
-            format: OutputFormat::Shuffle {
-                sequence: false,
-                lines: vec!["test1".to_string()],
-            },
-            ..Default::default()
-        },
-    );
-    config.add_source(
-        "in-test2",
-        DemoLogsConfig {
-            interval: Duration::from_secs_f64(0.01),
-            count: 1,
-            format: OutputFormat::Shuffle {
-                sequence: false,
-                lines: vec!["test2".to_string()],
-            },
-            ..Default::default()
-        },
-    );
-    config.add_transform(
-        "transform",
-        &["in*"],
-        RemapConfig {
-            source: Some("assert_eq!(.message, \"test1\")".to_string()),
-            drop_on_error: true,
-            reroute_dropped: true,
-            ..Default::default()
-        },
-    );
-    config.add_sink(
-        "out",
-        &["transform"],
-        BlackholeConfig {
-            print_interval_secs: Duration::from_secs(1),
-            rate: None,
-            acknowledgements: Default::default(),
-        },
-    );
-
-    let (topology, _) = start_topology(config.build().unwrap(), false).await;
-
-    let mut transform_tap_all_outputs_stream = create_events_stream(
-        topology.watch(),
-        TapPatterns::new(HashSet::from(["transform*".to_string()]), HashSet::new()),
-        500,
-        100,
-    );
-
-    let transform_tap_notifications = transform_tap_all_outputs_stream.next().await.unwrap();
-    assert_eq!(
-        assert_notification(transform_tap_notifications[0].clone()),
-        Notification::Matched(Matched::new("transform*".to_string()))
-    );
-
-    let mut default_output_found = false;
-    let mut dropped_output_found = false;
-    for _ in 0..2 {
-        if default_output_found && dropped_output_found {
-            break;
-        }
-
-        match transform_tap_all_outputs_stream.next().await {
-            Some(tap_events) => {
-                if !default_output_found {
-                    default_output_found = tap_events
-                        .iter()
-                        .map(|payload| assert_log(payload.clone()))
-                        .any(|log| log.get_message().unwrap_or_default() == "test1");
-                }
-                if !dropped_output_found {
-                    dropped_output_found = tap_events
-                        .iter()
-                        .map(|payload| assert_log(payload.clone()))
-                        .any(|log| log.get_message().unwrap_or_default() == "test2");
-                }
-            }
-            None => break,
-        }
-    }
-
-    assert!(default_output_found && dropped_output_found);
-}
diff --git a/src/app.rs b/src/app.rs
index 9e8a415608a8f..6f30f85de1d20 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -20,7 +20,9 @@ use tokio::{
 use tokio_stream::wrappers::UnboundedReceiverStream;
 
 #[cfg(feature = "api")]
-use crate::{api, internal_events::ApiStarted};
+use crate::api;
+#[cfg(feature = "api")]
+use crate::internal_events::ApiStarted;
 use crate::{
     cli::{LogFormat, Opts, RootOpts, WatchConfigMethod, handle_config_errors},
     config::{self, ComponentConfig, ComponentType, Config, ConfigPath},
@@ -34,6 +36,8 @@ use crate::{
     },
     trace,
 };
+#[cfg(feature = "api")]
+use std::sync::Arc;
 
 static WORKER_THREADS: AtomicUsize = AtomicUsize::new(0);
 
@@ -129,28 +133,32 @@ impl ApplicationConfig {
         Ok(())
     }
 
-    /// Configure the API server, if applicable
+    /// Configure the gRPC API server, if applicable
     #[cfg(feature = "api")]
-    pub fn setup_api(&self, handle: &Handle) -> Option<api::Server> {
+    pub fn setup_api(&self, handle: &Handle) -> Option<api::GrpcServer> {
         if self.api.enabled {
-            match api::Server::start(
+            // Start gRPC server
+            let api_server = handle.block_on(api::GrpcServer::start(
                 self.topology.config(),
                 self.topology.watch(),
-                std::sync::Arc::clone(&self.topology.running),
-                handle,
-            ) {
-                Ok(api_server) => {
+                Arc::clone(&self.topology.running),
+            ));
+            match api_server {
+                Ok(server) => {
                     emit!(ApiStarted {
-                        addr: self.api.address.unwrap(),
-                        playground: self.api.playground,
-                        graphql: self.api.graphql
+                        addr: server.addr()
                     });
-
-                    Some(api_server)
+                    Some(server)
                 }
                 Err(error) => {
                     let error = error.to_string();
-                    error!(message = "An error occurred that Vector couldn't handle.", %error, internal_log_rate_limit = false);
+                    error!(
+                        message = "An error occurred that Vector couldn't handle.",
+                        %error,
+                        internal_log_rate_limit = false
+                    );
+                    // Trigger shutdown because the API was explicitly enabled but failed to start
+                    // This ensures users don't run Vector thinking top/tap will work when they won't
                     _ = self
                         .topology
                         .abort_tx
@@ -256,9 +264,12 @@ impl Application {
             signals,
         } = self;
 
+        #[cfg(feature = "api")]
+        let api_server = config.setup_api(handle);
+
         let topology_controller = SharedTopologyController::new(TopologyController {
             #[cfg(feature = "api")]
-            api_server: config.setup_api(handle),
+            api_server,
             topology: config.topology,
             config_paths: config.config_paths.clone(),
             require_healthy: root_opts.require_healthy,
diff --git a/src/config/api.rs b/src/config/api.rs
index 5f99618c166f6..a421fe9f2e1b6 100644
--- a/src/config/api.rs
+++ b/src/config/api.rs
@@ -11,7 +11,7 @@ use vector_lib::configurable::configurable_component;
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 #[serde(default, deny_unknown_fields)]
 pub struct Options {
-    /// Whether the GraphQL API is enabled for this Vector instance.
+    /// Whether the API is enabled for this Vector instance.
     #[serde(default = "default_enabled")]
     #[configurable(metadata(docs::common = true, docs::required = false))]
     pub enabled: bool,
@@ -24,21 +24,6 @@ pub struct Options {
     #[configurable(metadata(docs::examples = "127.0.0.1:1234"))]
     #[configurable(metadata(docs::common = true, docs::required = false))]
     pub address: Option<SocketAddr>,
-
-    /// Whether the [GraphQL Playground](https://github.com/graphql/graphql-playground) is enabled
-    /// for the API. The Playground is accessible via the `/playground` endpoint
-    /// of the address set using the `bind` parameter. Note that the `playground`
-    /// endpoint will only be enabled if the `graphql` endpoint is also enabled.
-    #[serde(default = "default_playground")]
-    #[configurable(metadata(docs::common = false, docs::required = false))]
-    pub playground: bool,
-
-    /// Whether the endpoint for receiving and processing GraphQL queries is
-    /// enabled for the API. The endpoint is accessible via the `/graphql`
-    /// endpoint of the address set using the `bind` parameter.
-    #[serde(default = "default_graphql", skip_serializing_if = "is_true")]
-    #[configurable(metadata(docs::common = true, docs::required = false))]
-    pub graphql: bool,
 }
 
 impl_generate_config_from_default!(Options);
@@ -47,19 +32,11 @@ impl Default for Options {
     fn default() -> Self {
         Self {
             enabled: default_enabled(),
-            playground: default_playground(),
             address: default_address(),
-            graphql: default_graphql(),
         }
     }
 }
 
-// serde passes struct fields as reference
-#[allow(clippy::trivially_copy_pass_by_ref)]
-const fn is_true(value: &bool) -> bool {
-    *value
-}
-
 const fn default_enabled() -> bool {
     false
 }
@@ -71,21 +48,13 @@ pub fn default_address() -> Option<SocketAddr> {
     Some(SocketAddr::new(Ipv4Addr::LOCALHOST.into(), 8686))
 }
 
-/// Default GraphQL API address
-pub fn default_graphql_url() -> Url {
+/// Default gRPC API address for `vector top` and other API clients
+pub fn default_grpc_url() -> Url {
     let addr = default_address().unwrap();
-    Url::parse(&format!("http://{addr}/graphql"))
+    Url::parse(&format!("http://{addr}"))
         .expect("Couldn't parse default API URL. Please report this.")
 }
 
-const fn default_playground() -> bool {
-    true
-}
-
-const fn default_graphql() -> bool {
-    true
-}
-
 impl Options {
     pub fn merge(&mut self, other: Self) -> Result<(), String> {
         // Merge options
@@ -108,8 +77,6 @@ impl Options {
         let options = Options {
             address,
             enabled: self.enabled | other.enabled,
-            playground: self.playground & other.playground,
-            graphql: self.graphql & other.graphql,
         };
 
         *self = options;
@@ -122,8 +89,6 @@ fn bool_merge() {
     let mut a = Options {
         enabled: true,
         address: None,
-        playground: false,
-        graphql: false,
     };
 
     a.merge(Options::default()).unwrap();
@@ -133,8 +98,6 @@ fn bool_merge() {
         Options {
             enabled: true,
             address: default_address(),
-            playground: false,
-            graphql: false
         }
     );
 }
@@ -145,8 +108,6 @@ fn bind_merge() {
     let mut a = Options {
         enabled: true,
         address: Some(address),
-        playground: true,
-        graphql: true,
     };
 
     a.merge(Options::default()).unwrap();
@@ -156,8 +117,6 @@ fn bind_merge() {
         Options {
             enabled: true,
             address: Some(address),
-            playground: true,
-            graphql: true,
         }
     );
 }
diff --git a/src/internal_events/api.rs b/src/internal_events/api.rs
index 4894fc1de33e6..de2cb9588537d 100644
--- a/src/internal_events/api.rs
+++ b/src/internal_events/api.rs
@@ -7,20 +7,13 @@ use vector_lib::internal_event::InternalEvent;
 #[derive(Debug, NamedInternalEvent)]
 pub struct ApiStarted {
     pub addr: SocketAddr,
-    pub playground: bool,
-    pub graphql: bool,
 }
 
 impl InternalEvent for ApiStarted {
     fn emit(self) {
-        let playground = &*format!("http://{}:{}/playground", self.addr.ip(), self.addr.port());
-        let graphql = &*format!("http://{}:{}/graphql", self.addr.ip(), self.addr.port());
         info!(
-            message="API server running.",
-            address = ?self.addr,
-            playground = %if self.playground { playground } else { "off" },
-            graphql = %if self.graphql { graphql } else { "off" }
-
+            message = "API server running.",
+            address = %self.addr,
         );
         counter!("api_started_total").increment(1);
     }
diff --git a/src/proto/mod.rs b/src/proto/mod.rs
index bf576c8f7e542..75796939fb368 100644
--- a/src/proto/mod.rs
+++ b/src/proto/mod.rs
@@ -1,9 +1,9 @@
-#[cfg(any(feature = "sources-vector", feature = "sinks-vector"))]
-use crate::event::proto as event;
-
 #[cfg(any(feature = "sources-vector", feature = "sinks-vector"))]
 pub mod vector;
 
+#[cfg(feature = "api")]
+pub mod observability;
+
 #[cfg(feature = "sinks-datadog_metrics")]
 pub mod fds {
     use std::sync::OnceLock;
diff --git a/src/proto/observability.rs b/src/proto/observability.rs
new file mode 100644
index 0000000000000..f62f9adec9f97
--- /dev/null
+++ b/src/proto/observability.rs
@@ -0,0 +1,13 @@
+#![allow(clippy::clone_on_ref_ptr)]
+#![allow(warnings, clippy::pedantic, clippy::nursery)]
+
+tonic::include_proto!("vector.observability.v1");
+
+pub use observability_service_client::ObservabilityServiceClient as Client;
+pub use observability_service_server::{
+    ObservabilityService as Service, ObservabilityServiceServer as Server,
+};
+
+/// File descriptor set for gRPC reflection
+pub const FILE_DESCRIPTOR_SET: &[u8] =
+    include_bytes!(concat!(env!("OUT_DIR"), "/protobuf-fds.bin"));
diff --git a/src/tap/cmd.rs b/src/tap/cmd.rs
index 46fc21f6b5684..fe2b69bbeb8b5 100644
--- a/src/tap/cmd.rs
+++ b/src/tap/cmd.rs
@@ -1,24 +1,24 @@
 use std::time::Duration;
 
 use vector_lib::{
-    api_client::Client,
+    api_client::{Client, RECONNECT_DELAY_MS},
     tap::{EventFormatter, OutputChannel, TapRunner},
 };
 
 use crate::signal::{SignalRx, SignalTo};
 
-/// Delay (in milliseconds) before attempting to reconnect to the Vector API
-const RECONNECT_DELAY: u64 = 5000;
-
 /// CLI command func for issuing 'tap' queries, and communicating with a local/remote
 /// Vector API server via HTTP/WebSockets.
+#[allow(clippy::print_stderr)]
 pub(crate) async fn cmd(opts: &super::Opts, signal_rx: SignalRx) -> exitcode::ExitCode {
     let url = opts.url();
-    // Return early with instructions for enabling the API if the endpoint isn't reachable
-    // via a healthcheck.
-    let client = Client::new(url.clone());
-    #[allow(clippy::print_stderr)]
-    if client.healthcheck().await.is_err() {
+    let Ok(uri) = url.as_str().parse() else {
+        eprintln!("Invalid API URL: {url}");
+        return exitcode::USAGE;
+    };
+    let mut client = Client::new(uri);
+
+    if client.connect().await.is_err() || client.health().await.is_err() {
         eprintln!(
             indoc::indoc! {"
             Vector API server isn't reachable ({}).
@@ -34,47 +34,66 @@ pub(crate) async fn cmd(opts: &super::Opts, signal_rx: SignalRx) -> exitcode::Ex
         return exitcode::UNAVAILABLE;
     }
 
-    tap(opts, signal_rx).await
+    tap_internal(opts, signal_rx, Some(client)).await
 }
 
 /// Observe event flow from specified components
-pub async fn tap(opts: &super::Opts, mut signal_rx: SignalRx) -> exitcode::ExitCode {
-    let subscription_url = opts.web_socket_url();
+pub async fn tap(opts: &super::Opts, signal_rx: SignalRx) -> exitcode::ExitCode {
+    tap_internal(opts, signal_rx, None).await
+}
+
+async fn tap_internal(
+    opts: &super::Opts,
+    mut signal_rx: SignalRx,
+    mut client_opt: Option<Client>,
+) -> exitcode::ExitCode {
+    let url = opts.url();
     let output_channel = OutputChannel::Stdout(EventFormatter::new(opts.meta, opts.format));
     let tap_runner = TapRunner::new(
-        &subscription_url,
+        &url,
         opts.inputs_of.clone(),
         opts.outputs_patterns().clone(),
         &output_channel,
-        opts.format,
     );
 
     loop {
         tokio::select! {
             biased;
             Ok(SignalTo::Shutdown(_) | SignalTo::Quit) = signal_rx.recv() => break,
-            exec_result = tap_runner.run_tap(
-                opts.interval as i64,
-                opts.limit as i64,
-                opts.duration_ms,
-                opts.quiet,
-            ) => {
+            exec_result = async {
+                if let Some(client) = client_opt.take() {
+                    tap_runner.run_tap_with_client(
+                        client,
+                        opts.interval as i64,
+                        opts.limit as i64,
+                        opts.duration_ms,
+                        opts.quiet,
+                    ).await
+                } else {
+                    tap_runner.run_tap(
+                        opts.interval as i64,
+                        opts.limit as i64,
+                        opts.duration_ms,
+                        opts.quiet,
+                    ).await
+                }
+            } => {
                 match exec_result {
                     Ok(_) => {
                         break;
                     }
                     Err(tap_executor_error) => {
-                        if !opts.no_reconnect {
-                            #[allow(clippy::print_stderr)]
-                            {
-                                eprintln!(
-                                    "[tap] Connection failed with error {:?}. Reconnecting in {:?} seconds.",
-                                    tap_executor_error,
-                                    RECONNECT_DELAY / 1000);
-                            }
-                            tokio::time::sleep(Duration::from_millis(RECONNECT_DELAY)).await;
-                        }
-                        else {
+                        #[allow(clippy::print_stderr)]
+                        if tap_executor_error.is_fatal() {
+                            eprintln!("[tap] Error: {tap_executor_error:?}");
+                            break;
+                        } else if !opts.no_reconnect {
+                            eprintln!(
+                                "[tap] Connection failed with error {:?}. Reconnecting in {:?} seconds.",
+                                tap_executor_error,
+                                RECONNECT_DELAY_MS / 1000);
+                            tokio::time::sleep(Duration::from_millis(RECONNECT_DELAY_MS)).await;
+                        } else {
                             break;
                         }
                     }
diff --git a/src/tap/mod.rs b/src/tap/mod.rs
index 9ba77f3ce1a65..2e5fa1bbd4d3d 100644
--- a/src/tap/mod.rs
+++ b/src/tap/mod.rs
@@ -5,24 +5,24 @@ use clap::Parser;
 pub(crate) use cmd::cmd;
 pub use cmd::tap;
 use url::Url;
-use vector_lib::api_client::gql::TapEncodingFormat;
+use vector_lib::tap::TapEncodingFormat;
 
-use crate::config::api::default_graphql_url;
+use crate::config::api::default_grpc_url;
 
 /// Tap options
 #[derive(Parser, Debug, Clone)]
 #[command(rename_all = "kebab-case")]
 pub struct Opts {
-    /// Interval to sample events at, in milliseconds
-    #[arg(default_value = "500", short = 'i', long)]
+    /// Interval to sample events at, in milliseconds (must be >= 100)
+    #[arg(default_value = "500", short = 'i', long, value_parser = clap::value_parser!(u32).range(100..))]
     interval: u32,
 
-    /// GraphQL API server endpoint
+    /// gRPC API server endpoint (e.g. http://localhost:8686)
     #[arg(short, long)]
     url: Option<Url>,
 
-    /// Maximum number of events to sample each interval
-    #[arg(default_value = "100", short = 'l', long)]
+    /// Maximum number of events to sample each interval (must be >= 1)
+    #[arg(default_value = "100", short = 'l', long, value_parser = clap::value_parser!(u32).range(1..))]
     limit: u32,
 
     /// Encoding format for events printed to screen
@@ -77,21 +77,9 @@ impl Opts {
         }
     }
 
-    /// Use the provided URL as the Vector GraphQL API server, or default to the local port
+    /// Use the provided URL as the Vector gRPC API server, or default to the local port
     /// provided by the API config.
     pub fn url(&self) -> Url {
-        self.url.clone().unwrap_or_else(default_graphql_url)
-    }
-
-    /// URL with scheme set to WebSockets
-    pub fn web_socket_url(&self) -> Url {
-        let mut url = self.url();
-        url.set_scheme(match url.scheme() {
-            "https" => "wss",
-            _ => "ws",
-        })
-        .expect("Couldn't build WebSocket URL. Please report.");
-
-        url
+        self.url.clone().unwrap_or_else(default_grpc_url)
     }
 }
diff --git a/src/top/cmd.rs b/src/top/cmd.rs
index 6410063781549..e411712261920 100644
--- a/src/top/cmd.rs
+++ b/src/top/cmd.rs
@@ -3,9 +3,10 @@ use std::time::Duration;
 
 use chrono::Local;
 use futures_util::future::join_all;
+use http::Uri;
 use regex::Regex;
 use tokio::sync::{mpsc, oneshot};
-use vector_lib::api_client::{Client, connect_subscription_client};
+use vector_lib::api_client::{Client, RECONNECT_DELAY_MS};
 
 use vector_lib::top::{
     dashboard::{init_dashboard, is_tty},
@@ -13,26 +14,26 @@ use vector_lib::top::{
     state::{self, ConnectionStatus, EventType, State},
 };
 
-/// Delay (in milliseconds) before attempting to reconnect to the Vector API
-const RECONNECT_DELAY: u64 = 5000;
-
 /// CLI command func for displaying Vector components, and communicating with a local/remote
-/// Vector API server via HTTP/WebSockets
+/// Vector API server via gRPC
+#[allow(clippy::print_stderr)]
 pub async fn cmd(opts: &super::Opts) -> exitcode::ExitCode {
     // Exit early if the terminal is not a teletype
     if !is_tty() {
-        #[allow(clippy::print_stderr)]
-        {
-            eprintln!("Terminal must be a teletype (TTY) to display a Vector dashboard.");
-        }
+        eprintln!("Terminal must be a teletype (TTY) to display a Vector dashboard.");
         return exitcode::IOERR;
     }
 
     let url = opts.url();
+
     // Create a new API client for connecting to the local/remote Vector instance.
-    let client = Client::new(url.clone());
-    #[allow(clippy::print_stderr)]
-    if client.healthcheck().await.is_err() {
+    let Ok(uri) = url.as_str().parse::<Uri>() else {
+        eprintln!("Invalid API URL: {url}");
+        return exitcode::USAGE;
+    };
+    let mut client = Client::new(uri.clone());
+
+    if client.connect().await.is_err() || client.health().await.is_err() {
         eprintln!(
             indoc::indoc! {"
             Vector API server isn't reachable ({}).
@@ -48,11 +49,11 @@ pub async fn cmd(opts: &super::Opts) -> exitcode::ExitCode {
         return exitcode::UNAVAILABLE;
     }
 
-    top(opts, client, "Vector").await
+    top(opts, uri, "Vector").await
 }
 
 /// General monitoring
-pub async fn top(opts: &super::Opts, client: Client, dashboard_title: &str) -> exitcode::ExitCode {
+pub async fn top(opts: &super::Opts, uri: Uri, dashboard_title: &str) -> exitcode::ExitCode {
     // Channel for updating state via event messages
     let (tx, rx) = tokio::sync::mpsc::channel(20);
     let mut starting_state = State::new(BTreeMap::new());
@@ -68,7 +69,7 @@ pub async fn top(opts: &super::Opts, client: Client, dashboard_title: &str) -> e
     // Channel for shutdown signal
     let (shutdown_tx, shutdown_rx) = oneshot::channel::<()>();
 
-    let connection = tokio::spawn(subscription(opts.clone(), client, tx.clone(), shutdown_tx));
+    let connection = tokio::spawn(subscription(opts.clone(), uri, tx.clone(), shutdown_tx));
 
     // Initialize the dashboard
     match init_dashboard(
@@ -97,60 +98,67 @@ pub async fn top(opts: &super::Opts, client: Client, dashboard_title: &str) -> e
     }
 }
 
-// This task handles reconnecting the subscription client and all
-// subscriptions in the case of a web socket disconnect
+// This task handles reconnecting the gRPC client and all
+// subscriptions in the case of a connection failure
 async fn subscription(
     opts: super::Opts,
-    client: Client,
+    uri: Uri,
     tx: mpsc::Sender<EventType>,
     shutdown_tx: oneshot::Sender<()>,
 ) {
-    let ws_url = opts.web_socket_url();
-
     loop {
         // Initialize state. On future reconnects, we re-initialize state in
         // order to accurately capture added, removed, and edited
         // components.
-        let state = match metrics::init_components(&client, &opts.components).await {
+        let state = match metrics::init_components(uri.clone(), &opts.components).await {
             Ok(state) => state,
             Err(_) => {
-                tokio::time::sleep(Duration::from_millis(RECONNECT_DELAY)).await;
+                tokio::time::sleep(Duration::from_millis(RECONNECT_DELAY_MS)).await;
                 continue;
             }
         };
+        let initial_components = state
+            .components
+            .keys()
+            .map(|k| k.id().to_string())
+            .collect();
         _ = tx.send(EventType::InitializeState(state)).await;
 
-        let subscription_client = match connect_subscription_client(ws_url.clone()).await {
-            Ok(c) => c,
+        // Subscribe to updated metrics via gRPC streaming
+        let handles = match metrics::subscribe(
+            uri.clone(),
+            tx.clone(),
+            opts.interval as i64,
+            opts.components.clone(),
+            initial_components,
+        )
+        .await
+        {
+            Ok(handles) => handles,
             Err(_) => {
-                tokio::time::sleep(Duration::from_millis(RECONNECT_DELAY)).await;
+                tokio::time::sleep(Duration::from_millis(RECONNECT_DELAY_MS)).await;
                 continue;
             }
         };
 
-        // Subscribe to updated metrics
-        let finished = metrics::subscribe(
-            subscription_client,
-            tx.clone(),
-            opts.interval as i64,
-            opts.components.clone(),
-        );
-
         _ = tx
             .send(EventType::ConnectionUpdated(ConnectionStatus::Connected(
                 Local::now(),
             )))
             .await;
-        // Tasks spawned in metrics::subscribe finish when the subscription
-        // streams have completed. Currently, subscription streams only
-        // complete when the underlying web socket connection to the GraphQL
-        // server drops.
-        _ = join_all(finished).await;
+
+        // Wait for metric stream tasks to finish. poll_components is intentionally
+        // excluded: it runs indefinitely while get_components succeeds, so joining
+        // it here would prevent reconnection when metric streams fail first.
+        _ = join_all(handles.metric_handles).await;
+        handles.poll_handle.abort();
+
         _ = tx
             .send(EventType::ConnectionUpdated(
-                ConnectionStatus::Disconnected(RECONNECT_DELAY),
+                ConnectionStatus::Disconnected(RECONNECT_DELAY_MS),
             ))
             .await;
+
         if opts.no_reconnect {
             _ = shutdown_tx.send(());
             break;
diff --git a/src/top/mod.rs b/src/top/mod.rs
index 5fc101f7b13c6..c185e3193a64d 100644
--- a/src/top/mod.rs
+++ b/src/top/mod.rs
@@ -8,17 +8,17 @@ pub use cmd::{cmd, top};
 use url::Url;
 use vector_lib::top::state::{FilterColumn, SortColumn};
 
-use crate::config::api::default_graphql_url;
+use crate::config::api::default_grpc_url;
 
 /// Top options
 #[derive(Parser, Debug, Clone)]
 #[command(rename_all = "kebab-case")]
 pub struct Opts {
-    /// Interval to sample metrics at, in milliseconds
-    #[arg(default_value = "1000", short = 'i', long)]
+    /// Interval to sample metrics at, in milliseconds (must be >= 100)
+    #[arg(default_value = "1000", short = 'i', long, value_parser = clap::value_parser!(u32).range(100..))]
     interval: u32,
 
-    /// GraphQL API server endpoint
+    /// gRPC API server endpoint (e.g. http://localhost:8686)
     #[arg(short, long)]
     url: Option<Url>,
 
@@ -56,21 +56,9 @@ pub struct Opts {
 }
 
 impl Opts {
-    /// Use the provided URL as the Vector GraphQL API server, or default to the local port
+    /// Use the provided URL as the Vector gRPC API server, or default to the local port
     /// provided by the API config.
     pub fn url(&self) -> Url {
-        self.url.clone().unwrap_or_else(default_graphql_url)
-    }
-
-    /// URL with scheme set to WebSockets
-    pub fn web_socket_url(&self) -> Url {
-        let mut url = self.url();
-        url.set_scheme(match url.scheme() {
-            "https" => "wss",
-            _ => "ws",
-        })
-        .expect("Couldn't build WebSocket URL. Please report.");
-
-        url
+        self.url.clone().unwrap_or_else(default_grpc_url)
     }
 }
diff --git a/src/topology/controller.rs b/src/topology/controller.rs
index 53acc243a71f8..b77629828a577 100644
--- a/src/topology/controller.rs
+++ b/src/topology/controller.rs
@@ -39,7 +39,7 @@ pub struct TopologyController {
     pub config_paths: Vec<config::ConfigPath>,
     pub require_healthy: Option<bool>,
     #[cfg(feature = "api")]
-    pub api_server: Option<api::Server>,
+    pub api_server: Option<api::GrpcServer>,
     pub extra_context: ExtraContext,
 }
 
@@ -70,37 +70,39 @@ impl TopologyController {
         #[cfg(feature = "api")]
         if !new_config.api.enabled {
             if let Some(server) = self.api_server.take() {
-                debug!("Dropping api server.");
-                drop(server)
+                debug!("Stopping gRPC API server.");
+                drop(server);
             }
         } else if self.api_server.is_none() {
-            use std::sync::atomic::AtomicBool;
+            debug!("Starting gRPC API server.");
 
-            use tokio::runtime::Handle;
-
-            use crate::internal_events::ApiStarted;
-
-            debug!("Starting api server.");
-
-            self.api_server = match api::Server::start(
+            match api::GrpcServer::start(
                 self.topology.config(),
                 self.topology.watch(),
-                Arc::<AtomicBool>::clone(&self.topology.running),
-                &Handle::current(),
-            ) {
+                Arc::clone(&self.topology.running),
+            )
+            .await
+            {
                 Ok(api_server) => {
-                    emit!(ApiStarted {
-                        addr: new_config.api.address.unwrap(),
-                        playground: new_config.api.playground,
-                        graphql: new_config.api.graphql,
-                    });
-
-                    Some(api_server)
+                    let addr = api_server.addr();
+                    info!(
+                        message = "GRPC API server started.",
+                        addr = %addr,
+                    );
+                    self.api_server = Some(api_server);
                 }
                 Err(error) => {
-                    let error = error.to_string();
-                    error!("An error occurred that Vector couldn't handle: {}.", error);
-                    return ReloadOutcome::FatalError(ShutdownError::ApiFailed { error });
+                    let error_string = error.to_string();
+                    error!(
+                        message = "An error occurred that Vector couldn't handle.",
+                        error = %error_string,
+                        internal_log_rate_limit = false,
+                    );
+                    // Fail fast when API is explicitly enabled but fails to start
+                    // This ensures users don't run with a broken configuration thinking top/tap will work
+                    return ReloadOutcome::FatalError(ShutdownError::ApiFailed {
+                        error: error_string,
+                    });
                 }
             }
         }
@@ -111,12 +113,6 @@ impl TopologyController {
             .await
         {
             Ok(()) => {
-                #[cfg(feature = "api")]
-                // Pass the new config to the API server.
-                if let Some(ref api_server) = self.api_server {
-                    api_server.update_config(self.topology.config());
-                }
-
                 emit!(VectorReloaded {
                     config_paths: &self.config_paths
                 });
diff --git a/src/topology/running.rs b/src/topology/running.rs
index db667e4891110..6839379cd0f1a 100644
--- a/src/topology/running.rs
+++ b/src/topology/running.rs
@@ -58,6 +58,7 @@ pub struct RunningTopology {
     inputs_tap_metadata: HashMap<ComponentKey, Inputs<OutputId>>,
     outputs: HashMap<OutputId, ControlChannel>,
     outputs_tap_metadata: HashMap<ComponentKey, (&'static str, String)>,
+    component_type_names: HashMap<ComponentKey, String>,
     source_tasks: HashMap<ComponentKey, TaskHandle>,
     tasks: HashMap<ComponentKey, TaskHandle>,
     shutdown_coordinator: SourceShutdownCoordinator,
@@ -82,6 +83,7 @@ impl RunningTopology {
             inputs_tap_metadata: HashMap::new(),
             outputs: HashMap::new(),
             outputs_tap_metadata: HashMap::new(),
+            component_type_names: HashMap::new(),
             shutdown_coordinator: SourceShutdownCoordinator::default(),
             detach_triggers: HashMap::new(),
             source_tasks: HashMap::new(),
@@ -713,17 +715,20 @@ impl RunningTopology {
             for key in &diff.sources.to_remove {
                 // Sources only have outputs
                 self.outputs_tap_metadata.remove(key);
+                self.component_type_names.remove(key);
             }
 
             for key in &diff.transforms.to_remove {
                 // Transforms can have both inputs and outputs
                 self.outputs_tap_metadata.remove(key);
                 self.inputs_tap_metadata.remove(key);
+                self.component_type_names.remove(key);
             }
 
             for key in &diff.sinks.to_remove {
                 // Sinks only have inputs
                 self.inputs_tap_metadata.remove(key);
+                self.component_type_names.remove(key);
             }
 
             let removed_sinks = diff.enrichment_tables.to_remove.iter().filter(|key| {
@@ -749,8 +754,10 @@ impl RunningTopology {
 
             for key in diff.sources.changed_and_added() {
                 if let Some(task) = new_pieces.tasks.get(key) {
+                    let typetag = task.typetag().to_string();
                     self.outputs_tap_metadata
-                        .insert(key.clone(), ("source", task.typetag().to_string()));
+                        .insert(key.clone(), ("source", typetag.clone()));
+                    self.component_type_names.insert(key.clone(), typetag);
                 }
             }
 
@@ -771,8 +778,17 @@ impl RunningTopology {
 
             for key in diff.transforms.changed_and_added() {
                 if let Some(task) = new_pieces.tasks.get(key) {
+                    let typetag = task.typetag().to_string();
                     self.outputs_tap_metadata
-                        .insert(key.clone(), ("transform", task.typetag().to_string()));
+                        .insert(key.clone(), ("transform", typetag.clone()));
+                    self.component_type_names.insert(key.clone(), typetag);
+                }
+            }
+
+            for key in diff.sinks.changed_and_added() {
+                if let Some(task) = new_pieces.tasks.get(key) {
+                    self.component_type_names
+                        .insert(key.clone(), task.typetag().to_string());
                 }
             }
 
@@ -888,6 +904,11 @@ impl RunningTopology {
                     // Note, only sources and transforms are relevant. Sinks do
                     // not have outputs to tap.
                     removals,
+                    type_names: self
+                        .component_type_names
+                        .iter()
+                        .map(|(k, v)| (k.to_string(), v.clone()))
+                        .collect(),
                 })
                 .expect("Couldn't broadcast config changes.");
         }
diff --git a/tests/vector_api/harness.rs b/tests/vector_api/harness.rs
index 2ee288275cda0..274592fac5dae 100644
--- a/tests/vector_api/harness.rs
+++ b/tests/vector_api/harness.rs
@@ -21,7 +21,7 @@ use vector::test_util::{temp_dir, temp_file};
 use vector_lib::api_client::Client;
 
 // Constants
-pub const STARTUP_TIMEOUT: Duration = Duration::from_secs(2);
+pub const STARTUP_TIMEOUT: Duration = Duration::from_secs(10);
 pub const EVENT_PROCESSING_TIMEOUT: Duration = Duration::from_secs(30);
 
 /// Test harness for Vector instances with API enabled
@@ -112,14 +112,12 @@ impl TestHarness {
             .spawn()
             .map_err(|e| format!("Failed to spawn vector: {e}"))?;
 
-        let api_client = Client::new(
-            format!("http://127.0.0.1:{api_port}/graphql")
-                .parse()
-                .map_err(|e| format!("Invalid URL: {e}"))?,
-        );
+        let url = format!("http://127.0.0.1:{api_port}");
+        let mut api_client = Client::new(url.parse().expect("valid URL"));
 
         // Wait for Vector startup with crash detection
-        wait_for_startup(&mut vector, &api_client, STARTUP_TIMEOUT).await?;
+        // This will repeatedly try to connect until Vector is ready
+        wait_for_startup(&mut vector, &mut api_client, STARTUP_TIMEOUT).await?;
 
         Ok(Self {
             vector,
@@ -130,14 +128,9 @@ impl TestHarness {
         })
     }
 
-    /// Returns reference to the API client
-    pub fn api_client(&self) -> &Client {
-        &self.api_client
-    }
-
-    /// Returns the API port number
-    pub fn api_port(&self) -> u16 {
-        self.api_port
+    /// Returns mutable reference to the API client
+    pub fn api_client(&mut self) -> &mut Client {
+        &mut self.api_client
     }
 
     /// Reloads Vector configuration by sending SIGHUP or using watch mode
@@ -169,8 +162,16 @@ impl TestHarness {
                 .map_err(|e| format!("Failed to send SIGHUP: {e}"))?;
         }
 
+        // Give Vector a moment to process the reload signal before polling
+        sleep(Duration::from_millis(500)).await;
+
         // Poll for reload completion with crash detection
-        wait_for_topology_match(&mut self.vector, &self.api_client, expected_component_ids).await
+        wait_for_topology_match(
+            &mut self.vector,
+            &mut self.api_client,
+            expected_component_ids,
+        )
+        .await
     }
 
     /// Checks if Vector is still running
@@ -245,10 +246,11 @@ pub fn create_data_directory() -> PathBuf {
 /// Fails fast if Vector crashes, succeeds fast if API becomes ready quickly.
 pub async fn wait_for_startup(
     vector: &mut Child,
-    client: &Client,
+    client: &mut Client,
     timeout: Duration,
 ) -> Result<(), String> {
     let start = Instant::now();
+    let mut connected = false;
 
     loop {
         // Check if Vector crashed
@@ -263,8 +265,13 @@ pub async fn wait_for_startup(
             };
         }
 
-        // Check if API is ready
-        if client.healthcheck().await.is_ok() {
+        // Try to connect if not connected yet
+        if !connected && client.connect().await.is_ok() {
+            connected = true;
+        }
+
+        // Check if API is ready (only if connected)
+        if connected && client.health().await.is_ok() {
             return Ok(());
         }
 
@@ -284,12 +291,11 @@ pub async fn wait_for_startup(
 /// Combines topology polling with crash detection for reload scenarios.
 pub async fn wait_for_topology_match(
     vector: &mut Child,
-    client: &Client,
+    client: &mut Client,
     expected_component_ids: &[&str],
 ) -> Result<(), String> {
-    use vector_lib::api_client::gql::ComponentsQueryExt;
-
     let start = Instant::now();
+    let mut last_components: Vec<String> = Vec::new();
 
     loop {
         // Check if Vector crashed
@@ -298,20 +304,25 @@ pub async fn wait_for_topology_match(
         }
 
         // Query components to see if topology matches
-        if let Ok(result) = client.components_query(100).await
-            && let Some(data) = result.data
-        {
-            let mut current_ids: Vec<&str> = data
+        if let Ok(response) = client.get_components(100).await {
+            let mut current_ids: Vec<String> = response
                 .components
-                .edges
                 .iter()
-                .map(|e| e.node.component_id.as_str())
+                .map(|c| c.component_id.clone())
                 .collect();
             current_ids.sort_unstable();
 
-            let mut expected_sorted = expected_component_ids.to_vec();
+            let mut expected_sorted: Vec<String> = expected_component_ids
+                .iter()
+                .map(|s| s.to_string())
+                .collect();
             expected_sorted.sort_unstable();
 
+            // Track last seen components for better error reporting
+            if current_ids != last_components {
+                last_components = current_ids.clone();
+            }
+
             if current_ids == expected_sorted {
                 return Ok(());
             }
@@ -320,7 +331,8 @@ pub async fn wait_for_topology_match(
         // Check timeout
         if start.elapsed() >= STARTUP_TIMEOUT {
             return Err(format!(
-                "Topology did not match expected components within {STARTUP_TIMEOUT:?}"
+                "Topology did not match expected components within {STARTUP_TIMEOUT:?}. Last seen: {:?}, expected: {:?}",
+                last_components, expected_component_ids
             ));
         }
 
@@ -330,16 +342,14 @@ pub async fn wait_for_topology_match(
 
 /// Waits for a component to process the expected number of events
 ///
-/// Polls the GraphQL API until the component's sent_events_total
+/// Polls the gRPC API until the component's sent_events_total
 /// reaches or exceeds the expected count.
 pub async fn wait_for_component_events(
-    client: &Client,
+    client: &mut Client,
     component_id: &str,
     expected_events: i64,
     timeout: Duration,
 ) -> Result<i64, String> {
-    use vector_lib::api_client::gql::ComponentsQueryExt;
-
     let start = Instant::now();
     let mut last_count = 0;
 
@@ -350,20 +360,21 @@ pub async fn wait_for_component_events(
             ));
         }
 
-        let result = client
-            .components_query(100)
+        let response = client
+            .get_components(100)
             .await
             .map_err(|e| format!("Query failed: {e}"))?;
 
-        let data = result.data.ok_or("No data in response")?;
-
-        if let Some(component) = data
+        if let Some(component) = response
             .components
-            .edges
             .iter()
-            .find(|e| e.node.component_id == component_id)
+            .find(|c| c.component_id == component_id)
         {
-            let events = component.node.on.sent_events_total();
+            let events = component
+                .metrics
+                .as_ref()
+                .and_then(|m| m.sent_events_total)
+                .unwrap_or(0);
 
             if events != last_count {
                 last_count = events;
diff --git a/tests/vector_api/lib.rs b/tests/vector_api/lib.rs
index baafa332bc991..e82f39d41b42e 100644
--- a/tests/vector_api/lib.rs
+++ b/tests/vector_api/lib.rs
@@ -1,6 +1,6 @@
-//! Integration tests for Vector's GraphQL API
+//! Integration tests for Vector's gRPC API
 //!
-//! This test suite verifies the GraphQL API that powers both `vector top` and `vector tap` commands.
+//! This test suite verifies the gRPC API that powers both `vector top` and `vector tap` commands.
 //! Tests cover component discovery, metrics collection, event streaming, and config reloading.
 
 mod common;
diff --git a/tests/vector_api/tap.rs b/tests/vector_api/tap.rs
index d29a47b9775e5..fdb71d2fa48fa 100644
--- a/tests/vector_api/tap.rs
+++ b/tests/vector_api/tap.rs
@@ -1,119 +1,59 @@
 //! Integration tests for `vector tap` command
 //!
-//! Provides extensions for WebSocket subscriptions and tests for event streaming.
+//! Provides extensions for gRPC streaming and tests for event streaming.
 
 use super::{common::*, harness::*};
 use indoc::indoc;
 use std::time::{Duration, Instant};
 use tokio_stream::StreamExt;
-use vector_lib::api_client::{
-    connect_subscription_client,
-    gql::{
-        TapEncodingFormat, TapSubscriptionExt,
-        output_events_by_component_id_patterns_subscription::OutputEventsByComponentIdPatternsSubscriptionOutputEventsByComponentIdPatterns as TapEvent,
-    },
-};
+use vector_lib::api_client::proto::{StreamOutputEventsRequest, StreamOutputEventsResponse};
 
 pub const TAP_TIMEOUT: Duration = Duration::from_secs(10);
 
 impl TestHarness {
-    /// Returns WebSocket URL for subscriptions
-    fn websocket_url(&self) -> url::Url {
-        format!("ws://127.0.0.1:{}/graphql", self.api_port())
-            .parse()
-            .expect("Valid WebSocket URL")
-    }
-
-    /// Creates a tap subscription for the given patterns
+    /// Collects tap events from the given patterns
     ///
-    /// Uses sensible defaults: format=JSON, limit=1000, interval=100ms
-    pub async fn tap_subscription(
-        &self,
-        outputs_patterns: &[&str],
-        inputs_patterns: &[&str],
-    ) -> Result<TapSubscription, String> {
-        const DEFAULT_LIMIT: i64 = 1000;
-        const DEFAULT_INTERVAL_MS: i64 = 100;
-        let url = self.websocket_url();
-
-        let subscription_client = connect_subscription_client(url)
-            .await
-            .map_err(|e| format!("Failed to connect to WebSocket: {e}"))?;
-
-        let stream = subscription_client.output_events_by_component_id_patterns_subscription(
-            outputs_patterns.iter().map(|s| s.to_string()).collect(),
-            inputs_patterns.iter().map(|s| s.to_string()).collect(),
-            TapEncodingFormat::Json,
-            DEFAULT_LIMIT,
-            DEFAULT_INTERVAL_MS,
-        );
-
-        Ok(TapSubscription {
-            stream,
-            _client: subscription_client,
-        })
-    }
-
-    /// Creates a tap subscription and collects initial events
-    ///
-    /// Returns both the collected events and the subscription handle.
-    /// If you need to collect more events later, keep the handle; otherwise it will be dropped.
-    /// For input pattern filtering, use `tap_subscription` directly.
+    /// This is a simplified version that collects all events inline without storing a stream.
     pub async fn tap_and_collect(
-        &self,
+        &mut self,
         outputs_patterns: &[&str],
         count: usize,
-    ) -> Result<(Vec<TapEvent>, TapSubscription), String> {
-        let mut tap = self.tap_subscription(outputs_patterns, &[]).await?;
-        let events = tap.take_events(count, TAP_TIMEOUT).await?;
-        Ok((events, tap))
-    }
-}
-
-/// Wrapper around a tap subscription stream with helper methods
-pub struct TapSubscription {
-    stream: vector_lib::api_client::BoxedSubscription<
-        vector_lib::api_client::gql::OutputEventsByComponentIdPatternsSubscription,
-    >,
-    _client: vector_lib::api_client::SubscriptionClient, // Keep client alive!
-}
+    ) -> Result<Vec<StreamOutputEventsResponse>, String> {
+        const DEFAULT_LIMIT: i32 = 1000;
+        const DEFAULT_INTERVAL_MS: i32 = 100;
+
+        let request = StreamOutputEventsRequest {
+            outputs_patterns: outputs_patterns.iter().map(|s| s.to_string()).collect(),
+            inputs_patterns: vec![],
+            limit: DEFAULT_LIMIT,
+            interval_ms: DEFAULT_INTERVAL_MS,
+        };
+
+        let mut stream = self
+            .api_client()
+            .stream_output_events(request)
+            .await
+            .map_err(|e| format!("Failed to create tap stream: {e}"))?;
 
-impl TapSubscription {
-    /// Collects tap events until count is reached or timeout occurs
-    pub async fn take_events(
-        &mut self,
-        count: usize,
-        timeout: Duration,
-    ) -> Result<Vec<TapEvent>, String> {
         let start = Instant::now();
         let mut events = Vec::new();
 
         while events.len() < count {
-            if start.elapsed() >= timeout {
+            if start.elapsed() >= TAP_TIMEOUT {
                 return Err(format!(
                     "Timeout: collected {}/{} events in {:?}",
                     events.len(),
                     count,
-                    timeout
+                    TAP_TIMEOUT
                 ));
             }
 
-            match tokio::time::timeout(timeout - start.elapsed(), self.stream.as_mut().next()).await
-            {
-                Ok(Some(Some(response))) => {
-                    if let Some(data) = response.data {
-                        for event in data.output_events_by_component_id_patterns {
-                            events.push(event);
-                        }
-                    } else if let Some(errors) = response.errors
-                        && !errors.is_empty()
-                    {
-                        return Err(format!("GraphQL errors: {:?}", errors));
-                    }
+            match tokio::time::timeout(TAP_TIMEOUT - start.elapsed(), stream.next()).await {
+                Ok(Some(Ok(event))) => {
+                    events.push(event);
                 }
-                Ok(Some(None)) => {
-                    // No response in this poll, continue
-                    continue;
+                Ok(Some(Err(e))) => {
+                    return Err(format!("Stream error: {}", e));
                 }
                 Ok(None) => {
                     return Err(format!(
@@ -138,72 +78,70 @@ impl TapSubscription {
 #[tokio::test]
 async fn tap_receives_events() {
     let config = single_source_config("demo", 0.01, Some(100));
-    let harness = TestHarness::new(&config)
+    let mut harness = TestHarness::new(&config)
         .await
         .expect("Failed to start Vector");
 
     // Tap the source output with wildcard pattern and collect events
-    let (events, _tap) = harness
+    let events = harness
         .tap_and_collect(&["*"], 10)
         .await
         .expect("Should receive events");
 
     assert!(!events.is_empty(), "Should receive at least one event");
 
-    // Verify we got at least one log event (not just notifications)
-    let log_events: Vec<_> = events
+    // Verify we got at least one tapped event (not just notifications)
+    use vector_lib::api_client::proto::stream_output_events_response::Event;
+    let tapped_events: Vec<_> = events
         .iter()
-        .filter_map(|e| {
-            if let TapEvent::Log(log) = e {
-                Some(log)
-            } else {
-                None
-            }
+        .filter_map(|e| match &e.event {
+            Some(Event::TappedEvent(tapped)) => Some(tapped),
+            _ => None,
         })
         .collect();
 
+    let notification_count = events
+        .iter()
+        .filter(|e| matches!(&e.event, Some(Event::Notification(_))))
+        .count();
+
     assert!(
-        !log_events.is_empty(),
-        "Should receive at least one log event, got {} events total ({} notifications)",
+        !tapped_events.is_empty(),
+        "Should receive at least one tapped event, got {} events total ({} notifications)",
         events.len(),
-        events
-            .iter()
-            .filter(|e| matches!(e, TapEvent::EventNotification(_)))
-            .count()
+        notification_count
     );
 }
 
 #[tokio::test]
 async fn tap_specific_component() {
     let config = dual_source_config("demo1", "demo2", 0.01, Some(100));
-    let harness = TestHarness::new(&config)
+    let mut harness = TestHarness::new(&config)
         .await
         .expect("Failed to start Vector");
 
     // Tap only demo1, not demo2
-    let (events, _tap) = harness
+    let events = harness
         .tap_and_collect(&["demo1"], 10)
         .await
         .expect("Should receive events");
 
     // Verify we only got events from demo1
-    let log_events: Vec<_> = events
+    use vector_lib::api_client::proto::stream_output_events_response::Event;
+    let tapped_events: Vec<_> = events
         .iter()
-        .filter_map(|e| {
-            if let TapEvent::Log(log) = e {
-                Some(log)
-            } else {
-                None
-            }
+        .filter_map(|e| match &e.event {
+            Some(Event::TappedEvent(tapped)) => Some(tapped),
+            _ => None,
         })
         .collect();
 
-    assert!(!log_events.is_empty(), "Should receive log events");
+    assert!(!tapped_events.is_empty(), "Should receive tapped events");
 
-    // All log events should be from demo1
-    for log in &log_events {
+    // All tapped events should be from demo1
+    for tapped in &tapped_events {
         assert_eq!(
-            log.component_id, "demo1",
+            tapped.component_id, "demo1",
             "Should only receive events from demo1"
         );
     }
@@ -211,88 +149,106 @@ async fn tap_specific_component() {
 
 #[tokio::test]
 async fn tap_survives_config_reload() {
-    let config = single_source_config("demo", 0.05, Some(100));
+    use vector_lib::api_client::proto::stream_output_events_response::Event;
+
+    let config = single_source_config("demo", 0.05, None); // No count limit - runs continuously
     let mut harness = TestHarness::new(&config)
         .await
         .expect("Failed to start Vector");
 
-    // Start tap with wildcard and collect initial events
-    let (initial_events, mut tap) = harness
-        .tap_and_collect(&["*"], 5)
+    // Open the stream ONCE and keep it alive across the reload.
+    // tonic channels are Arc-based so the returned stream is owned and does not
+    // borrow `harness`, allowing us to call reload_with_config below.
+    let request = StreamOutputEventsRequest {
+        outputs_patterns: vec!["*".to_string()],
+        inputs_patterns: vec![],
+        limit: 1000,
+        interval_ms: 100,
+    };
+    let mut stream = harness
+        .api_client()
+        .stream_output_events(request)
         .await
-        .expect("Should receive initial events");
-
-    assert!(!initial_events.is_empty(), "Should receive initial events");
+        .expect("Failed to open tap stream");
+
+    // Collect a few pre-reload events to confirm the stream is working
+    let mut pre_reload_count = 0;
+    let start = Instant::now();
+    while pre_reload_count < 5 {
+        assert!(
+            start.elapsed() < TAP_TIMEOUT,
+            "Timeout waiting for pre-reload events"
+        );
+        match tokio::time::timeout(TAP_TIMEOUT - start.elapsed(), stream.next()).await {
+            Ok(Some(Ok(_))) => pre_reload_count += 1,
+            Ok(Some(Err(e))) => panic!("Stream error before reload: {e}"),
+            Ok(None) => panic!("Stream ended unexpectedly before reload"),
+            Err(_) => panic!("Timeout before reload"),
+        }
+    }
 
-    // Reload config with a new component
+    // Reload with completely new components
     harness
         .reload_with_config(
             indoc! {"
                 sources:
-                  demo:
+                  tap_demo1:
                     type: demo_logs
                     format: json
                     interval: 0.05
-                    count: 100
 
-                  new_demo:
+                  tap_demo2:
                     type: demo_logs
                     format: json
                     interval: 0.05
-                    count: 100
 
                 sinks:
-                  blackhole:
+                  tap_blackhole:
                     type: blackhole
-                    inputs: ['demo', 'new_demo']
+                    inputs: ['tap_demo1', 'tap_demo2']
             "},
-            &["demo", "new_demo", "blackhole"],
+            &["tap_demo1", "tap_demo2", "tap_blackhole"],
         )
         .await
         .expect("Failed to reload config");
 
-    // Tap should still work and see events from both sources
-    let after_reload = tap
-        .take_events(5, TAP_TIMEOUT)
-        .await
-        .expect("Should receive events after reload");
-
-    assert!(
-        !after_reload.is_empty(),
-        "Should receive events after reload"
-    );
-
-    let log_events: Vec<_> = after_reload
-        .iter()
-        .filter_map(|e| {
-            if let TapEvent::Log(log) = e {
-                Some(log)
-            } else {
-                None
+    // Continue reading from the SAME stream. If the tap implementation drops active
+    // streams on reload, stream.next() will return None and the test will fail.
+    let mut post_reload_count = 0;
+    let start = Instant::now();
+    while post_reload_count < 5 {
+        assert!(
+            start.elapsed() < TAP_TIMEOUT,
+            "Stream did not survive reload: only received {post_reload_count} tapped events after reload"
+        );
+        match tokio::time::timeout(TAP_TIMEOUT - start.elapsed(), stream.next()).await {
+            Ok(Some(Ok(event))) => {
+                if matches!(&event.event, Some(Event::TappedEvent(_))) {
+                    post_reload_count += 1;
+                }
+                // Notifications (component added/removed) are expected during reload - skip them
             }
-        })
-        .collect();
-
-    assert!(
-        !log_events.is_empty(),
-        "Should receive log events after reload"
-    );
+            Ok(Some(Err(e))) => panic!("Stream error after reload: {e}"),
+            Ok(None) => panic!("Stream was closed on reload - tap subscription was dropped"),
+            Err(_) => panic!("Timeout waiting for post-reload tapped events"),
+        }
+    }
 }
 
 #[tokio::test]
 async fn multiple_concurrent_subscriptions() {
     let config = dual_source_config("demo1", "demo2", 0.01, Some(100));
-    let harness = TestHarness::new(&config)
+    let mut harness = TestHarness::new(&config)
         .await
         .expect("Failed to start Vector");
 
-    // Create two separate tap subscriptions using the same harness
-    let (events1, _tap1) = harness
+    // Create two separate tap requests using the same harness
+    let events1 = harness
         .tap_and_collect(&["demo1"], 5)
         .await
         .expect("Should receive events from tap1");
 
-    let (events2, _tap2) = harness
+    let events2 = harness
         .tap_and_collect(&["demo2"], 5)
         .await
         .expect("Should receive events from tap2");
@@ -313,62 +269,57 @@ async fn multiple_concurrent_subscriptions() {
     );
 
     // Verify tap1 only sees demo1
-    let log_events1: Vec<_> = events1
+    use vector_lib::api_client::proto::stream_output_events_response::Event;
+    let tapped_events1: Vec<_> = events1
         .iter()
-        .filter_map(|e| {
-            if let TapEvent::Log(log) = e {
-                Some(log)
-            } else {
-                None
-            }
+        .filter_map(|e| match &e.event {
+            Some(Event::TappedEvent(tapped)) => Some(tapped),
+            _ => None,
         })
         .collect();
 
-    for log in &log_events1 {
+    for tapped in &tapped_events1 {
         assert_eq!(
-            log.component_id, "demo1",
+            tapped.component_id, "demo1",
             "Tap1 should only see demo1 events"
         );
     }
 
     // Verify tap2 only sees demo2
-    let log_events2: Vec<_> = events2
+    let tapped_events2: Vec<_> = events2
         .iter()
-        .filter_map(|e| {
-            if let TapEvent::Log(log) = e {
-                Some(log)
-            } else {
-                None
-            }
+        .filter_map(|e| match &e.event {
+            Some(Event::TappedEvent(tapped)) => Some(tapped),
+            _ => None,
         })
         .collect();
 
-    for log in &log_events2 {
+    for tapped in &tapped_events2 {
         assert_eq!(
-            log.component_id, "demo2",
+            tapped.component_id, "demo2",
             "Tap2 should only see demo2 events"
         );
     }
 
     // Verify we got different sets of events
     assert_ne!(
-        log_events1.len(),
+        tapped_events1.len(),
         0,
-        "Should have some log events from demo1"
+        "Should have some tapped events from demo1"
     );
     assert_ne!(
-        log_events2.len(),
+        tapped_events2.len(),
         0,
-        "Should have some log events from demo2"
+        "Should have some tapped events from demo2"
     );
 
     // Create new taps to the same components to verify repeatability
-    let (events1_again, _tap1_again) = harness
+    let events1_again = harness
         .tap_and_collect(&["demo1"], 5)
         .await
         .expect("Should receive events from tap1 again");
 
-    let (events2_again, _tap2_again) = harness
+    let events2_again = harness
         .tap_and_collect(&["demo2"], 5)
         .await
         .expect("Should receive events from tap2 again");
@@ -384,47 +335,41 @@ async fn multiple_concurrent_subscriptions() {
     );
 
     // Verify component isolation is maintained
-    let log_events1_again: Vec<_> = events1_again
+    let tapped_events1_again: Vec<_> = events1_again
         .iter()
-        .filter_map(|e| {
-            if let TapEvent::Log(log) = e {
-                Some(log)
-            } else {
-                None
-            }
+        .filter_map(|e| match &e.event {
+            Some(Event::TappedEvent(tapped)) => Some(tapped),
+            _ => None,
         })
         .collect();
 
-    let log_events2_again: Vec<_> = events2_again
+    let tapped_events2_again: Vec<_> = events2_again
         .iter()
-        .filter_map(|e| {
-            if let TapEvent::Log(log) = e {
-                Some(log)
-            } else {
-                None
-            }
+        .filter_map(|e| match &e.event {
+            Some(Event::TappedEvent(tapped)) => Some(tapped),
+            _ => None,
         })
         .collect();
 
     assert!(
-        !log_events1_again.is_empty(),
-        "Should have log events from demo1 again"
+        !tapped_events1_again.is_empty(),
+        "Should have tapped events from demo1 again"
     );
     assert!(
-        !log_events2_again.is_empty(),
-        "Should have log events from demo2 again"
+        !tapped_events2_again.is_empty(),
+        "Should have tapped events from demo2 again"
     );
 
-    for log in &log_events1_again {
+    for tapped in &tapped_events1_again {
         assert_eq!(
-            log.component_id, "demo1",
+            tapped.component_id, "demo1",
             "Second tap1 should only see demo1 events"
         );
     }
 
-    for log in &log_events2_again {
+    for tapped in &tapped_events2_again {
         assert_eq!(
-            log.component_id, "demo2",
+            tapped.component_id, "demo2",
             "Second tap2 should only see demo2 events"
         );
     }
diff --git a/tests/vector_api/top.rs b/tests/vector_api/top.rs
index 0c85e53b7e21f..79e94a094785c 100644
--- a/tests/vector_api/top.rs
+++ b/tests/vector_api/top.rs
@@ -1,40 +1,37 @@
 //! Integration tests for `vector top` command
 //!
-//! Provides extensions for GraphQL queries and tests for component discovery,
+//! Provides extensions for gRPC queries and tests for component discovery,
 //! metrics collection, and config reloading.
 
 use super::{common::*, harness::*};
 use indoc::indoc;
+use tokio_stream::StreamExt;
+use vector_lib::api_client::proto::{
+    GetComponentsResponse, MetricName, stream_component_metrics_response::Value,
+};
 
 impl TestHarness {
-    /// Queries all components from the GraphQL API
-    pub async fn query_components(
-        &self,
-    ) -> Result<vector_lib::api_client::gql::components_query::ResponseData, String> {
-        use vector_lib::api_client::gql::ComponentsQueryExt;
-
+    /// Queries all components from the gRPC API
+    pub async fn query_components(&mut self) -> Result<GetComponentsResponse, String> {
         self.api_client()
-            .components_query(100)
+            .get_components(100)
             .await
-            .map_err(|e| format!("Query failed: {e}"))?
-            .data
-            .ok_or_else(|| "No data in response".to_string())
+            .map_err(|e| format!("Query failed: {e}"))
     }
 
-    /// Queries component IDs from the GraphQL API
-    pub async fn query_component_ids(&self) -> Result<Vec<String>, String> {
-        let data = self.query_components().await?;
-        Ok(data
+    /// Queries component IDs from the gRPC API
+    pub async fn query_component_ids(&mut self) -> Result<Vec<String>, String> {
+        let response = self.query_components().await?;
+        Ok(response
             .components
-            .edges
             .iter()
-            .map(|e| e.node.component_id.clone())
+            .map(|c| c.component_id.clone())
             .collect())
     }
 
     /// Waits for a component to process at least the expected number of events
     pub async fn wait_for_events(
-        &self,
+        &mut self,
         component_id: &str,
         expected_events: i64,
     ) -> Result<i64, String> {
@@ -56,7 +53,7 @@ impl TestHarness {
 async fn displays_pipeline_topology_and_metrics() {
     const EXPECTED_EVENTS: i64 = 100;
 
-    let runner = TestHarness::new(indoc! {"
+    let mut runner = TestHarness::new(indoc! {"
         sources:
           demo:
             type: demo_logs
@@ -93,47 +90,57 @@ async fn displays_pipeline_topology_and_metrics() {
     assert_eq!(component_ids.len(), 3);
 
     // Query full component data for types and metrics
-    let data = runner
+    let response = runner
         .query_components()
         .await
         .expect("Failed to query components");
 
     // Verify component types are reported correctly
-    for edge in &data.components.edges {
-        let component_id = &edge.node.component_id;
-        let component_type = edge.node.on.to_string();
+    use vector_lib::api_client::proto::ComponentType;
+    for component in &response.components {
+        let component_id = &component.component_id;
+        let component_type =
+            ComponentType::try_from(component.component_type).expect("Valid component type");
 
         match component_id.as_str() {
-            "demo" => assert_eq!(component_type, "source"),
-            "blackhole1" | "blackhole2" => assert_eq!(component_type, "sink"),
+            "demo" => assert_eq!(component_type, ComponentType::Source),
+            "blackhole1" | "blackhole2" => assert_eq!(component_type, ComponentType::Sink),
             _ => panic!("Unexpected component: {}", component_id),
         }
     }
 
     // Verify source sent events
-    let source = data
+    let source = response
         .components
-        .edges
         .iter()
-        .find(|e| e.node.component_id == "demo")
+        .find(|c| c.component_id == "demo")
         .expect("Should find source");
 
-    assert!(source.node.on.sent_events_total() >= EXPECTED_EVENTS);
+    let sent_events = source
+        .metrics
+        .as_ref()
+        .and_then(|m| m.sent_events_total)
+        .unwrap_or(0);
+    assert!(sent_events >= EXPECTED_EVENTS);
 
     // Verify at least one sink received events
-    let sink1 = data
+    let sink1 = response
         .components
-        .edges
         .iter()
-        .find(|e| e.node.component_id == "blackhole1")
+        .find(|c| c.component_id == "blackhole1")
         .expect("Should find sink1");
 
-    assert!(sink1.node.on.received_events_total() >= EXPECTED_EVENTS);
+    let received_events = sink1
+        .metrics
+        .as_ref()
+        .and_then(|m| m.received_events_total)
+        .unwrap_or(0);
+    assert!(received_events >= EXPECTED_EVENTS);
 }
 
 #[tokio::test]
 async fn config_reload_updates_components() {
-    // Initial config: 1 source -> 1 sink
+    // Initial config: 1 source -> 1 sink (runs continuously)
     let config = single_source_config("demo1", 0.1, None);
     let mut runner = TestHarness::new(&config)
         .await
@@ -146,81 +153,83 @@ async fn config_reload_updates_components() {
     assert!(component_ids.contains(&"blackhole".to_string()));
     assert_eq!(component_ids.len(), 2);
 
-    // RELOAD 1: Add components
+    // RELOAD 1: Replace with completely new set
     runner
         .reload_with_config(
             indoc! {"
                 sources:
-                  demo1:
+                  new_demo1:
                     type: demo_logs
                     format: json
                     interval: 0.1
 
-                  demo2:
+                  new_demo2:
                     type: demo_logs
                     format: json
                     interval: 0.1
 
                 sinks:
-                  blackhole1:
+                  new_blackhole1:
                     type: blackhole
-                    inputs: ['demo1']
+                    inputs: ['new_demo1']
 
-                  blackhole2:
+                  new_blackhole2:
                     type: blackhole
-                    inputs: ['demo2']
+                    inputs: ['new_demo2']
             "},
-            &["demo1", "demo2", "blackhole1", "blackhole2"],
+            &["new_demo1", "new_demo2", "new_blackhole1", "new_blackhole2"],
         )
         .await
         .expect("Failed to reload config");
 
-    // Verify additions
+    // Verify old components removed and new ones added
     assert!(runner.check_running(), "Vector should still be running");
 
     let component_ids = runner.query_component_ids().await.expect("Failed to query");
 
-    assert!(component_ids.contains(&"demo1".to_string()));
-    assert!(component_ids.contains(&"demo2".to_string()));
-    assert!(component_ids.contains(&"blackhole1".to_string()));
-    assert!(component_ids.contains(&"blackhole2".to_string()));
+    assert!(!component_ids.contains(&"demo1".to_string()));
+    assert!(!component_ids.contains(&"blackhole".to_string()));
+    assert!(component_ids.contains(&"new_demo1".to_string()));
+    assert!(component_ids.contains(&"new_demo2".to_string()));
+    assert!(component_ids.contains(&"new_blackhole1".to_string()));
+    assert!(component_ids.contains(&"new_blackhole2".to_string()));
     assert_eq!(component_ids.len(), 4);
 
     // Verify new components are processing events
     runner
-        .wait_for_events("demo2", 10)
+        .wait_for_events("new_demo1", 10)
         .await
         .expect("New source should process events");
 
-    // RELOAD 2: Replace with completely new components (same count, different names)
+    // RELOAD 2: Scale back down to single component
     runner
         .reload_with_config(
             indoc! {"
                 sources:
-                  new_demo:
+                  final_demo:
                     type: demo_logs
                     format: json
                     interval: 0.1
 
                 sinks:
-                  new_blackhole:
+                  final_blackhole:
                     type: blackhole
-                    inputs: ['new_demo']
+                    inputs: ['final_demo']
             "},
-            &["new_demo", "new_blackhole"],
+            &["final_demo", "final_blackhole"],
         )
         .await
         .expect("Failed to reload config");
 
-    // Verify old components removed and new ones added
+    // Verify all previous components removed and final ones added
     let component_ids = runner.query_component_ids().await.expect("Failed to query");
 
-    assert!(!component_ids.contains(&"demo1".to_string()));
-    assert!(!component_ids.contains(&"demo2".to_string()));
-    assert!(!component_ids.contains(&"blackhole1".to_string()));
-    assert!(!component_ids.contains(&"blackhole2".to_string()));
-    assert!(component_ids.contains(&"new_demo".to_string()));
-    assert!(component_ids.contains(&"new_blackhole".to_string()));
+    assert!(!component_ids.contains(&"new_demo1".to_string()));
+    assert!(!component_ids.contains(&"new_demo2".to_string()));
+    assert!(!component_ids.contains(&"new_blackhole1".to_string()));
+    assert!(!component_ids.contains(&"new_blackhole2".to_string()));
+    assert!(component_ids.contains(&"final_demo".to_string()));
+    assert!(component_ids.contains(&"final_blackhole".to_string()));
     assert_eq!(component_ids.len(), 2);
 }
 
@@ -233,33 +242,171 @@ async fn watch_mode_auto_reloads() {
         .expect("Failed to start Vector");
 
     // Verify initial state: 1 source + 1 sink
-    let data = runner.query_components().await.expect("Failed to query");
-    assert_eq!(data.components.edges.len(), 2);
+    let response = runner.query_components().await.expect("Failed to query");
+    assert_eq!(response.components.len(), 2);
 
     // Modify config file - Vector should auto-reload (no SIGHUP needed!)
+    // Use completely new component names to avoid reload issues
     runner
         .reload_with_config(
             indoc! {"
                 sources:
-                  demo:
+                  watch_demo1:
                     type: demo_logs
                     format: json
                     interval: 0.1
 
-                  demo2:
+                  watch_demo2:
                     type: demo_logs
                     format: json
                     interval: 0.1
 
                 sinks:
-                  blackhole:
+                  watch_blackhole:
                     type: blackhole
-                    inputs: ['demo', 'demo2']
+                    inputs: ['watch_demo1', 'watch_demo2']
             "},
-            &["demo", "demo2", "blackhole"],
+            &["watch_demo1", "watch_demo2", "watch_blackhole"],
         )
         .await
         .expect("Watch mode reload failed");
 
+    // Verify reload worked
+    let component_ids = runner.query_component_ids().await.expect("Failed to query");
+    assert_eq!(component_ids.len(), 3);
+
     // Cleanup happens automatically via Drop
 }
+
+#[tokio::test]
+async fn multi_output_transform_reports_per_output_sent_events() {
+    // Pipeline: demo_logs -> route (two named outputs) -> two blackhole sinks
+    // The route transform splits events into "all" (everything) and "has_host" (subset).
+    // We verify that:
+    //   1. GetComponents reports two Output entries for the route transform
+    //   2. StreamComponentSentEventsTotal populates output_totals for the route transform
+    const EXPECTED_EVENTS: i64 = 50;
+
+    let mut runner = TestHarness::new(indoc! {"
+        sources:
+          demo:
+            type: demo_logs
+            format: json
+            interval: 0.01
+
+        transforms:
+          splitter:
+            type: route
+            inputs: ['demo']
+            route:
+              all: 'true'
+              has_host: 'exists(.host)'
+
+        sinks:
+          sink_all:
+            type: blackhole
+            inputs: ['splitter.all']
+
+          sink_has_host:
+            type: blackhole
+            inputs: ['splitter.has_host']
+    "})
+    .await
+    .expect("Failed to start Vector");
+
+    // Wait for events to reach the sinks
+    runner
+        .wait_for_events("demo", EXPECTED_EVENTS)
+        .await
+        .expect("Source never sent expected events");
+
+    // --- Assert 1: GetComponents reports per-output entries for the route transform ---
+    let response = runner
+        .query_components()
+        .await
+        .expect("Failed to query components");
+
+    let splitter = response
+        .components
+        .iter()
+        .find(|c| c.component_id == "splitter")
+        .expect("splitter transform not found");
+
+    // Route transform must report at least 2 named outputs
+    assert!(
+        splitter.outputs.len() >= 2,
+        "Expected >= 2 outputs for route transform, got {}",
+        splitter.outputs.len()
+    );
+
+    let output_ids: Vec<&str> = splitter
+        .outputs
+        .iter()
+        .map(|o| o.output_id.as_str())
+        .collect();
+    assert!(
+        output_ids.contains(&"all"),
+        "Missing 'all' output, got: {:?}",
+        output_ids
+    );
+    assert!(
+        output_ids.contains(&"has_host"),
+        "Missing 'has_host' output, got: {:?}",
+        output_ids
+    );
+
+    // --- Assert 2: StreamComponentMetrics(SentEventsTotal) populates output_totals ---
+    let mut stream = runner
+        .api_client()
+        .stream_component_metrics(MetricName::SentEventsTotal, 500)
+        .await
+        .expect("Failed to open sent_events_total stream");
+
+    // Drain stream updates until we get output_totals for the splitter, or timeout
+    let deadline = tokio::time::Instant::now() + EVENT_PROCESSING_TIMEOUT;
+    let mut splitter_totals_found = false;
+
+    while tokio::time::Instant::now() < deadline {
+        match tokio::time::timeout(std::time::Duration::from_millis(600), stream.next()).await {
+            Ok(Some(Ok(msg))) => {
+                if msg.component_id == "splitter"
+                    && let Some(Value::Total(total)) = msg.value
+                    && !total.output_totals.is_empty()
+                {
+                    // Both named outputs must be present with positive counts
+                    let all_total = total.output_totals.get("all").copied().unwrap_or(0);
+                    let has_host_total = total.output_totals.get("has_host").copied().unwrap_or(0);
+
+                    assert!(
+                        all_total > 0,
+                        "Expected positive total for 'all' output, got {}",
+                        all_total
+                    );
+                    assert!(
+                        has_host_total > 0,
+                        "Expected positive total for 'has_host' output, got {}",
+                        has_host_total
+                    );
+                    // "all" must be >= "has_host" since it matches every event
+                    assert!(
+                        all_total >= has_host_total,
+                        "'all' ({}) should be >= 'has_host' ({})",
+                        all_total,
+                        has_host_total
+                    );
+
+                    splitter_totals_found = true;
+                    break;
+                }
+            }
+            Ok(Some(Err(e))) => panic!("Stream error: {e}"),
+            Ok(None) => panic!("Stream ended unexpectedly"),
+            Err(_) => continue, // timeout on this tick, keep looping
+        }
+    }
+
+    assert!(
+        splitter_totals_found,
+        "Never received non-empty output_totals for splitter transform within timeout"
+    );
+}
diff --git a/website/content/en/blog/graphql-api.md b/website/content/en/blog/graphql-api.md
index 92692735e90a2..f623c4caa921d 100644
--- a/website/content/en/blog/graphql-api.md
+++ b/website/content/en/blog/graphql-api.md
@@ -9,6 +9,8 @@ badges:
 tags: ["graphql", "api", "metrics"]
 ---
 
+{{< grpc-migration-warning >}}
+
 Although Vector is an observability tool, it's nonetheless important to be able
 to observe Vector itself, especially in production environments where it serves
 as critical infrastructure. That's why we're excited to announce the new [Vector
diff --git a/website/content/en/docs/reference/api.md b/website/content/en/docs/reference/api.md
index a28724feeb0a7..11a3566f6acfa 100644
--- a/website/content/en/docs/reference/api.md
+++ b/website/content/en/docs/reference/api.md
@@ -1,11 +1,12 @@
 ---
-title: The Vector API
+title: The Vector Observability API
 short: API
 weight: 6
-tags: ["api", "graphql"]
+tags: ["api", "grpc"]
 ---
 
-Vector ships with a [GraphQL] API that allows you to interact with a running Vector instance. This page covers how to configure and enable Vector's API.
+Vector ships with a [gRPC](https://grpc.io) API that allows you to interact with a running Vector
+instance. This page covers how to configure and enable Vector's API.
 
 ## Configuration
 
@@ -17,12 +18,20 @@ Vector ships with a [GraphQL] API that allows you to interact with a running Vec
 
 ## How it works
 
-### GraphQL
+The API exposes a gRPC service defined in [`proto/vector/observability.proto`](https://github.com/vectordotdev/vector/blob/master/proto/vector/observability.proto).
+You can interact with it using any standard gRPC tooling.
 
-Vector chose [GraphQL] for its API because GraphQL is self-documenting and type safe. We believe that this offers a superior client experience and makes Vector richly programmable through its API.
+### Example using grpcurl
 
-### Playground
+```bash
+# Check health
+grpcurl -plaintext localhost:8686 vector.observability.v1.ObservabilityService/Health
 
-Vector's GraphQL API ships with a built-in playground that allows you to explore the available commands and manually run queries against the API. This can be accessed at the `/playground` path.
+# List components
+grpcurl -plaintext localhost:8686 vector.observability.v1.ObservabilityService/GetComponents
 
-[graphql]: https://graphql.org
+# Stream events (tap)
+grpcurl -plaintext \
+  -d '{"outputs_patterns": ["*"], "limit": 100, "interval_ms": 500}' \
+  localhost:8686 vector.observability.v1.ObservabilityService/StreamOutputEvents
+```
diff --git a/website/content/en/docs/reference/configuration/api.md b/website/content/en/docs/reference/configuration/api.md
index e3ba6a0372ff7..068968d900e6d 100644
--- a/website/content/en/docs/reference/configuration/api.md
+++ b/website/content/en/docs/reference/configuration/api.md
@@ -7,7 +7,8 @@ show_toc: true
 
 This page documents the configuration for Vector's observability API.
 
-The API enables you to query Vector's topology, metrics, and health information through a GraphQL endpoint, as well as access an interactive GraphQL playground for development.
+The API enables you to query Vector's topology, metrics, and health information
+through a gRPC endpoint.
 
 {{< config-cross-links group="api" >}}
 
diff --git a/website/content/en/highlights/2020-12-23-graphql-api.md b/website/content/en/highlights/2020-12-23-graphql-api.md
index 7873c32482560..70c40ebfac28a 100644
--- a/website/content/en/highlights/2020-12-23-graphql-api.md
+++ b/website/content/en/highlights/2020-12-23-graphql-api.md
@@ -11,6 +11,8 @@ badges:
   domains: ["api"]
 ---
 
+{{< grpc-migration-warning >}}
+
 Vector now has a [GraphQL] API that you can use for a variety of purposes:
 
 * To view Vector's internal metrics
diff --git a/website/content/en/highlights/2020-12-23-vector-top.md b/website/content/en/highlights/2020-12-23-vector-top.md
index 1b99b30cc62e5..138c6344aae5a 100644
--- a/website/content/en/highlights/2020-12-23-vector-top.md
+++ b/website/content/en/highlights/2020-12-23-vector-top.md
@@ -12,6 +12,8 @@ badges:
   domains: ["cli", "observability"]
 ---
 
+{{< grpc-migration-warning >}}
+
 [`vector top`][top] is a command for the Vector [CLI] that displays both metrics emitted by your Vector instance as well
 as information about your Vector [topology] through a beautiful dashboard-style interface reminiscent of tools like
 [htop]. To use it, run `vector top` and specify the URL of the running Vector instance you want to monitor:
diff --git a/website/content/en/highlights/2021-04-21-vector-tap.md b/website/content/en/highlights/2021-04-21-vector-tap.md
index 867bd0f445f1c..be234b5ac9d89 100644
--- a/website/content/en/highlights/2021-04-21-vector-tap.md
+++ b/website/content/en/highlights/2021-04-21-vector-tap.md
@@ -11,6 +11,8 @@ badges:
   domains: ["graphql", "cli", "observability"]
 ---
 
+{{< grpc-migration-warning >}}
+
 Vector 0.13 introduces a new [`vector tap`][tap] subcommand that allows for
 tapping into the events flowing through Vector. This can be used to "live tail"
 events while troubleshooting incidents events or simply to debug your Vector
diff --git a/website/cue/reference/api.cue b/website/cue/reference/api.cue
index 7575915c4be26..38feeff331893 100644
--- a/website/cue/reference/api.cue
+++ b/website/cue/reference/api.cue
@@ -1,7 +1,7 @@
 package metadata
 
 // These sources produce JSON providing a structured representation of the
-// Vector GraphQL API
+// Vector gRPC API
 
 api: {
 	description:     !=""
@@ -11,34 +11,16 @@ api: {
 }
 
 api: {
-	description:     """
-		The Vector [GraphQL](\(urls.graphql)) API allows you to interact with a
+	description: """
+		The Vector gRPC API allows you to interact with a
 		running Vector instance, enabling introspection and management of
-		Vector in real-time.
+		Vector in real-time. The service definition is available in
+		`proto/vector/observability.proto`.
 		"""
-	schema_json_url: "https://github.com/vectordotdev/vector/blob/master/lib/vector-api-client/graphql/schema.json"
+	schema_json_url: "https://github.com/vectordotdev/vector/blob/master/proto/vector/observability.proto"
 	configuration:   generated.configuration.configuration.api.type.object.options
 
 	endpoints: {
-		"/graphql": {
-			POST: {
-				description: """
-					Main endpoint for receiving and processing
-					GraphQL queries.
-					"""
-				responses: {
-					"200": {
-						description: """
-							The query has been processed. GraphQL returns 200
-							regardless if the query was successful or not. This
-							is due to the fact that queries can partially fail.
-							Please check for the `errors` key to determine if
-							there were any errors in your query.
-							"""
-					}
-				}
-			}
-		}
 		"/health": {
 			GET: {
 				description: """
@@ -52,19 +34,5 @@ api: {
 				}
 			}
 		}
-		"/playground": {
-			GET: {
-				description: """
-					A bundled GraphQL playground that enables you
-					to explore the available queries and manually
-					run queries.
-					"""
-				responses: {
-					"200": {
-						description: "Vector is initialized and running."
-					}
-				}
-			}
-		}
 	}
 }
diff --git a/website/cue/reference/cli.cue b/website/cue/reference/cli.cue
index 763188264df78..b570bd823aa77 100644
--- a/website/cue/reference/cli.cue
+++ b/website/cue/reference/cli.cue
@@ -334,7 +334,7 @@ cli: {
 				}
 				"url": {
 					_short:      "u"
-					description: "Vector GraphQL API server endpoint"
+					description: "Vector gRPC API server endpoint"
 					type:        "string"
 				}
 				"limit": {
@@ -414,7 +414,7 @@ cli: {
 				}
 				"url": {
 					_short:      "u"
-					description: "Vector GraphQL API server endpoint"
+					description: "Vector gRPC API server endpoint"
 					type:        "string"
 				}
 			}
diff --git a/website/cue/reference/components/sources/internal_metrics.cue b/website/cue/reference/components/sources/internal_metrics.cue
index 22ebc5a49a5a6..98ed1ffe025d7 100644
--- a/website/cue/reference/components/sources/internal_metrics.cue
+++ b/website/cue/reference/components/sources/internal_metrics.cue
@@ -79,7 +79,7 @@ components: sources: internal_metrics: {
 			tags:              _component_tags
 		}
 		api_started_total: {
-			description:       "The number of times the Vector GraphQL API has been started."
+			description:       "The number of times the Vector API has been started."
 			type:              "counter"
 			default_namespace: "vector"
 			tags:              _internal_metrics_tags
diff --git a/website/cue/reference/generated/configuration.cue b/website/cue/reference/generated/configuration.cue
index 5b98f0c6fbe35..fdb5d0cb15bd0 100644
--- a/website/cue/reference/generated/configuration.cue
+++ b/website/cue/reference/generated/configuration.cue
@@ -19,31 +19,10 @@ generated: configuration: {
 				}
 				enabled: {
 					type: bool: default: false
-					description: "Whether the GraphQL API is enabled for this Vector instance."
+					description: "Whether the API is enabled for this Vector instance."
 					common:      true
 					required:    false
 				}
-				graphql: {
-					type: bool: default: true
-					description: """
-						Whether the endpoint for receiving and processing GraphQL queries is
-						enabled for the API. The endpoint is accessible via the `/graphql`
-						endpoint of the address set using the `bind` parameter.
-						"""
-					common:   true
-					required: false
-				}
-				playground: {
-					type: bool: default: true
-					description: """
-						Whether the [GraphQL Playground](https://github.com/graphql/graphql-playground) is enabled
-						for the API. The Playground is accessible via the `/playground` endpoint
-						of the address set using the `bind` parameter. Note that the `playground`
-						endpoint will only be enabled if the `graphql` endpoint is also enabled.
-						"""
-					common:   false
-					required: false
-				}
 			}
 			description: "API options."
 			warnings: ["The API currently does not support authentication. Only enable it in isolated environments or for debugging. It must not be exposed to untrusted clients."]
diff --git a/website/layouts/shortcodes/grpc-migration-warning.html b/website/layouts/shortcodes/grpc-migration-warning.html
new file mode 100644
index 0000000000000..b02140664df1a
--- /dev/null
+++ b/website/layouts/shortcodes/grpc-migration-warning.html
@@ -0,0 +1 @@
+{{ partial "admonition.html" (dict "type" "warning" "icon" "exclamation-triangle" "content" "The Vector observability API migrated from GraphQL to gRPC in version 0.55.0.") }}

From f1d8a93402168a2c5daf1eab2f4584aa5762bac4 Mon Sep 17 00:00:00 2001
From: iMithrellas <imithrellas@gmail.com>
Date: Tue, 24 Mar 2026 16:52:15 +0100
Subject: [PATCH 047/326] fix(windows platform): correct stop/start state
 checks and add configurable stop timeout (#24772)

* fix(windows service): wait for stopped state on stop

* enhancement(windows service): make stop wait timeout configurable for stop and uninstall

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 .../windows_service_stop_state_wait.fix.md    |  3 +
 src/service.rs                                | 71 ++++++++++++++++---
 src/vector_windows.rs                         | 58 +++++++++------
 3 files changed, 100 insertions(+), 32 deletions(-)
 create mode 100644 changelog.d/windows_service_stop_state_wait.fix.md

diff --git a/changelog.d/windows_service_stop_state_wait.fix.md b/changelog.d/windows_service_stop_state_wait.fix.md
new file mode 100644
index 0000000000000..45b60f01ca5fa
--- /dev/null
+++ b/changelog.d/windows_service_stop_state_wait.fix.md
@@ -0,0 +1,3 @@
+Fixed Windows service state checks in `vector service start`/`stop`, and made `vector service stop` wait until the service reaches `Stopped`. Added `--stop-timeout` to `vector service stop` and `vector service uninstall`.
+
+authors: iMithrellas
diff --git a/src/service.rs b/src/service.rs
index 5f384b888490d..974ac1ddeaf70 100644
--- a/src/service.rs
+++ b/src/service.rs
@@ -101,6 +101,18 @@ impl InstallOpts {
     }
 }
 
+#[derive(Parser, Debug)]
+#[command(rename_all = "kebab-case")]
+struct UninstallOpts {
+    /// The name of the service.
+    #[arg(long)]
+    name: Option<String>,
+
+    /// How long to wait for the service to stop before uninstalling, in seconds.
+    #[arg(default_value = "10", long)]
+    stop_timeout: u32,
+}
+
 #[derive(Parser, Debug)]
 #[command(rename_all = "kebab-case")]
 struct RestartOpts {
@@ -113,6 +125,18 @@ struct RestartOpts {
     stop_timeout: u32,
 }
 
+#[derive(Parser, Debug)]
+#[command(rename_all = "kebab-case")]
+struct StopOpts {
+    /// The name of the service.
+    #[arg(long)]
+    name: Option<String>,
+
+    /// How long to wait for the service to stop, in seconds.
+    #[arg(default_value = "10", long)]
+    stop_timeout: u32,
+}
+
 impl RestartOpts {
     fn service_info(&self) -> ServiceInfo {
         let mut default_service = ServiceInfo::default();
@@ -123,6 +147,26 @@ impl RestartOpts {
     }
 }
 
+impl UninstallOpts {
+    fn service_info(&self) -> ServiceInfo {
+        let mut default_service = ServiceInfo::default();
+        let service_name = self.name.as_deref().unwrap_or(DEFAULT_SERVICE_NAME);
+
+        default_service.name = OsString::from(service_name);
+        default_service
+    }
+}
+
+impl StopOpts {
+    fn service_info(&self) -> ServiceInfo {
+        let mut default_service = ServiceInfo::default();
+        let service_name = self.name.as_deref().unwrap_or(DEFAULT_SERVICE_NAME);
+
+        default_service.name = OsString::from(service_name);
+        default_service
+    }
+}
+
 #[derive(Parser, Debug)]
 #[command(rename_all = "kebab-case")]
 struct StandardOpts {
@@ -147,11 +191,11 @@ enum SubCommand {
     /// Install the service.
     Install(InstallOpts),
     /// Uninstall the service.
-    Uninstall(StandardOpts),
+    Uninstall(UninstallOpts),
     /// Start the service.
     Start(StandardOpts),
     /// Stop the service.
-    Stop(StandardOpts),
+    Stop(StopOpts),
     /// Restart the service.
     Restart(RestartOpts),
 }
@@ -182,9 +226,9 @@ impl Default for ServiceInfo {
 #[derive(Debug, Clone, PartialEq)]
 enum ControlAction {
     Install,
-    Uninstall,
+    Uninstall { stop_timeout: Duration },
     Start,
-    Stop,
+    Stop { stop_timeout: Duration },
     Restart { stop_timeout: Duration },
 }
 
@@ -196,10 +240,17 @@ pub fn cmd(opts: &Opts) -> exitcode::ExitCode {
                 control_service(&opts.service_info(), ControlAction::Install)
             }
             SubCommand::Uninstall(opts) => {
-                control_service(&opts.service_info(), ControlAction::Uninstall)
+                let stop_timeout = Duration::from_secs(opts.stop_timeout as u64);
+                control_service(
+                    &opts.service_info(),
+                    ControlAction::Uninstall { stop_timeout },
+                )
             }
             SubCommand::Start(opts) => control_service(&opts.service_info(), ControlAction::Start),
-            SubCommand::Stop(opts) => control_service(&opts.service_info(), ControlAction::Stop),
+            SubCommand::Stop(opts) => {
+                let stop_timeout = Duration::from_secs(opts.stop_timeout as u64);
+                control_service(&opts.service_info(), ControlAction::Stop { stop_timeout })
+            }
             SubCommand::Restart(opts) => {
                 let stop_timeout = Duration::from_secs(opts.stop_timeout as u64);
                 control_service(
@@ -233,17 +284,17 @@ fn control_service(service: &ServiceInfo, action: ControlAction) -> exitcode::Ex
             &service_definition,
             vector_windows::service_control::ControlAction::Install,
         ),
-        ControlAction::Uninstall => vector_windows::service_control::control(
+        ControlAction::Uninstall { stop_timeout } => vector_windows::service_control::control(
             &service_definition,
-            vector_windows::service_control::ControlAction::Uninstall,
+            vector_windows::service_control::ControlAction::Uninstall { stop_timeout },
         ),
         ControlAction::Start => vector_windows::service_control::control(
             &service_definition,
             vector_windows::service_control::ControlAction::Start,
         ),
-        ControlAction::Stop => vector_windows::service_control::control(
+        ControlAction::Stop { stop_timeout } => vector_windows::service_control::control(
             &service_definition,
-            vector_windows::service_control::ControlAction::Stop,
+            vector_windows::service_control::ControlAction::Stop { stop_timeout },
         ),
         ControlAction::Restart { stop_timeout } => vector_windows::service_control::control(
             &service_definition,
diff --git a/src/vector_windows.rs b/src/vector_windows.rs
index dc29efec8170e..66fdfe22dd990 100644
--- a/src/vector_windows.rs
+++ b/src/vector_windows.rs
@@ -81,9 +81,9 @@ pub mod service_control {
     #[derive(Debug, Copy, Clone, PartialEq)]
     pub enum ControlAction {
         Install,
-        Uninstall,
+        Uninstall { stop_timeout: Duration },
         Start,
-        Stop,
+        Stop { stop_timeout: Duration },
         Restart { stop_timeout: Duration },
     }
 
@@ -114,9 +114,13 @@ pub mod service_control {
         fn from_str(s: &str) -> std::result::Result<Self, Self::Err> {
             match s {
                 "install" => Ok(ControlAction::Install),
-                "uninstall" => Ok(ControlAction::Uninstall),
+                "uninstall" => Ok(ControlAction::Uninstall {
+                    stop_timeout: Duration::from_secs(10),
+                }),
                 "start" => Ok(ControlAction::Start),
-                "stop" => Ok(ControlAction::Stop),
+                "stop" => Ok(ControlAction::Stop {
+                    stop_timeout: Duration::from_secs(10),
+                }),
                 _ => Err(format!("invalid option {} for ControlAction", s)),
             }
         }
@@ -125,10 +129,12 @@ pub mod service_control {
     pub fn control(service_def: &ServiceDefinition, action: ControlAction) -> crate::Result<()> {
         match action {
             ControlAction::Start => start_service(service_def),
-            ControlAction::Stop => stop_service(service_def),
+            ControlAction::Stop { stop_timeout } => stop_service(service_def, stop_timeout),
             ControlAction::Restart { stop_timeout } => restart_service(service_def, stop_timeout),
             ControlAction::Install => install_service(service_def),
-            ControlAction::Uninstall => uninstall_service(service_def),
+            ControlAction::Uninstall { stop_timeout } => {
+                uninstall_service(service_def, stop_timeout)
+            }
         }
     }
 
@@ -138,7 +144,7 @@ pub mod service_control {
         let service_status = service.query_status().context(ServiceSnafu)?;
 
         if service_status.current_state != ServiceState::StartPending
-            || service_status.current_state != ServiceState::Running
+            && service_status.current_state != ServiceState::Running
         {
             service.start(&[] as &[OsString]).context(ServiceSnafu)?;
             emit!(WindowsServiceStart {
@@ -155,26 +161,31 @@ pub mod service_control {
         Ok(())
     }
 
-    fn stop_service(service_def: &ServiceDefinition) -> crate::Result<()> {
+    fn stop_service(service_def: &ServiceDefinition, stop_timeout: Duration) -> crate::Result<()> {
         let service_access = ServiceAccess::QUERY_STATUS | ServiceAccess::STOP;
         let service = open_service(service_def, service_access)?;
         let service_status = service.query_status().context(ServiceSnafu)?;
+        let already_stopped = service_status.current_state == ServiceState::Stopped;
 
-        if service_status.current_state != ServiceState::StopPending
-            || service_status.current_state != ServiceState::Stopped
-        {
+        if service_status.current_state != ServiceState::StopPending && !already_stopped {
             service.stop().context(ServiceSnafu)?;
-            emit!(WindowsServiceStop {
-                name: &*service_def.name.to_string_lossy(),
-                already_stopped: false,
-            });
-        } else {
-            emit!(WindowsServiceStop {
-                name: &*service_def.name.to_string_lossy(),
-                already_stopped: true,
-            });
         }
 
+        if !already_stopped {
+            let service_status = ensure_state(
+                &service,
+                ServiceState::Stopped,
+                stop_timeout,
+                Duration::from_secs(1),
+            )?;
+            handle_service_exit_code(service_status.exit_code);
+        }
+
+        emit!(WindowsServiceStop {
+            name: &*service_def.name.to_string_lossy(),
+            already_stopped,
+        });
+
         Ok(())
     }
 
@@ -242,7 +253,10 @@ pub mod service_control {
         Ok(())
     }
 
-    fn uninstall_service(service_def: &ServiceDefinition) -> crate::Result<()> {
+    fn uninstall_service(
+        service_def: &ServiceDefinition,
+        stop_timeout: Duration,
+    ) -> crate::Result<()> {
         let service_access =
             ServiceAccess::QUERY_STATUS | ServiceAccess::STOP | ServiceAccess::DELETE;
         let service = open_service(service_def, service_access)?;
@@ -259,7 +273,7 @@ pub mod service_control {
         let service_status = ensure_state(
             &service,
             ServiceState::Stopped,
-            Duration::from_secs(10),
+            stop_timeout,
             Duration::from_secs(1),
         )?;
         handle_service_exit_code(service_status.exit_code);

From 0122cf6ec8fe7cce20a2bb694db137e3d5a9038a Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 24 Mar 2026 12:04:14 -0400
Subject: [PATCH 048/326] chore(sinks)!: remove deprecated `headers` option
 from http and opentelemetry sinks (#24994)

* chore(sinks): remove deprecated `headers` option from http and opentelemetry sinks

* Fix tests
---
 benches/http.rs                                       |  1 -
 .../remove_deprecated_http_headers_option.breaking.md |  4 ++++
 src/sinks/axiom/config.rs                             |  1 -
 src/sinks/http/config.rs                              | 11 +----------
 src/sinks/http/tests.rs                               |  1 -
 src/sinks/opentelemetry/mod.rs                        |  1 -
 src/sinks/util/http.rs                                |  7 -------
 .../cue/reference/components/sinks/generated/http.cue | 11 -----------
 .../components/sinks/generated/opentelemetry.cue      | 11 -----------
 9 files changed, 5 insertions(+), 43 deletions(-)
 create mode 100644 changelog.d/remove_deprecated_http_headers_option.breaking.md

diff --git a/benches/http.rs b/benches/http.rs
index 0bc99dec551cf..30b35b8b257f7 100644
--- a/benches/http.rs
+++ b/benches/http.rs
@@ -55,7 +55,6 @@ fn benchmark_http(c: &mut Criterion) {
                                 compression: *compression,
                                 method: Default::default(),
                                 auth: Default::default(),
-                                headers: Default::default(),
                                 payload_prefix: Default::default(),
                                 payload_suffix: Default::default(),
                                 batch,
diff --git a/changelog.d/remove_deprecated_http_headers_option.breaking.md b/changelog.d/remove_deprecated_http_headers_option.breaking.md
new file mode 100644
index 0000000000000..b2b1fd28b869e
--- /dev/null
+++ b/changelog.d/remove_deprecated_http_headers_option.breaking.md
@@ -0,0 +1,4 @@
+The `headers` option has been removed from the `http` and `opentelemetry` sinks.
+Use `request.headers` instead. This option has been deprecated since v0.33.0.
+
+authors: thomasqueirozb
diff --git a/src/sinks/axiom/config.rs b/src/sinks/axiom/config.rs
index 0349fc02831b8..61421973d5475 100644
--- a/src/sinks/axiom/config.rs
+++ b/src/sinks/axiom/config.rs
@@ -170,7 +170,6 @@ impl SinkConfig for AxiomConfig {
             request,
             acknowledgements: self.acknowledgements,
             batch: self.batch,
-            headers: None,
             encoding: EncodingConfigWithFraming::new(
                 Some(FramingConfig::NewlineDelimited),
                 SerializerConfig::Json(JsonSerializerConfig {
diff --git a/src/sinks/http/config.rs b/src/sinks/http/config.rs
index 81df73add1efb..a3a105fa5c608 100644
--- a/src/sinks/http/config.rs
+++ b/src/sinks/http/config.rs
@@ -57,13 +57,6 @@ pub struct HttpSinkConfig {
     #[configurable(derived)]
     pub auth: Option<Auth>,
 
-    /// A list of custom headers to add to each request.
-    #[configurable(deprecated = "This option has been deprecated, use `request.headers` instead.")]
-    #[configurable(metadata(
-        docs::additional_props_description = "An HTTP request header and it's value."
-    ))]
-    pub headers: Option<BTreeMap<String, String>>,
-
     #[configurable(derived)]
     #[serde(default)]
     pub compression: Compression,
@@ -242,8 +235,7 @@ impl SinkConfig for HttpSinkConfig {
         let encoder = self.build_encoder()?;
         let transformer = self.encoding.transformer();
 
-        let mut request = self.request.clone();
-        request.add_old_option(self.headers.clone());
+        let request = self.request.clone();
 
         validate_headers(&request.headers, self.auth.is_some())?;
         let (static_headers, template_headers) = request.split_headers();
@@ -406,7 +398,6 @@ mod tests {
                     Transformer::default(),
                 ),
                 auth: None,
-                headers: None,
                 compression: Compression::default(),
                 batch: BatchConfig::default(),
                 request: RequestConfig::default(),
diff --git a/src/sinks/http/tests.rs b/src/sinks/http/tests.rs
index 7182d608a865a..12ff994239f5d 100644
--- a/src/sinks/http/tests.rs
+++ b/src/sinks/http/tests.rs
@@ -59,7 +59,6 @@ fn default_cfg(encoding: EncodingConfigWithFraming) -> HttpSinkConfig {
         uri: Default::default(),
         method: Default::default(),
         auth: Default::default(),
-        headers: Default::default(),
         compression: Default::default(),
         encoding,
         payload_prefix: Default::default(),
diff --git a/src/sinks/opentelemetry/mod.rs b/src/sinks/opentelemetry/mod.rs
index 88963f8603cde..7d73e25c4030d 100644
--- a/src/sinks/opentelemetry/mod.rs
+++ b/src/sinks/opentelemetry/mod.rs
@@ -49,7 +49,6 @@ impl Default for Protocol {
             uri: Default::default(),
             method: HttpMethod::Post,
             auth: Default::default(),
-            headers: Default::default(),
             compression: Default::default(),
             payload_prefix: Default::default(),
             payload_suffix: Default::default(),
diff --git a/src/sinks/util/http.rs b/src/sinks/util/http.rs
index e21ef48e4ed66..e19025e3c6ee3 100644
--- a/src/sinks/util/http.rs
+++ b/src/sinks/util/http.rs
@@ -684,13 +684,6 @@ fn headers_examples() -> BTreeMap<String, String> {
 }
 
 impl RequestConfig {
-    pub fn add_old_option(&mut self, headers: Option<BTreeMap<String, String>>) {
-        if let Some(headers) = headers {
-            warn!("Option `headers` has been deprecated. Use `request.headers` instead.");
-            self.headers.extend(headers);
-        }
-    }
-
     pub fn split_headers(&self) -> (BTreeMap<String, String>, BTreeMap<String, Template>) {
         let mut static_headers = BTreeMap::new();
         let mut template_headers = BTreeMap::new();
diff --git a/website/cue/reference/components/sinks/generated/http.cue b/website/cue/reference/components/sinks/generated/http.cue
index 61fc5eab98ff2..0fcc53fab8092 100644
--- a/website/cue/reference/components/sinks/generated/http.cue
+++ b/website/cue/reference/components/sinks/generated/http.cue
@@ -780,17 +780,6 @@ generated: components: sinks: http: configuration: {
 			}
 		}
 	}
-	headers: {
-		deprecated:         true
-		deprecated_message: "This option has been deprecated, use `request.headers` instead."
-		description:        "A list of custom headers to add to each request."
-		required:           false
-		type: object: options: "*": {
-			description: "An HTTP request header and it's value."
-			required:    true
-			type: string: {}
-		}
-	}
 	method: {
 		description: "The HTTP method to use when making the request."
 		required:    false
diff --git a/website/cue/reference/components/sinks/generated/opentelemetry.cue b/website/cue/reference/components/sinks/generated/opentelemetry.cue
index f48dfd18a61a4..4505d8a9bf512 100644
--- a/website/cue/reference/components/sinks/generated/opentelemetry.cue
+++ b/website/cue/reference/components/sinks/generated/opentelemetry.cue
@@ -783,17 +783,6 @@ generated: components: sinks: opentelemetry: configuration: protocol: {
 				}
 			}
 		}
-		headers: {
-			deprecated:         true
-			deprecated_message: "This option has been deprecated, use `request.headers` instead."
-			description:        "A list of custom headers to add to each request."
-			required:           false
-			type: object: options: "*": {
-				description: "An HTTP request header and it's value."
-				required:    true
-				type: string: {}
-			}
-		}
 		method: {
 			description: "The HTTP method to use when making the request."
 			required:    false

From 8bac1dbdcd27550444ea3b73e9dd4ef36172b2d4 Mon Sep 17 00:00:00 2001
From: Vladimir Zhuk <vladimir.zhuk@datadoghq.com>
Date: Tue, 24 Mar 2026 15:00:40 -0400
Subject: [PATCH 049/326] chore(datadog_metrics sink): switch series v2 and
 sketches to zstd compression (#24956)

* chore(datadog_metrics sink): switch series v2 endpoint to zstd compression

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(regression): switch statsd_to_datadog_metrics to ingress_throughput

The egress_throughput goal measures compressed bytes received by the
blackhole. Switching v2 series from zlib to zstd produces smaller
compressed payloads (better compression ratio), which registers as a
false regression in egress bytes/sec. ingress_throughput measures how
fast Vector consumes statsd data from the generator, which is
compression-agnostic and reflects actual pipeline performance.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(datadog_metrics sink): prevent division-by-zero in proptest with zero limits

Start proptest ranges at 1 instead of 0 for uncompressed_limit and
compressed_limit. The old validate_payload_size_limits rejected zero
limits, but with_payload_limits is now infallible, so finish() can
panic on division-by-zero when computing recommended_splits.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(datadog_metrics sink): switch sketches endpoint to zstd compression

Sketches endpoint now uses zstd instead of zlib, matching Series v2.
Only Series v1 remains on zlib.

Validated against real Datadog API: 36/36 correctness checks passed,
all 18 metrics match between v1 and v2.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(datadog_metrics sink): correct changelog to reflect sketches use zstd

The changelog incorrectly stated that Sketches continue to use zlib,
but the code routes Sketches to zstd compression.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor(datadog_metrics sink): move compression constants to vector-common

Move zlib and zstd compression-bound constants from inline locals in
DatadogMetricsCompression::max_compressed_size to
lib/vector-common/src/constants.rs with descriptive names and doc
comments linking to their specifications.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor(datadog_metrics sink): move inline use statements to module top

Move use statements from inside test helper function bodies to the top
of the test module, as is conventional in Rust.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* cargo fmt

* fix(datadog_metrics sink): update integration test decompression for zstd

The decompress_payload helper in integration_tests.rs hardcoded zlib
decompression, but Series v2 now uses zstd. Auto-detect the compression
format via is_zstd so tests work for both zlib and zstd payloads.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 ...adog_metrics_zstd_series_v2.enhancement.md |   3 +
 lib/vector-common/src/constants.rs            |  16 +
 .../statsd_to_datadog_metrics/experiment.yaml |   2 +-
 src/sinks/datadog/metrics/config.rs           |  33 +-
 src/sinks/datadog/metrics/encoder.rs          | 811 ++++++++++++------
 .../datadog/metrics/integration_tests.rs      |  13 +-
 src/sinks/datadog/metrics/request_builder.rs  |  20 +-
 src/sinks/datadog/metrics/service.rs          |   8 +-
 8 files changed, 629 insertions(+), 277 deletions(-)
 create mode 100644 changelog.d/24956_datadog_metrics_zstd_series_v2.enhancement.md

diff --git a/changelog.d/24956_datadog_metrics_zstd_series_v2.enhancement.md b/changelog.d/24956_datadog_metrics_zstd_series_v2.enhancement.md
new file mode 100644
index 0000000000000..1ecaef6b46b8c
--- /dev/null
+++ b/changelog.d/24956_datadog_metrics_zstd_series_v2.enhancement.md
@@ -0,0 +1,3 @@
+The `datadog_metrics` sink now uses zstd compression when submitting metrics to the Series v2 (`/api/v2/series`) and Sketches endpoints. Series v1 continues to use zlib (deflate).
+
+authors: vladimir-dd
diff --git a/lib/vector-common/src/constants.rs b/lib/vector-common/src/constants.rs
index 1eeadca45b5dc..8b336d7937344 100644
--- a/lib/vector-common/src/constants.rs
+++ b/lib/vector-common/src/constants.rs
@@ -1,3 +1,19 @@
 pub const GZIP_MAGIC: &[u8] = &[0x1f, 0x8b];
 pub const ZLIB_MAGIC: &[u8] = &[0x78];
 pub const ZSTD_MAGIC: &[u8] = &[0x28, 0xB5, 0x2F, 0xFD];
+
+/// Maximum size of a zlib stored (uncompressed) block in bytes.
+/// See: <https://www.zlib.net/zlib_tech.html>
+pub const ZLIB_STORED_BLOCK_SIZE: usize = 16384;
+
+/// Per-block overhead for zlib stored blocks: 1-byte header + 2-byte length + 2-byte ~length.
+/// See: <https://www.zlib.net/zlib_tech.html>
+pub const ZLIB_STORED_BLOCK_OVERHEAD: usize = 5;
+
+/// Zlib frame overhead: 2-byte header + 4-byte Adler-32 checksum trailer.
+/// See: <https://www.zlib.net/zlib_tech.html>
+pub const ZLIB_FRAME_OVERHEAD: usize = 6;
+
+/// Threshold below which zstd's `ZSTD_compressBound` adds extra margin (128 KiB).
+/// See: <https://github.com/facebook/zstd/blob/dev/lib/zstd.h> (`ZSTD_compressBound`)
+pub const ZSTD_SMALL_INPUT_THRESHOLD: usize = 128 << 10;
diff --git a/regression/cases/statsd_to_datadog_metrics/experiment.yaml b/regression/cases/statsd_to_datadog_metrics/experiment.yaml
index 7c0e069a9eddc..3650e2c1157a2 100644
--- a/regression/cases/statsd_to_datadog_metrics/experiment.yaml
+++ b/regression/cases/statsd_to_datadog_metrics/experiment.yaml
@@ -1,4 +1,4 @@
-optimization_goal: egress_throughput
+optimization_goal: ingress_throughput
 
 target:
   name: vector
diff --git a/src/sinks/datadog/metrics/config.rs b/src/sinks/datadog/metrics/config.rs
index e296bd823d60c..a5fdccede6a14 100644
--- a/src/sinks/datadog/metrics/config.rs
+++ b/src/sinks/datadog/metrics/config.rs
@@ -87,11 +87,6 @@ impl DatadogMetricsEndpoint {
         }
     }
 
-    // Gets whether or not this is a series endpoint.
-    pub const fn is_series(self) -> bool {
-        matches!(self, Self::Series { .. })
-    }
-
     pub(super) const fn payload_limits(self) -> DatadogMetricsPayloadLimits {
         // from https://docs.datadoghq.com/api/latest/metrics/#submit-metrics
         let (uncompressed, compressed) = match self {
@@ -112,6 +107,32 @@ impl DatadogMetricsEndpoint {
             compressed,
         }
     }
+
+    /// Returns the compression scheme used for this endpoint.
+    pub(super) const fn compression(self) -> DatadogMetricsCompression {
+        match self {
+            Self::Series(SeriesApiVersion::V1) => DatadogMetricsCompression::Zlib,
+            _ => DatadogMetricsCompression::Zstd,
+        }
+    }
+}
+
+/// Selects the compressor for a given Datadog metrics endpoint.
+#[derive(Clone, Copy, Debug)]
+pub(super) enum DatadogMetricsCompression {
+    /// zlib (deflate) — used by Series v1.
+    Zlib,
+    /// zstd — used by Series v2 and Sketches.
+    Zstd,
+}
+
+impl DatadogMetricsCompression {
+    pub(super) const fn content_encoding(self) -> &'static str {
+        match self {
+            Self::Zstd => "zstd",
+            Self::Zlib => "deflate",
+        }
+    }
 }
 
 /// Maps Datadog metric endpoints to their actual URI.
@@ -270,7 +291,7 @@ impl DatadogMetricsConfig {
             endpoint_configuration,
             self.default_namespace.clone(),
             self.series_api_version,
-        )?;
+        );
 
         let protocol = self.get_protocol(dd_common);
         let sink = DatadogMetricsSink::new(
diff --git a/src/sinks/datadog/metrics/encoder.rs b/src/sinks/datadog/metrics/encoder.rs
index 9f0b71c87ba98..a626244123861 100644
--- a/src/sinks/datadog/metrics/encoder.rs
+++ b/src/sinks/datadog/metrics/encoder.rs
@@ -16,7 +16,12 @@ use vector_lib::{
     request_metadata::GroupedCountByteSize,
 };
 
-use super::config::{DatadogMetricsEndpoint, SeriesApiVersion};
+use vector_common::constants::{
+    ZLIB_FRAME_OVERHEAD, ZLIB_STORED_BLOCK_OVERHEAD, ZLIB_STORED_BLOCK_SIZE,
+    ZSTD_SMALL_INPUT_THRESHOLD,
+};
+
+use super::config::{DatadogMetricsCompression, DatadogMetricsEndpoint, SeriesApiVersion};
 use crate::{
     common::datadog::{
         DatadogMetricType, DatadogPoint, DatadogSeriesMetric, DatadogSeriesMetricMetadata,
@@ -47,23 +52,6 @@ mod ddmetric_proto {
     include!(concat!(env!("OUT_DIR"), "/datadog.agentpayload.rs"));
 }
 
-#[derive(Debug, Snafu)]
-pub enum CreateError {
-    #[snafu(display("Invalid compressed/uncompressed payload size limits were given"))]
-    InvalidLimits,
-}
-
-impl CreateError {
-    /// Gets the telemetry-friendly string version of this error.
-    ///
-    /// The value will be a short string with only lowercase letters and underscores.
-    pub const fn as_error_type(&self) -> &'static str {
-        match self {
-            Self::InvalidLimits => "invalid_payload_limits",
-        }
-    }
-}
-
 #[derive(Debug, Snafu)]
 pub enum EncoderError {
     #[snafu(display(
@@ -133,6 +121,16 @@ impl FinishError {
 struct EncoderState {
     writer: Compressor,
     written: usize,
+    /// Upper bound on uncompressed bytes sitting in the compressor's internal buffer (written but
+    /// not yet flushed to `writer.get_ref()`).  All compressors may buffer internally: zstd holds
+    /// up to 128 KB per block, zlib's BufWriter holds up to 4 KB.  Since `get_ref().len()` only
+    /// reflects bytes that have been flushed through all layers, we track this bound to avoid
+    /// underestimating the compressed payload size.
+    ///
+    /// Increases by `n` on each write. Resets to `n` when a new compressed block is detected in
+    /// `writer.get_ref()` (the triggering write may straddle the block boundary, so `n` is a safe
+    /// upper bound on what remains buffered after the flush).
+    buffered_bound: usize,
     buf: Vec<u8>,
     processed: Vec<Metric>,
     byte_size: GroupedCountByteSize,
@@ -141,8 +139,9 @@ struct EncoderState {
 impl Default for EncoderState {
     fn default() -> Self {
         Self {
-            writer: get_compressor(),
+            writer: Compression::zlib_default().into(),
             written: 0,
+            buffered_bound: 0,
             buf: Vec::with_capacity(1024),
             processed: Vec::new(),
             byte_size: telemetry().create_request_count_byte_size(),
@@ -164,45 +163,62 @@ pub struct DatadogMetricsEncoder {
 
 impl DatadogMetricsEncoder {
     /// Creates a new `DatadogMetricsEncoder` for the given endpoint.
-    pub fn new(
-        endpoint: DatadogMetricsEndpoint,
-        default_namespace: Option<String>,
-    ) -> Result<Self, CreateError> {
+    pub fn new(endpoint: DatadogMetricsEndpoint, default_namespace: Option<String>) -> Self {
         let payload_limits = endpoint.payload_limits();
-        Self::with_payload_limits(
+
+        Self {
             endpoint,
-            default_namespace,
-            payload_limits.uncompressed,
-            payload_limits.compressed,
-        )
+            default_namespace: default_namespace.map(Arc::from),
+            uncompressed_limit: payload_limits.uncompressed,
+            compressed_limit: payload_limits.compressed,
+            state: EncoderState {
+                writer: endpoint.compression().compressor(),
+                ..Default::default()
+            },
+            log_schema: log_schema(),
+            origin_product_value: *ORIGIN_PRODUCT_VALUE,
+        }
     }
+}
 
+#[cfg(test)]
+impl DatadogMetricsEncoder {
     /// Creates a new `DatadogMetricsEncoder` for the given endpoint, with specific payload limits.
+    ///
+    /// Only available in tests; production code always uses the API-defined limits via `new`.
     pub fn with_payload_limits(
         endpoint: DatadogMetricsEndpoint,
         default_namespace: Option<String>,
         uncompressed_limit: usize,
         compressed_limit: usize,
-    ) -> Result<Self, CreateError> {
-        let (uncompressed_limit, compressed_limit) =
-            validate_payload_size_limits(endpoint, uncompressed_limit, compressed_limit)
-                .ok_or(CreateError::InvalidLimits)?;
-
-        Ok(Self {
+    ) -> Self {
+        Self {
             endpoint,
             default_namespace: default_namespace.map(Arc::from),
             uncompressed_limit,
             compressed_limit,
-            state: EncoderState::default(),
+            state: EncoderState {
+                writer: endpoint.compression().compressor(),
+                ..Default::default()
+            },
             log_schema: log_schema(),
             origin_product_value: *ORIGIN_PRODUCT_VALUE,
-        })
+        }
+    }
+
+    /// Returns the current `buffered_bound` value for white-box testing of zstd block-flush reset.
+    fn buffered_bound(&self) -> usize {
+        self.state.buffered_bound
     }
 }
 
 impl DatadogMetricsEncoder {
     fn reset_state(&mut self) -> EncoderState {
-        mem::take(&mut self.state)
+        let new_state = EncoderState {
+            writer: self.endpoint.compression().compressor(),
+            ..Default::default()
+        };
+        mem::replace(&mut self.state, new_state)
     }
 
     fn encode_single_metric(&mut self, metric: Metric) -> Result<Option<Metric>, EncoderError> {
@@ -342,24 +358,36 @@ impl DatadogMetricsEncoder {
         // compressor might have internal state around checksums, etc, that can't be similarly
         // rolled back.
         //
-        // Our strategy is thus: simply take the encoded-but-decompressed size and see if it would
-        // fit within the compressed limit.  In `get_endpoint_payload_size_limits`, we calculate the
-        // expected maximum overhead of zlib based on all input data being incompressible, which
-        // zlib ensures will be the worst case as it can figure out whether a compressed or
-        // uncompressed block would take up more space _before_ choosing which strategy to go with.
+        // Strategy: split the estimate into two parts:
+        //   1. Bytes already flushed to the output buffer (`get_ref().len()`) — exact compressed size.
+        //   2. Bytes still in the compressor's internal buffer plus this new metric — estimated via
+        //      max_compressed_size(buffered_bound + n) (worst-case upper bound).
         //
-        // Thus, simply put, we've already accounted for the uncertainty by making our check here
-        // assume the worst case while our limits assume the worst case _overhead_.  Maybe our
-        // numbers are technically off in the end, but `finish` catches that for us, too.
-        let compressed_len = self.state.writer.get_ref().len();
-        let max_compressed_metric_len = n + max_compressed_overhead_len(n);
-        if compressed_len + max_compressed_metric_len > self.compressed_limit {
+        // All compressors may buffer data internally before flushing to the output: zstd buffers
+        // up to 128 KB per block, zlib's BufWriter holds up to 4 KB.  `get_ref().len()` only
+        // reflects bytes that have been flushed through all layers.  We track `buffered_bound` —
+        // an upper bound on uncompressed bytes written but not yet visible in `get_ref()` — and
+        // include it in the estimate for all compressor types.
+        let compression = self.endpoint.compression();
+        let flushed_compressed = self.state.writer.get_ref().len();
+        if flushed_compressed + compression.max_compressed_size(self.state.buffered_bound + n)
+            > self.compressed_limit
+        {
             return Ok(false);
         }
 
         // We should be safe to write our holding buffer to the compressor and store the metric.
+        //
+        // Update buffered_bound: if a new block appeared in the output (flushed_compressed grew),
+        // reset to n — the triggering write may straddle the block boundary, so n is a safe upper
+        // bound on what remains buffered.  Otherwise accumulate.
         self.state.writer.write_all(&self.state.buf)?;
         self.state.written += n;
+        if self.state.writer.get_ref().len() > flushed_compressed {
+            self.state.buffered_bound = n;
+        } else {
+            self.state.buffered_bound += n;
+        }
         Ok(true)
     }
 
@@ -383,7 +411,10 @@ impl DatadogMetricsEncoder {
         // Make sure we've written our header already.
         if self.state.written == 0 {
             match write_payload_header(self.endpoint, &mut self.state.writer) {
-                Ok(n) => self.state.written += n,
+                Ok(n) => {
+                    self.state.written += n;
+                    self.state.buffered_bound += n;
+                }
                 Err(_) => return Ok(Some(metric)),
             }
         }
@@ -874,75 +905,41 @@ fn generate_series_metrics(
     }])
 }
 
-fn get_compressor() -> Compressor {
-    // We use the "zlib default" compressor because it's all Datadog supports, and adding it
-    // generically to `Compression` would make things a little weird because of the conversion trait
-    // implementations that are also only none vs gzip.
-    Compression::zlib_default().into()
-}
-
-const fn max_uncompressed_header_len() -> usize {
-    SERIES_PAYLOAD_HEADER.len() + SERIES_PAYLOAD_FOOTER.len()
-}
-
-// Datadog ingest APIs accept zlib, which is what we're accounting for here. By default, zlib
-// has a 2 byte header and 4 byte CRC trailer. [1]
-//
-// [1] https://www.zlib.net/zlib_tech.html
-const ZLIB_HEADER_TRAILER: usize = 6;
-
-const fn max_compression_overhead_len(compressed_limit: usize) -> usize {
-    // We calculate the overhead as the zlib header/trailer plus the worst case overhead of
-    // compressing `compressed_limit` bytes, such that we assume all of the data we write may not be
-    // compressed at all.
-    ZLIB_HEADER_TRAILER + max_compressed_overhead_len(compressed_limit)
-}
-
-const fn max_compressed_overhead_len(len: usize) -> usize {
-    // Datadog ingest APIs accept zlib, which is what we're accounting for here.
-    //
-    // Deflate, the underlying compression algorithm, has a technique to ensure that input data
-    // can't be encoded in such a way where it's expanded by a meaningful amount. This technique
-    // allows storing blocks of uncompressed data with only 5 bytes of overhead per block.
-    // Technically, the blocks can be up to 65KB in Deflate, but modern zlib implementations use
-    // block sizes of 16KB. [1][2]
-    //
-    // We calculate the overhead of compressing a given `len` bytes as the worst case of that many
-    // bytes being written to the compressor and being unable to be compressed at all
-    //
-    // [1] https://www.zlib.net/zlib_tech.html
-    // [2] https://www.bolet.org/~pornin/deflate-flush-fr.html
-    const STORED_BLOCK_SIZE: usize = 16384;
-    (1 + len.saturating_sub(ZLIB_HEADER_TRAILER) / STORED_BLOCK_SIZE) * 5
-}
-
-const fn validate_payload_size_limits(
-    endpoint: DatadogMetricsEndpoint,
-    uncompressed_limit: usize,
-    compressed_limit: usize,
-) -> Option<(usize, usize)> {
-    if endpoint.is_series() {
-        // For series, we need to make sure the uncompressed limit can account for the header/footer
-        // we would add that wraps the encoded metrics up in the expected JSON object. This does
-        // imply that adding 1 to this limit would be allowed, and obviously we can't encode a
-        // series metric in a single byte, but this is just a simple sanity check, not an exhaustive
-        // search of the absolute bare minimum size.
-        let header_len = max_uncompressed_header_len();
-        if uncompressed_limit <= header_len {
-            return None;
+impl DatadogMetricsCompression {
+    fn compressor(self) -> Compressor {
+        match self {
+            Self::Zstd => Compression::zstd_default().into(),
+            Self::Zlib => Compression::zlib_default().into(),
         }
     }
 
-    // Get the maximum possible overhead of the compression container, based on the incoming
-    // _uncompressed_ limit. We use the uncompressed limit because we're calculating the maximum
-    // overhead in the case that, theoretically, none of the input data was compressible.  This
-    // possibility is essentially impossible, but serves as a proper worst-case-scenario check.
-    let max_compression_overhead = max_compression_overhead_len(uncompressed_limit);
-    if compressed_limit <= max_compression_overhead {
-        return None;
+    /// Returns the worst-case compressed size of `n` uncompressed bytes.
+    ///
+    /// For zlib (deflate), the worst case occurs when data is entirely incompressible and stored in
+    /// uncompressed blocks (5 bytes overhead per 16 KB block, as per the DEFLATE spec).
+    ///
+    /// For zstd, this uses the same formula as `ZSTD_compressBound` from the zstd C library.
+    const fn max_compressed_size(self, n: usize) -> usize {
+        match self {
+            Self::Zlib => {
+                // Deflate stores incompressible data in uncompressed blocks, each with fixed
+                // overhead. We subtract the zlib frame from the block count since those bytes
+                // are not stored-block data.
+                n + (1 + n.saturating_sub(ZLIB_FRAME_OVERHEAD) / ZLIB_STORED_BLOCK_SIZE)
+                    * ZLIB_STORED_BLOCK_OVERHEAD
+            }
+            Self::Zstd => {
+                // zstd_safe::compress_bound is not const, so we use the same formula it uses
+                // internally: srcSize + (srcSize >> 8) + small correction for inputs < 128 KB.
+                n + (n >> 8)
+                    + if n < ZSTD_SMALL_INPUT_THRESHOLD {
+                        (ZSTD_SMALL_INPUT_THRESHOLD - n) >> 11
+                    } else {
+                        0
+                    }
+            }
+        }
     }
-
-    Some((uncompressed_limit, compressed_limit))
 }
 
 fn write_payload_header(
@@ -983,11 +980,8 @@ fn write_payload_footer(
 
 #[cfg(test)]
 mod tests {
-    use std::{
-        io::{self, copy},
-        num::NonZeroU32,
-        sync::Arc,
-    };
+    use std::io::{self, Write as _};
+    use std::{num::NonZeroU32, sync::Arc};
 
     use bytes::{BufMut, Bytes, BytesMut};
     use chrono::{DateTime, TimeZone, Timelike, Utc};
@@ -1010,19 +1004,30 @@ mod tests {
 
     use super::{
         DatadogMetricsEncoder, EncoderError, ddmetric_proto, encode_proto_key_and_message,
-        encode_tags, encode_timestamp, generate_series_metrics, get_compressor,
-        get_sketch_payload_sketches_field_number, max_compression_overhead_len,
-        max_uncompressed_header_len, series_to_proto_message, sketch_to_proto_message,
-        validate_payload_size_limits, write_payload_footer, write_payload_header,
+        encode_tags, encode_timestamp, generate_series_metrics,
+        get_sketch_payload_sketches_field_number, series_to_proto_message, sketch_to_proto_message,
+        write_payload_footer, write_payload_header,
     };
     use crate::{
         common::datadog::DatadogMetricType,
-        sinks::datadog::metrics::{
-            config::{DatadogMetricsEndpoint, SeriesApiVersion},
-            encoder::{DEFAULT_DD_ORIGIN_PRODUCT_VALUE, ORIGIN_PRODUCT_VALUE},
+        sinks::{
+            datadog::metrics::{
+                config::{DatadogMetricsCompression, DatadogMetricsEndpoint, SeriesApiVersion},
+                encoder::{DEFAULT_DD_ORIGIN_PRODUCT_VALUE, ORIGIN_PRODUCT_VALUE},
+            },
+            util::{Compression, Compressor},
         },
     };
 
+    const fn max_uncompressed_header_len(endpoint: DatadogMetricsEndpoint) -> usize {
+        match endpoint {
+            DatadogMetricsEndpoint::Series(SeriesApiVersion::V1) => {
+                super::SERIES_PAYLOAD_HEADER.len() + super::SERIES_PAYLOAD_FOOTER.len()
+            }
+            _ => 0,
+        }
+    }
+
     fn get_simple_counter() -> Metric {
         let value = MetricValue::Counter { value: 3.14 };
         Metric::new("basic_counter", MetricKind::Incremental, value).with_timestamp(Some(ts()))
@@ -1048,8 +1053,8 @@ mod tests {
             .with_timestamp(Some(ts()))
     }
 
-    fn get_compressed_empty_series_payload() -> Bytes {
-        let mut compressor = get_compressor();
+    fn get_compressed_empty_series_v1_payload() -> Bytes {
+        let mut compressor = Compressor::from(Compression::zlib_default());
 
         _ = write_payload_header(
             DatadogMetricsEndpoint::Series(SeriesApiVersion::V1),
@@ -1066,14 +1071,104 @@ mod tests {
     }
 
     fn get_compressed_empty_sketches_payload() -> Bytes {
-        get_compressor().finish().expect("should not fail").freeze()
+        Compressor::from(Compression::zstd_default())
+            .finish()
+            .expect("should not fail")
+            .freeze()
+    }
+
+    fn get_compressed_empty_series_v2_payload() -> Bytes {
+        Compressor::from(Compression::zstd_default())
+            .finish()
+            .expect("should not fail")
+            .freeze()
     }
 
-    fn decompress_payload(payload: Bytes) -> io::Result<Bytes> {
+    fn decompress_zlib_payload(payload: Bytes) -> io::Result<Bytes> {
         let mut decompressor = ZlibDecoder::new(&payload[..]);
         let mut decompressed = BytesMut::new().writer();
-        let result = copy(&mut decompressor, &mut decompressed);
-        result.map(|_| decompressed.into_inner().freeze())
+        io::copy(&mut decompressor, &mut decompressed)?;
+        Ok(decompressed.into_inner().freeze())
+    }
+
+    fn decompress_zstd_payload(payload: Bytes) -> io::Result<Bytes> {
+        let decompressed = zstd::decode_all(&payload[..])?;
+        Ok(Bytes::from(decompressed))
+    }
+
+    /// Returns the number of bytes added to the compressor's output buffer after writing `n`
+    /// bytes of high-entropy data. Measures only the *incremental* bytes, not the frame overhead
+    /// that `finish()` would append (Adler-32 / empty final block for zlib, end frame for zstd).
+    ///
+    /// This mirrors how `try_compress_buffer` uses `max_compressed_size`: it checks how many
+    /// more compressed bytes would be produced, against the current running output length.
+    /// Compresses `n` bytes of high-entropy (worst-case for compression) data and returns the
+    /// total output size after `finish()`.
+    fn total_compressed_len(compression: DatadogMetricsCompression, n: usize) -> usize {
+        // Xorshift64 — period 2^64-1, passes BigCrush, produces statistically random bytes
+        // that neither zlib nor zstd can compress significantly.
+        let mut state = 0xdeadbeef_cafebabe_u64;
+        let data: Vec<u8> = (0..n)
+            .map(|_| {
+                state ^= state << 13;
+                state ^= state >> 7;
+                state ^= state << 17;
+                state as u8
+            })
+            .collect();
+        let mut compressor = compression.compressor();
+        compressor.write_all(&data).expect("write should succeed");
+        compressor.finish().expect("finish should succeed").len()
+    }
+
+    /// Validates that `max_compressed_size(n)` is a true upper bound on the compressed bytes
+    /// attributable to `n` uncompressed bytes, for both zlib and zstd.
+    ///
+    /// We measure `total_compressed_len(n) - total_compressed_len(0)` to strip the fixed frame
+    /// overhead (header + trailer) written regardless of input size, isolating the bytes
+    /// contributed by the data itself.
+    #[test]
+    fn max_compressed_size_is_upper_bound() {
+        // zlib stored-block boundary: 16 384 bytes; zstd block boundary: 131 072 bytes.
+        let test_sizes = [
+            0, 1, 100, 1_000, 16_383, 16_384, 16_385, 32_767, 32_768, 131_071, 131_072, 131_073,
+            500_000,
+        ];
+
+        let zlib_frame = total_compressed_len(DatadogMetricsCompression::Zlib, 0);
+        let zstd_frame = total_compressed_len(DatadogMetricsCompression::Zstd, 0);
+
+        // The formula must not overestimate by more than 1% of input + 64 bytes (a small
+        // constant that covers the zstd correction term for very small inputs).
+        let max_slack = |n: usize| n / 100 + 64;
+
+        for &n in &test_sizes {
+            let actual_zlib = total_compressed_len(DatadogMetricsCompression::Zlib, n) - zlib_frame;
+            let max_zlib = DatadogMetricsCompression::Zlib.max_compressed_size(n);
+            assert!(
+                actual_zlib <= max_zlib,
+                "zlib n={n}: formula underestimates: actual={actual_zlib} > max={max_zlib}"
+            );
+            assert!(
+                max_zlib - actual_zlib <= max_slack(n),
+                "zlib n={n}: formula overestimates: slack={} > {}",
+                max_zlib - actual_zlib,
+                max_slack(n)
+            );
+
+            let actual_zstd = total_compressed_len(DatadogMetricsCompression::Zstd, n) - zstd_frame;
+            let max_zstd = DatadogMetricsCompression::Zstd.max_compressed_size(n);
+            assert!(
+                actual_zstd <= max_zstd,
+                "zstd n={n}: formula underestimates: actual={actual_zstd} > max={max_zstd}"
+            );
+            assert!(
+                max_zstd - actual_zstd <= max_slack(n),
+                "zstd n={n}: formula overestimates: slack={} > {}",
+                max_zstd - actual_zstd,
+                max_slack(n)
+            );
+        }
     }
 
     fn ts() -> DateTime<Utc> {
@@ -1149,8 +1244,7 @@ mod tests {
     #[test]
     fn incorrect_metric_for_endpoint_causes_error() {
         // Series metrics can't go to the sketches endpoint.
-        let mut sketch_encoder = DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Sketches, None)
-            .expect("default payload size limits should be valid");
+        let mut sketch_encoder = DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Sketches, None);
         let series_result = sketch_encoder.try_encode(get_simple_counter());
         assert!(matches!(
             series_result.err(),
@@ -1159,8 +1253,7 @@ mod tests {
 
         // And sketches can't go to the series endpoint.
         let mut series_v1_encoder =
-            DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Series(SeriesApiVersion::V1), None)
-                .expect("default payload size limits should be valid");
+            DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Series(SeriesApiVersion::V1), None);
         let sketch_result = series_v1_encoder.try_encode(get_simple_sketch());
         assert!(matches!(
             sketch_result.err(),
@@ -1168,8 +1261,7 @@ mod tests {
         ));
 
         let mut series_v2_encoder =
-            DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Series(SeriesApiVersion::V2), None)
-                .expect("default payload size limits should be valid");
+            DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Series(SeriesApiVersion::V2), None);
         let sketch_result = series_v2_encoder.try_encode(get_simple_sketch());
         assert!(matches!(
             sketch_result.err(),
@@ -1380,8 +1472,7 @@ mod tests {
         // This is a simple test where we ensure that a single metric, with the default limits, can
         // be encoded without hitting any errors.
         let mut encoder =
-            DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Series(SeriesApiVersion::V1), None)
-                .expect("default payload size limits should be valid");
+            DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Series(SeriesApiVersion::V1), None);
         let counter = get_simple_counter();
         let expected = counter.clone();
 
@@ -1404,8 +1495,7 @@ mod tests {
         // This is a simple test where we ensure that a single metric, with the default limits, can
         // be encoded without hitting any errors.
         let mut encoder =
-            DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Series(SeriesApiVersion::V2), None)
-                .expect("default payload size limits should be valid");
+            DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Series(SeriesApiVersion::V2), None);
         let counter = get_simple_counter();
         let expected = counter.clone();
 
@@ -1427,8 +1517,7 @@ mod tests {
     fn encode_single_sketch_metric_with_default_limits() {
         // This is a simple test where we ensure that a single metric, with the default limits, can
         // be encoded without hitting any errors.
-        let mut encoder = DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Sketches, None)
-            .expect("default payload size limits should be valid");
+        let mut encoder = DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Sketches, None);
         let sketch = get_simple_sketch();
         let expected = sketch.clone();
 
@@ -1450,8 +1539,7 @@ mod tests {
     fn encode_empty_sketch() {
         // This is a simple test where we ensure that a single metric, with the default limits, can
         // be encoded without hitting any errors.
-        let mut encoder = DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Sketches, None)
-            .expect("default payload size limits should be valid");
+        let mut encoder = DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Sketches, None);
         let sketch = Metric::new(
             "empty",
             MetricKind::Incremental,
@@ -1511,77 +1599,6 @@ mod tests {
         assert_eq!(normal_buf, incremental_buf);
     }
 
-    #[test]
-    fn payload_size_limits_series() {
-        // Get the maximum length of the header/trailer data.
-        let header_len = max_uncompressed_header_len();
-
-        // This is too small.
-        let result = validate_payload_size_limits(
-            DatadogMetricsEndpoint::Series(SeriesApiVersion::V2),
-            header_len,
-            usize::MAX,
-        );
-        assert_eq!(result, None);
-
-        // This is just right.
-        let result = validate_payload_size_limits(
-            DatadogMetricsEndpoint::Series(SeriesApiVersion::V2),
-            header_len + 1,
-            usize::MAX,
-        );
-        assert_eq!(result, Some((header_len + 1, usize::MAX)));
-
-        // Get the maximum compressed overhead length, based on our input uncompressed size.  This
-        // represents the worst case overhead based on the input data (of length usize::MAX, in this
-        // case) being entirely incompressible.
-        let compression_overhead_len = max_compression_overhead_len(usize::MAX);
-
-        // This is too small.
-        let result = validate_payload_size_limits(
-            DatadogMetricsEndpoint::Series(SeriesApiVersion::V2),
-            usize::MAX,
-            compression_overhead_len,
-        );
-        assert_eq!(result, None);
-
-        // This is just right.
-        let result = validate_payload_size_limits(
-            DatadogMetricsEndpoint::Series(SeriesApiVersion::V2),
-            usize::MAX,
-            compression_overhead_len + 1,
-        );
-        assert_eq!(result, Some((usize::MAX, compression_overhead_len + 1)));
-    }
-
-    #[test]
-    fn payload_size_limits_sketches() {
-        // There's no lower bound on uncompressed size for the sketches payload.
-        let result = validate_payload_size_limits(DatadogMetricsEndpoint::Sketches, 0, usize::MAX);
-        assert_eq!(result, Some((0, usize::MAX)));
-
-        // Get the maximum compressed overhead length, based on our input uncompressed size.  This
-        // represents the worst case overhead based on the input data (of length usize::MAX, in this
-        // case) being entirely incompressible.
-        let compression_overhead_len = max_compression_overhead_len(usize::MAX);
-
-        // This is too small.
-        let result = validate_payload_size_limits(
-            DatadogMetricsEndpoint::Sketches,
-            usize::MAX,
-            compression_overhead_len,
-        );
-        assert_eq!(result, None);
-
-        // This is just right.
-        let result = validate_payload_size_limits(
-            DatadogMetricsEndpoint::Sketches,
-            usize::MAX,
-            compression_overhead_len + 1,
-        );
-        assert_eq!(result, Some((usize::MAX, compression_overhead_len + 1)));
-    }
-
     #[test]
     fn default_payload_limits_are_endpoint_aware() {
         let v1 = DatadogMetricsEndpoint::Series(SeriesApiVersion::V1).payload_limits();
@@ -1609,8 +1626,7 @@ mod tests {
             let mut encoder = DatadogMetricsEncoder::new(
                 DatadogMetricsEndpoint::Series(SeriesApiVersion::V2),
                 None,
-            )
-            .expect("default payload size limits should be valid");
+            );
 
             let mut next_pending = Vec::new();
             let mut hit_limit = false;
@@ -1658,14 +1674,14 @@ mod tests {
         // We manually create the encoder with an arbitrarily low "uncompressed" limit but high
         // "compressed" limit to exercise the codepath that should avoid encoding a metric when the
         // uncompressed payload would exceed the limit.
-        let header_len = max_uncompressed_header_len();
+        let header_len =
+            max_uncompressed_header_len(DatadogMetricsEndpoint::Series(SeriesApiVersion::V1));
         let mut encoder = DatadogMetricsEncoder::with_payload_limits(
             DatadogMetricsEndpoint::Series(SeriesApiVersion::V1),
             None,
             header_len + 1,
             usize::MAX,
-        )
-        .expect("payload size limits should be valid");
+        );
 
         // Trying to encode a metric that would cause us to exceed our uncompressed limits will
         // _not_ return an error from `try_encode`, but instead will simply return back the metric
@@ -1684,11 +1700,11 @@ mod tests {
         let (payload, processed) = result.unwrap();
         assert_eq!(
             payload.uncompressed_byte_size,
-            max_uncompressed_header_len()
+            max_uncompressed_header_len(DatadogMetricsEndpoint::Series(SeriesApiVersion::V1))
         );
         assert_eq!(
             payload.into_payload(),
-            get_compressed_empty_series_payload()
+            get_compressed_empty_series_v1_payload()
         );
         assert_eq!(processed.len(), 0);
     }
@@ -1703,8 +1719,7 @@ mod tests {
             None,
             1,
             usize::MAX,
-        )
-        .expect("payload size limits should be valid");
+        );
 
         // Trying to encode a metric that would cause us to exceed our uncompressed limits will
         // _not_ return an error from `try_encode`, but instead will simply return back the metric
@@ -1740,8 +1755,7 @@ mod tests {
             None,
             uncompressed_limit,
             compressed_limit,
-        )
-        .expect("payload size limits should be valid");
+        );
 
         // Trying to encode a metric that would cause us to exceed our compressed limits will
         // _not_ return an error from `try_encode`, but instead will simply return back the metric
@@ -1760,11 +1774,11 @@ mod tests {
         let (payload, processed) = result.unwrap();
         assert_eq!(
             payload.uncompressed_byte_size,
-            max_uncompressed_header_len()
+            max_uncompressed_header_len(DatadogMetricsEndpoint::Series(SeriesApiVersion::V1))
         );
         assert_eq!(
             payload.into_payload(),
-            get_compressed_empty_series_payload()
+            get_compressed_empty_series_v1_payload()
         );
         assert_eq!(processed.len(), 0);
     }
@@ -1775,14 +1789,13 @@ mod tests {
         // "uncompressed" limit to exercise the codepath that should avoid encoding a metric when the
         // compressed payload would exceed the limit.
         let uncompressed_limit = 128;
-        let compressed_limit = 16;
+        let compressed_limit = 32;
         let mut encoder = DatadogMetricsEncoder::with_payload_limits(
             DatadogMetricsEndpoint::Sketches,
             None,
             uncompressed_limit,
             compressed_limit,
-        )
-        .expect("payload size limits should be valid");
+        );
 
         // Trying to encode a metric that would cause us to exceed our compressed limits will
         // _not_ return an error from `try_encode`, but instead will simply return back the metric
@@ -1807,6 +1820,284 @@ mod tests {
         assert_eq!(processed.len(), 0);
     }
 
+    #[test]
+    fn encode_series_v2_breaks_out_when_limit_reached_compressed() {
+        // We manually create the encoder with an arbitrarily low "compressed" limit but high
+        // "uncompressed" limit to exercise the codepath that should avoid encoding a metric when the
+        // compressed payload would exceed the limit.
+        let uncompressed_limit = 128;
+        let compressed_limit = 32;
+        let mut encoder = DatadogMetricsEncoder::with_payload_limits(
+            DatadogMetricsEndpoint::Series(SeriesApiVersion::V2),
+            None,
+            uncompressed_limit,
+            compressed_limit,
+        );
+
+        // Trying to encode a metric that would cause us to exceed our compressed limits will
+        // _not_ return an error from `try_encode`, but instead will simply return back the metric
+        // as it could not be added.
+        let counter = get_simple_counter();
+        let result = encoder.try_encode(counter.clone());
+        assert!(result.is_ok());
+        assert_eq!(result.unwrap(), Some(counter));
+
+        // And similarly, since we didn't actually encode a metric, we _should_ be able to finish
+        // this payload, but it will be empty (effectively, the header/footer will exist) and no
+        // processed metrics should be returned.
+        let result = encoder.finish();
+        assert!(result.is_ok());
+
+        let (payload, processed) = result.unwrap();
+        assert_eq!(payload.uncompressed_byte_size, 0);
+        assert_eq!(
+            payload.into_payload(),
+            get_compressed_empty_series_v2_payload()
+        );
+        assert_eq!(processed.len(), 0);
+    }
+
+    #[test]
+    fn zstd_v2_payload_never_exceeds_512kb_with_incompressible_data() {
+        // End-to-end regression test using the real 512 KB compressed limit.
+        //
+        // Metric names are generated with a xorshift64 PRNG producing random printable ASCII
+        // (6.5 bits of entropy per byte), making them effectively incompressible for zstd.
+        // This makes the capacity estimate tight, so the test validates both directions:
+        //
+        //   Safety   (upper bound): payload ≤ 512 KB.
+        //     Without the fix, the encoder ignores zstd's internal 128 KB buffer.  When the
+        //     encoder finally stops, finish() flushes that hidden buffer on top of the already
+        //     ~511 KB payload → ~639 KB → TooLarge.
+        //
+        //   Utilization (lower bound): payload > 95% of 512 KB.
+        //     With incompressible data, actual_compressed ≈ max_cs(uncompressed), so the
+        //     estimate is tight.  The ~2.5% gap comes from: (1) compressible proto framing
+        //     (field tags, timestamps, metadata) that zstd compresses better than max_cs
+        //     predicts, (2) the max_cs overhead term (~0.4%), and (3) one-metric stopping
+        //     granularity (~1%).
+
+        // xorshift64 PRNG: 5000 random printable ASCII chars per metric name (0x21..0x7E,
+        // 93 values ≈ 6.5 bits/byte).  Long names ensure the random portion dominates the
+        // compressible proto framing, maximizing utilization.
+        const PRINTABLE_START: u8 = 0x21;
+        const PRINTABLE_END: u8 = 0x7E;
+        const PRINTABLE_LEN: u64 = (PRINTABLE_END - PRINTABLE_START + 1) as u64; // 93
+        let mut xor_state = 0xdeadbeef_cafebabe_u64;
+        let mut next_name = || -> String {
+            std::iter::once('m')
+                .chain((0..4999).map(|_| {
+                    xor_state ^= xor_state << 13;
+                    xor_state ^= xor_state >> 7;
+                    xor_state ^= xor_state << 17;
+                    (PRINTABLE_START + (xor_state % PRINTABLE_LEN) as u8) as char
+                }))
+                .collect()
+        };
+
+        let mut encoder =
+            DatadogMetricsEncoder::new(DatadogMetricsEndpoint::Series(SeriesApiVersion::V2), None);
+
+        let mut accepted = 0usize;
+        loop {
+            let metric = Metric::new(
+                next_name(),
+                MetricKind::Incremental,
+                MetricValue::Counter {
+                    value: (accepted + 1) as f64,
+                },
+            )
+            .with_timestamp(Some(ts()));
+
+            match encoder.try_encode(metric) {
+                Ok(None) => accepted += 1,
+                Ok(Some(_)) => break,
+                Err(e) => panic!("unexpected encoding error: {e}"),
+            }
+        }
+
+        assert!(accepted > 0, "at least one metric must be accepted");
+
+        let compressed_limit = DatadogMetricsEndpoint::Series(SeriesApiVersion::V2)
+            .payload_limits()
+            .compressed;
+
+        let (payload, _) = encoder.finish().unwrap_or_else(|e| {
+            panic!(
+                "finish() returned an error after {accepted} metrics — \
+                 the capacity estimate failed to prevent overflow: {e:?}"
+            )
+        });
+        let payload_len = payload.into_payload().len();
+
+        // Safety: the hard limit must never be exceeded.
+        assert!(
+            payload_len <= compressed_limit,
+            "payload ({payload_len} bytes) exceeded the {compressed_limit}-byte compressed limit"
+        );
+
+        // Utilization: the encoder should use at least 95% of the available capacity.
+        let min_utilization = compressed_limit * 95 / 100;
+        assert!(
+            payload_len > min_utilization,
+            "payload ({payload_len} bytes) is below 95% of the {compressed_limit}-byte limit \
+             ({min_utilization} bytes) — estimate may be over-conservative"
+        );
+    }
+
+    #[test]
+    fn compressed_limit_is_respected_regardless_of_compressor_internal_buffering() {
+        // Regression test for zstd's internal buffering hiding the compressed-size check.
+        //
+        // zstd buffers up to 128 KB internally before flushing a block to the output Vec.
+        // The old capacity check used `get_ref().len()` alone as "compressed bytes so far", which
+        // returns 0 until zstd's first 128 KB block completes. This caused the encoder to accept
+        // metrics indefinitely — finish() would then return TooLarge, triggering expensive
+        // re-encoding.
+        //
+        // The fix splits the estimate: exact compressed size for flushed blocks, plus
+        // max_compressed_size for the unflushed portion (bytes still in zstd's internal buffer).
+        // This is accurate for flushed data and bounded for unflushed data.
+        //
+        // At compressed_limit=512, no zstd block will flush (needs 128 KB of input), so
+        // get_ref().len() stays 0 throughout. The old code would accept all 100 metrics;
+        // the new code stops after a handful.
+        let compressed_limit = 512;
+        let mut encoder = DatadogMetricsEncoder::with_payload_limits(
+            DatadogMetricsEndpoint::Series(SeriesApiVersion::V2),
+            None,
+            1_000_000,
+            compressed_limit,
+        );
+
+        let mut accepted = 0;
+        for i in 0..100 {
+            let metric = Metric::new(
+                format!("counter_{i:0>20}"),
+                MetricKind::Incremental,
+                MetricValue::Counter {
+                    value: (i + 1) as f64,
+                },
+            )
+            .with_timestamp(Some(ts()));
+            match encoder.try_encode(metric) {
+                Ok(None) => accepted += 1,
+                Ok(Some(_)) => break,
+                Err(e) => panic!("unexpected encoding error: {e}"),
+            }
+        }
+
+        assert!(accepted > 0, "encoder should accept at least one metric");
+        assert!(
+            accepted < 10,
+            "encoder accepted too many metrics — compressed limit was likely not enforced (accepted={accepted})"
+        );
+
+        let result = encoder.finish();
+        assert!(
+            result.is_ok(),
+            "finish() must not return TooLarge: {:?}",
+            result.err()
+        );
+        let (payload, _) = result.unwrap();
+        assert!(
+            payload.into_payload().len() <= compressed_limit,
+            "payload exceeded compressed_limit"
+        );
+    }
+
+    #[test]
+    fn zstd_buffered_bound_resets_to_last_metric_size_after_block_flush() {
+        // White-box test: directly verifies that buffered_bound resets to exactly n (the last
+        // metric's encoded size) when a zstd block flush occurs, not to 0 or some other value.
+        //
+        // buffered_bound is an upper bound on bytes in zstd's internal buffer.  On each write it
+        // accumulates (+= n).  When a flush is detected (get_ref().len() grows), it resets to n —
+        // meaning only the triggering write could straddle the block boundary.
+        //
+        // If it reset to 0 instead, subsequent capacity checks would degenerate to
+        //   flushed_compressed + max_cs(n)
+        // which vastly underestimates for any data written after the flush, re-introducing the
+        // original blind spot.  If it failed to reset at all, the encoder would become
+        // over-conservative and reject valid metrics after the first flush.
+        //
+        // Strategy:
+        //   1. Measure a single metric's encoded size by inspecting buffered_bound after one write.
+        //   2. Feed metrics into a second encoder (with unlimited limits) until buffered_bound
+        //      *decreases*, which signals a block flush.  Assert the post-flush value equals
+        //      exactly one metric's encoded size.
+
+        let make_metric = |i: usize| {
+            // Fixed-width name (600-char zero-padded) gives a constant per-metric encoded size.
+            // Value is (i + 1) to ensure it is never 0.0: proto3 omits default (zero) values,
+            // which would make the first metric smaller than the rest.
+            Metric::new(
+                format!("counter_{i:0>600}"),
+                MetricKind::Incremental,
+                MetricValue::Counter {
+                    value: (i + 1) as f64,
+                },
+            )
+            .with_timestamp(Some(ts()))
+        };
+
+        // Step 1: measure a single metric's encoded size.
+        let metric_size = {
+            let mut probe = DatadogMetricsEncoder::with_payload_limits(
+                DatadogMetricsEndpoint::Series(SeriesApiVersion::V2),
+                None,
+                usize::MAX,
+                usize::MAX,
+            );
+            assert!(
+                probe.try_encode(make_metric(0)).unwrap().is_none(),
+                "first metric must be accepted"
+            );
+            probe.buffered_bound()
+        };
+        assert!(metric_size > 0, "encoded metric must be non-empty");
+
+        // Step 2: encode metrics until buffered_bound decreases (= flush detected).
+        let mut encoder = DatadogMetricsEncoder::with_payload_limits(
+            DatadogMetricsEndpoint::Series(SeriesApiVersion::V2),
+            None,
+            usize::MAX,
+            usize::MAX,
+        );
+
+        let mut prev_buffered = 0usize;
+        let mut flush_seen = false;
+
+        for i in 0..1000 {
+            let metric = make_metric(i);
+            match encoder.try_encode(metric) {
+                Ok(None) => {}
+                Ok(Some(_)) => panic!("unexpected rejection at i={i} with unlimited limits"),
+                Err(e) => panic!("unexpected error at i={i}: {e}"),
+            }
+
+            let curr = encoder.buffered_bound();
+
+            if curr < prev_buffered {
+                // A block flush just occurred: buffered_bound must reset to exactly n.
+                assert_eq!(
+                    curr, metric_size,
+                    "after block flush, buffered_bound should reset to one metric's encoded size \
+                     ({metric_size} bytes) but got {curr}"
+                );
+                flush_seen = true;
+                break;
+            }
+
+            prev_buffered = curr;
+        }
+
+        assert!(
+            flush_seen,
+            "no zstd block flush detected after 1000 metrics — increase loop bound or metric size"
+        );
+    }
+
     fn arb_counter_metric() -> impl Strategy<Value = Metric> {
         let name = string_regex("[a-zA-Z][a-zA-Z0-9_]{8,96}").expect("regex should not be invalid");
         let value = ARB_POSITIVE_F64;
@@ -1827,9 +2118,9 @@ mod tests {
 
     proptest! {
         #[test]
-        fn encoding_check_for_payload_limit_edge_cases(
-            uncompressed_limit in 0..64_000_000usize,
-            compressed_limit in 0..10_000_000usize,
+        fn encoding_check_for_payload_limit_edge_cases_v1(
+            uncompressed_limit in 1..64_000_000usize,
+            compressed_limit in 1..10_000_000usize,
             metric in arb_counter_metric(),
         ) {
             // We simply try to encode a single metric into an encoder, and make sure that when we
@@ -1838,25 +2129,51 @@ mod tests {
             //
             // We check this with targeted unit tests as well but this is some cheap insurance to
             // show that we're hopefully not missing any particular corner cases.
-            let result = DatadogMetricsEncoder::with_payload_limits(
+            let mut encoder = DatadogMetricsEncoder::with_payload_limits(
+                DatadogMetricsEndpoint::Series(SeriesApiVersion::V1),
+                None,
+                uncompressed_limit,
+                compressed_limit,
+            );
+            _ = encoder.try_encode(metric);
+
+            if let Ok((payload, _processed)) = encoder.finish() {
+                let payload = payload.into_payload();
+                prop_assert!(payload.len() <= compressed_limit);
+
+                // V1 uses zlib/deflate.
+                let result = decompress_zlib_payload(payload);
+                prop_assert!(result.is_ok());
+
+                let decompressed = result.unwrap();
+                prop_assert!(decompressed.len() <= uncompressed_limit);
+            }
+        }
+
+        #[test]
+        fn encoding_check_for_payload_limit_edge_cases_v2(
+            uncompressed_limit in 1..10_000_000usize,
+            compressed_limit in 1..1_000_000usize,
+            metric in arb_counter_metric(),
+        ) {
+            let mut encoder = DatadogMetricsEncoder::with_payload_limits(
                 DatadogMetricsEndpoint::Series(SeriesApiVersion::V2),
                 None,
                 uncompressed_limit,
                 compressed_limit,
             );
-            if let Ok(mut encoder) = result {
-                _ = encoder.try_encode(metric);
+            _ = encoder.try_encode(metric);
 
-                if let Ok((payload, _processed)) = encoder.finish() {
-                    let payload = payload.into_payload();
-                    prop_assert!(payload.len() <= compressed_limit);
+            if let Ok((payload, _processed)) = encoder.finish() {
+                let payload = payload.into_payload();
+                prop_assert!(payload.len() <= compressed_limit);
 
-                    let result = decompress_payload(payload);
-                    prop_assert!(result.is_ok());
+                // V2 uses zstd.
+                let result = decompress_zstd_payload(payload);
+                prop_assert!(result.is_ok());
 
-                    let decompressed = result.unwrap();
-                    prop_assert!(decompressed.len() <= uncompressed_limit);
-                }
+                let decompressed = result.unwrap();
+                prop_assert!(decompressed.len() <= uncompressed_limit);
             }
         }
     }
diff --git a/src/sinks/datadog/metrics/integration_tests.rs b/src/sinks/datadog/metrics/integration_tests.rs
index e63d4c35e73c9..176c2153d88e0 100644
--- a/src/sinks/datadog/metrics/integration_tests.rs
+++ b/src/sinks/datadog/metrics/integration_tests.rs
@@ -29,6 +29,7 @@ use crate::{
             DATA_VOLUME_SINK_TAGS, SINK_TAGS, assert_data_volume_sink_compliance,
             assert_sink_compliance,
         },
+        compression::is_zstd,
         map_event_batch_stream,
     },
 };
@@ -142,10 +143,14 @@ async fn start_test(events: Vec<Event>) -> (Vec<Event>, Receiver<(http::request:
 }
 
 fn decompress_payload(payload: Vec<u8>) -> std::io::Result<Vec<u8>> {
-    let mut decompressor = ZlibDecoder::new(&payload[..]);
-    let mut decompressed = Vec::new();
-    let result = std::io::copy(&mut decompressor, &mut decompressed);
-    result.map(|_| decompressed)
+    if is_zstd(&payload) {
+        zstd::decode_all(&payload[..])
+    } else {
+        let mut decompressor = ZlibDecoder::new(&payload[..]);
+        let mut decompressed = Vec::new();
+        std::io::copy(&mut decompressor, &mut decompressed)?;
+        Ok(decompressed)
+    }
 }
 
 #[tokio::test]
diff --git a/src/sinks/datadog/metrics/request_builder.rs b/src/sinks/datadog/metrics/request_builder.rs
index 3b1c2f4607d39..ba8a7723dbf07 100644
--- a/src/sinks/datadog/metrics/request_builder.rs
+++ b/src/sinks/datadog/metrics/request_builder.rs
@@ -9,19 +9,13 @@ use vector_lib::{
 
 use super::{
     config::{DatadogMetricsEndpoint, DatadogMetricsEndpointConfiguration, SeriesApiVersion},
-    encoder::{CreateError, DatadogMetricsEncoder, EncoderError, FinishError},
+    encoder::{DatadogMetricsEncoder, EncoderError, FinishError},
     service::DatadogMetricsRequest,
 };
 use crate::sinks::util::{IncrementalRequestBuilder, metadata::RequestMetadataBuilder};
 
 #[derive(Debug, Snafu)]
 pub enum RequestBuilderError {
-    #[snafu(
-        context(false),
-        display("Failed to build the request builder: {source}")
-    )]
-    FailedToBuild { source: CreateError },
-
     #[snafu(context(false), display("Failed to encode metric: {source}"))]
     FailedToEncode { source: EncoderError },
 
@@ -40,7 +34,6 @@ impl RequestBuilderError {
     /// many events were dropped as a result.
     pub fn into_parts(self) -> (String, &'static str, u64) {
         match self {
-            Self::FailedToBuild { source } => (source.to_string(), source.as_error_type(), 0),
             // Encoding errors always happen at the per-metric level, so we could only ever drop a
             // single metric/event at a time.
             Self::FailedToEncode { source } => (source.to_string(), source.as_error_type(), 1),
@@ -81,18 +74,18 @@ impl DatadogMetricsRequestBuilder {
         endpoint_configuration: DatadogMetricsEndpointConfiguration,
         default_namespace: Option<String>,
         series_api_version: SeriesApiVersion,
-    ) -> Result<Self, RequestBuilderError> {
-        Ok(Self {
+    ) -> Self {
+        Self {
             endpoint_configuration,
             series_encoder: DatadogMetricsEncoder::new(
                 DatadogMetricsEndpoint::Series(series_api_version),
                 default_namespace.clone(),
-            )?,
+            ),
             sketches_encoder: DatadogMetricsEncoder::new(
                 DatadogMetricsEndpoint::Sketches,
                 default_namespace,
-            )?,
-        })
+            ),
+        }
     }
 
     const fn get_encoder(
@@ -247,6 +240,7 @@ impl IncrementalRequestBuilder<((Option<Arc<str>>, DatadogMetricsEndpoint), Vec<
             payload,
             uri,
             content_type: ddmetrics_metadata.endpoint.content_type(),
+            content_encoding: ddmetrics_metadata.endpoint.compression().content_encoding(),
             finalizers: ddmetrics_metadata.finalizers,
             metadata: request_metadata,
         }
diff --git a/src/sinks/datadog/metrics/service.rs b/src/sinks/datadog/metrics/service.rs
index e40c7cd91c406..024493ed88fc2 100644
--- a/src/sinks/datadog/metrics/service.rs
+++ b/src/sinks/datadog/metrics/service.rs
@@ -44,6 +44,7 @@ pub struct DatadogMetricsRequest {
     pub payload: Bytes,
     pub uri: Uri,
     pub content_type: &'static str,
+    pub content_encoding: &'static str,
     pub finalizers: EventFinalizers,
     pub metadata: RequestMetadata,
 }
@@ -63,11 +64,6 @@ impl DatadogMetricsRequest {
                 HeaderValue::from_str(&key).expect("API key should be only valid ASCII characters")
             },
         );
-        // Requests to the metrics endpoints can be compressed, and there's almost no reason to
-        // _not_ compress them given tha t metric data, when encoded, is very repetitive.  Thus,
-        // here and through the sink code, we always compress requests.  Datadog also only supports
-        // zlib (DEFLATE) compression, which is why it's hard-coded here vs being set via the common
-        // `Compression` value that most sinks utilize.
         let request = Request::post(self.uri)
             .header("DD-API-KEY", api_key)
             // TODO: The Datadog Agent sends this header to indicate the version of the Go library
@@ -82,7 +78,7 @@ impl DatadogMetricsRequest {
             // this header.
             .header("DD-Agent-Payload", "4.87.0")
             .header(CONTENT_TYPE, self.content_type)
-            .header(CONTENT_ENCODING, "deflate");
+            .header(CONTENT_ENCODING, self.content_encoding);
 
         request.body(Body::from(self.payload))
     }

From 753cf9a7c03a5cef85a29f3561666d94e9084d8b Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 24 Mar 2026 15:57:50 -0400
Subject: [PATCH 050/326] docs(internal docs): consolidate reference
 documentation into detailed docs table in AGENTS.md (#25036)

* docs: consolidate reference documentation into detailed docs table in AGENTS.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs(internal docs): add PR title semantic convention section to AGENTS.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs(internal docs): fix markdown lint errors in PR title section

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 AGENTS.md | 37 +++++++++++++++----------------------
 1 file changed, 15 insertions(+), 22 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 580018abf0283..e70a963047d9f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -191,6 +191,12 @@ Then: `chmod +x .git/hooks/pre-push`
 | Topic | Document |
 |-------|----------|
 | Rust style patterns | [docs/RUST_STYLE.md](docs/RUST_STYLE.md) |
+| Code style rules (formatting, const strings, organization) | [STYLE.md](STYLE.md) |
+| System architecture (sources, transforms, sinks, topology) | [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) |
+| Component specification (naming, configuration, health checks) | [docs/specs/component.md](docs/specs/component.md) |
+| Instrumentation requirements (event/metric naming) | [docs/specs/instrumentation.md](docs/specs/instrumentation.md) |
+| How to document code changes | [docs/DOCUMENTING.md](docs/DOCUMENTING.md) |
+| Adding changelog entries | [changelog.d/README.md](changelog.d/README.md) |
 
 ## Architecture Notes
 
@@ -258,28 +264,15 @@ make build-licenses
 
 Before opening a PR, read [`.github/PULL_REQUEST_TEMPLATE.md`](.github/PULL_REQUEST_TEMPLATE.md) and use it as the reference for the PR body structure and title.
 
-## Reference Documentation
+### PR Title Format
 
-These documents provide context that AI agents and developers need when working on Vector code.
+PR titles must follow the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) spec and are validated by `.github/workflows/semantic.yml`.
 
-### Essential for Code Changes
+Examples:
 
-- **[STYLE.md](STYLE.md)** - Code style rules (formatting, const strings, code organization)
-- **[docs/ARCHITECTURE.md](docs/ARCHITECTURE.md)** - System architecture (sources, transforms, sinks, topology)
-- **[docs/DEVELOPING.md](docs/DEVELOPING.md)** - Development workflow and testing
-
-### Component Development
-
-- **[docs/specs/component.md](docs/specs/component.md)** - Component specification (naming, configuration, health checks)
-- **[docs/specs/instrumentation.md](docs/specs/instrumentation.md)** - Instrumentation requirements (event/metric naming)
-- **[src/internal_events](src/internal_events)** - Internal event examples for telemetry
-
-### Adding Documentation
-
-- **[docs/DOCUMENTING.md](docs/DOCUMENTING.md)** - How to document code changes
-- **[changelog.d/README.md](changelog.d/README.md)** - Adding changelog entries
-
-### Full Guides
-
-- **[CONTRIBUTING.md](CONTRIBUTING.md)** - Complete contributing guide
-- **[website/README.md](website/README.md)** - Website development only (separate from Rust code)
+```text
+feat(kafka source): add consumer group lag metric
+fix(loki sink): handle empty label sets correctly
+docs(internal docs): update contributing guide
+chore(deps): bump tokio to X
+```

From 47b5b02b9fdd13b67294df65175e9eca99c4cd8b Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 24 Mar 2026 16:36:30 -0400
Subject: [PATCH 051/326] chore(ci): split deny check into optional (all) and
 required (licenses) (#24990)

ci(deny): split deny check into optional (all) and required (licenses)

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 .github/workflows/deny.yml      | 27 +++++++++++++++++++++++----
 Makefile                        |  4 ++++
 vdev/src/commands/check/deny.rs | 13 +++++++++++--
 3 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml
index 2a9696cc3f76d..52b40d1e1d535 100644
--- a/.github/workflows/deny.yml
+++ b/.github/workflows/deny.yml
@@ -26,12 +26,14 @@ on:
         type: string
 
   pull_request:
+  merge_group:
+    types: [checks_requested]
   schedule:
     # Same schedule as nightly.yml
     - cron: "0 5 * * 2-6"  # Runs at 5:00 AM UTC, Tuesday through Saturday
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
   cancel-in-progress: true
 
 permissions:
@@ -48,8 +50,6 @@ jobs:
     timeout-minutes: 30
     if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') }}
     needs: [changes]
-    env:
-      CARGO_INCREMENTAL: 0
     steps:
       - name: Checkout branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -61,5 +61,24 @@ jobs:
           mold: false
           cargo-deny: true
 
-      - name: Check cargo deny advisories/licenses
+      - name: Check cargo deny (all)
         run: make check-deny
+
+  test-deny-licenses:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.deny == 'true') }}
+    needs: [changes]
+    steps:
+      - name: Checkout branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref }}
+
+      - uses: ./.github/actions/setup
+        with:
+          mold: false
+          cargo-deny: true
+
+      - name: Check cargo deny licenses
+        run: make check-deny-licenses
diff --git a/Makefile b/Makefile
index c6e5d2423820c..71a324a5a7c5b 100644
--- a/Makefile
+++ b/Makefile
@@ -518,6 +518,10 @@ check-scripts: ## Check that scripts do not have common mistakes
 check-deny: ## Check advisories licenses and sources for crate dependencies
 	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check deny
 
+.PHONY: check-deny-licenses
+check-deny-licenses: ## Check licenses for crate dependencies
+	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check deny --licenses-only
+
 .PHONY: check-events
 check-events: ## Check that events satisfy patterns set in https://github.com/vectordotdev/vector/blob/master/rfcs/2020-03-17-2064-event-driven-observability.md
 	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check events
diff --git a/vdev/src/commands/check/deny.rs b/vdev/src/commands/check/deny.rs
index 11d04c6710fa9..d24b7454b51da 100644
--- a/vdev/src/commands/check/deny.rs
+++ b/vdev/src/commands/check/deny.rs
@@ -5,10 +5,19 @@ use crate::app;
 /// Check for advisories, licenses, and sources for crate dependencies
 #[derive(clap::Args, Debug)]
 #[command()]
-pub struct Cli {}
+pub struct Cli {
+    /// Only check licenses
+    #[arg(long)]
+    licenses_only: bool,
+}
 
 impl Cli {
     pub fn exec(self) -> Result<()> {
+        let check = if self.licenses_only {
+            "licenses"
+        } else {
+            "all"
+        };
         app::exec(
             "cargo",
             [
@@ -17,7 +26,7 @@ impl Cli {
                 "error",
                 "--all-features",
                 "check",
-                "all",
+                check,
             ],
             true,
         )

From ca9b29bc52b7c7ba857c337b25278edbad1c5e66 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 25 Mar 2026 13:17:07 -0400
Subject: [PATCH 052/326] chore(deps): bump serial_test from 3.2.0 to 3.4.0
 (#25022)

Bumps [serial_test](https://github.com/palfrey/serial_test) from 3.2.0 to 3.4.0.
- [Release notes](https://github.com/palfrey/serial_test/releases)
- [Commits](https://github.com/palfrey/serial_test/compare/v3.2.0...v3.4.0)

---
updated-dependencies:
- dependency-name: serial_test
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 11 ++++++-----
 Cargo.toml |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index d23731697fa21..229f42dd631ed 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9923,11 +9923,12 @@ dependencies = [
 
 [[package]]
 name = "serial_test"
-version = "3.2.0"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b258109f244e1d6891bf1053a55d63a5cd4f8f4c30cf9a1280989f80e7a1fa9"
+checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
 dependencies = [
- "futures",
+ "futures-executor",
+ "futures-util",
  "log",
  "once_cell",
  "parking_lot",
@@ -9937,9 +9938,9 @@ dependencies = [
 
 [[package]]
 name = "serial_test_derive"
-version = "3.2.0"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d69265a08751de7844521fd15003ae0a888e035773ba05695c5c759a6f89eef"
+checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.44",
diff --git a/Cargo.toml b/Cargo.toml
index 0a577cde861d9..83da1ac8eb616 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -214,7 +214,7 @@ vector-vrl-category = { path = "lib/vector-vrl/category" }
 vector-vrl-functions = { path = "lib/vector-vrl/functions", default-features = false }
 vrl = { git = "https://github.com/vectordotdev/vrl.git", branch = "main", default-features = false, features = ["arbitrary", "cli", "test", "test_framework", "stdlib-base"] }
 mock_instant = { version = "0.6" }
-serial_test = { version = "3.2" }
+serial_test = { version = "3.4" }
 strum = { version = "0.28", features = ["derive"] }
 
 [dependencies]

From a2918e6ac4b874dc7c67b558a1e2bc9fd2b4ae81 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 25 Mar 2026 13:58:38 -0400
Subject: [PATCH 053/326] chore(deps): bump quick-junit from 0.5.2 to 0.6.0
 (#25032)

* chore(deps): bump quick-junit from 0.5.2 to 0.6.0

Bumps [quick-junit](https://github.com/nextest-rs/quick-junit) from 0.5.2 to 0.6.0.
- [Release notes](https://github.com/nextest-rs/quick-junit/releases)
- [Changelog](https://github.com/nextest-rs/quick-junit/blob/main/CHANGELOG.md)
- [Commits](https://github.com/nextest-rs/quick-junit/compare/quick-junit-0.5.2...quick-junit-0.6.0)

---
updated-dependencies:
- dependency-name: quick-junit
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(deps): update quick-junit version requirement to 0.6.0 in Cargo.toml

Dependabot only bumped the version in Cargo.lock but left the version
requirement in Cargo.toml at "0.5.1", which resolves to >=0.5.1,<0.6.0
and causes cargo to revert the lock file back to 0.5.2 on any build.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
---
 Cargo.lock | 4 ++--
 Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 229f42dd631ed..c5efc9802ce97 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8395,9 +8395,9 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
 [[package]]
 name = "quick-junit"
-version = "0.5.2"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ee9342d671fae8d66b3ae9fd7a9714dfd089c04d2a8b1ec0436ef77aee15e5f"
+checksum = "e3e64c58c4c88fc1045e8fe98a1b7cec3643187e3dd678f9bbcdd8f12a6933d6"
 dependencies = [
  "chrono",
  "indexmap 2.12.0",
diff --git a/Cargo.toml b/Cargo.toml
index 83da1ac8eb616..06b83efedb33e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -408,7 +408,7 @@ ordered-float.workspace = true
 percent-encoding = { version = "2.3.1", default-features = false }
 postgres-openssl = { version = "0.5.1", default-features = false, features = ["runtime"], optional = true }
 pulsar = { version = "6.7.0", default-features = false, features = ["tokio-runtime", "auth-oauth2", "flate2", "lz4", "snap", "zstd"], optional = true }
-quick-junit = { version = "0.5.1" }
+quick-junit = { version = "0.6.0" }
 rand.workspace = true
 rand_distr.workspace = true
 rdkafka = { version = "0.39.0", default-features = false, features = ["curl-static", "tokio", "libz", "ssl", "zstd"], optional = true }

From 209b252deed214144fd2a6d4ed6c5ea3a3e08821 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 25 Mar 2026 15:11:04 -0400
Subject: [PATCH 054/326] chore(dev): enforce and fix markdownlint rules
 (#25038)

* chore(markdown): move markdownlint config to project root, add fix-markdown target

- Move .markdownlintrc from scripts/ to project root
- Update vdev check markdown to use new path
- Add `make fix-markdown` target for auto-fixing issues
- Enable default rules and disable rules incompatible with Hugo's
  rendering pipeline (MD001, MD041, MD051, MD052, MD053)
- Enforce emphasis style as asterisk (MD049)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(vdev): remove .github exclusion from markdown lint check

Previously .github/ was excluded because it had unresolved violations.
Those are now fixed, so all tracked markdown files are linted.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(markdown): enforce and fix markdownlint rules

- Enable default rules; disable rules incompatible with Hugo rendering
  pipeline (MD001, MD024, MD025, MD041, MD051, MD052, MD053) and rules
  with intentional exceptions (MD012, MD013, MD014, MD033, MD034, MD049)
- Add make fix-markdown target for auto-fixing issues
- Remove .github exclusion from markdown lint (violations now fixed)
- Fix all existing violations: table formatting (MD055/MD060), ordered
  list prefixes (MD029), non-descriptive link text (MD059), missing code
  block languages (MD040), missing alt text (MD045), list/heading
  spacing (MD022/MD032), list style (MD004), list indent (MD007)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(markdown): rename config to .markdownlint.jsonc for editor compatibility

Rename .markdownlintrc to .markdownlint.jsonc so that markdownlint-cli2
(used by Zed, VS Code, and most modern editors) auto-detects the config.
Add a comment pointing toward migrating CI from markdownlint-cli (legacy)
to markdownlint-cli2 to unify tooling.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/ISSUE_TEMPLATE/minor-release.md       |  3 +-
 .github/PULL_REQUEST_TEMPLATE.md              |  5 +-
 .github/SUPPORT.md                            | 14 ++--
 .github/actions/spelling/README.md            |  2 +-
 .github/actions/spelling/advice.md            |  1 +
 .../.markdownlintrc => .markdownlint.jsonc    | 19 ++++--
 AGENTS.md                                     |  2 +-
 CONTRIBUTING.md                               | 10 +--
 Makefile                                      |  4 ++
 PRIVACY.md                                    |  7 +-
 RELEASES.md                                   | 18 ++---
 VERSIONING.md                                 | 14 ++--
 distribution/docker/README.md                 | 12 ++--
 docs/DEVELOPING.md                            |  4 +-
 docs/README.md                                |  4 +-
 docs/tutorials/sinks/1_basic_sink.md          |  8 +--
 ...6-1999-api-extensions-for-lua-transform.md | 16 ++---
 .../2020-04-04-2221-kubernetes-integration.md | 54 +++++++--------
 ...-05-25-2685-dev-workflow-simplification.md |  8 +--
 rfcs/2020-05-25-2692-more-usable-logevents.md | 10 +--
 rfcs/2020-07-28-3642-jmx_rfc.md               |  4 +-
 rfcs/2020-10-15-3480-file-source-rework.md    | 32 ++++-----
 rfcs/2021-02-23-6531-performance-testing.md   |  4 +-
 ...1-03-26-6517-end-to-end-acknowledgement.md | 16 ++---
 rfcs/2021-07-19-8216-multiple-pipelines.md    |  4 +-
 rfcs/2021-08-13-8025-internal-tracing.md      |  8 +--
 rfcs/2021-08-29-8381-vrl-iteration-support.md | 25 +++----
 ...-accept-metrics-in-datadog-agent-source.md | 20 +++---
 ...021-10-29-8621-framing-and-codecs-sinks.md | 68 +++++++++----------
 ...m-stats-along-traces-in-dd-agent-source.md |  2 +-
 rfcs/2021-11-12-9811-vrl-vm.md                |  4 +-
 ...021-12-06-10298-kubernetes_logs-rewrite.md |  4 +-
 rfcs/2022-05-17-11532-chronicle-sink.md       | 20 +++---
 rfcs/2022-10-12-14742-flexible-metric-tags.md | 16 ++---
 rfcs/2022-10-31-15056-tooling-revamp.md       |  2 +-
 rfcs/2023-05-03-data-volume-metrics.md        |  2 +-
 rfcs/README.md                                | 18 ++---
 vdev/src/commands/check/markdown.rs           | 14 ++--
 website/README.md                             |  4 +-
 .../en/blog/adaptive-request-concurrency.md   | 14 ++--
 .../en/blog/highlights-february-2025.md       |  4 +-
 website/content/en/blog/how-we-test-vector.md |  4 +-
 .../content/en/blog/tracking-allocations.md   |  2 +-
 .../content/en/blog/vector-remap-language.md  | 22 +++---
 .../en/docs/administration/management.md      | 10 +--
 .../en/docs/administration/monitoring.md      | 16 ++---
 .../en/docs/administration/validating.md      |  8 +--
 .../content/en/docs/introduction/concepts.md  |  4 +-
 .../reference/configuration/unit-tests.md     | 36 +++++-----
 .../content/en/docs/reference/vrl/_index.md   | 16 ++---
 .../content/en/docs/reference/vrl/errors.md   | 22 +++---
 .../setup/going-to-prod/arch/aggregator.md    |  2 +-
 .../docs/setup/going-to-prod/arch/unified.md  |  2 +-
 .../setup/installation/manual/from-source.md  |  2 +-
 .../installation/package-managers/helm.md     |  4 +-
 .../installation/platforms/kubernetes.md      |  4 +-
 .../guides/developer/config-autocompletion.md |  4 +-
 .../content/en/guides/developer/debugging.md  |  2 +-
 .../2020-10-27-kubernetes-integration.md      |  6 +-
 ...20-11-19-prometheus-remote-integrations.md |  2 +-
 .../2020-12-01-0-11-upgrade-guide.md          | 12 ++--
 .../2021-02-16-0-12-upgrade-guide.md          |  8 +--
 .../2021-08-24-vector-aggregator.md           |  2 +-
 .../2021-08-25-0-16-upgrade-guide.md          |  8 +--
 .../2021-10-08-0-17-upgrade-guide.md          | 12 ++--
 .../2021-11-18-0-18-0-upgrade-guide.md        |  8 +--
 .../2021-12-28-0-19-0-upgrade-guide.md        |  6 +-
 .../2022-02-08-0-20-0-upgrade-guide.md        | 12 ++--
 .../2022-03-22-0-21-0-upgrade-guide.md        | 10 +--
 .../2022-03-31-native-event-codecs.md         |  6 +-
 .../2022-05-03-0-22-0-upgrade-guide.md        |  6 +-
 .../2022-10-04-0-25-0-upgrade-guide.md        |  4 +-
 .../2023-02-28-0-28-0-upgrade-guide.md        |  2 +-
 .../2023-03-26-0-37-0-upgrade-guide.md        |  2 +-
 .../2023-07-05-0-31-0-upgrade-guide.md        |  2 +-
 .../2023-09-27-0-33-0-upgrade-guide.md        |  8 +--
 .../2023-11-07-0-34-0-upgrade-guide.md        | 16 ++---
 .../highlights/2023-11-07-new-linux-repos.md  | 10 +--
 .../2023-12-19-0-35-0-upgrade-guide.md        | 12 ++--
 .../2024-05-07-0-38-0-upgrade-guide.md        |  2 +-
 .../2024-06-17-0-39-0-upgrade-guide.md        |  2 +-
 .../2024-07-29-0-40-0-upgrade-guide.md        |  4 +-
 82 files changed, 415 insertions(+), 407 deletions(-)
 rename scripts/.markdownlintrc => .markdownlint.jsonc (53%)

diff --git a/.github/ISSUE_TEMPLATE/minor-release.md b/.github/ISSUE_TEMPLATE/minor-release.md
index 105299559632b..7ab406601e4cb 100644
--- a/.github/ISSUE_TEMPLATE/minor-release.md
+++ b/.github/ISSUE_TEMPLATE/minor-release.md
@@ -37,6 +37,7 @@ cargo vdev release prepare --version "${NEW_VECTOR_VERSION}" --vrl-version "${NE
 ```
 
 Automated steps include:
+
 - Create a new release branch from master to freeze commits
   - `git fetch && git checkout origin/master && git checkout -b "${RELEASE_BRANCH}" && git push -u`
 - Create a new release preparation branch from `master`
@@ -79,7 +80,7 @@ Automated steps include:
       - [ ] Squash the release preparation commits (but not the cherry-picked commits!) to a single
           commit. This makes it easier to cherry-pick to master after the release.
     - [ ] Merge release preparation branch into the release branch.
-        - `git switch "${RELEASE_BRANCH}" && git merge --ff-only "${PREP_BRANCH}"`
+      - `git switch "${RELEASE_BRANCH}" && git merge --ff-only "${PREP_BRANCH}"`
 
 - [ ] Tag new release
   - [ ] `git tag v"${NEW_VECTOR_VERSION}" -a -m v"${NEW_VECTOR_VERSION}"`
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 2d239269beeda..0aa52163fafd3 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -9,6 +9,7 @@ This should help the reviewers give feedback faster and with higher quality. -->
 <!-- Please describe how you tested your changes. Also include any information about your setup. -->
 
 ## Change Type
+
 - [ ] Bug fix
 - [ ] New feature
 - [ ] Dependencies
@@ -16,6 +17,7 @@ This should help the reviewers give feedback faster and with higher quality. -->
 - [ ] Performance
 
 ## Is this a breaking change?
+
 - [ ] Yes
 - [ ] No
 
@@ -36,6 +38,7 @@ Changes to CI, website, playground and similar are generally not considered user
 -->
 
 ## Notes
+
 - Please read our [Vector contributor resources](https://github.com/vectordotdev/vector/tree/master/docs#getting-started).
 - Do not hesitate to use `@vectordotdev/vector` to reach out to us regarding this PR.
 - Some CI checks run only after we manually approve them.
@@ -48,7 +51,7 @@ Changes to CI, website, playground and similar are generally not considered user
   - Feel free to push as many commits as you want. They will be squashed into one before merging.
   - For example, you can run `git merge origin master` and `git push`.
 - If this PR introduces changes Vector dependencies (modifies `Cargo.lock`), please
-  run `make build-licenses` to regenerate the [license inventory](https://github.com/vectordotdev/vrl/blob/main/LICENSE-3rdparty.csv) and commit the changes (if any). More details [here](https://crates.io/crates/dd-rust-license-tool).
+  run `make build-licenses` to regenerate the [license inventory](https://github.com/vectordotdev/vrl/blob/main/LICENSE-3rdparty.csv) and commit the changes (if any). More details on the [dd-rust-license-tool](https://crates.io/crates/dd-rust-license-tool).
 
 
 <!--
diff --git a/.github/SUPPORT.md b/.github/SUPPORT.md
index 009ce3d96cd9e..299edf2dd1a52 100644
--- a/.github/SUPPORT.md
+++ b/.github/SUPPORT.md
@@ -32,21 +32,21 @@ you are observing.
 
 Essential details to include:
 
-- Errors: for each error, please provide the full error message snippet, and
+* Errors: for each error, please provide the full error message snippet, and
   details such as where the error is observed, at what stage in the process
   (e.g. at boot time, after some specific condition etc.).
-- What is the version of Vector (and the Helm chart if deploying via Helm) and
+* What is the version of Vector (and the Helm chart if deploying via Helm) and
   the versions of any other systems in use (like Elasticsearch, NATS, etc.).
-- What is your Vector configuration. See the below section on [how to format
+* What is your Vector configuration. See the below section on [how to format
   your config](#formatting).
-- How are you [deploying](https://vector.dev/docs/setup/deployment/) Vector?
-- What is your complete deployment architecture? For example: I have Logstash
+* How are you [deploying](https://vector.dev/docs/setup/deployment/) Vector?
+* What is your complete deployment architecture? For example: I have Logstash
   agents sending to Vector over syslog that is being forwarded to Loki.
 
 Situation specific (not exhaustive):
 
-- Did it occur after upgrading to a new version of Vector?
-- Are you trying out Vector for the first time, or did you have a previous
+* Did it occur after upgrading to a new version of Vector?
+* Are you trying out Vector for the first time, or did you have a previous
   working configuration?
 
 These are just some examples of questions that may or may not apply to your
diff --git a/.github/actions/spelling/README.md b/.github/actions/spelling/README.md
index 1f699f3de3d27..c5c8999abc52a 100644
--- a/.github/actions/spelling/README.md
+++ b/.github/actions/spelling/README.md
@@ -1,7 +1,7 @@
 # check-spelling/check-spelling configuration
 
 File | Purpose | Format | Info
--|-|-|-
+--- | --- | --- | ---
 [dictionary.txt](dictionary.txt) | Replacement dictionary (creating this file will override the default dictionary) | one word per line | [dictionary](https://github.com/check-spelling/check-spelling/wiki/Configuration#dictionary)
 [allow.txt](allow.txt) | Add words to the dictionary | one word per line (only letters and `'`s allowed) | [allow](https://github.com/check-spelling/check-spelling/wiki/Configuration#allow)
 [reject.txt](reject.txt) | Remove words from the dictionary (after allow) | grep pattern matching whole dictionary words | [reject](https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples%3A-reject)
diff --git a/.github/actions/spelling/advice.md b/.github/actions/spelling/advice.md
index 4e45731a123e7..db46d4edf5d32 100644
--- a/.github/actions/spelling/advice.md
+++ b/.github/actions/spelling/advice.md
@@ -10,6 +10,7 @@
 <details><summary>If flagged items are :exploding_head: false positives</summary>
 
 If items relate to a ...
+
 * binary file (or some other file you wouldn't want to check at all).
 
   Please add a file path to the `excludes.txt` file matching the containing file.
diff --git a/scripts/.markdownlintrc b/.markdownlint.jsonc
similarity index 53%
rename from scripts/.markdownlintrc
rename to .markdownlint.jsonc
index 0869064bee714..5bca38386599b 100644
--- a/scripts/.markdownlintrc
+++ b/.markdownlint.jsonc
@@ -1,7 +1,11 @@
+// This config is auto-detected by markdownlint-cli2 (used by Zed, VS Code, and most modern editors).
+// The CI check currently uses markdownlint-cli (legacy). Migrate CI to markdownlint-cli2 to unify tooling:
+//   npm install -g markdownlint-cli2
+//   markdownlint-cli2 "**/*.md"
 {
-  "default": false,
+  "default": true,
 
-  "MD001": true,
+  "MD001": false, // Hugo generates the outer heading structure, so heading levels in content files are intentional
   "MD003": { "style": "atx" },
   "MD004": true,
   "MD005": true,
@@ -19,11 +23,11 @@
   "MD022": true,
   "MD023": true,
   "MD024": false, // due to the way we generate docs, there are cases where duplicate headings are out of our control
-  "MD025": true,
+  "MD025": false, // release templates and other files intentionally use multiple top-level headings
   "MD026": { "punctuation": ".,;:" },
   "MD027": true,
   "MD028": true,
-  "MD030": false,
+  "MD029": { "style": "ordered" },
   "MD031": true,
   "MD032": true,
   "MD033": false, // we allow HTML
@@ -38,8 +42,11 @@
   "MD042": true,
   "MD043": true,
   "MD044": true,
-  "MD045": false,
   "MD046": true,
   "MD047": true,
-  "MD048": true
+  "MD048": true,
+  "MD049": false, // both *foo* and _foo_ are used intentionally for different semantic purposes
+  "MD051": false, // Hugo assembles sections from partials/shortcodes; fragments exist at render time but not in raw markdown
+  "MD052": false, // Hugo link definitions use shortcodes in URLs, unresolvable by markdownlint
+  "MD053": false  // Hugo uses reference link definitions extensively in README/website content
 }
diff --git a/AGENTS.md b/AGENTS.md
index e70a963047d9f..8d25eca40144c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -189,7 +189,7 @@ Then: `chmod +x .git/hooks/pre-push`
 ## Detailed Documentation
 
 | Topic | Document |
-|-------|----------|
+| ----- | -------- |
 | Rust style patterns | [docs/RUST_STYLE.md](docs/RUST_STYLE.md) |
 | Code style rules (formatting, const strings, organization) | [STYLE.md](STYLE.md) |
 | System architecture (sources, transforms, sinks, topology) | [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) |
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2cdf612eb1156..556958083ac69 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -156,8 +156,8 @@ make check-scripts
 ```
 
 Please note that `make check-all` covers all checks, but it is slow and may runs checks not
-relevant to your PR. This command is defined
-[here](https://github.com/vectordotdev/vector/blob/1ef01aeeef592c21d32ba4d663e199f0608f615b/Makefile#L450-L454).
+relevant to your PR. This command is defined in the
+[Makefile](https://github.com/vectordotdev/vector/blob/1ef01aeeef592c21d32ba4d663e199f0608f615b/Makefile#L450-L454).
 
 ### GitHub Pull Requests
 
@@ -173,8 +173,8 @@ branches, this means that only the pull request title must conform to this
 format. Vector performs a pull request check to verify the pull request title
 in case you forget.
 
-A list of allowed sub-categories is defined
-[here](https://github.com/vectordotdev/vector/blob/master/.github/workflows/semantic.yml#L21).
+A list of allowed sub-categories is defined in the
+[semantic.yml workflow](https://github.com/vectordotdev/vector/blob/master/.github/workflows/semantic.yml#L21).
 
 The following are all good examples of pull request titles:
 
@@ -338,7 +338,7 @@ Vector requires all contributors to sign the Contributor License Agreement
 (CLA). This gives Vector the right to use your contribution as well as ensuring
 that you own your contributions and can use them for other purposes.
 
-The full text of the CLA can be found [here](https://gist.github.com/bits-bot/55bdc97a4fdad52d97feb4d6c3d1d618).
+The [full text of the CLA](https://gist.github.com/bits-bot/55bdc97a4fdad52d97feb4d6c3d1d618) is available on GitHub.
 
 ### Granted rights and copyright assignment
 
diff --git a/Makefile b/Makefile
index 71a324a5a7c5b..8b1b856647b9c 100644
--- a/Makefile
+++ b/Makefile
@@ -506,6 +506,10 @@ check-licenses: ## Check that the 3rd-party license file is up to date
 check-markdown: ## Check that markdown is styled properly
 	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check markdown
 
+.PHONY: fix-markdown
+fix-markdown: ## Auto-fix markdown style issues
+	${MAYBE_ENVIRONMENT_EXEC} markdownlint --fix --config .markdownlint.jsonc $(shell git ls-files '*.md')
+
 .PHONY: check-examples
 check-examples: ## Check that the config/examples files are valid
 	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check examples
diff --git a/PRIVACY.md b/PRIVACY.md
index 8c2c0c90e69a5..4e6988f0dd7b6 100644
--- a/PRIVACY.md
+++ b/PRIVACY.md
@@ -40,16 +40,15 @@ derived from backend server logs which are anonymized.
 
 ### Vector Repository
 
-The Vector repository is hosted on GitHub. You can review their privacy policy
-[here][github_pp]. Additionally, Vector will not attempt to mine information
+The Vector repository is hosted on GitHub. You can review the [GitHub privacy policy][github_pp]. Additionally, Vector will not attempt to mine information
 about users that interact with Vector on GitHub. Vector team members will
 occasionally reach out to active users offer help debugging or learn about
 ways Vector can improve.
 
 ### Vector Chat
 
-The Vector chat uses Discord; you can review their
-privacy policy [here][discord_pp].
+The Vector chat uses Discord; you can review the
+[Discord privacy policy][discord_pp].
 
 [github_pp]: https://help.github.com/en/github/site-policy/github-privacy-statement
 [discord_pp]: https://discord.com/privacy/
diff --git a/RELEASES.md b/RELEASES.md
index 506981c1e99d4..2e8ef4edc8617 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -6,17 +6,17 @@ This document covers Vector's releases and the relevant aspect for Vector users.
 
 1. [Channels](#channels)
    1. [Stable channel](#stable-channel)
-   1. [Nightly channel](#nightly-channel)
-1. [Tracking](#tracking)
+   2. [Nightly channel](#nightly-channel)
+2. [Tracking](#tracking)
    1. [Stable channel](#stable-channel-1)
-   1. [Nightly channel](#nightly-channel-1)
-1. [Downloading](#downloading)
-1. [Cadence](#cadence)
+   2. [Nightly channel](#nightly-channel-1)
+3. [Downloading](#downloading)
+4. [Cadence](#cadence)
    1. [Stable channel](#stable-channel-2)
-   1. [Nightly channel](#nightly-channel-2)
-1. [Support Policy](#support-policy)
-1. [Guarantees](#guarantees)
-1. [FAQ](#faq)
+   2. [Nightly channel](#nightly-channel-2)
+5. [Support Policy](#support-policy)
+6. [Guarantees](#guarantees)
+7. [FAQ](#faq)
    1. [Which release type should I be using?](#which-release-type-should-i-be-using)
 
 <!-- /MarkdownTOC -->
diff --git a/VERSIONING.md b/VERSIONING.md
index a84b608f6ad80..9dd49bd92b68e 100644
--- a/VERSIONING.md
+++ b/VERSIONING.md
@@ -9,16 +9,16 @@ Please see the [FAQ](#faq) section for more info.**
 <!-- MarkdownTOC autolink="true" style="ordered" indent="   " -->
 
 1. [Convention](#convention)
-1. [Public API](#public-api)
+2. [Public API](#public-api)
    1. [Areas that *are* covered](#areas-that-are-covered)
       1. [Intended for *public* consumption](#intended-for-public-consumption)
-      1. [Intended for *private* consumption](#intended-for-private-consumption)
-   1. [Areas that are *NOT* covered](#areas-that-are-not-covered)
-1. [FAQ](#faq)
+      2. [Intended for *private* consumption](#intended-for-private-consumption)
+   2. [Areas that are *NOT* covered](#areas-that-are-not-covered)
+3. [FAQ](#faq)
    1. [How often is Vector released?](#how-often-is-vector-released)
-   1. [How does Vector treat patch and minor versions?](#how-does-vector-treat-patch-and-minor-versions)
-   1. [How does Vector treat major versions \(breaking changes\)?](#how-does-vector-treat-major-versions-breaking-changes)
-   1. [How does Vector treat pre-1.0 versions?](#how-does-vector-treat-pre-10-versions)
+   2. [How does Vector treat patch and minor versions?](#how-does-vector-treat-patch-and-minor-versions)
+   3. [How does Vector treat major versions \(breaking changes\)?](#how-does-vector-treat-major-versions-breaking-changes)
+   4. [How does Vector treat pre-1.0 versions?](#how-does-vector-treat-pre-10-versions)
 
 <!-- /MarkdownTOC -->
 
diff --git a/distribution/docker/README.md b/distribution/docker/README.md
index b6e6a66ea65e5..71cef83c6a4e8 100644
--- a/distribution/docker/README.md
+++ b/distribution/docker/README.md
@@ -105,12 +105,12 @@ Vector maintains special tags that are automatically updated whenever Vector is
 
 | Version          | URL                                                      |
 |:-----------------|:---------------------------------------------------------|
-| Latest major     | `timberio/vector:latest-alpine`               |
-| Latest minor     | `timberio/vector:<MAJOR>.X-alpine`            |
-| Latest patch     | `timberio/vector:<MAJOR.MINOR>.X-alpine`      |
-| Specific version | `timberio/vector:<MAJOR.MINOR.PATCH>-alpine`  |
-| Latest nightly   | `timberio/vector:nightly-alpine`              |
-| Specific nightly | `timberio/vector:nightly-<YYYY-MM-DD>-alpine` |
+| Latest major     | `timberio/vector:latest-alpine`                          |
+| Latest minor     | `timberio/vector:<MAJOR>.X-alpine`                       |
+| Latest patch     | `timberio/vector:<MAJOR.MINOR>.X-alpine`                 |
+| Specific version | `timberio/vector:<MAJOR.MINOR.PATCH>-alpine`             |
+| Latest nightly   | `timberio/vector:nightly-alpine`                         |
+| Specific nightly | `timberio/vector:nightly-<YYYY-MM-DD>-alpine`            |
 
 ### Source Files
 
diff --git a/docs/DEVELOPING.md b/docs/DEVELOPING.md
index 63633d2bdac7b..9d3d50f7d6243 100644
--- a/docs/DEVELOPING.md
+++ b/docs/DEVELOPING.md
@@ -467,8 +467,8 @@ times:
 
 We use `flog` to build a sample set of log files to test sending logs from a
 file. This can be done with the following commands on Mac with `homebrew`.
-Installation instruction for flog can be found
-[here](https://github.com/mingrammer/flog#installation).
+Installation instruction for flog can be found in the
+[flog README](https://github.com/mingrammer/flog#installation).
 
 ```bash
 flog --bytes $((100 * 1024 * 1024)) > sample.log
diff --git a/docs/README.md b/docs/README.md
index cb3ed925a1158..443c706e38faa 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,8 +1,8 @@
 # Vector Internal Documentation
 
-**_This folder contains internal documentation for Vector contributors. If
+_**This folder contains internal documentation for Vector contributors. If
 you're a Vector user, please visit <https://vector.dev/docs>, which is powered by
-the [website](../website) directory._**
+the [website](../website) directory.**_
 
 ## Getting started
 
diff --git a/docs/tutorials/sinks/1_basic_sink.md b/docs/tutorials/sinks/1_basic_sink.md
index a099a5530602d..c823c6a26530f 100644
--- a/docs/tutorials/sinks/1_basic_sink.md
+++ b/docs/tutorials/sinks/1_basic_sink.md
@@ -2,7 +2,7 @@ Let's write a basic sink for Vector. Currently, there are two styles of sink in
 Vector - 'event' and 'event streams'. The 'event' style sinks are deprecated,
 but currently a significant portion of Vector's sinks are still developed in
 this style. A tracking issue that covers which sinks have been converted to
-'event streams' can be found [here][event_streams_tracking].
+'event streams' can be found in the [event streams tracking issue][event_streams_tracking].
 
 This tutorial covers writing an 'event stream' Sink.
 
@@ -300,8 +300,8 @@ Change the body of `run_inner` to look like the following:
     }
 ```
 
-More details about instrumenting Vector can be found
-[here](https://github.com/vectordotdev/vector/blob/master/docs/specs/instrumentation.md).
+More details about instrumenting Vector can be found in the
+[instrumentation specification](https://github.com/vectordotdev/vector/blob/master/docs/specs/instrumentation.md).
 
 # Running our sink
 
@@ -324,7 +324,7 @@ This simply connects a `stdin` source to our `basic` sink.
 ## vdev
 
 Vector provides a build tool `vdev` that simplifies the task of building Vector. Install
-`vdev` using the instructions [here][vdev_install].
+`vdev` using the [installation instructions][vdev_install].
 
 With `vdev` installed we can run Vector using:
 
diff --git a/rfcs/2020-03-06-1999-api-extensions-for-lua-transform.md b/rfcs/2020-03-06-1999-api-extensions-for-lua-transform.md
index 4b8b75c032d66..abec1d261a80b 100644
--- a/rfcs/2020-03-06-1999-api-extensions-for-lua-transform.md
+++ b/rfcs/2020-03-06-1999-api-extensions-for-lua-transform.md
@@ -28,7 +28,7 @@ This RFC proposes a new API for the `lua` transform.
 
 Currently, the [`lua` transform](https://vector.dev/docs/reference/transforms/lua/) has some limitations in its API. In particular, the following features are missing:
 
-*   **Nested Fields**
+* **Nested Fields**
 
     Currently accessing nested fields is possible using the field path notation:
 
@@ -44,7 +44,7 @@ Currently, the [`lua` transform](https://vector.dev/docs/reference/transforms/lu
 
     See [#706](https://github.com/vectordotdev/vector/issues/706) and [#1406](https://github.com/vectordotdev/vector/issues/1406).
 
-*   **Setup Code**
+* **Setup Code**
 
     Some scripts require expensive setup steps, for example, loading of modules or invoking shell commands. These steps should not be part of the main transform code.
 
@@ -79,7 +79,7 @@ Currently, the [`lua` transform](https://vector.dev/docs/reference/transforms/lu
 
     See [#1864](https://github.com/vectordotdev/vector/issues/1864).
 
-*   **Control Flow**
+* **Control Flow**
 
     It should be possible to define channels for output events, similarly to how it is done in [`swimlanes`](https://vector.dev/docs/reference/transforms/swimlanes/) transform.
 
@@ -136,7 +136,7 @@ This example is a log to metric transform which produces metric events from inco
 
 1. There is an internal counter which is increased on each incoming log event.
 2. The log events are discarded.
-2. Each 10 seconds the transform produces a metric event with the count of received log events.
+3. Each 10 seconds the transform produces a metric event with the count of received log events.
 4. Edge cases are handled in the following way:
    1. If there are no incoming invents, the metric event with the counter equal to 0 still has to be produced.
    2. On Vector's shutdown the transform has to produce the final metric event with the count of received events since the last flush.
@@ -645,10 +645,10 @@ The mapping between Vector data types and Lua data types is the following:
 
 | Vector Type | Lua Type | Comment |
 | :----------- | :-------- | :------- |
-| [`String`](https://vector.dev/docs/architecture/data-model/log/#strings) | [`string`](https://www.lua.org/pil/2.4.html) ||
-| [`Integer`](https://vector.dev/docs/architecture/data-model/log/#ints) | [`integer`](https://docs.rs/mlua/0.6.0/mlua/type.Integer.html) ||
-| [`Float`](https://vector.dev/docs/architecture/data-model/log/#floats) | [`number`](https://docs.rs/mlua/0.6.0/mlua/type.Number.html) ||
-| [`Boolean`](https://vector.dev/docs/architecture/data-model/log/#booleans) | [`boolean`](https://www.lua.org/pil/2.2.html) ||
+| [`String`](https://vector.dev/docs/architecture/data-model/log/#strings) | [`string`](https://www.lua.org/pil/2.4.html) | |
+| [`Integer`](https://vector.dev/docs/architecture/data-model/log/#ints) | [`integer`](https://docs.rs/mlua/0.6.0/mlua/type.Integer.html) | |
+| [`Float`](https://vector.dev/docs/architecture/data-model/log/#floats) | [`number`](https://docs.rs/mlua/0.6.0/mlua/type.Number.html) | |
+| [`Boolean`](https://vector.dev/docs/architecture/data-model/log/#booleans) | [`boolean`](https://www.lua.org/pil/2.2.html) | |
 | [`Timestamp`](https://vector.dev/docs/architecture/data-model/log/#timestamps) | [`userdata`](https://www.lua.org/pil/28.1.html) | There is no dedicated timestamp type in Lua. However, there is a standard library function [`os.date`](https://www.lua.org/manual/5.1/manual.html#pdf-os.date) which returns a table with fields `year`, `month`, `day`, `hour`, `min`, `sec`, and some others. Other standard library functions, such as [`os.time`](https://www.lua.org/manual/5.1/manual.html#pdf-os.time), support tables with these fields as arguments. Because of that, Vector timestamps passed to the transform are represented as `userdata` with the same set of accessible fields. In order to have one-to-one correspondence between Vector timestamps and Lua timestamps, `os.date` function from the standard library is patched to return not a table, but `userdata` with the same set of fields as it usually would return instead. This approach makes it possible to have both compatibility with the standard library functions and a dedicated data type for timestamps. |
 | [`Null`](https://vector.dev/docs/architecture/data-model/log/#null-values) | empty string | In Lua setting a table field to `nil` means deletion of this field. Furthermore, setting an array element to `nil` leads to deletion of this element. In order to avoid inconsistencies, already present `Null` values are visible represented as empty strings from Lua code, and it is impossible to create a new `Null` value in the user-defined code. |
 | [`Map`](https://vector.dev/docs/architecture/data-model/log/#maps) | [`userdata`](https://www.lua.org/pil/28.1.html) or [`table`](https://www.lua.org/pil/2.5.html) | Maps which are parts of events passed to the transform from Vector have `userdata` type. User-created maps have `table` type. Both types are converted to Vector's `Map` type when they are emitted from the transform. |
diff --git a/rfcs/2020-04-04-2221-kubernetes-integration.md b/rfcs/2020-04-04-2221-kubernetes-integration.md
index e95ee2b4a5dbc..b2a06a68be1ad 100644
--- a/rfcs/2020-04-04-2221-kubernetes-integration.md
+++ b/rfcs/2020-04-04-2221-kubernetes-integration.md
@@ -135,7 +135,7 @@ it has to be deployed on every [`Node`][k8s_docs_node] in your cluster.
 
 The following diagram demonstrates how this works:
 
-<img src="2020-04-04-2221-kubernetes-integration/deployment-topology.svg" />
+<img src="2020-04-04-2221-kubernetes-integration/deployment-topology.svg" alt="Kubernetes deployment topology" />
 
 ### What We'll Accomplish
 
@@ -149,7 +149,7 @@ The following diagram demonstrates how this works:
 
 #### Deploy using `kubectl`
 
-1.  Configure Vector:
+1. Configure Vector:
 
     Before we can deploy Vector we must configure. This is done by creating
     a Kubernetes `ConfigMap`:
@@ -173,7 +173,7 @@ The following diagram demonstrates how this works:
     kubectl create secret generic vector-config --from-file=vector.toml=vector.toml
     ```
 
-2.  Deploy Vector!
+2. Deploy Vector!
 
     Now that you have your custom `ConfigMap` ready it's time to deploy Vector.
     Create a `Namespace` and apply your `ConfigMap` and our recommended
@@ -190,20 +190,20 @@ The following diagram demonstrates how this works:
 
 #### Deploy using Helm
 
-1.  Install [`helm`][helm_install].
+1. Install [`helm`][helm_install].
 
-2.  Add our Helm Chart repo.
+2. Add our Helm Chart repo.
 
     ```shell
     helm repo add vector https://charts.vector.dev
     helm repo update
     ```
 
-3.  Configure Vector.
+3. Configure Vector.
 
     TODO: address this when we decide on the helm chart internals.
 
-4.  Deploy Vector!
+4. Deploy Vector!
 
     ```shell
     kubectl create namespace vector
@@ -227,9 +227,9 @@ The following diagram demonstrates how this works:
 
 #### Deploy using Kustomize
 
-1.  Install [`kustomize`][kustomize].
+1. Install [`kustomize`][kustomize].
 
-1.  Prepare `kustomization.yaml`.
+2. Prepare `kustomization.yaml`.
 
     Use the same config as in [`kubectl` guide][anchor_tutorial_kubectl].
 
@@ -243,7 +243,7 @@ The following diagram demonstrates how this works:
       - vector-configmap.yaml
     ```
 
-1.  Deploy Vector!
+3. Deploy Vector!
 
     ```shell
     kustomize build . | kubectl apply -f -
@@ -327,9 +327,7 @@ logs such that they're accessible from the following locations:
 - `/var/log/containers` - legacy location, kept for backward compatibility
   with pre `1.14` clusters.
 
-To make our lives easier, here's a [link][k8s_src_build_container_logs_directory]
-to the part of the k8s source that's responsible for building the path to the
-log file. If we encounter issues, this would be a good starting point to unwrap
+To make our lives easier, here's a reference to the [k8s source code responsible for building the container log path][k8s_src_build_container_logs_directory]. If we encounter issues, this would be a good starting point to unwrap
 the k8s code.
 
 #### Log file format
@@ -603,7 +601,7 @@ This worth a separate dedicated RFC though.
 #### Security considerations on deployment configuration
 
 Security considerations on deployment configuration are grouped together with
-other security-related measures. See [here](#deployment-hardening).
+other security-related measures. See the [deployment hardening](#deployment-hardening) section.
 
 #### Other notable [`PodSpec`][k8s_api_pod_spec] properties
 
@@ -1059,7 +1057,7 @@ We have a matrix of concerns, we'd like to ensure Vectors works properly with.
   - OCI (via [CRI-O](https://cri-o.io/) or [containerd](https://containerd.io/))
     - [runc](https://github.com/opencontainers/runc)
     - [runhcs](https://github.com/Microsoft/hcsshim/tree/master/cmd/runhcs) -
-      see more [here][windows_in_kubernetes]
+      see [Windows in Kubernetes][windows_in_kubernetes]
     - [Kata Containers](https://github.com/kata-containers/runtime)
     - [gVisor](https://github.com/google/gvisor)
     - [Firecracker](https://github.com/firecracker-microvm/firecracker-containerd)
@@ -1508,16 +1506,16 @@ nightly!) the supported Vector versions.
 ## Prior Art
 
 1. [Filebeat k8s integration]
-1. [Fluentbit k8s integration]
-1. [Fluentd k8s integration]
-1. [LogDNA k8s integration]
-1. [Honeycomb integration]
-1. [Bonzai logging operator] - This is approach is likely outside of the scope
+2. [Fluentbit k8s integration]
+3. [Fluentd k8s integration]
+4. [LogDNA k8s integration]
+5. [Honeycomb integration]
+6. [Bonzai logging operator] - This is approach is likely outside of the scope
    of Vector's initial Kubernetes integration because it focuses more on
    deployment strategies and topologies. There are likely some very useful
    and interesting tactics in their approach though.
-1. [Influx Helm charts]
-1. [Awesome Operators List] - an "awesome list" of operators.
+7. [Influx Helm charts]
+8. [Awesome Operators List] - an "awesome list" of operators.
 
 ## Sales Pitch
 
@@ -1541,7 +1539,7 @@ See [motivation](#motivation).
    namespaces?
    We'd just need to configure Vector to exclude this namespace?~~
    See the [Origin filtering][anchor_origin_filtering] section.
-1. ~~From what I understand, Vector requires the Kubernetes `watch` verb in order
+2. ~~From what I understand, Vector requires the Kubernetes `watch` verb in order
    to receive updates to k8s cluster changes. This is required for the
    `kubernetes_pod_metadata` transform. Yet, Fluentbit [requires the `get`,
    `list`, and `watch` verbs][fluentbit_role]. Why don't we require the same?~~
@@ -1550,7 +1548,7 @@ See [motivation](#motivation).
    complete the implementation. It's really trivial to determine from a set of
    API calls used.
    See the [Deployment Hardening](#deployment-hardening) section.
-1. What are some of the details that set Vector's Kubernetes integration apart?
+3. What are some of the details that set Vector's Kubernetes integration apart?
    This is for marketing purposes and also helps us "raise the bar".
 
 ### From Mike
@@ -1559,12 +1557,12 @@ See [motivation](#motivation).
    we want to test against? Some clusters use `docker`, some use `CRI-O`,
    [etc][container_runtimes]. Some even use [gVisor] or [Firecracker]. There
    might be differences in how different container runtimes handle logs.
-1. How do we want to approach Helm Chart Repository management.
-1. How do we implement liveness, readiness and startup probes?
+2. How do we want to approach Helm Chart Repository management.
+3. How do we implement liveness, readiness and startup probes?
    Readiness probe is a tricky one. See [Container probes](#container-probes).
-1. Can we populate file at `terminationMessagePath` with some meaningful
+4. Can we populate file at `terminationMessagePath` with some meaningful
    information when we exit or crash?
-1. Can we allow passing arbitrary fields from the `Pod` object to the event?
+5. Can we allow passing arbitrary fields from the `Pod` object to the event?
    Currently we only to pass `pod_id`, pod `annotations` and pod `labels`.
 
 ## Plan Of Attack
diff --git a/rfcs/2020-05-25-2685-dev-workflow-simplification.md b/rfcs/2020-05-25-2685-dev-workflow-simplification.md
index b5dfb5f41eed6..99a186c843f0c 100644
--- a/rfcs/2020-05-25-2685-dev-workflow-simplification.md
+++ b/rfcs/2020-05-25-2685-dev-workflow-simplification.md
@@ -183,7 +183,7 @@ There are tools like `hab` (from the Habitat project) and `packer` that can be u
 ## Outstanding Questions
 
 - Windows/Mac/FreeBSD builds via `make build` et all will produce native binaries natively, we should be review those docs.
-- This RFC does not scope in integration tests beyond letting the `environment` run them. We may find motivation to explore a more **_slick_** solution in the future.
+- This RFC does not scope in integration tests beyond letting the `environment` run them. We may find motivation to explore a more _**slick**_ solution in the future.
 
 ## Rationale & Alternatives
 
@@ -207,6 +207,6 @@ Alternatives:
 2. Get preliminary consensus this is good path forward
 3. Add `DOCKER_SOCKET` passing and support integration testing
 4. Cross-OS testing
-6. Explore handling `make environment-%` commands via wildcard
-7. Acceptance testing (Test including new contributor test)
-8. Merge preliminary support
+5. Explore handling `make environment-%` commands via wildcard
+6. Acceptance testing (Test including new contributor test)
+7. Merge preliminary support
diff --git a/rfcs/2020-05-25-2692-more-usable-logevents.md b/rfcs/2020-05-25-2692-more-usable-logevents.md
index 09ab89b35d7e5..601ef610f626a 100644
--- a/rfcs/2020-05-25-2692-more-usable-logevents.md
+++ b/rfcs/2020-05-25-2692-more-usable-logevents.md
@@ -183,14 +183,14 @@ In the [WASM transform](https://github.com/vectordotdev/vector/pull/2006/files)
 This RFC ultimately proposes the following steps:
 
 1. Add UX improvements on `LogEvent`, particularly turning JSON into or from `LogEvent`.
-1. Refactor the `PathIter` to make `vector::event::Lookup` type.
-1. Add UX improvements on `Lookup` , particularly an internal `String` ↔ `Lookup` with an `Into`/`From` that does not do path parsing, as well as a `<Lookup as std::str::FromStr>::from_str(s: String)` that does. (This also enables `"foo.bar".parse::<Lookup>()?`)
-1. Refactor all `LogEvent` to accept `Into<Lookup>` values.
+2. Refactor the `PathIter` to make `vector::event::Lookup` type.
+3. Add UX improvements on `Lookup` , particularly an internal `String` ↔ `Lookup` with an `Into`/`From` that does not do path parsing, as well as a `<Lookup as std::str::FromStr>::from_str(s: String)` that does. (This also enables `"foo.bar".parse::<Lookup>()?`)
+4. Refactor all `LogEvent` to accept `Into<Lookup>` values.
     1. Remove obsolete functionality like `insert_path` since the new `Lookup` type covers this.
     2. Refactor the `keys` function to return an `Iterator<Lookup>`
-1. Add an `Entry` style API to `LogEvent`.
+5. Add an `Entry` style API to `LogEvent`.
     1. Remove functionality rendered obsolete by the Entry API like `try_insert`, moving them to use the new Entry API
-1. Provide `iter` and `iter_mut` functions that yield `(Lookup, Value)`.
+6. Provide `iter` and `iter_mut` functions that yield `(Lookup, Value)`.
     1. Remove the `all_fields` function, moving them to the new iterator.
 
 We believe these steps will provide a more ergonomic and consistent API.
diff --git a/rfcs/2020-07-28-3642-jmx_rfc.md b/rfcs/2020-07-28-3642-jmx_rfc.md
index b872b276574f5..7f0181b65620c 100644
--- a/rfcs/2020-07-28-3642-jmx_rfc.md
+++ b/rfcs/2020-07-28-3642-jmx_rfc.md
@@ -161,7 +161,7 @@ The query will return these metrics by parsing the query results and converting
 The type of metric for any metric marked `untyped` is unclear but likely gauges. We'll need to do deeper research to determine:
 
 1. Whether we want to keep them.
-1. What type they are if we retain them.
+2. What type they are if we retain them.
 
 Naming of metrics is determined via:
 
@@ -215,7 +215,7 @@ Additionally, as part of Vector's vision to be the "one tool" for ingesting and
 
 1. Having users run telegraf or Prom node exporter and using Vector's Prometheus source to scrape it. We could not add the source directly to Vector and instead instruct users to run Prometheus' `jmx_exporter` and point Vector at the resulting data.
 
-1. Or we could use something like [jmxtrans](https://github.com/jmxtrans/jmxtrans) and add a Vector OutputWriter.
+2. Or we could use something like [jmxtrans](https://github.com/jmxtrans/jmxtrans) and add a Vector OutputWriter.
 
 I decided against both of these this as they would be in conflict with one of the listed
 principles of Vector:
diff --git a/rfcs/2020-10-15-3480-file-source-rework.md b/rfcs/2020-10-15-3480-file-source-rework.md
index da199d16e5c56..e7becd118c5d1 100644
--- a/rfcs/2020-10-15-3480-file-source-rework.md
+++ b/rfcs/2020-10-15-3480-file-source-rework.md
@@ -194,10 +194,10 @@ In the pseudocode above, read scheduling is controlled by `sort`, `should_read`,
 would need to answer the following questions:
 
 1. In what order should I read the available files?
-1. Should I finish one file before moving on to the next?
-1. Should I back off reads to this file?
-1. Should I back off reads to all files (i.e. sleep)?
-1. How long should I spend working on a single file?
+2. Should I finish one file before moving on to the next?
+3. Should I back off reads to this file?
+4. Should I back off reads to all files (i.e. sleep)?
+5. How long should I spend working on a single file?
 
 These questions would then be answered by a combination of configuration, file
 metadata, and gathered statistics.
@@ -226,9 +226,9 @@ out a magic identifier, but also the logic to update our list of watched files
 based on those identifiers. It needs to answer the following:
 
 1. Given a visible path, does it contain a file I've seen before?
-1. If I have seen it before, has it been renamed?
-1. If I have seen it before, am I now seeing it in multiple places?
-1. If I'm seeing duplicates, how should I choose which to follow?
+2. If I have seen it before, has it been renamed?
+3. If I have seen it before, am I now seeing it in multiple places?
+4. If I'm seeing duplicates, how should I choose which to follow?
 
 This logic is mostly in one place in the current implementation, so it should
 not be terribly difficult to extract it. The use of `Fingerprinter` should
@@ -238,9 +238,9 @@ In addition to simply consolidating the logic, we can expand and make the use of
 `Fingerprinter` more intelligent. We currently have three ways it can work:
 
 1. Checksum (usually reliable but frustrating for small files)
-1. Device and inode (simple and works with small files, but doesn't handle edge
+2. Device and inode (simple and works with small files, but doesn't handle edge
    cases well)
-1. First line checksum (solid for intended use case but not yet general)
+3. First line checksum (solid for intended use case but not yet general)
 
 I'd first propose that we drop device and inode fingerprinting and add
 path-based fingerprinting in its place. This gives users the option to do the
@@ -255,8 +255,8 @@ in place, the algorithm can look something like the following:
 
 1. Read up to `max_line_length` bytes from the file starting at
    `ignored_header_bytes`
-1. Return no fingerprint if there is no newline in the returned bytes
-1. Otherwise, return the checksum of the bytes up to the first newline
+2. Return no fingerprint if there is no newline in the returned bytes
+3. Otherwise, return the checksum of the bytes up to the first newline
 
 This should give a good balance between usability and flexibility for the
 default strategy. As we implement it, we should evolve the current
@@ -278,11 +278,11 @@ about providing an understandable config UI than designing the right interface.
 This should be driven by real world use cases. For example:
 
 1. Ignoring existing checkpoints
-1. Start at the beginning or end of existing files, optionally taking into
+2. Start at the beginning or end of existing files, optionally taking into
    account factors like mtime
-1. Start at the beginning or end of files added while we're watching (this can
+3. Start at the beginning or end of files added while we're watching (this can
    be tricky)
-1. Ordering which of the above concerns take precedence
+4. Ordering which of the above concerns take precedence
 
 I would suggest a config like the following:
 
@@ -327,8 +327,8 @@ reads, but it will require a bit of experimentation before we're able to
 determine if it's worthwhile. There are a few possible approaches:
 
 1. Dispatch reads to an explicit threadpool
-1. Spawn a limited number of blocking tokio tasks
-1. Implement something with `iouring`
+2. Spawn a limited number of blocking tokio tasks
+3. Implement something with `iouring`
 
 The first two both introduce the questions of sizing and the ability of the
 underlying file system to enable concurrent access in a way that actually adds
diff --git a/rfcs/2021-02-23-6531-performance-testing.md b/rfcs/2021-02-23-6531-performance-testing.md
index e60a21b02f577..fbb5205bcb3ed 100644
--- a/rfcs/2021-02-23-6531-performance-testing.md
+++ b/rfcs/2021-02-23-6531-performance-testing.md
@@ -47,10 +47,10 @@ processes in our work on Vector:
 1. Performance is a first-class testing concern for Vector. We will drive our
    process to identify regressions or opportunities for optimization as close
    to introduction as possible.
-1. Identifying _that_ a regression has happened is often easier than _why_. We
+2. Identifying _that_ a regression has happened is often easier than _why_. We
    will continuously improve Vector’s diagnosis tooling to reduce the time to
    debug and repair detected issues.
-1. Performance regressions will inevitably, unintentionally make their way
+3. Performance regressions will inevitably, unintentionally make their way
    into a release. When this happens we will treat this just like we would a
    correctness regression, relying on our diagnostic tools and rolling the
    experiences of repair back into the tooling.
diff --git a/rfcs/2021-03-26-6517-end-to-end-acknowledgement.md b/rfcs/2021-03-26-6517-end-to-end-acknowledgement.md
index b669c9ebc7c68..a69bdbc719c2f 100644
--- a/rfcs/2021-03-26-6517-end-to-end-acknowledgement.md
+++ b/rfcs/2021-03-26-6517-end-to-end-acknowledgement.md
@@ -330,39 +330,39 @@ source handles acknowledgements.
 
 The above structure provides for several considerations:
 
-1.  This the minimum amount of data that can be added to the metadata to
+1. This the minimum amount of data that can be added to the metadata to
     fully support this feature, amounting to a single shared reference
     as the `Option` is optimized into the `Arc`.
 
-2.  The use of `Arc` reference counting for finalization prevents events
+2. The use of `Arc` reference counting for finalization prevents events
     from "escaping" without providing a status indication.
 
-3.  If a source does not need or is not configured to require
+3. If a source does not need or is not configured to require
     finalization, it will not contribute to the list of sources and so
     has no additional event overhead, and no additional allocations when
     the event is created.
 
-4.  Sending the finalization status to the source does not require any
+4. Sending the finalization status to the source does not require any
     lookups or topology traversal.
 
-5.  No additional work is required to handle dropped sources due to
+5. No additional work is required to handle dropped sources due to
     topology reconfiguration, other than the expected checking for a
     closed channel when sending.
 
 ## Drawbacks
 
-1.  This adds a base size overhead to each event, even for
+1. This adds a base size overhead to each event, even for
     configurations that do not support or require end-to-end
     acknowledgement.
 
 ## Alternatives
 
-1.  The set of sources could be stored in a more customary `Vec`. This
+1. The set of sources could be stored in a more customary `Vec`. This
     provides for merging multiple sources with a minimum of
     code. However, merged events already have other overhead, and it
     increases the data required for this array by an additional word.
 
-2.  The source could be stored as simply the unique identifier
+2. The source could be stored as simply the unique identifier
     string. This requires that all reporting of finalization status
     proceed through a dictionary lookup instead of simply sending it
     through a channel, increasing the run-time overhead.
diff --git a/rfcs/2021-07-19-8216-multiple-pipelines.md b/rfcs/2021-07-19-8216-multiple-pipelines.md
index a628fe1843e08..6176d99ec2272 100644
--- a/rfcs/2021-07-19-8216-multiple-pipelines.md
+++ b/rfcs/2021-07-19-8216-multiple-pipelines.md
@@ -36,8 +36,8 @@ Large Vector users often require complex Vector topologies to facilitate the col
 This change will introduce the concept of pipelines to users. A pipeline is defined as:
 
 1. A collection of transforms defined together, outside of the top-level configuration file
-1. Able to draw input from and send output to components defined in the top-level configuration, but are isolated from other pipelines
-1. Having each contained component's internal metrics tagged with the `id` of the pipeline
+2. Able to draw input from and send output to components defined in the top-level configuration, but are isolated from other pipelines
+3. Having each contained component's internal metrics tagged with the `id` of the pipeline
 
 Pipelines will be loaded from a `pipelines` sub-directory relative to the Vector configuration directory (e.g., `/etc/vector/pipelines`). Therefore, if a user changes the location of the Vector configuration directory they will also change the `pipelines` directory path. They are coupled.
 
diff --git a/rfcs/2021-08-13-8025-internal-tracing.md b/rfcs/2021-08-13-8025-internal-tracing.md
index 37dc48afc418b..d86a9f8ce4035 100644
--- a/rfcs/2021-08-13-8025-internal-tracing.md
+++ b/rfcs/2021-08-13-8025-internal-tracing.md
@@ -81,10 +81,10 @@ The step after that is a bit fuzzy, however. You could jump straight to
 profiling, but it has a few weaknesses:
 
 1. It's not something that can easily be run in customer environments
-1. The focus on CPU time vs wall clock time means it can miss issues like bad
+2. The focus on CPU time vs wall clock time means it can miss issues like bad
    rate limits, waiting on downstream components, slow IO operations or
    syscalls, etc
-1. The output tends to require interpretation by an experienced engineer, and
+3. The output tends to require interpretation by an experienced engineer, and
    doesn't always indicate clearly where time is being spent from a Vector
    perspective
 
@@ -251,10 +251,10 @@ as follows:
    corresponding visualizations means it would take more interpretation and
    external knowledge to derive the same signal.
 
-1. Their aggregated nature would put a limit on the level of detail (e.g. no
+2. Their aggregated nature would put a limit on the level of detail (e.g. no
    file name field on a `read` span from the file source).
 
-1. Collecting timings directly is likely to require more explicit
+3. Collecting timings directly is likely to require more explicit
    instrumentation code than simply adding spans.
 
 ### Do nothing
diff --git a/rfcs/2021-08-29-8381-vrl-iteration-support.md b/rfcs/2021-08-29-8381-vrl-iteration-support.md
index 39ab28cc9f717..020e9be84c66b 100644
--- a/rfcs/2021-08-29-8381-vrl-iteration-support.md
+++ b/rfcs/2021-08-29-8381-vrl-iteration-support.md
@@ -338,14 +338,14 @@ individual use-cases, this list shows one available solution per use-case.
    . = map_keys(., recursive: true) -> |key| { trim_start(key, "_") }
    ```
 
-11. [add prefix to all keys](https://discord.com/channels/742820443487993987/764187584452493323/883274684576182302)
+1. [add prefix to all keys](https://discord.com/channels/742820443487993987/764187584452493323/883274684576182302)
 
    ```coffee
    . = map_keys(., recursive: true) -> |key| { "my_" + key }
    ```
 
 
-12. [parse message using list of Grok patterns until one matches](https://discord.com/channels/742820443487993987/764187584452493323/870353108692271104)
+2. [parse message using list of Grok patterns until one matches](https://discord.com/channels/742820443487993987/764187584452493323/870353108692271104)
 
    ```coffee
    patterns = []
@@ -359,7 +359,7 @@ individual use-cases, this list shows one available solution per use-case.
    }
    ```
 
-13. [find match against list of regular expressions](https://discord.com/channels/742820443487993987/764187584452493323/864496206947942400)
+3. [find match against list of regular expressions](https://discord.com/channels/742820443487993987/764187584452493323/864496206947942400)
 
    ```coffee
    matched = false
@@ -377,13 +377,13 @@ individual use-cases, this list shows one available solution per use-case.
    matched = any(patterns) -> |pattern| { match(.message, pattern) }
    ```
 
-14. [remove prefix from keys](https://discord.com/channels/742820443487993987/764187584452493323/864496206947942400)
+4. [remove prefix from keys](https://discord.com/channels/742820443487993987/764187584452493323/864496206947942400)
 
    ```coffee
    . = map_keys(. ,recursive: true) -> |key| { replace(key, "my_prefix_", "") }
    ```
 
-15. [run `encode_json` on all top-level object fields](https://discord.com/channels/742820443487993987/746070591097798688/841787442271879209)
+5. [run `encode_json` on all top-level object fields](https://discord.com/channels/742820443487993987/746070591097798688/841787442271879209)
 
    ```coffee
    . = map_values(.) -> |value| {
@@ -395,7 +395,7 @@ individual use-cases, this list shows one available solution per use-case.
    }
    ```
 
-16. [map key/value pairs to object with ”key” and ”value” fields](https://discord.com/channels/742820443487993987/746070591097798688/832684085771370587)
+6. [map key/value pairs to object with ”key” and ”value” fields](https://discord.com/channels/742820443487993987/746070591097798688/832684085771370587)
 
    ```coffee
    . = { "labels": { "key1": "value1", "key2": "value2" } }
@@ -405,7 +405,8 @@ individual use-cases, this list shows one available solution per use-case.
    }
 
    .labels = new_labels
-  ```
+
+  ```text
 
   **NOTE** this is similar to [Jq’s `to_entries`
   function](https://stedolan.github.io/jq/manual/#to_entries,from_entries,with_entries),
@@ -422,7 +423,7 @@ individual use-cases, this list shows one available solution per use-case.
   . = to_entries(.)
   ```
 
-17. [run `parse_json` on multiple strings in array, and emit as multiple
+1. [run `parse_json` on multiple strings in array, and emit as multiple
     events](https://discord.com/channels/742820443487993987/746070591097798688/832257215506415657)
 
    ```coffee
@@ -432,7 +433,7 @@ individual use-cases, this list shows one available solution per use-case.
    ```
 
 
-18. [convert object to specific string format](https://discord.com/channels/742820443487993987/764187584452493323/824574475495407639)
+2. [convert object to specific string format](https://discord.com/channels/742820443487993987/764187584452493323/824574475495407639)
 
    ```coffee
    . = { "key1": "value1", "key2": "value2" }
@@ -451,7 +452,7 @@ individual use-cases, this list shows one available solution per use-case.
    "{" + join(strings, ",") + "}"
    ```
 
-19. [re-introduce previous `only_fields` functionality using iteration](https://github.com/vectordotdev/vector/issues/7347)
+3. [re-introduce previous `only_fields` functionality using iteration](https://github.com/vectordotdev/vector/issues/7347)
 
 
    ```coffee
@@ -471,7 +472,7 @@ individual use-cases, this list shows one available solution per use-case.
    . = filter(.) -> |key, _| { includes(only_fields, key) }
    ```
 
-20. [map complex dynamic object based on conditionals](https://github.com/vectordotdev/vector/discussions/12387#discussioncomment-2639876)
+4. [map complex dynamic object based on conditionals](https://github.com/vectordotdev/vector/discussions/12387#discussioncomment-2639876)
 
    ```coffee
    .input = map_values(.input) -> |input| {
@@ -507,7 +508,7 @@ individual use-cases, this list shows one available solution per use-case.
    }
    ```
 
-21. merge array of objects into single object
+5. merge array of objects into single object
 
    ```coffee
    result = {}
diff --git a/rfcs/2021-09-01-8547-accept-metrics-in-datadog-agent-source.md b/rfcs/2021-09-01-8547-accept-metrics-in-datadog-agent-source.md
index ac95ef626762e..c0471ed349985 100644
--- a/rfcs/2021-09-01-8547-accept-metrics-in-datadog-agent-source.md
+++ b/rfcs/2021-09-01-8547-accept-metrics-in-datadog-agent-source.md
@@ -78,7 +78,7 @@ https://vector.mycompany.tld` to forward metrics to a Vector deployment.
 
 The current `dd_url` endpoint configuration has a [conditional
 behavior](https://github.com/DataDog/datadog-agent/blob/main/pkg/config/config.go#L1199-L1201) (also
-[here](https://github.com/DataDog/datadog-agent/blob/main/pkg/forwarder/forwarder_health.go#L131-L143)). I.e. if
+[in the forwarder health check](https://github.com/DataDog/datadog-agent/blob/main/pkg/forwarder/forwarder_health.go#L131-L143)). I.e. if
 `dd_url` contains a known pattern (i.e. it has a suffix that matches a Datadog site) some extra hostname manipulation
 happens. But overall, the following paths are expected to be supported on the host behind `dd_url`:
 
@@ -100,20 +100,20 @@ A few details about the Datadog Agents & [Datadog metrics](https://docs.datadogh
   [`MetricSample`](https://github.com/DataDog/datadog-agent/blob/main/pkg/metrics/metric_sample.go#L81-L94) and can be
   of [several types](https://github.com/DataDog/datadog-agent/blob/main/pkg/metrics/metric_sample.go#L20-L31)
 * Major Agent usecases:
-  * Metrics are send from corechecks (i.e. go code)
-    [here](https://github.com/DataDog/datadog-agent/blob/main/pkg/aggregator/sender.go#L227-L252)
-  * Dogstatsd metrics are converted to the `MetricSample` structure
-    [here](https://github.com/DataDog/datadog-agent/blob/main/pkg/dogstatsd/enrich.go#L87-L137) However Datadog Agents
+  * Metrics are send from corechecks (i.e. go code) via the
+    [aggregator sender](https://github.com/DataDog/datadog-agent/blob/main/pkg/aggregator/sender.go#L227-L252)
+  * Dogstatsd metrics are converted to the `MetricSample` structure in the
+    [dogstatsd enrich module](https://github.com/DataDog/datadog-agent/blob/main/pkg/dogstatsd/enrich.go#L87-L137). However Datadog Agents
     metrics are transformed before being sent, ultimately metrics accounts for two different kind of payload:
 * The count, gauge and rate series kind of payload, sent to `/api/v1/series` using the [JSON schema officially
   documented](https://docs.datadoghq.com/api/latest/metrics) with few undocumented [additional
   fields](https://github.com/DataDog/datadog-agent/blob/main/pkg/metrics/series.go#L45-L57), but this align very well
   with the existing `datadog_metrics` sinks.
-* The sketches kind of payload, sent to `/api/beta/sketches` and serialized as protobuf as shown
-  [here](https://github.com/DataDog/datadog-agent/blob/main/pkg/serializer/serializer.go#L315-L338) (it ultimately lands
-  [here](https://github.com/DataDog/datadog-agent/blob/main/pkg/metrics/sketch_series.go#L103-L269)). Public `.proto`
-  definition can be found
-  [here](https://github.com/DataDog/agent-payload/blob/master/proto/metrics/agent_payload.proto#L47-L81).
+* The sketches kind of payload, sent to `/api/beta/sketches` and serialized as protobuf as shown in the
+  [serializer](https://github.com/DataDog/datadog-agent/blob/main/pkg/serializer/serializer.go#L315-L338) (it ultimately lands in the
+  [sketch_series module](https://github.com/DataDog/datadog-agent/blob/main/pkg/metrics/sketch_series.go#L103-L269)). Public `.proto`
+  definition can be found in the
+  [agent-payload proto](https://github.com/DataDog/agent-payload/blob/master/proto/metrics/agent_payload.proto#L47-L81).
 
 Vector has a nice description of its [metrics data
 model](https://vector.dev/docs/architecture/data-model/metric/) and a [concise enum for
diff --git a/rfcs/2021-10-29-8621-framing-and-codecs-sinks.md b/rfcs/2021-10-29-8621-framing-and-codecs-sinks.md
index 4b2c7ace88349..87a28793d93ec 100644
--- a/rfcs/2021-10-29-8621-framing-and-codecs-sinks.md
+++ b/rfcs/2021-10-29-8621-framing-and-codecs-sinks.md
@@ -94,37 +94,37 @@ Incremental steps to execute this change. These will be converted to issues afte
 
 Overview for the current state of sinks regarding encoding:
 
-|sink|encoding config|`.apply_rules`|notes|
-|-|-|-|-|
-|`aws_cloudwatch_logs`| `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | Enveloped in `rusoto_logs::InputLogEvent`. `Text` reads message_key()
-|`aws_kinesis_firehose`| `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | Enveloped in `rusoto_firehose::Record` that serializes to base64. `Text` reads `message_key()` | -
-|`aws_kinesis_streams`| `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | Enveloped in `rusoto_kinesis::PutRecordsRequestEntry`. `Text` reads `message_key()`
-|`aws_s3`| `EncodingConfig<StandardEncodings { Text, Json, Ndjson }>` | ✔︎ | Uses `util::{RequestBuilder, Encoder, Compressor}`. `Text` reads `message_key()`
-|`aws_sqs`| `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | Enveloped in `EncodedEvent<SendMessageEntry>`. `Text` reads `message_key()`
-|`azure_blob`| `EncodingConfig<Encoding { Ndjson, Text }>` | ✔︎ | Enveloped in `EncodedEvent<PartitionInnerBuffer>`. `Text` reads `message_key()`
-|`azure_monitor_logs`| `EncodingConfigWithDefault<Encoding { Default }>` | ✔︎ | Serializes to JSON. Enveloped in HTTP request
-|`blackhole`| - | - | -
-|`clickhouse`| `EncodingConfigWithDefault<Encoding { Default }>` | ✔︎ | Serializes to JSON. Enveloped in HTTP request
-|`console`| `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | `Text` reads `message_key()`
-|`datadog_logs`| `EncodingConfigFixed<DatadogLogsJsonEncoding>` | ✔︎ | Doesn't provide options to encode the event payload separately from the protocol
-|`datadog_events`| - | ✗ | -
-|`datadog_archives`| - | ✗ | Uses custom `DatadogArchivesEncoding`, which has a field `inner: StandardEncodings` which is not user-configurable
-|`elasticsearch`| `EncodingConfigFixed<ElasticsearchEncoder>` | ✔︎ | Reshapes event internally and implements custom `ElasticsearchEncoder` to serialize for the Elasticsearch protocol
-|`file`| `EncodingConfig<Encoding { Text, Ndjson }>` | ✔︎ | `Text` reads `message_key()`
-|`gcp`| `EncodingConfig<StandardEncodings>` | ✔︎ | Enveloped in HTTP request via `sinks::util::request_builder::RequestBuild`. Sets HTTP request header depending on encoding config
-|`honeycomb`| - | ✗ | Embeds event as JSON under a `data` key. Enveloped in HTTP request
-|`http`| `EncodingConfig<Encoding { Text, Ndjson, Json }>` | ✔︎ | Enveloped in HTTP request. Request-level compression. Sets HTTP request header depending on encoding config
-|`humio`| `EncodingConfig<Encoding { Json, Text }>` | ✔︎ | Wrapper, see `splunk_hec` for more information
-|`influxdb`| `EncodingConfigWithDefault<Encoding { Default }>` | ✔︎ | Encoding (for the protocol envelope) is done by routing event fields either into a "tags" or "fields" map that are passed into an internal function `influx_line_protocol`
-|`kafka`| `EncodingConfig<StandardEncodings { Text, Json, Ndjson }>` | ✔︎ | Uses `Encoder<Event>` for `StandardEncodings` in `encode_input`, enveloped in `KafkaRequest`
-|`logdna`| `EncodingConfigWithDefault<Encoding { Default }>` | ✔︎ | Builds a message by manually picking fields from the event. Enveloped in HTTP request
-|`loki`| `EncodingConfig<Encoding { Json, Text, Logfmt }>` | ✔︎ | Uses reshaping. `Text` reads `message_key()`, `Logfmt` build a key-value string. Sink has config to preprocess event by adding/removing label fields and timestamp. Enveloped in HTTP request
-|`nats`| `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | `Text` reads `message_key()`
-|`new_relic_logs`| `EncodingConfigWithDefault<Encoding { Json }>` | ✔︎ | Defers to HTTP sink, uses encoding config to reshape only and convert to JSON
-|`papertrail`| `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | `Text` reads `message_key()`. Serializes event using syslog and sends buffer via TCP
-|`pulsar`| `EncodingConfig<Encoding { Text, Json, Avro }>` | ✔︎ | `Text` reads `message_key()`, `Avro` expects another dedicated key for the serialization schema. Serialized buffer is sent to Pulsar producer
-|`redis`| `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | `Text` reads `message_key()`. Encoded message is serialized to buffer
-|`sematext`| `EncodingConfigFixed<ElasticsearchEncoder>` | ✔︎ | Wrapper, see `elasticsearch` for more information
-|`socket`| `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | `Text` reads `message_key()`
-|`splunk_hec`| `EncodingConfig<HecLogsEncoder { Json, Text }>` | ✔︎ | Encoding is used to create a message according to the Splunk HEC protocol. There is no separate control over encoding the payload itself
-|`vector`| - | - | -
+| sink | encoding config | `.apply_rules` | notes |
+| - | - | - | - |
+| `aws_cloudwatch_logs` | `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | Enveloped in `rusoto_logs::InputLogEvent`. `Text` reads message_key() |
+| `aws_kinesis_firehose` | `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | Enveloped in `rusoto_firehose::Record` that serializes to base64. `Text` reads `message_key()` |
+| `aws_kinesis_streams` | `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | Enveloped in `rusoto_kinesis::PutRecordsRequestEntry`. `Text` reads `message_key()` |
+| `aws_s3` | `EncodingConfig<StandardEncodings { Text, Json, Ndjson }>` | ✔︎ | Uses `util::{RequestBuilder, Encoder, Compressor}`. `Text` reads `message_key()` |
+| `aws_sqs` | `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | Enveloped in `EncodedEvent<SendMessageEntry>`. `Text` reads `message_key()` |
+| `azure_blob` | `EncodingConfig<Encoding { Ndjson, Text }>` | ✔︎ | Enveloped in `EncodedEvent<PartitionInnerBuffer>`. `Text` reads `message_key()` |
+| `azure_monitor_logs` | `EncodingConfigWithDefault<Encoding { Default }>` | ✔︎ | Serializes to JSON. Enveloped in HTTP request |
+| `blackhole` | - | - | - |
+| `clickhouse` | `EncodingConfigWithDefault<Encoding { Default }>` | ✔︎ | Serializes to JSON. Enveloped in HTTP request |
+| `console` | `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | `Text` reads `message_key()` |
+| `datadog_logs` | `EncodingConfigFixed<DatadogLogsJsonEncoding>` | ✔︎ | Doesn't provide options to encode the event payload separately from the protocol |
+| `datadog_events` | - | ✗ | - |
+| `datadog_archives` | - | ✗ | Uses custom `DatadogArchivesEncoding`, which has a field `inner: StandardEncodings` which is not user-configurable |
+| `elasticsearch` | `EncodingConfigFixed<ElasticsearchEncoder>` | ✔︎ | Reshapes event internally and implements custom `ElasticsearchEncoder` to serialize for the Elasticsearch protocol |
+| `file` | `EncodingConfig<Encoding { Text, Ndjson }>` | ✔︎ | `Text` reads `message_key()` |
+| `gcp` | `EncodingConfig<StandardEncodings>` | ✔︎ | Enveloped in HTTP request via `sinks::util::request_builder::RequestBuild`. Sets HTTP request header depending on encoding config |
+| `honeycomb` | - | ✗ | Embeds event as JSON under a `data` key. Enveloped in HTTP request |
+| `http` | `EncodingConfig<Encoding { Text, Ndjson, Json }>` | ✔︎ | Enveloped in HTTP request. Request-level compression. Sets HTTP request header depending on encoding config |
+| `humio` | `EncodingConfig<Encoding { Json, Text }>` | ✔︎ | Wrapper, see `splunk_hec` for more information |
+| `influxdb` | `EncodingConfigWithDefault<Encoding { Default }>` | ✔︎ | Encoding (for the protocol envelope) is done by routing event fields either into a "tags" or "fields" map that are passed into an internal function `influx_line_protocol` |
+| `kafka` | `EncodingConfig<StandardEncodings { Text, Json, Ndjson }>` | ✔︎ | Uses `Encoder<Event>` for `StandardEncodings` in `encode_input`, enveloped in `KafkaRequest` |
+| `logdna` | `EncodingConfigWithDefault<Encoding { Default }>` | ✔︎ | Builds a message by manually picking fields from the event. Enveloped in HTTP request |
+| `loki` | `EncodingConfig<Encoding { Json, Text, Logfmt }>` | ✔︎ | Uses reshaping. `Text` reads `message_key()`, `Logfmt` build a key-value string. Sink has config to preprocess event by adding/removing label fields and timestamp. Enveloped in HTTP request |
+| `nats` | `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | `Text` reads `message_key()` |
+| `new_relic_logs` | `EncodingConfigWithDefault<Encoding { Json }>` | ✔︎ | Defers to HTTP sink, uses encoding config to reshape only and convert to JSON |
+| `papertrail` | `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | `Text` reads `message_key()`. Serializes event using syslog and sends buffer via TCP |
+| `pulsar` | `EncodingConfig<Encoding { Text, Json, Avro }>` | ✔︎ | `Text` reads `message_key()`, `Avro` expects another dedicated key for the serialization schema. Serialized buffer is sent to Pulsar producer |
+| `redis` | `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | `Text` reads `message_key()`. Encoded message is serialized to buffer |
+| `sematext` | `EncodingConfigFixed<ElasticsearchEncoder>` | ✔︎ | Wrapper, see `elasticsearch` for more information |
+| `socket` | `EncodingConfig<Encoding { Text, Json }>` | ✔︎ | `Text` reads `message_key()` |
+| `splunk_hec` | `EncodingConfig<HecLogsEncoder { Json, Text }>` | ✔︎ | Encoding is used to create a message according to the Splunk HEC protocol. There is no separate control over encoding the payload itself |
+| `vector` | - | - | - |
diff --git a/rfcs/2021-11-03-9862-ingest-apm-stats-along-traces-in-dd-agent-source.md b/rfcs/2021-11-03-9862-ingest-apm-stats-along-traces-in-dd-agent-source.md
index 0dd290232319a..c34109a576289 100644
--- a/rfcs/2021-11-03-9862-ingest-apm-stats-along-traces-in-dd-agent-source.md
+++ b/rfcs/2021-11-03-9862-ingest-apm-stats-along-traces-in-dd-agent-source.md
@@ -100,7 +100,7 @@ found in the trace support [RFC][trace-support-pr] and may provide relevant cont
 ## Cross cutting concerns
 
 * Ongoing work on transforms to add `named_outputs` that is laying the ground for the same feature but on `sources`,
-  [one PR][named-outputs-pr] has already be merged while scheduled work is tracked [here][named-outputs-improvements].
+  [one PR][named-outputs-pr] has already be merged while scheduled work is tracked in the [named outputs improvements issue][named-outputs-improvements].
 * [Ongoing work on schemas][schema-rfc] will ultimately offer a programatic way of validating required fields and
   express constrains on incoming event for a given sink. Traces & APM stats are a good fit for that because they will be
   represented as standard Vector events, but sinks handling thos will expect some mandatory information.
diff --git a/rfcs/2021-11-12-9811-vrl-vm.md b/rfcs/2021-11-12-9811-vrl-vm.md
index 0cb103fa9cf6a..6f6450cf3903d 100644
--- a/rfcs/2021-11-12-9811-vrl-vm.md
+++ b/rfcs/2021-11-12-9811-vrl-vm.md
@@ -323,8 +323,8 @@ functionality.
 The implementation needs to occur in well defined stages to prevent dumping a
 massive PR that never gets over the line.
 
-- [ ] Submit a PR with spike-level code _roughly_ demonstrating the change for
-      the VM. [here](https://github.com/vectordotdev/vector/pull/9829)
+- [ ] Submit a [PR with spike-level code](https://github.com/vectordotdev/vector/pull/9829) _roughly_ demonstrating the change for
+      the VM.
 - [ ] Incorporate (unit and property) tests.
 - [ ] Document and comment the VM and the functions used to emit OpCodes.
 - [ ] Develop a safe API surrounding the VM (in particular function calls).
diff --git a/rfcs/2021-12-06-10298-kubernetes_logs-rewrite.md b/rfcs/2021-12-06-10298-kubernetes_logs-rewrite.md
index d2dccc735fd1d..f66ab9824613a 100644
--- a/rfcs/2021-12-06-10298-kubernetes_logs-rewrite.md
+++ b/rfcs/2021-12-06-10298-kubernetes_logs-rewrite.md
@@ -126,8 +126,8 @@ enough to not warrant a version split between the old and new code.
 
 - Replace contents of `src/kubernetes` with equivalents from `kube`
   1. `src/kubernetes/client` replaced with `kube-client`
-  1. `src/kubernetes/reflector` and dependencies replaced with `kube-runtime::reflector`
-  1. `src/kubernetes/state` updates to minimize in-house code
+  2. `src/kubernetes/reflector` and dependencies replaced with `kube-runtime::reflector`
+  3. `src/kubernetes/state` updates to minimize in-house code
 - Ensure unit tests and integration tests show matching behavior before and after rewrite
 
 ## Future Improvements
diff --git a/rfcs/2022-05-17-11532-chronicle-sink.md b/rfcs/2022-05-17-11532-chronicle-sink.md
index 146008b8b9b3a..a65596fdfa3d7 100644
--- a/rfcs/2022-05-17-11532-chronicle-sink.md
+++ b/rfcs/2022-05-17-11532-chronicle-sink.md
@@ -128,16 +128,16 @@ The encoding of the message (text or json) can be set via an `encoding` field.
 ##### Schema
 
 A UDM message has the following sections. (To keep this RFC succinct, this is
-not a comprehensive list, the full list can be found
-[here](https://cloud.google.com/chronicle/docs/reference/udm-field-list#udm_event_data_model).)
+not a comprehensive list, the full list can be found in the
+[UDM event data model reference](https://cloud.google.com/chronicle/docs/reference/udm-field-list#udm_event_data_model).)
 
 - *Metadata*
   Contains metadata about the event. The fields available for metadata can be
-  found [here](https://cloud.google.com/chronicle/docs/reference/udm-field-list#metadata).
+  found in the [UDM metadata field reference](https://cloud.google.com/chronicle/docs/reference/udm-field-list#metadata).
   Mandatory fields are `event_type` and `event_timestamp`.
 
   The value of `event_type` has repercussions for which fields are mandatory
-  in the rest of the event. See [here](https://cloud.google.com/chronicle/docs/unified-data-model/udm-usage#required_and_optional_fields_based_on_event_type)
+  in the rest of the event. See the [required and optional fields by event type](https://cloud.google.com/chronicle/docs/unified-data-model/udm-usage#required_and_optional_fields_based_on_event_type)
   for the list. For example, if `event_type == "FILE_COPY"` then `src.file`
   becomes mandatory. **Currently it is not possible to validate a field based
   on the value of another field within Vector schema, so this will need to
@@ -145,18 +145,18 @@ not a comprehensive list, the full list can be found
 
 - *Principal*
   The principal is the entity that originates the event. This field is mandatory
-  and can contain any of the fields defined
-  [here](https://cloud.google.com/chronicle/docs/reference/udm-field-list#noun).
+  and can contain any of the fields defined in the
+  [UDM noun field reference](https://cloud.google.com/chronicle/docs/reference/udm-field-list#noun).
 
 - *Src*
   The source entity being acted upon. Depending on the `event_type` this field
-  is optional. Can contain any of the fields defined
-  [here](https://cloud.google.com/chronicle/docs/reference/udm-field-list#noun).
+  is optional. Can contain any of the fields defined in the
+  [UDM noun field reference](https://cloud.google.com/chronicle/docs/reference/udm-field-list#noun).
 
 - *Target*
   The target entity being acted upon. Depending on the `event_type` this field
-  is optional. Can contain any of the fields defined
-  [here](https://cloud.google.com/chronicle/docs/reference/udm-field-list#noun).
+  is optional. Can contain any of the fields defined in the
+  [UDM noun field reference](https://cloud.google.com/chronicle/docs/reference/udm-field-list#noun).
 
 ### Implementation
 
diff --git a/rfcs/2022-10-12-14742-flexible-metric-tags.md b/rfcs/2022-10-12-14742-flexible-metric-tags.md
index ccb0a2340e167..283541491d255 100644
--- a/rfcs/2022-10-12-14742-flexible-metric-tags.md
+++ b/rfcs/2022-10-12-14742-flexible-metric-tags.md
@@ -127,9 +127,9 @@ supported in the presence of multi-valued tags, which will be selectable with co
 
 1. The individual values are tracked as before. Events are dropped when any one tag's cardinality
    exceeds the limit, but only the tags that would exceed the limit are dropped.
-1. The individual values are tracked as before. Events are dropped when any one tag's cardinality
+2. The individual values are tracked as before. Events are dropped when any one tag's cardinality
    exceeds the limit, and all values of tags that would exceed the limit are dropped.
-1. Values of multi-valued tags are combined before tracking. Events are dropped as before and all
+3. Values of multi-valued tags are combined before tracking. Events are dropped as before and all
    values of tags that would exceed the limit are dropped.
 
 #### Sinks
@@ -215,7 +215,7 @@ The use of an `IndexSet` for the tag value provides us with two useful invariant
 
 1. Only unique values for each tag will be stored, which prevents repeated values from showing up in
    the output.
-1. The values can be retrieved in the order they first appeared, which allows us to trivially
+2. The values can be retrieved in the order they first appeared, which allows us to trivially
    retrieve either the first or last stored value.
 
 ## Drawbacks
@@ -257,16 +257,16 @@ which will cause problems for users:
 1. Unconditionally expose the tags as arrays of values using the existing naming, but still accept
    assignments using either single values or arrays of values. This will cause breakage to existing
    scripts that relies on the existing single value tag values.
-1. For Lua or VRL scripts, conditionally expose the tags as single values or arrays, as described in
+2. For Lua or VRL scripts, conditionally expose the tags as single values or arrays, as described in
    the proposal, but accept assignments following the native JSON codec scheme. In Lua, this could
    cause a breaking change where scripts that emit metrics that have the wrong tabs type to be
    accepted for transmission. In VRL, this would create headaches for type definitions, at best
    preventing proper validation of programs.
-1. Expose the tags as single values using the existing naming, picking some arbitrary value when a
+3. Expose the tags as single values using the existing naming, picking some arbitrary value when a
    tag has multiple values, and set up a secondary tags structure that exposes the arrays. This will
    lead to all kinds of confusion and conflicts when the same tag is assigned through different
    variables.
-1. Add functions specifically for manipulating tag sets. This continues to make metrics management
+4. Add functions specifically for manipulating tag sets. This continues to make metrics management
    look like a second-class afterthought, and doesn't ease any compatibility problems for existing
    scripts.
 
@@ -284,8 +284,8 @@ that would support this feature but with different semantics:
 
 1. `Vec<String>` — Retains the ordering of tags as they appear, but allows for duplicate values and
    cannot support both bare tags and multiple values simultaneously.
-1. `Vec<Option<String>>` — Same as above but supports bare tags and mutiple values simultaneously.
-1. `BTreeSet<Option<String>>` — Duplicate values are merged but are sorted, likely putting the bare
+2. `Vec<Option<String>>` — Same as above but supports bare tags and mutiple values simultaneously.
+3. `BTreeSet<Option<String>>` — Duplicate values are merged but are sorted, likely putting the bare
    tag first for single-value uses.
 
 There are also at least two other container types that could possibly support this use case:
diff --git a/rfcs/2022-10-31-15056-tooling-revamp.md b/rfcs/2022-10-31-15056-tooling-revamp.md
index 70e83db6bb530..d0660f5361222 100644
--- a/rfcs/2022-10-31-15056-tooling-revamp.md
+++ b/rfcs/2022-10-31-15056-tooling-revamp.md
@@ -41,7 +41,7 @@ This RFC discusses improving Vector's developer tooling in order to ease mainten
 
 - Test failures are difficult to debug, esp. since [this change](https://github.com/vectordotdev/vector/pull/13128)
 - Windows is essentially unsupported since Make takes a great deal of effort to install and most [scripts](https://github.com/vectordotdev/vector/tree/v0.24.2/scripts) require Bash and utilities like `find`
-- Adding tests for new integrations to CI ([here](https://github.com/vectordotdev/vector/blob/v0.24.2/Makefile#L333-L341) and [here](https://github.com/vectordotdev/vector/blob/v0.24.2/.github/workflows/integration-test.yml#L58-L91)) is a manual and occasionally forgotten step (see [outstanding questions](#outstanding-questions))
+- Adding tests for new integrations to CI ([Makefile](https://github.com/vectordotdev/vector/blob/v0.24.2/Makefile#L333-L341) and [integration-test workflow](https://github.com/vectordotdev/vector/blob/v0.24.2/.github/workflows/integration-test.yml#L58-L91)) is a manual and occasionally forgotten step (see [outstanding questions](#outstanding-questions))
 - Makefiles and scripts can get messy fast and often are hard to scale well
 
 ## Proposal
diff --git a/rfcs/2023-05-03-data-volume-metrics.md b/rfcs/2023-05-03-data-volume-metrics.md
index 368fe874cd420..ba1b571653122 100644
--- a/rfcs/2023-05-03-data-volume-metrics.md
+++ b/rfcs/2023-05-03-data-volume-metrics.md
@@ -109,7 +109,7 @@ as the O(1) scan.
 
 #### `component_received_event_bytes_total`
 
-This metric is emitted by the framework [here][source_sender], so it looks like
+This metric is emitted by the [framework's source sender][source_sender], so it looks like
 the only change needed is to add the service tag.
 
 #### `component_sent_event_bytes_total`
diff --git a/rfcs/README.md b/rfcs/README.md
index 8c0f2a932f5f7..055819c005902 100644
--- a/rfcs/README.md
+++ b/rfcs/README.md
@@ -78,8 +78,8 @@ more info navigating your solution.
 
 1. Search GitHub for [previous issues](https://github.com/vectordotdev/vector/issues) and
    [RFCs](https://github.com/vectordotdev/vector/tree/master/rfcs) on this topic.
-1. If an RFC issue does not exist, [open one](https://github.com/vectordotdev/vector/issues/new/choose).
-1. Use the issue to obtain consensus that an RFC is necessary.
+2. If an RFC issue does not exist, [open one](https://github.com/vectordotdev/vector/issues/new/choose).
+3. Use the issue to obtain consensus that an RFC is necessary.
    - The change might be quickly rejected.
    - The change might be on our long term roadmap and get deferred.
    - The change might be blocked by other work.
@@ -87,22 +87,22 @@ more info navigating your solution.
 ### Creating an RFC
 
 1. Create a new branch
-1. Copy the [`rfcs/_YYYY-MM-DD-issue#-title.md`](rfcs/_YYYY-MM-DD-issue%23-title.md) template with the appropriate
+2. Copy the [`rfcs/_YYYY-MM-DD-issue#-title.md`](rfcs/_YYYY-MM-DD-issue%23-title.md) template with the appropriate
    name. Be sure to use the issue number you created above. (e.g., `rfcs/2020-02-10-445-internal-observability.md`)
-1. Fill in your RFC, pay attention the bullets and guidelines. Do not omit any sections.
-1. Work with the Vector team to land on a confident solution. Allocate time for code-level spikes if necessary.
-1. Submit your RFC as a pull request and tag reviewers for approval.
+3. Fill in your RFC, pay attention the bullets and guidelines. Do not omit any sections.
+4. Work with the Vector team to land on a confident solution. Allocate time for code-level spikes if necessary.
+5. Submit your RFC as a pull request and tag reviewers for approval.
 
 ### Getting an RFC accepted
 
 1. Schedule a "last call" meeting for your RFC. This should be 1 week after opening your pull request. The purpose is to efficiently obtain consensus.
-1. At least 3 Vector team members must approve your RFC in the form of pull request approvals.
-1. Once approved, self-merge your RFC, or ask a Vector team member to do it for you.
+2. At least 3 Vector team members must approve your RFC in the form of pull request approvals.
+3. Once approved, self-merge your RFC, or ask a Vector team member to do it for you.
 
 ### Implementing an RFC
 
 1. Create issues from the "Plan Of Attack" section. Place them in an epic if necessary.
-1. Coordinate with leadership to schedule your work.
+2. Coordinate with leadership to schedule your work.
 
 ## FAQ
 
diff --git a/vdev/src/commands/check/markdown.rs b/vdev/src/commands/check/markdown.rs
index 002ed62908444..3ecf0c91f3201 100644
--- a/vdev/src/commands/check/markdown.rs
+++ b/vdev/src/commands/check/markdown.rs
@@ -14,16 +14,10 @@ impl Cli {
             return Ok(());
         }
 
-        let args: Vec<&str> = vec![
-            "--config",
-            "scripts/.markdownlintrc",
-            // We should fix these as well. Previously these files were not linted.
-            "--ignore",
-            ".github",
-        ]
-        .into_iter()
-        .chain(files.iter().map(String::as_str))
-        .collect();
+        let args: Vec<&str> = vec!["--config", ".markdownlint.jsonc"]
+            .into_iter()
+            .chain(files.iter().map(String::as_str))
+            .collect();
 
         app::exec("markdownlint", &args, true)
     }
diff --git a/website/README.md b/website/README.md
index 214ed0d4007e2..47475945dbf9d 100644
--- a/website/README.md
+++ b/website/README.md
@@ -139,8 +139,8 @@ When you make changes to the Markdown sources, Sass/CSS, or JavaScript, the site
 ### Add a new version of Vector
 
 1. Add the new version to the `versions` list in [`cue/reference/versions.cue`](./cue/reference/versions.cue). Make sure to preserve reverse ordering.
-1. Generate a new CUE file for the release by running `make release-prepare` in the root directory of the Vector repo. This generates a CUE file at `cue/releases/{VERSION}.cue`.
-1. Add a new Markdown file to [`content/en/releases`](./content/en/releases), where the filename is `{version}.md` (e.g. `0.12.0.md`) and the file has metadata that looks like this:
+2. Generate a new CUE file for the release by running `make release-prepare` in the root directory of the Vector repo. This generates a CUE file at `cue/releases/{VERSION}.cue`.
+3. Add a new Markdown file to [`content/en/releases`](./content/en/releases), where the filename is `{version}.md` (e.g. `0.12.0.md`) and the file has metadata that looks like this:
 
     ```markdown
     ---
diff --git a/website/content/en/blog/adaptive-request-concurrency.md b/website/content/en/blog/adaptive-request-concurrency.md
index 9c9aff9597454..b2a701433d638 100644
--- a/website/content/en/blog/adaptive-request-concurrency.md
+++ b/website/content/en/blog/adaptive-request-concurrency.md
@@ -25,7 +25,7 @@ TRACE tower_limit::rate::service: rate limit exceeded, disabling service
 Users typically have two questions about this:
 
 1. What does it mean?
-1. How can I fix it?
+2. How can I fix it?
 
 The answer to the first question is simple: Vector has _internally_ rate-limited processing to respect user-configured limits—[`request.rate_limit_duration_secs`][rate_limit_duration_secs] and [`request.rate_limit_num`][rate_limit_num]—for that particular [sink][sinks]. In other words, Vector has intentionally reduced performance to stay within static limits.
 
@@ -66,12 +66,12 @@ We feel strongly that Vector's **Adaptive Request Concurrency** (ARC) feature pr
 
 Here's how that plays out in some example scenarios:
 
-Change |   | Response
-:------|:-:|:--------
-**You deploy more Vector instances** | ➔ |Vector automatically redistributes HTTP throughput across both current and new instances
-**You scale up your Elasticsearch cluster** | ➔ | Vector automatically increases concurrency to take full advantage of the new capacity
-**You scale your Elasticsearch cluster back down** | ➔ | Vector lowers concurrency to avoid any risk of destabilizing the cluster (while still taking full of advantage of the now-decreased bandwidth)
-**Your Elasticsearch cluster experiences a temporary outage** | ➔ |Vector lowers concurrency dramatically and provides backpressure by [buffering][buffer] events
+| Change | | Response |
+| :------- | :-: | :-------- |
+| **You deploy more Vector instances** | ➔ | Vector automatically redistributes HTTP throughput across both current and new instances |
+| **You scale up your Elasticsearch cluster** | ➔ | Vector automatically increases concurrency to take full advantage of the new capacity |
+| **You scale your Elasticsearch cluster back down** | ➔ | Vector lowers concurrency to avoid any risk of destabilizing the cluster (while still taking full of advantage of the now-decreased bandwidth) |
+| **Your Elasticsearch cluster experiences a temporary outage** | ➔ | Vector lowers concurrency dramatically and provides backpressure by [buffering][buffer] events |
 
 With ARC, these scenarios require no human intervention. Vector quietly hums along making these decisions for you with a speed and granularity that rate limits simply cannot provide.
 
diff --git a/website/content/en/blog/highlights-february-2025.md b/website/content/en/blog/highlights-february-2025.md
index 1adf7bce8787e..eabb4a8adda38 100644
--- a/website/content/en/blog/highlights-february-2025.md
+++ b/website/content/en/blog/highlights-february-2025.md
@@ -44,5 +44,5 @@ We supported generating a Vector config schema for a while. This guide demonstra
 popular IDEs in order to help with writing configs.
 
 We would love to this to VRL IDE support in the future. In the meantime, we would like to highlight
-this   [tree-sitter](https://github.com/tree-sitter/tree-sitter) plugin that was developed by https://github.com/belltoy. You can read more
-[here](https://github.com/vectordotdev/vrl/issues/964).
+this   [tree-sitter](https://github.com/tree-sitter/tree-sitter) plugin that was developed by https://github.com/belltoy. You can read more about it in the
+[VRL tree-sitter issue](https://github.com/vectordotdev/vrl/issues/964).
diff --git a/website/content/en/blog/how-we-test-vector.md b/website/content/en/blog/how-we-test-vector.md
index 2d1313ec0a66e..cd029c3a5116a 100644
--- a/website/content/en/blog/how-we-test-vector.md
+++ b/website/content/en/blog/how-we-test-vector.md
@@ -21,9 +21,9 @@ task for software like Vector:
 
 1. It's relatively new and not as "battle tested" as more widely deployed
    software.
-1. The vast majority of its functionality lives at the edges, interfacing with
+2. The vast majority of its functionality lives at the edges, interfacing with
    various external systems.
-1. Instead of a monolithic application designed for a single task, it is
+3. Instead of a monolithic application designed for a single task, it is
    a collection of components that can be assembled into a near-infinite number
    of configurations.
 
diff --git a/website/content/en/blog/tracking-allocations.md b/website/content/en/blog/tracking-allocations.md
index 009ff33622c11..7fd2815af22b9 100644
--- a/website/content/en/blog/tracking-allocations.md
+++ b/website/content/en/blog/tracking-allocations.md
@@ -44,4 +44,4 @@ In our development and testing of this feature, we've observed ~20% reduction in
 
 We currently do not provide support for tracking memory ownership between components. For example, when a sink is batching events, and is configured to batch many events, you may observe high Vector memory usage. If you looked at the memory usage metrics, you would see most of it being attributed to components that either created the events (such as a source) or processed the events (such as any transforms that modified the event) rather than the sink which is batching the events. Adding support for shared ownership tracking provides further insights into the lifetimes of components, further easing the debugging process.
 
-Please Let us know your feedback and suggestions [here](https://github.com/vectordotdev/vector/issues/15474)!
+Please let us know your feedback and suggestions in the [allocation tracking feedback issue](https://github.com/vectordotdev/vector/issues/15474)!
diff --git a/website/content/en/blog/vector-remap-language.md b/website/content/en/blog/vector-remap-language.md
index d580e612ac4bb..368b113afbb3f 100644
--- a/website/content/en/blog/vector-remap-language.md
+++ b/website/content/en/blog/vector-remap-language.md
@@ -330,14 +330,14 @@ maintaining flexibility. This makes VRL ideal for always-up,
 performance-sensitive infrastructure like observability pipelines. To illustrate
 how we achieve this, below is a VRL feature matrix across these two principles:
 
-| Feature                   | Safety | Performance |
-|:--------------------------|:------:|:-----------:|
-| [Progressive type safety] |   ✅    |             |
-| [Fail safety]             |   ✅    |             |
-| [Memory safety]           |   ✅    |             |
-| [Ergonomic safety]        |   ✅    |      ✅      |
-| [Vector/Rust native]      |   ✅    |      ✅      |
-| [Stateless]               |   ✅    |      ✅      |
+| Feature | Safety | Performance |
+| :-- | :----: | :---------: |
+| [Progressive type safety] | ✅ | |
+| [Fail safety] | ✅ | |
+| [Memory safety] | ✅ | |
+| [Ergonomic safety] | ✅ | ✅ |
+| [Vector/Rust native] | ✅ | ✅ |
+| [Stateless] | ✅ | ✅ |
 
 For more info on each click on the feature, but for the purposes of
 demonstrating how VRL is unique, let's touch on the first two: *progressive type
@@ -411,7 +411,7 @@ either specify the type of the `.log` field or handle the error in the event
 that `.log` is not a string. To resolve this error, the user must do one of
 three things:
 
-1.  **Handle the error**
+1. **Handle the error**
 
     ```coffee
     ., err = parse_common_log(.log)
@@ -430,7 +430,7 @@ three things:
     handling this error is a *very* common mistake that would otherwise result
     in data loss and downtime.
 
-2.  **Raise the error and abort**
+2. **Raise the error and abort**
 
     ```coffee
     . = parse_common_log!(.log)
@@ -445,7 +445,7 @@ three things:
     operators. Again, this forces the users to decide how to handle errors
     instead of being surprised by them.
 
-3.  **Specify types**
+3. **Specify types**
 
     ```coffee
     .log = to_string!(.log)
diff --git a/website/content/en/docs/administration/management.md b/website/content/en/docs/administration/management.md
index c1eb175139124..dff4be7153bbf 100644
--- a/website/content/en/docs/administration/management.md
+++ b/website/content/en/docs/administration/management.md
@@ -179,11 +179,11 @@ docker restart -f $(docker ps -aqf "name=vector")
 The commands above involve configuring Vector using TOML, but you can also use JSON or YAML. You can also use one of
 three image variants (the commands assume `alpine`):
 
-Variant | Image basis
-:-------|:-----------
-`alpine` | [Alpine](https://hub.docker.com/_/alpine), a Linux distro built around [musl libc](https://www.musl-libc.org) and [BusyBox](https://busybox.net)
-`debian` | The [`debian-slim`](https://hub.docker.com/_/debian) image, which is a smaller and more compact version of the standard `debian` image
-`distroless` | The [Distroless](https://github.com/GoogleContainerTools/distroless) project, which provides extremely lean images with no package managers, shells, or other inessential utilities
+| Variant | Image basis |
+| :-------- | :----------- |
+| `alpine` | [Alpine](https://hub.docker.com/_/alpine), a Linux distro built around [musl libc](https://www.musl-libc.org) and [BusyBox](https://busybox.net) |
+| `debian` | The [`debian-slim`](https://hub.docker.com/_/debian) image, which is a smaller and more compact version of the standard `debian` image |
+| `distroless` | The [Distroless](https://github.com/GoogleContainerTools/distroless) project, which provides extremely lean images with no package managers, shells, or other inessential utilities |
 
 ### Helm
 
diff --git a/website/content/en/docs/administration/monitoring.md b/website/content/en/docs/administration/monitoring.md
index d9947a1b55e67..76819ee25ab18 100644
--- a/website/content/en/docs/administration/monitoring.md
+++ b/website/content/en/docs/administration/monitoring.md
@@ -77,14 +77,14 @@ sinks:
 Vector logs at the `info` level by default. You can set a different level when [starting] up your instance using either
 command-line flags or the `VECTOR_LOG` environment variable. The table below details these options:
 
-Method | Description
-:------|:-----------
-`-v` flag | Drops the log level to `debug`
-`-vv` flag | Drops the log level to `trace`
-`-q` flag | Raises the log level to `warn`
-`-qq` flag | Raises the log level to `error`
-`-qqq` flag | Disables logging
-`VECTOR_LOG=<level>` environment variable | Set the log level. Must be one of `trace`, `debug`, `info`, `warn`, `error`, `off`.
+| Method | Description |
+| :------- | :----------- |
+| `-v` flag | Drops the log level to `debug` |
+| `-vv` flag | Drops the log level to `trace` |
+| `-q` flag | Raises the log level to `warn` |
+| `-qq` flag | Raises the log level to `error` |
+| `-qqq` flag | Disables logging |
+| `VECTOR_LOG=<level>` environment variable | Set the log level. Must be one of `trace`, `debug`, `info`, `warn`, `error`, `off`. |
 
 #### Stack traces
 
diff --git a/website/content/en/docs/administration/validating.md b/website/content/en/docs/administration/validating.md
index bfdaec1f98189..0519d971fced4 100644
--- a/website/content/en/docs/administration/validating.md
+++ b/website/content/en/docs/administration/validating.md
@@ -36,10 +36,10 @@ files, including:
 These checks verify that the configuration file contains a valid topology:
 
 1. At least one [source][sources] is defined
-1. At least one [sink][sinks] is defined
-1. All inputs for each topology component (specified using the `inputs` parameter) contain at least
+2. At least one [sink][sinks] is defined
+3. All inputs for each topology component (specified using the `inputs` parameter) contain at least
   one value.
-1. All inputs refer to valid and upstream [sources] or [transforms].
+4. All inputs refer to valid and upstream [sources] or [transforms].
 
 ### Environment checks
 
@@ -47,7 +47,7 @@ Finally, these checks ensure that Vector is running in an environment that can s
 configured topology:
 
 1. All components have the pre-requisites to run, e.g. data directories exist and are writable.
-1. All sinks can connect to their specified targets.
+2. All sinks can connect to their specified targets.
 
 These environment checks can be disabled using the [`--no-environment`][no_environment] flag:
 
diff --git a/website/content/en/docs/introduction/concepts.md b/website/content/en/docs/introduction/concepts.md
index ad2dadddc6135..237b4fa903d50 100644
--- a/website/content/en/docs/introduction/concepts.md
+++ b/website/content/en/docs/introduction/concepts.md
@@ -40,7 +40,7 @@ A **trace** event can be thought of as a special kind of log event. The componen
 **Note**: Support for traces is limited and is in alpha.
 
 If you’re interested in using traces with a Vector component that doesn’t yet support them,
-please check the list of open issues [here](https://github.com/vectordotdev/vector/issues?q=is%3Aissue+state%3Aopen+label%3A%22domain%3A%20traces%22).
+please check the [list of open traces issues](https://github.com/vectordotdev/vector/issues?q=is%3Aissue+state%3Aopen+label%3A%22domain%3A%20traces%22).
 If you don’t see your use case covered, feel free to [open a new issue](https://github.com/vectordotdev/vector/issues/new?template=feature.yml).
 
 
@@ -88,7 +88,7 @@ This is the default behavior. When a buffer fills up, backpressure will be appli
 `buffer.when_full = drop_newest`
 When a buffer fills up, new events will be dropped. This does _not_ provide backpressure.
 
-View the full configuration options for buffers [here](/docs/reference/configuration/sinks/vector/#buffer).
+View the [full buffer configuration options](/docs/reference/configuration/sinks/vector/#buffer).
 
 ## Backpressure
 
diff --git a/website/content/en/docs/reference/configuration/unit-tests.md b/website/content/en/docs/reference/configuration/unit-tests.md
index c838086f50286..5e11240c9136f 100644
--- a/website/content/en/docs/reference/configuration/unit-tests.md
+++ b/website/content/en/docs/reference/configuration/unit-tests.md
@@ -14,9 +14,9 @@ work just like unit tests in most programming languages:
 
 1. Provide a set of [inputs](#inputs) to a transform (or to [multiple transforms](#multiple) chained
   together).
-1. Specify the expected [outputs](#outputs) from the changes made by the transform (or multiple
+2. Specify the expected [outputs](#outputs) from the changes made by the transform (or multiple
   transforms).
-1. Receive directly actionable feedback from any test failures.
+3. Receive directly actionable feedback from any test failures.
 
 Unit tests can serve as a useful guardrail when running in Vector in production settings where you
 need to ensure that your topology doesn't exhibit unexpected behavior and generally improve the
@@ -219,14 +219,14 @@ Inside each test definition, you need to specify two things:
 
 In the `inputs` array for the test, you have these options:
 
-Parameter | Type | Description
-:---------|:-----|:-----------
-`type` | string | The type of input you're providing. [`vrl`](#logs), [`log`](#logs), [`raw`](#logs), or [`metric`](#metrics) are currently the only valid values.
-`insert_at` | string (name of transform) | The name of the transform into which the test input is inserted. This is particularly useful when you want to test only a subset of a transform pipeline.
-`value` | string (raw event value) | A raw string value to act as an input event. Use only in cases where events are raw strings and not structured objects with event fields.
-`log_fields` | object | If the transform handles [log events](#logs), these are the key/value pairs that comprise the input event.
-`metric` | object | If the transform handles [metric events](#metrics), these are the fields that comprise that metric. Subfields include `name`, `tags`, `kind`, and others.
-`source` | string (vrl program) | If the transform handles [log events](#logs), the result of the vrl program will be the input event.
+| Parameter | Type | Description |
+| :--------- | :---- | :----------- |
+| `type` | string | The type of input you're providing. [`vrl`](#logs), [`log`](#logs), [`raw`](#logs), or [`metric`](#metrics) are currently the only valid values. |
+| `insert_at` | string (name of transform) | The name of the transform into which the test input is inserted. This is particularly useful when you want to test only a subset of a transform pipeline. |
+| `value` | string (raw event value) | A raw string value to act as an input event. Use only in cases where events are raw strings and not structured objects with event fields. |
+| `log_fields` | object | If the transform handles [log events](#logs), these are the key/value pairs that comprise the input event. |
+| `metric` | object | If the transform handles [metric events](#metrics), these are the fields that comprise that metric. Subfields include `name`, `tags`, `kind`, and others. |
+| `source` | string (vrl program) | If the transform handles [log events](#logs), the result of the vrl program will be the input event. |
 
 Here's an example `inputs` declaration:
 
@@ -248,17 +248,17 @@ message = "<102>1 2020-12-22T15:22:31.111Z vector-user.biz su 2666 ID389 - Somet
 
 In the `outputs` array of your unit testing configuration, you specify two things:
 
-Parameter | Type | Description
-:---------|:-----|:-----------
-`extract_from` | string (name of transform) | The transform whose output you want to test.
-`conditions` | array of objects | The [VRL conditions](#verifying) to run against the output.
+| Parameter | Type | Description |
+| :--------- | :---- | :----------- |
+| `extract_from` | string (name of transform) | The transform whose output you want to test. |
+| `conditions` | array of objects | The [VRL conditions](#verifying) to run against the output. |
 
 Each condition in the `conditions` array has two fields:
 
-Parameter | Type | Description
-:---------|:-----|:-----------
-`type` | string | The type of condition you're providing. [`vrl`][vrl] is currently the only valid value.
-`source` | string (VRL Boolean expression) | Explained in detail [above](#verifying).
+| Parameter | Type | Description |
+| :--------- | :---- | :----------- |
+| `type` | string | The type of condition you're providing. [`vrl`][vrl] is currently the only valid value. |
+| `source` | string (VRL Boolean expression) | Explained in detail [above](#verifying). |
 
 Here's an example `outputs` declaration:
 
diff --git a/website/content/en/docs/reference/vrl/_index.md b/website/content/en/docs/reference/vrl/_index.md
index a0b2cfb426efe..9685d6eddfdbf 100644
--- a/website/content/en/docs/reference/vrl/_index.md
+++ b/website/content/en/docs/reference/vrl/_index.md
@@ -166,14 +166,14 @@ flexibility. This makes VRL ideal for critical, performance-sensitive
 infrastructure, like observability pipelines. To illustrate how we achieve these,
 below is a VRL feature matrix across these principles:
 
-| Feature                                       | Safety | Performance |
-| :-------------------------------------------- | :----- | :---------- |
-| [Compilation](#compilation)                   | ✅      | ✅           |
-| [Ergonomic safety](#ergonomic-safety)         | ✅      | ✅           |
-| [Fail safety](#fail-safety)                   | ✅      |             |
-| [Memory safety](#memory-safety)               | ✅      |             |
-| [Vector and Rust native](#vector-rust-native) | ✅      | ✅           |
-| [Statelessness](#stateless)                   | ✅      | ✅           |
+| Feature | Safety | Performance |
+| :-- | :----- | :---------- |
+| [Compilation](#compilation) | ✅ | ✅ |
+| [Ergonomic safety](#ergonomic-safety) | ✅ | ✅ |
+| [Fail safety](#fail-safety) | ✅ | |
+| [Memory safety](#memory-safety) | ✅ | |
+| [Vector and Rust native](#vector-rust-native) | ✅ | ✅ |
+| [Statelessness](#stateless) | ✅ | ✅ |
 
 ## Concepts
 
diff --git a/website/content/en/docs/reference/vrl/errors.md b/website/content/en/docs/reference/vrl/errors.md
index e6da9cbec8245..ba6fe86ae6d88 100644
--- a/website/content/en/docs/reference/vrl/errors.md
+++ b/website/content/en/docs/reference/vrl/errors.md
@@ -64,17 +64,17 @@ of an infallible assignment.
 
 ##### Empty values
 
-Type | Empty value
-:----|:-----------
-String | `""`
-Integer | `0`
-Float | `0.0`
-Boolean | `false`
-Object | `{}`
-Array | `[]`
-Timestamp | `t'1970-01-01T00:00:00Z'` (Unix epoch)
-Regular expression | `r''`
-Null | `null`
+| Type | Empty value |
+| :---- | :----------- |
+| String | `""` |
+| Integer | `0` |
+| Float | `0.0` |
+| Boolean | `false` |
+| Object | `{}` |
+| Array | `[]` |
+| Timestamp | `t'1970-01-01T00:00:00Z'` (Unix epoch) |
+| Regular expression | `r''` |
+| Null | `null` |
 
 #### Coalescing
 
diff --git a/website/content/en/docs/setup/going-to-prod/arch/aggregator.md b/website/content/en/docs/setup/going-to-prod/arch/aggregator.md
index 3bf337c7f4ac6..6211e8b5f14c9 100644
--- a/website/content/en/docs/setup/going-to-prod/arch/aggregator.md
+++ b/website/content/en/docs/setup/going-to-prod/arch/aggregator.md
@@ -111,4 +111,4 @@ This eliminates the need to deploy a single monolith aggregator, creating an unn
 
 ## Support
 
-For easy setup and maintenance of this architecture, consider the Vector’s [discussions](https://discussions.vector.dev) or [chat](https://chat.vector.dev). These are free best effort channels. For enterprise needs, consider Datadog Observability Pipelines, which comes with enterprise-level support. Read more about that product [here](https://www.datadoghq.com/product/observability-pipelines/).
+For easy setup and maintenance of this architecture, consider the Vector’s [discussions](https://discussions.vector.dev) or [chat](https://chat.vector.dev). These are free best effort channels. For enterprise needs, consider Datadog Observability Pipelines, which comes with enterprise-level support. Read more about [Datadog Observability Pipelines](https://www.datadoghq.com/product/observability-pipelines/).
diff --git a/website/content/en/docs/setup/going-to-prod/arch/unified.md b/website/content/en/docs/setup/going-to-prod/arch/unified.md
index 59be6fa2a779a..710d1d4bdc6a5 100644
--- a/website/content/en/docs/setup/going-to-prod/arch/unified.md
+++ b/website/content/en/docs/setup/going-to-prod/arch/unified.md
@@ -23,4 +23,4 @@ We recommend this architecture for Vector users that have already deployed the a
 
 ## Support
 
-For easy setup and maintenance of this architecture, consider the Vector’s [discussions](https://discussions.vector.dev) or [chat](https://chat.vector.dev). These are free best effort channels. For enterprise needs, consider Datadog Observability Pipelines, which comes with enterprise-level support. Read more about that [here](https://www.datadoghq.com/product/observability-pipelines/).
+For easy setup and maintenance of this architecture, consider the Vector’s [discussions](https://discussions.vector.dev) or [chat](https://chat.vector.dev). These are free best effort channels. For enterprise needs, consider Datadog Observability Pipelines, which comes with enterprise-level support. Read more about [Datadog Observability Pipelines](https://www.datadoghq.com/product/observability-pipelines/).
diff --git a/website/content/en/docs/setup/installation/manual/from-source.md b/website/content/en/docs/setup/installation/manual/from-source.md
index 5ad19d46bce5c..0af130387f999 100644
--- a/website/content/en/docs/setup/installation/manual/from-source.md
+++ b/website/content/en/docs/setup/installation/manual/from-source.md
@@ -235,7 +235,7 @@ To update Vector, follow the same [installation](#installation) instructions abo
 
 Vector supports many feature flags to customize which features are included in a build. By default,
 all sources, transforms, and sinks are enabled. To view a complete list of features, they are listed
-under "[features]" [here](https://github.com/vectordotdev/vector/blob/master/Cargo.toml).
+under "[features]" in [Cargo.toml](https://github.com/vectordotdev/vector/blob/master/Cargo.toml).
 
 Example of building with only specific components:
 
diff --git a/website/content/en/docs/setup/installation/package-managers/helm.md b/website/content/en/docs/setup/installation/package-managers/helm.md
index 87c49e56140cb..0c38f086781fd 100644
--- a/website/content/en/docs/setup/installation/package-managers/helm.md
+++ b/website/content/en/docs/setup/installation/package-managers/helm.md
@@ -27,7 +27,7 @@ To check available Helm chart configuration options:
 helm show values vector/vector
 ```
 
-This example configuration file deploys Vector as an Agent, the full default configuration can be found [here](https://github.com/vectordotdev/helm-charts/blob/develop/charts/vector/templates/configmap.yaml). For more information about configuration options, see the [configuration] docs page.
+This example configuration file deploys Vector as an Agent, the [full default configuration](https://github.com/vectordotdev/helm-charts/blob/develop/charts/vector/templates/configmap.yaml) is available in the helm-charts repository. For more information about configuration options, see the [configuration] docs page.
 
 ```yaml
 cat <<-'VALUES' > values.yaml
@@ -69,7 +69,7 @@ To check available Helm chart configuration options:
 helm show values vector/vector
 ```
 
-The chart deploys an Aggregator by default, the full configuration can be found [here](https://github.com/vectordotdev/helm-charts/blob/develop/charts/vector/templates/configmap.yaml). For more information about configuration options, see the [Configuration] docs page.
+The chart deploys an Aggregator by default, the [full configuration](https://github.com/vectordotdev/helm-charts/blob/develop/charts/vector/templates/configmap.yaml) is available in the helm-charts repository. For more information about configuration options, see the [Configuration] docs page.
 
 ### Installing
 
diff --git a/website/content/en/docs/setup/installation/platforms/kubernetes.md b/website/content/en/docs/setup/installation/platforms/kubernetes.md
index b86e3ad251e48..8629db632ca19 100644
--- a/website/content/en/docs/setup/installation/platforms/kubernetes.md
+++ b/website/content/en/docs/setup/installation/platforms/kubernetes.md
@@ -40,7 +40,7 @@ kubectl create namespace --dry-run=client -o yaml vector > namespace.yaml
 
 ##### Prepare your kustomization file
 
-This example configuration file deploys Vector as an Agent, the full default configuration can be found [here](https://github.com/vectordotdev/helm-charts/blob/develop/charts/vector/templates/configmap.yaml). For more information about configuration options, see the [configuration] docs page.
+This example configuration file deploys Vector as an Agent, the [full default configuration](https://github.com/vectordotdev/helm-charts/blob/develop/charts/vector/templates/configmap.yaml) is available in the helm-charts repository. For more information about configuration options, see the [configuration] docs page.
 
 ```shell
 cat <<-'KUSTOMIZATION' > kustomization.yaml
@@ -99,7 +99,7 @@ kubectl create namespace --dry-run=client -o yaml vector > namespace.yaml
 
 ##### Prepare your kustomization file
 
-This example configuration deploys Vector as an Aggregator, the full configuration can be found [here](https://github.com/vectordotdev/helm-charts/blob/develop/charts/vector/templates/configmap.yaml). For more information about configuration options, see the [Configuration] docs page.
+This example configuration deploys Vector as an Aggregator, the [full configuration](https://github.com/vectordotdev/helm-charts/blob/develop/charts/vector/templates/configmap.yaml) is available in the helm-charts repository. For more information about configuration options, see the [Configuration] docs page.
 
 ```shell
 cat <<-'KUSTOMIZATION' > kustomization.yaml
diff --git a/website/content/en/guides/developer/config-autocompletion.md b/website/content/en/guides/developer/config-autocompletion.md
index e092a023f20f5..d98486e1c4ae2 100644
--- a/website/content/en/guides/developer/config-autocompletion.md
+++ b/website/content/en/guides/developer/config-autocompletion.md
@@ -37,11 +37,11 @@ vector generate-schema -o vector-v0.45.0-schema.json
 1. `Settings | Languages & Frameworks | Schemas and DTDs | JSON Schema Mappings`
 2. Import `vector-v0.45.0-schema.json`
 
-You can find more details [here][jetbrains].
+You can find more details in the [JetBrains JSON schema documentation][jetbrains].
 
 ### Visual Studio Code
 
-Follow the guide [here][vscode].
+Follow the [VS Code YAML schema validation guide][vscode].
 
 ## Example
 
diff --git a/website/content/en/guides/developer/debugging.md b/website/content/en/guides/developer/debugging.md
index 4e84514264e02..af1081377f2d5 100644
--- a/website/content/en/guides/developer/debugging.md
+++ b/website/content/en/guides/developer/debugging.md
@@ -35,7 +35,7 @@ You can set different verbosity levels for specific components:
 VECTOR_LOG=info,vector::sources::aws_s3=warn vector --config path/to/config.yaml
 ```
 
-You can find more information on the syntax [here](https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct.EnvFilter.html#usage-notes).
+You can find more information on the [EnvFilter syntax](https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct.EnvFilter.html#usage-notes).
 
 ### Vector Tools
 
diff --git a/website/content/en/highlights/2020-10-27-kubernetes-integration.md b/website/content/en/highlights/2020-10-27-kubernetes-integration.md
index b94d1eb296e19..505f86f217c55 100644
--- a/website/content/en/highlights/2020-10-27-kubernetes-integration.md
+++ b/website/content/en/highlights/2020-10-27-kubernetes-integration.md
@@ -23,14 +23,14 @@ Kubernetes observability data.
 
 ## Feature highlights
 
-1.  [**A new `kubernetes_logs` source**][kubernetes_logs_source] - A new source
+1. [**A new `kubernetes_logs` source**][kubernetes_logs_source] - A new source
     designed to handle the intricacies of Kubernetes log collection. It'll
     collect all Pod logs, merge split logs together, and enrich them with k8s
     metadata.
-2.  [**YAML config support**][config_formats_highlight] -
+2. [**YAML config support**][config_formats_highlight] -
     To ensure Vector fits cleanly into your existing K8s workflows, Vector now
     accepts YAML and JSON config formats.
-3.  [**Adaptive Request Currency (ARC)**][adaptive_concurrency_post] -
+3. [**Adaptive Request Currency (ARC)**][adaptive_concurrency_post] -
     A new Vector feature designed to automatically optimize HTTP communication
     in the face of ever changing environments like Kubernetes. It does away with
     static rate limits and raises the performance and reliability of your entire
diff --git a/website/content/en/highlights/2020-11-19-prometheus-remote-integrations.md b/website/content/en/highlights/2020-11-19-prometheus-remote-integrations.md
index 760d069821723..604b85bfc4bf7 100644
--- a/website/content/en/highlights/2020-11-19-prometheus-remote-integrations.md
+++ b/website/content/en/highlights/2020-11-19-prometheus-remote-integrations.md
@@ -66,7 +66,7 @@ Kubernetes where Prometheus is tightly integrated.
 To get started, setup the new
 [`prometheus_remote_write` source][prometheus_remote_write_source] and send
 your metrics to [Datadog][datadog], [New Relic][new_relic], [Influx][influx],
-[Elasticsearch][elastic], and [more][sinks]:
+[Elasticsearch][elastic], and [many other sinks][sinks]:
 
 ```toml title="vector.toml"
 [sources.prometheus]
diff --git a/website/content/en/highlights/2020-12-01-0-11-upgrade-guide.md b/website/content/en/highlights/2020-12-01-0-11-upgrade-guide.md
index dc37a0f044e8d..4c51c5dba4eb8 100644
--- a/website/content/en/highlights/2020-12-01-0-11-upgrade-guide.md
+++ b/website/content/en/highlights/2020-12-01-0-11-upgrade-guide.md
@@ -13,12 +13,12 @@ badges:
 0.11 includes some minor breaking changes:
 
 1. [The metrics emitted by the `internal_metrics` source have changed names.](#second)
-1. [The `statsd` sink now supports all socket types.](#third)
-1. [The `source_type` field is now explicit in the `splunk_hec` sink.](#fifth)
-1. [Remove forwarding to syslog from distributed systemd unit.](#sixth)
-1. [The `http` source no longer dedots JSON fields.](#seventh)
-1. [The `prometheus` sink has been renamed to `prometheus_exporter`](#first)
-1. [The `reduce` transform `identifier_fields` was renamed to `group_by`.](#fourth)
+2. [The `statsd` sink now supports all socket types.](#third)
+3. [The `source_type` field is now explicit in the `splunk_hec` sink.](#fifth)
+4. [Remove forwarding to syslog from distributed systemd unit.](#sixth)
+5. [The `http` source no longer dedots JSON fields.](#seventh)
+6. [The `prometheus` sink has been renamed to `prometheus_exporter`](#first)
+7. [The `reduce` transform `identifier_fields` was renamed to `group_by`.](#fourth)
 
 We cover each below to help you upgrade quickly:
 
diff --git a/website/content/en/highlights/2021-02-16-0-12-upgrade-guide.md b/website/content/en/highlights/2021-02-16-0-12-upgrade-guide.md
index e0e21c3bba265..9f05bda354d2f 100644
--- a/website/content/en/highlights/2021-02-16-0-12-upgrade-guide.md
+++ b/website/content/en/highlights/2021-02-16-0-12-upgrade-guide.md
@@ -14,10 +14,10 @@ badges:
 painlessly. If you have questions, [hop in our chat][chat] and we'll help you upgrade.
 
 1. [Breaking: The `encoding.codec` option is now required for all relevant sinks](#first)
-1. [Breaking: Vector `check_fields` conditions now require the `type` option](#second)
-1. [Breaking: The `generator` source requires a `format` option](#third)
-1. [Deprecation: Many transforms have been deprecated in favor of the new `remap` transform](#fourth)
-1. [Deprecation: The `file` source `start_at_beginning` has been deprecated](#fifth)
+2. [Breaking: Vector `check_fields` conditions now require the `type` option](#second)
+3. [Breaking: The `generator` source requires a `format` option](#third)
+4. [Deprecation: Many transforms have been deprecated in favor of the new `remap` transform](#fourth)
+5. [Deprecation: The `file` source `start_at_beginning` has been deprecated](#fifth)
 
 ## Upgrade Guide
 
diff --git a/website/content/en/highlights/2021-08-24-vector-aggregator.md b/website/content/en/highlights/2021-08-24-vector-aggregator.md
index c55f7aecbd19e..95a2c790e3b69 100644
--- a/website/content/en/highlights/2021-08-24-vector-aggregator.md
+++ b/website/content/en/highlights/2021-08-24-vector-aggregator.md
@@ -37,7 +37,7 @@ installing a HAProxy Deployment for load balancing across multiple aggregators.
 
 ## Setup and installation
 
-Instructions on how setup and install the `vector-aggregator` chart can be found [here][setup].
+Instructions on how setup and install the `vector-aggregator` chart can be found in the [Helm installation guide][setup].
 
 ## Looking forward
 
diff --git a/website/content/en/highlights/2021-08-25-0-16-upgrade-guide.md b/website/content/en/highlights/2021-08-25-0-16-upgrade-guide.md
index 9061612d5d8b2..96c30410f344c 100644
--- a/website/content/en/highlights/2021-08-25-0-16-upgrade-guide.md
+++ b/website/content/en/highlights/2021-08-25-0-16-upgrade-guide.md
@@ -13,10 +13,10 @@ badges:
 Vector's 0.16.0 release includes three **breaking changes**:
 
 1. [Component name field renamed to ID](#name-to-id)
-1. [Datadog Log sink encoding option removed](#encoding)
-1. [Renaming of `memory_use_bytes` internal metric](#memory_use_bytes)
-1. [`datadog_logs` source renamed to `datadog_agent`](#datadog_logs_rename)
-1. [`kubernetes_logs` source's new RBAC](#kubernetes_logs_rbac)
+2. [Datadog Log sink encoding option removed](#encoding)
+3. [Renaming of `memory_use_bytes` internal metric](#memory_use_bytes)
+4. [`datadog_logs` source renamed to `datadog_agent`](#datadog_logs_rename)
+5. [`kubernetes_logs` source's new RBAC](#kubernetes_logs_rbac)
 
 We cover them below to help you upgrade quickly:
 
diff --git a/website/content/en/highlights/2021-10-08-0-17-upgrade-guide.md b/website/content/en/highlights/2021-10-08-0-17-upgrade-guide.md
index 2af26a0c1b6d5..a6cf5ba705354 100644
--- a/website/content/en/highlights/2021-10-08-0-17-upgrade-guide.md
+++ b/website/content/en/highlights/2021-10-08-0-17-upgrade-guide.md
@@ -13,12 +13,12 @@ badges:
 Vector's 0.17.0 release includes several **breaking changes**:
 
 1. [Blackhole sink configuration changes](#blackhole)
-1. [Datadog Logs sink loses `batch.max_bytes` setting](#datadog_logs_max_bytes)
-1. [Vector now logs to stderr](#logging)
-1. [The `generator` source now has a default `interval` setting](#interval)
-1. [The deprecated `wasm` transform was removed](#wasm)
-1. [The `exec` source now has a `decoding` setting](#exec_source)
-1. [The algorithm underlying ARC has been optimized](#arc)
+2. [Datadog Logs sink loses `batch.max_bytes` setting](#datadog_logs_max_bytes)
+3. [Vector now logs to stderr](#logging)
+4. [The `generator` source now has a default `interval` setting](#interval)
+5. [The deprecated `wasm` transform was removed](#wasm)
+6. [The `exec` source now has a `decoding` setting](#exec_source)
+7. [The algorithm underlying ARC has been optimized](#arc)
 
 We cover them below to help you upgrade quickly:
 
diff --git a/website/content/en/highlights/2021-11-18-0-18-0-upgrade-guide.md b/website/content/en/highlights/2021-11-18-0-18-0-upgrade-guide.md
index 66c49480594a4..2270990762970 100644
--- a/website/content/en/highlights/2021-11-18-0-18-0-upgrade-guide.md
+++ b/website/content/en/highlights/2021-11-18-0-18-0-upgrade-guide.md
@@ -13,10 +13,10 @@ badges:
 Vector's 0.18.0 release includes **breaking changes**:
 
 1. [`batch.max_size` no longer valid for sinks](#batch-max-size)
-1. [`request.in_flight_limit` no longer valid for sources and sinks](#request-in-flight-limit)
-1. [`http_client_responses_total` now labels status with only numeric code](#http_client_responses_total)
-1. [Field name change for aggregated summaries in `metric_to_log` transform](#agg_summary_metric_to_log)
-1. [Removal of deprecated configuration fields for the Datadog metrics sink: `host` and `namespace`](#dd_metrics_sink_deprecated_fields)
+2. [`request.in_flight_limit` no longer valid for sources and sinks](#request-in-flight-limit)
+3. [`http_client_responses_total` now labels status with only numeric code](#http_client_responses_total)
+4. [Field name change for aggregated summaries in `metric_to_log` transform](#agg_summary_metric_to_log)
+5. [Removal of deprecated configuration fields for the Datadog metrics sink: `host` and `namespace`](#dd_metrics_sink_deprecated_fields)
 
 We cover them below to help you upgrade quickly:
 
diff --git a/website/content/en/highlights/2021-12-28-0-19-0-upgrade-guide.md b/website/content/en/highlights/2021-12-28-0-19-0-upgrade-guide.md
index fcfa8c9c8aff7..e23e7b54c9f5e 100644
--- a/website/content/en/highlights/2021-12-28-0-19-0-upgrade-guide.md
+++ b/website/content/en/highlights/2021-12-28-0-19-0-upgrade-guide.md
@@ -13,9 +13,9 @@ badges:
 Vector's 0.19.0 release includes **breaking changes**:
 
 1. [Removal of deprecated configuration fields for the Splunk HEC Logs sink: `host`](#splunk-hec-logs-sink-deprecated-fields)
-1. [Updated internal metrics for the Splunk HEC sinks](#splunk-hec-sinks-metrics-update)
-1. [Removal of deprecated configuration fields for the Elasticsearch sink](#elasticsearch-sink-deprecated-fields)
-1. [Removal of default for `version` field for Vector source and sink](#vector-version)
+2. [Updated internal metrics for the Splunk HEC sinks](#splunk-hec-sinks-metrics-update)
+3. [Removal of deprecated configuration fields for the Elasticsearch sink](#elasticsearch-sink-deprecated-fields)
+4. [Removal of default for `version` field for Vector source and sink](#vector-version)
 
 And **deprecations**:
 
diff --git a/website/content/en/highlights/2022-02-08-0-20-0-upgrade-guide.md b/website/content/en/highlights/2022-02-08-0-20-0-upgrade-guide.md
index 9bb01a8f6026a..997aefb340c72 100644
--- a/website/content/en/highlights/2022-02-08-0-20-0-upgrade-guide.md
+++ b/website/content/en/highlights/2022-02-08-0-20-0-upgrade-guide.md
@@ -13,12 +13,12 @@ badges:
 Vector's 0.20.0 release includes **breaking changes**:
 
 1. [Change to set expiration behavior in `prometheus_exporter` sink](#prom-exporter-set-expiration)
-1. [New metrics behavior for `route` transform](#metrics-route-transform)
-1. [New internal events for `loki` sink](#events-loki-sink)
-1. [`if` statement predicates in `VRL` need to handle errors](#vrl-fallible-predicates)
-1. [Division by a literal nonzero number in `VRL` is no longer fallible](#vrl-infallible-division)
-1. ['syslog' decoder will raise an error if the incoming message cannot be decoded successfully](#syslog-decoder)
-1. [Unit tests no longer allow nonexistent targets in `extract_from`/`no_outputs_from` configurations](#unit-test-nonexistent-build-error)
+2. [New metrics behavior for `route` transform](#metrics-route-transform)
+3. [New internal events for `loki` sink](#events-loki-sink)
+4. [`if` statement predicates in `VRL` need to handle errors](#vrl-fallible-predicates)
+5. [Division by a literal nonzero number in `VRL` is no longer fallible](#vrl-infallible-division)
+6. ['syslog' decoder will raise an error if the incoming message cannot be decoded successfully](#syslog-decoder)
+7. [Unit tests no longer allow nonexistent targets in `extract_from`/`no_outputs_from` configurations](#unit-test-nonexistent-build-error)
 
 And **deprecations**:
 
diff --git a/website/content/en/highlights/2022-03-22-0-21-0-upgrade-guide.md b/website/content/en/highlights/2022-03-22-0-21-0-upgrade-guide.md
index 855cfa2ddd81a..761e6d861455b 100644
--- a/website/content/en/highlights/2022-03-22-0-21-0-upgrade-guide.md
+++ b/website/content/en/highlights/2022-03-22-0-21-0-upgrade-guide.md
@@ -58,10 +58,10 @@ Here are some examples that require migrating
 
 | old syntax | new syntax | comment |
 | ------------- | --------------- | -------------- |
-| foo\\.bar.baz     | "foo.bar".baz     | The `.` field separator needs to be escaped if used as part of a field name. The old syntax allowed individual character escaping. The new syntax requires quotes around the field name.
-| headers.User-Agent | headers."User-Agent" | `-` requires quotes with the new syntax
-| foo with spaces | "foo with spaces" | Spaces also need to be quoted
-| foo\\"bar | "foo\\"bar" | Double quotes and backlashes must be escaped _inside_ quotes
+| foo\\.bar.baz | "foo.bar".baz | The `.` field separator needs to be escaped if used as part of a field name. The old syntax allowed individual character escaping. The new syntax requires quotes around the field name. |
+| headers.User-Agent | headers."User-Agent" | `-` requires quotes with the new syntax |
+| foo with spaces | "foo with spaces" | Spaces also need to be quoted |
+| foo\\"bar | "foo\\"bar" | Double quotes and backlashes must be escaped _inside_ quotes |
 
 
 ### TOML transform example
@@ -84,7 +84,7 @@ inputs = ["input"]
 fields.match = ["message.\"user-identifier\""]
 ```
 
-For more information on the new syntax, you can review the documentation [here](https://vector.dev/docs/reference/vrl/expressions/#path)
+For more information on the new syntax, you can review the [VRL path expressions documentation](https://vector.dev/docs/reference/vrl/expressions/#path)
 
 
 
diff --git a/website/content/en/highlights/2022-03-31-native-event-codecs.md b/website/content/en/highlights/2022-03-31-native-event-codecs.md
index b31b000e6bdfa..0a10938afffea 100644
--- a/website/content/en/highlights/2022-03-31-native-event-codecs.md
+++ b/website/content/en/highlights/2022-03-31-native-event-codecs.md
@@ -63,9 +63,9 @@ a `timestamp` key like:
 ```
 
 The specific JSON schema here is subject to change, but you can find an initial
-schema [here][cue schema]. The protobuf schema for the `native` codec is the
-same used in the `vector` source and sink, and the definition can be found
-[here][proto schema].
+[CUE schema][cue schema]. The protobuf schema for the `native` codec is the
+same used in the `vector` source and sink, and the definition can be found in the
+[proto schema][proto schema].
 
 We will be providing more thorough guidance for using each as the feature
 matures. One current limitation of the JSON-based native codec is that timestamp
diff --git a/website/content/en/highlights/2022-05-03-0-22-0-upgrade-guide.md b/website/content/en/highlights/2022-05-03-0-22-0-upgrade-guide.md
index 0d1fcc0645fcc..b7be9fad5dd50 100644
--- a/website/content/en/highlights/2022-05-03-0-22-0-upgrade-guide.md
+++ b/website/content/en/highlights/2022-05-03-0-22-0-upgrade-guide.md
@@ -13,8 +13,8 @@ badges:
 Vector's 0.22.0 release includes **breaking changes**:
 
 1. [`gcp_stackdriver_metrics` configuration change](#stackdriver-metrics)
-3. [VRL now supports template strings](#vrl-template-strings)
-4. [`encode_key_value` and `encode_logfmt` quote wrapping behavior change](#encode-key-value-quote-wrapping)
+2. [VRL now supports template strings](#vrl-template-strings)
+3. [`encode_key_value` and `encode_logfmt` quote wrapping behavior change](#encode-key-value-quote-wrapping)
 
 and **deprecations**:
 
@@ -68,7 +68,7 @@ project_id = "vector-123456"
   zone = "us-central1-a"
 ```
 
-For more information on the new syntax, you can review the documentation [here](https://vector.dev/docs/reference/configuration/sinks/gcp_stackdriver_metrics/)
+For more information on the new syntax, you can review the [GCP Stackdriver Metrics sink documentation](https://vector.dev/docs/reference/configuration/sinks/gcp_stackdriver_metrics/)
 
 
 #### VRL now supports template strings {#vrl-template-strings}
diff --git a/website/content/en/highlights/2022-10-04-0-25-0-upgrade-guide.md b/website/content/en/highlights/2022-10-04-0-25-0-upgrade-guide.md
index b017db9ccda3c..8464524b01c45 100644
--- a/website/content/en/highlights/2022-10-04-0-25-0-upgrade-guide.md
+++ b/website/content/en/highlights/2022-10-04-0-25-0-upgrade-guide.md
@@ -21,8 +21,8 @@ Vector's 0.25.0 release includes **breaking changes**:
 and **deprecations**:
 
 1. [Deprecation of VRL metadata functions](#metadata-function-deprecation)
-1. [Deprecation of `endpoint` option in Elasticsearch sink](#elasticsearch-endpoint-deprecation)
-1. [Deprecation of the Lua version 1 API](#lua-v1-api-deprecation)
+2. [Deprecation of `endpoint` option in Elasticsearch sink](#elasticsearch-endpoint-deprecation)
+3. [Deprecation of the Lua version 1 API](#lua-v1-api-deprecation)
 
 We cover them below to help you upgrade quickly:
 
diff --git a/website/content/en/highlights/2023-02-28-0-28-0-upgrade-guide.md b/website/content/en/highlights/2023-02-28-0-28-0-upgrade-guide.md
index 847f9e796cfb2..8d221c3062213 100644
--- a/website/content/en/highlights/2023-02-28-0-28-0-upgrade-guide.md
+++ b/website/content/en/highlights/2023-02-28-0-28-0-upgrade-guide.md
@@ -15,7 +15,7 @@ Vector's 0.28.0 release includes **breaking changes**:
 2. [Removal of metadata functions](#metadata-functions-removal)
 3. [Removal of the `apex` sink](#apex-removal)
 4. [Removal of the `disk_v1` buffer type](#disk_v1-removal)
-4. [Renaming of `host` to `hostname` in `datadog_logs`](#host-rename-dd-logs)
+5. [Renaming of `host` to `hostname` in `datadog_logs`](#host-rename-dd-logs)
 
 and **deprecations**:
 
diff --git a/website/content/en/highlights/2023-03-26-0-37-0-upgrade-guide.md b/website/content/en/highlights/2023-03-26-0-37-0-upgrade-guide.md
index cc9b211403d01..116e1a96027c4 100644
--- a/website/content/en/highlights/2023-03-26-0-37-0-upgrade-guide.md
+++ b/website/content/en/highlights/2023-03-26-0-37-0-upgrade-guide.md
@@ -12,7 +12,7 @@ badges:
 Vector's 0.37.0 release includes **breaking changes**:
 
 1. [Vector defaults to requiring non-optional environment variables](#strict-env-vars)
-1. [The `dnstap` source now requires the `mode` parameter](#dnstap-mode)
+2. [The `dnstap` source now requires the `mode` parameter](#dnstap-mode)
 
 and **potentially impactful changes**:
 
diff --git a/website/content/en/highlights/2023-07-05-0-31-0-upgrade-guide.md b/website/content/en/highlights/2023-07-05-0-31-0-upgrade-guide.md
index 7214b6d8a7612..9f4f2976f261e 100644
--- a/website/content/en/highlights/2023-07-05-0-31-0-upgrade-guide.md
+++ b/website/content/en/highlights/2023-07-05-0-31-0-upgrade-guide.md
@@ -12,7 +12,7 @@ badges:
 Vector's 0.31.0 release includes **breaking changes**:
 
 1. [Removal of various deprecated internal metrics](#deprecated-internal-metrics)
-1. [`component_received_event_bytes_total` and `component_sent_event_bytes_total` consistently use estimated JSON size of the event](#event_json_size)
+2. [`component_received_event_bytes_total` and `component_sent_event_bytes_total` consistently use estimated JSON size of the event](#event_json_size)
 
 and **potentially impactful changes**:
 
diff --git a/website/content/en/highlights/2023-09-27-0-33-0-upgrade-guide.md b/website/content/en/highlights/2023-09-27-0-33-0-upgrade-guide.md
index a081b80ee22b7..c965c41aae404 100644
--- a/website/content/en/highlights/2023-09-27-0-33-0-upgrade-guide.md
+++ b/website/content/en/highlights/2023-09-27-0-33-0-upgrade-guide.md
@@ -12,18 +12,18 @@ badges:
 Vector's 0.33.0 release includes **breaking changes**:
 
 1. [Behavior of the `datadog_logs` sink's `endpoint` setting](#datadog-logs-endpoint)
-1. [Disable OpenSSL legacy provider by default](#openssl-legacy-provider)
+2. [Disable OpenSSL legacy provider by default](#openssl-legacy-provider)
 
 and **deprecations**:
 
 1. [Default config location change](#default-config-location-change)
-1. [Renaming the `armv7` rpm package](#armv7-rename)
-1. [Metadata field in the Vector protobuf definition](#vector-proto-metadata)
+2. [Renaming the `armv7` rpm package](#armv7-rename)
+3. [Metadata field in the Vector protobuf definition](#vector-proto-metadata)
 
 and **potentially impactful changes**:
 
 1. [Async runtime default number of worker threads](#runtime-worker-threads)
-1. [Setting `request.concurrency = "none"`](#request-concurrency)
+2. [Setting `request.concurrency = "none"`](#request-concurrency)
 
 We cover them below to help you upgrade quickly:
 
diff --git a/website/content/en/highlights/2023-11-07-0-34-0-upgrade-guide.md b/website/content/en/highlights/2023-11-07-0-34-0-upgrade-guide.md
index abd78eb132d99..0eb2e166d664d 100644
--- a/website/content/en/highlights/2023-11-07-0-34-0-upgrade-guide.md
+++ b/website/content/en/highlights/2023-11-07-0-34-0-upgrade-guide.md
@@ -12,18 +12,18 @@ badges:
 Vector's 0.34.0 release includes **breaking changes**:
 
 1. [Removal of Deprecated Datadog Component Config Options](#datadog-deprecated-config-options)
-1. [Removal of Deprecated `component_name` Metric Tag](#deprecated-component-name)
-1. [Removal of Deprecated Metrics Replaced by `component_errors_total`](#deprecated-component-errors-total-metrics)
-1. [Removal of `peer_addr` Metric Tag](#remove-peer-addr)
-1. [Blackhole sink no longer reports by default](#blackhole-sink-reporting)
-1. [Remove direct OpenSSL legacy provider support](#openssl-legacy-provider)
-1. [Removal of the deprecated `armv7` rpm package](#armv7-rename)
-1. [Default config location change](#default-config-location-change)
+2. [Removal of Deprecated `component_name` Metric Tag](#deprecated-component-name)
+3. [Removal of Deprecated Metrics Replaced by `component_errors_total`](#deprecated-component-errors-total-metrics)
+4. [Removal of `peer_addr` Metric Tag](#remove-peer-addr)
+5. [Blackhole sink no longer reports by default](#blackhole-sink-reporting)
+6. [Remove direct OpenSSL legacy provider support](#openssl-legacy-provider)
+7. [Removal of the deprecated `armv7` rpm package](#armv7-rename)
+8. [Default config location change](#default-config-location-change)
 
 and **deprecations**:
 
 1. [Deprecation of `requests_completed_total`, `request_duration_seconds`, and `requests_received_total` Internal Metrics](#deprecate-obsolete-http-metrics)
-1. [Deprecation of `repositories.timber.io` package repositories](#timber-package-deprecation)
+2. [Deprecation of `repositories.timber.io` package repositories](#timber-package-deprecation)
 
 We cover them below to help you upgrade quickly:
 
diff --git a/website/content/en/highlights/2023-11-07-new-linux-repos.md b/website/content/en/highlights/2023-11-07-new-linux-repos.md
index 83ad54738fca4..b437833a51a8d 100644
--- a/website/content/en/highlights/2023-11-07-new-linux-repos.md
+++ b/website/content/en/highlights/2023-11-07-new-linux-repos.md
@@ -54,14 +54,14 @@ existing repository to your discretion.
 rm "/etc/apt/sources.list.d/timber-vector.list"
 ```
 
-2. Run the following commands to set up APT to download through HTTPS:
+1. Run the following commands to set up APT to download through HTTPS:
 
 ```sh
 sudo apt-get update
 sudo apt-get install apt-transport-https curl gnupg
 ```
 
-3. Run the following commands to set up the Vector `deb` repo on your system
+1. Run the following commands to set up the Vector `deb` repo on your system
 and create a Datadog archive keyring:
 
 ```sh
@@ -73,7 +73,7 @@ curl https://keys.datadoghq.com/DATADOG_APT_KEY_F14F620E.public | sudo gpg --no-
 curl https://keys.datadoghq.com/DATADOG_APT_KEY_C0962C7D.public | sudo gpg --no-default-keyring --keyring /usr/share/keyrings/datadog-archive-keyring.gpg --import --batch
 ```
 
-4. Run the following commands to update your local `apt` repo and install Vector:
+1. Run the following commands to update your local `apt` repo and install Vector:
 
 ```sh
 sudo apt-get update
@@ -91,7 +91,7 @@ sudo apt-get install vector
 rm "/etc/yum.repos.d/timber-vector.repo"
 ```
 
-2. Run the following commands to set up the Vector `rpm` repo on your system:
+1. Run the following commands to set up the Vector `rpm` repo on your system:
 
 ```sh
 cat <<EOF > /etc/yum.repos.d/vector.repo
@@ -109,7 +109,7 @@ EOF
 
 **Note:** If you are running RHEL 8.1 or CentOS 8.1, use `repo_gpgcheck=0` instead of `repo_gpgcheck=1` in the configuration above.
 
-3. Update your packages and install Vector:
+1. Update your packages and install Vector:
 
 ```sh
 sudo yum makecache
diff --git a/website/content/en/highlights/2023-12-19-0-35-0-upgrade-guide.md b/website/content/en/highlights/2023-12-19-0-35-0-upgrade-guide.md
index de9408043cac2..f4c5081b7f9e8 100644
--- a/website/content/en/highlights/2023-12-19-0-35-0-upgrade-guide.md
+++ b/website/content/en/highlights/2023-12-19-0-35-0-upgrade-guide.md
@@ -12,9 +12,9 @@ badges:
 Vector's 0.35.0 release includes **breaking changes**:
 
 1. [The Throttle transform's `events_discarded_total` internal metric is now opt-in](#events-discarded-total-opt-in)
-1. [The `file` internal metric tag is now opt-in for file-based components](#file-tag-opt-in)
-1. [Datadog sinks now default the API key and Site to the value of environment variables](#datadog-env-vars)
-1. [Removal of `requests_completed_total`, `request_duration_seconds`, and `requests_received_total` Internal Metrics](#remove-obsolete-http-metrics)
+2. [The `file` internal metric tag is now opt-in for file-based components](#file-tag-opt-in)
+3. [Datadog sinks now default the API key and Site to the value of environment variables](#datadog-env-vars)
+4. [Removal of `requests_completed_total`, `request_duration_seconds`, and `requests_received_total` Internal Metrics](#remove-obsolete-http-metrics)
 
 and **deprecations**:
 
@@ -23,9 +23,9 @@ and **deprecations**:
 and **potentially impactful changes**:
 
 1. [HTTP server-based sources now include a `keepalive.max_connection_age_secs` config option that defaults to 5 minutes](#http-keepalive-max-connection-age)
-1. [Update `component_sent_bytes_total` to correctly report uncompressed bytes for all sinks](#component-sent-bytes-total)
-1. [Update `component_received_bytes_total` to correctly report decompressed bytes for all sources](#component-received-bytes-total)
-1. [Update default values for the `request.retry_max_duration_secs` and `request.rate_limit_num` sink configuration options](#request-config-options)
+2. [Update `component_sent_bytes_total` to correctly report uncompressed bytes for all sinks](#component-sent-bytes-total)
+3. [Update `component_received_bytes_total` to correctly report decompressed bytes for all sources](#component-received-bytes-total)
+4. [Update default values for the `request.retry_max_duration_secs` and `request.rate_limit_num` sink configuration options](#request-config-options)
 
 We cover them below to help you upgrade quickly:
 
diff --git a/website/content/en/highlights/2024-05-07-0-38-0-upgrade-guide.md b/website/content/en/highlights/2024-05-07-0-38-0-upgrade-guide.md
index 90a7239d71ebf..379b7ad197ee2 100644
--- a/website/content/en/highlights/2024-05-07-0-38-0-upgrade-guide.md
+++ b/website/content/en/highlights/2024-05-07-0-38-0-upgrade-guide.md
@@ -16,7 +16,7 @@ Vector's 0.38.0 release includes a **breaking change**:
 and **deprecations**:
 
 1. [Deprecation of the path coalescing operator](#path-coalescing)
-1. [Deprecation of `enterprise` configuration](#enterprise-configuration)
+2. [Deprecation of `enterprise` configuration](#enterprise-configuration)
 
 We cover them below to help you upgrade quickly:
 
diff --git a/website/content/en/highlights/2024-06-17-0-39-0-upgrade-guide.md b/website/content/en/highlights/2024-06-17-0-39-0-upgrade-guide.md
index 784d2602f2592..dae63b3e6da72 100644
--- a/website/content/en/highlights/2024-06-17-0-39-0-upgrade-guide.md
+++ b/website/content/en/highlights/2024-06-17-0-39-0-upgrade-guide.md
@@ -12,7 +12,7 @@ badges:
 Vector's 0.39.0 release includes two **breaking changes**:
 
 1. [Removal of the path coalescing operator](#path-coalescing)
-1. [Removal of `enterprise` configuration](#enterprise-configuration)
+2. [Removal of `enterprise` configuration](#enterprise-configuration)
 
 We cover them below to help you upgrade quickly:
 
diff --git a/website/content/en/highlights/2024-07-29-0-40-0-upgrade-guide.md b/website/content/en/highlights/2024-07-29-0-40-0-upgrade-guide.md
index a2f604eeaf66f..5813dfc248a40 100644
--- a/website/content/en/highlights/2024-07-29-0-40-0-upgrade-guide.md
+++ b/website/content/en/highlights/2024-07-29-0-40-0-upgrade-guide.md
@@ -12,8 +12,8 @@ badges:
 Vector's 0.40.0 release includes three **breaking changes**:
 
 1. [GELF codec defaults to null-delimited messages for stream-based sources](#gelf)
-1. [Reduce transforms now properly aggregate nested fields](#reduce-aggregate)
-1. [Vector no longer supports CentOS 7](#centos7)
+2. [Reduce transforms now properly aggregate nested fields](#reduce-aggregate)
+3. [Vector no longer supports CentOS 7](#centos7)
 
 We cover them below to help you upgrade quickly:
 

From 7dc3ce3f34de6b79c0f09b4e44fe0e9d87cc09c2 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 25 Mar 2026 18:32:34 -0400
Subject: [PATCH 055/326] chore(dev): add links to design issues (#25046)

* chore: add TODO comments linking to log_namespace design issues

https://github.com/vectordotdev/vector/issues/25044
https://github.com/vectordotdev/vector/issues/25045

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* docs fix

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
---
 lib/codecs/src/decoding/format/mod.rs  | 2 ++
 lib/codecs/src/decoding/format/otlp.rs | 1 +
 2 files changed, 3 insertions(+)

diff --git a/lib/codecs/src/decoding/format/mod.rs b/lib/codecs/src/decoding/format/mod.rs
index 701d11c8403d5..cbb2172c3392d 100644
--- a/lib/codecs/src/decoding/format/mod.rs
+++ b/lib/codecs/src/decoding/format/mod.rs
@@ -50,6 +50,8 @@ pub trait Deserializer: DynClone + Send + Sync {
     /// by not requiring heap allocations for it.
     ///
     /// **Note**: The type of the produced events depends on the implementation.
+    ///
+    /// TODO: <https://github.com/vectordotdev/vector/issues/25044>
     fn parse(
         &self,
         bytes: Bytes,
diff --git a/lib/codecs/src/decoding/format/otlp.rs b/lib/codecs/src/decoding/format/otlp.rs
index 2004df92269ca..29b3477e4398f 100644
--- a/lib/codecs/src/decoding/format/otlp.rs
+++ b/lib/codecs/src/decoding/format/otlp.rs
@@ -181,6 +181,7 @@ impl Deserializer for OtlpDeserializer {
                     }
                 }
                 OtlpSignalType::Traces => {
+                    // TODO: <https://github.com/vectordotdev/vector/issues/25045>
                     if let Ok(mut events) =
                         self.traces_deserializer.parse(bytes.clone(), log_namespace)
                         && let Some(Event::Log(log)) = events.first()

From 4fba57e9c4d6561c126851df8c4065221b44e992 Mon Sep 17 00:00:00 2001
From: Oleksandr Zanichkovskyi <olexandr.zanichkovsky@zophiatech.com>
Date: Wed, 25 Mar 2026 23:51:02 +0100
Subject: [PATCH 056/326] feat(opentelemetry source): allow to add headers to
 metadata for OpenTelemetry metrics and traces (#24942)

* feat: allow to add headers to metadata for OpenTelemetry metrics and traces

* chore: code formatting

* chore: refactored the implementation and tests

* chore: added changelog

* chore: fixed formatting

* chore: updated docs

* make generate-docs

* feat: pass log_namespace when enriching metrics with header for use_otlp_decoding.metrics = true

* chore: removed log_namespace comment related to metrics and traces

* chore: fixed review comments

* update comment and regen docs

* chore: revert log_namespace threading in build_warp_trace_filter

The semantics of log_namespace for traces have not been defined yet.
The correct fix will be addressed in a dedicated follow-up branch.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore: revert log_namespace threading in build_warp_trace_filter

The semantics of log_namespace for traces have not been defined yet.
The correct fix will be addressed in a dedicated follow-up branch.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
---
 ...telemetry-header-enrichment.enhancement.md |   7 +
 src/sources/opentelemetry/config.rs           |   7 +-
 src/sources/opentelemetry/http.rs             |  25 +-
 src/sources/opentelemetry/tests.rs            | 288 +++++++++++++++++-
 src/sources/util/http/headers.rs              | 176 +++++++++--
 .../sources/generated/opentelemetry.cue       |   7 +-
 6 files changed, 463 insertions(+), 47 deletions(-)
 create mode 100644 changelog.d/24619-opentelemetry-header-enrichment.enhancement.md

diff --git a/changelog.d/24619-opentelemetry-header-enrichment.enhancement.md b/changelog.d/24619-opentelemetry-header-enrichment.enhancement.md
new file mode 100644
index 0000000000000..e0b0b33a5caa3
--- /dev/null
+++ b/changelog.d/24619-opentelemetry-header-enrichment.enhancement.md
@@ -0,0 +1,7 @@
+`opentelemetry` source: Implemented header enrichment for OTLP metrics and traces. Unlike logs, which support enriching
+the event itself or its metadata, depending on `log_namespace` settings, for metrics and traces this setting is ignored
+and header values are added to the event metadata.
+
+Issue: https://github.com/vectordotdev/vector/issues/24619
+
+authors: ozanichkovsky
diff --git a/src/sources/opentelemetry/config.rs b/src/sources/opentelemetry/config.rs
index c7eed8f301b50..89f6163da0595 100644
--- a/src/sources/opentelemetry/config.rs
+++ b/src/sources/opentelemetry/config.rs
@@ -202,13 +202,14 @@ pub struct HttpConfig {
     #[serde(default)]
     pub keepalive: KeepaliveConfig,
 
-    /// A list of HTTP headers to include in the log event.
+    /// A list of HTTP headers to include in the event.
     ///
     /// Accepts the wildcard (`*`) character for headers matching a specified pattern.
     ///
-    /// Specifying "*" results in all headers included in the log event.
+    /// Specifying "*" results in all headers included in the event.
     ///
-    /// These headers are not included in the JSON payload if a field with a conflicting name exists.
+    /// For log events in legacy namespace mode, headers are not included if a field with a conflicting name exists.
+    /// For metrics and traces, headers are always added to event metadata.
     #[serde(default)]
     #[configurable(metadata(docs::examples = "User-Agent"))]
     #[configurable(metadata(docs::examples = "X-My-Custom-Header"))]
diff --git a/src/sources/opentelemetry/http.rs b/src/sources/opentelemetry/http.rs
index f15e44bbd0926..42be681f1cb90 100644
--- a/src/sources/opentelemetry/http.rs
+++ b/src/sources/opentelemetry/http.rs
@@ -109,9 +109,11 @@ pub(crate) fn build_warp_filter(
     );
     let metrics_filters = build_warp_metrics_filter(
         acknowledgements,
+        log_namespace,
         out.clone(),
         bytes_received.clone(),
         events_received.clone(),
+        headers.clone(),
         metrics_deserializer,
     );
     let trace_filters = build_warp_trace_filter(
@@ -119,6 +121,7 @@ pub(crate) fn build_warp_filter(
         out.clone(),
         bytes_received,
         events_received,
+        headers.clone(),
         traces_deserializer,
     );
     log_filters
@@ -257,12 +260,14 @@ fn build_warp_log_filter(
 }
 fn build_warp_metrics_filter(
     acknowledgements: bool,
+    log_namespace: LogNamespace,
     source_sender: SourceSender,
     bytes_received: Registered<BytesReceived>,
     events_received: Registered<EventsReceived>,
+    headers_cfg: Vec<HttpConfigParamKind>,
     deserializer: Option<OtlpDeserializer>,
 ) -> BoxedFilter<(Response,)> {
-    let make_events = move |encoding_header: Option<String>, _headers: HeaderMap, body: Bytes| {
+    let make_events = move |encoding_header: Option<String>, headers: HeaderMap, body: Bytes| {
         decompress_body(encoding_header.as_deref(), body)
             .inspect_err(|err| {
                 // Other status codes are already handled by `sources::util::decompress_body` (tech debt).
@@ -276,15 +281,14 @@ fn build_warp_metrics_filter(
             .and_then(|decoded_body| {
                 bytes_received.emit(ByteSize(decoded_body.len()));
                 if let Some(d) = deserializer.as_ref() {
-                    parse_with_deserializer(
-                        d,
-                        decoded_body,
-                        LogNamespace::default(),
-                        &events_received,
-                    )
+                    parse_with_deserializer(d, decoded_body, log_namespace, &events_received)
                 } else {
                     decode_metrics_body(decoded_body, &events_received)
                 }
+                .map(|mut events| {
+                    enrich_events(&mut events, &headers_cfg, &headers, log_namespace);
+                    events
+                })
             })
     };
 
@@ -301,9 +305,10 @@ fn build_warp_trace_filter(
     source_sender: SourceSender,
     bytes_received: Registered<BytesReceived>,
     events_received: Registered<EventsReceived>,
+    headers_cfg: Vec<HttpConfigParamKind>,
     deserializer: Option<OtlpDeserializer>,
 ) -> BoxedFilter<(Response,)> {
-    let make_events = move |encoding_header: Option<String>, _headers: HeaderMap, body: Bytes| {
+    let make_events = move |encoding_header: Option<String>, headers: HeaderMap, body: Bytes| {
         decompress_body(encoding_header.as_deref(), body)
             .inspect_err(|err| {
                 // Other status codes are already handled by `sources::util::decompress_body` (tech debt).
@@ -326,6 +331,10 @@ fn build_warp_trace_filter(
                 } else {
                     decode_trace_body(decoded_body, &events_received)
                 }
+                .map(|mut events| {
+                    enrich_events(&mut events, &headers_cfg, &headers, LogNamespace::default());
+                    events
+                })
             })
     };
 
diff --git a/src/sources/opentelemetry/tests.rs b/src/sources/opentelemetry/tests.rs
index de5781756dba1..9fb0bac71a1cd 100644
--- a/src/sources/opentelemetry/tests.rs
+++ b/src/sources/opentelemetry/tests.rs
@@ -4,12 +4,31 @@ use std::{
     time::{SystemTime, UNIX_EPOCH},
 };
 
+use crate::{
+    SourceSender,
+    config::{OutputId, SourceConfig, SourceContext},
+    event::{
+        Event, EventStatus, LogEvent, Metric as MetricEvent, MetricKind, MetricTags, MetricValue,
+        ObjectMap, Value, into_event_stream,
+        metric::{Bucket, Quantile},
+    },
+    sources::opentelemetry::config::{
+        GrpcConfig, HttpConfig, LOGS, METRICS, OpentelemetryConfig, TRACES,
+    },
+    test_util::{
+        self,
+        addr::next_addr,
+        components::{SOURCE_TAGS, assert_source_compliance},
+    },
+};
 use chrono::{DateTime, TimeZone, Utc};
 use futures::Stream;
 use futures_util::StreamExt;
 use prost::Message;
 use similar_asserts::assert_eq;
 use tonic::Request;
+use vector_lib::opentelemetry::proto::collector::trace::v1::ExportTraceServiceRequest;
+use vector_lib::opentelemetry::proto::trace::v1::{ResourceSpans, ScopeSpans, Span};
 use vector_lib::{
     config::LogNamespace,
     lookup::path,
@@ -33,22 +52,6 @@ use vector_lib::{
 };
 use vrl::value;
 
-use crate::{
-    SourceSender,
-    config::{OutputId, SourceConfig, SourceContext},
-    event::{
-        Event, EventStatus, LogEvent, Metric as MetricEvent, MetricKind, MetricTags, MetricValue,
-        ObjectMap, Value, into_event_stream,
-        metric::{Bucket, Quantile},
-    },
-    sources::opentelemetry::config::{GrpcConfig, HttpConfig, LOGS, METRICS, OpentelemetryConfig},
-    test_util::{
-        self,
-        addr::next_addr,
-        components::{SOURCE_TAGS, assert_source_compliance},
-    },
-};
-
 fn create_test_logs_request() -> Request<ExportLogsServiceRequest> {
     Request::new(ExportLogsServiceRequest {
         resource_logs: vec![ResourceLogs {
@@ -100,6 +103,104 @@ fn create_test_logs_request() -> Request<ExportLogsServiceRequest> {
     })
 }
 
+fn create_test_metrics_request() -> ExportMetricsServiceRequest {
+    ExportMetricsServiceRequest {
+        resource_metrics: vec![ResourceMetrics {
+            resource: Some(Resource {
+                attributes: vec![KeyValue {
+                    key: "service.name".to_string(),
+                    value: Some(AnyValue {
+                        value: Some(StringValue("vector-collector".to_string())),
+                    }),
+                }],
+                dropped_attributes_count: 0,
+            }),
+            schema_url: "".to_string(),
+            scope_metrics: vec![ScopeMetrics {
+                scope: Some(InstrumentationScope {
+                    name: "vector-collector-instrumentation".to_string(),
+                    version: "0.111.0".to_string(),
+                    attributes: vec![],
+                    dropped_attributes_count: 0,
+                }),
+                schema_url: "".to_string(),
+                metrics: vec![Metric {
+                    name: "some.random.metric".to_string(),
+                    description: "Some random metric we use for test".to_string(),
+                    unit: "1".to_string(),
+                    data: Some(Data::Summary(Summary {
+                        data_points: vec![SummaryDataPoint {
+                            attributes: vec![
+                                KeyValue {
+                                    key: "host".to_string(),
+                                    value: Some(AnyValue {
+                                        value: Some(StringValue("localhost".to_string())),
+                                    }),
+                                },
+                                KeyValue {
+                                    key: "service".to_string(),
+                                    value: Some(AnyValue {
+                                        value: Some(StringValue("vector-collector".to_string())),
+                                    }),
+                                },
+                            ],
+                            start_time_unix_nano: 0,
+                            time_unix_nano: 0,
+                            count: 5,
+                            sum: 122.5,
+                            quantile_values: vec![
+                                ValueAtQuantile {
+                                    quantile: 0.5,
+                                    value: 24.5,
+                                },
+                                ValueAtQuantile {
+                                    quantile: 0.9,
+                                    value: 45.0,
+                                },
+                                ValueAtQuantile {
+                                    quantile: 1.0,
+                                    value: 60.0,
+                                },
+                            ],
+                            flags: 0,
+                        }],
+                    })),
+                }],
+            }],
+        }],
+    }
+}
+
+fn create_test_traces_request() -> ExportTraceServiceRequest {
+    ExportTraceServiceRequest {
+        resource_spans: vec![ResourceSpans {
+            resource: None,
+            scope_spans: vec![ScopeSpans {
+                scope: None,
+                spans: vec![Span {
+                    trace_id: (1..17).collect::<Vec<u8>>(),
+                    span_id: (1..9).collect::<Vec<u8>>(),
+                    parent_span_id: (1..9).collect::<Vec<u8>>(),
+                    name: "span".to_string(),
+                    kind: 1,
+                    start_time_unix_nano: 1713525203000000000,
+                    end_time_unix_nano: 1713525205000000000,
+                    attributes: vec![],
+                    dropped_attributes_count: 0,
+                    events: vec![],
+                    dropped_events_count: 0,
+                    links: vec![],
+                    dropped_links_count: 0,
+                    status: None,
+                    trace_state: "".to_string(),
+                }],
+                schema_url: "".to_string(),
+            }],
+            schema_url: "".to_string(),
+        }],
+    }
+}
+
 #[test]
 fn generate_config() {
     test_util::test_generate_config::<OpentelemetryConfig>();
@@ -1091,6 +1192,39 @@ fn get_source_config_with_headers(
     }
 }
 
+async fn send_and_collect_otel_event(
+    use_otlp_decoding: bool,
+    output_port: &str,
+    endpoint: &str,
+    body: Vec<u8>,
+) -> Event {
+    let (_guard_0, grpc_addr) = next_addr();
+    let (_guard_1, http_addr) = next_addr();
+
+    let source = get_source_config_with_headers(grpc_addr, http_addr, use_otlp_decoding);
+
+    let (sender, output, _) = new_source(EventStatus::Delivered, output_port.to_string());
+    let server = source
+        .build(SourceContext::new_test(sender, None))
+        .await
+        .unwrap();
+    tokio::spawn(server);
+    test_util::wait_for_tcp(http_addr).await;
+
+    let _res = reqwest::Client::new()
+        .post(format!("http://{http_addr}/{endpoint}"))
+        .header("Content-Type", "application/x-protobuf")
+        .header("User-Agent", "Test")
+        .body(body)
+        .send()
+        .await
+        .expect("Failed to send request to OpenTelemetry source.");
+
+    let mut events = test_util::collect_ready(output).await;
+    assert_eq!(events.len(), 1);
+    events.pop().unwrap()
+}
+
 #[tokio::test]
 async fn http_headers_logs_use_otlp_decoding_false() {
     assert_source_compliance(&SOURCE_TAGS, async {
@@ -1237,6 +1371,128 @@ async fn http_headers_logs_use_otlp_decoding_true() {
     .await;
 }
 
+#[tokio::test]
+async fn http_headers_metrics_use_otlp_decoding_false() {
+    assert_source_compliance(&SOURCE_TAGS, async {
+        let event = send_and_collect_otel_event(
+            false,
+            METRICS,
+            "v1/metrics",
+            create_test_metrics_request().encode_to_vec(),
+        )
+        .await;
+        let metric = event.as_metric();
+        assert_eq!(
+            metric
+                .metadata()
+                .value()
+                .get(path!("opentelemetry", "headers"))
+                .unwrap()
+                .get("AbsentHeader")
+                .unwrap(),
+            &Value::Null
+        );
+        assert_eq!(
+            metric
+                .metadata()
+                .value()
+                .get(path!("opentelemetry", "headers"))
+                .unwrap()
+                .get("User-Agent")
+                .unwrap(),
+            &value!("Test")
+        );
+    })
+    .await;
+}
+
+#[tokio::test]
+async fn http_headers_metrics_use_otlp_decoding_true() {
+    assert_source_compliance(&SOURCE_TAGS, async {
+        let event = send_and_collect_otel_event(
+            true,
+            METRICS,
+            "v1/metrics",
+            create_test_metrics_request().encode_to_vec(),
+        )
+        .await;
+        let log = event.as_log();
+        assert_eq!(log["AbsentHeader"], Value::Null);
+        assert_eq!(log["User-Agent"], "Test".into());
+    })
+    .await;
+}
+
+#[tokio::test]
+async fn http_headers_traces_use_otlp_decoding_false() {
+    assert_source_compliance(&SOURCE_TAGS, async {
+        let event = send_and_collect_otel_event(
+            false,
+            TRACES,
+            "v1/traces",
+            create_test_traces_request().encode_to_vec(),
+        )
+        .await;
+        let trace = event.as_trace();
+        assert_eq!(
+            trace
+                .metadata()
+                .value()
+                .get(path!("opentelemetry", "headers"))
+                .unwrap()
+                .get("AbsentHeader")
+                .unwrap(),
+            &Value::Null
+        );
+        assert_eq!(
+            trace
+                .metadata()
+                .value()
+                .get(path!("opentelemetry", "headers"))
+                .unwrap()
+                .get("User-Agent")
+                .unwrap(),
+            &value!("Test")
+        );
+    })
+    .await;
+}
+
+#[tokio::test]
+async fn http_headers_traces_use_otlp_decoding_true() {
+    assert_source_compliance(&SOURCE_TAGS, async {
+        let event = send_and_collect_otel_event(
+            true,
+            TRACES,
+            "v1/traces",
+            create_test_traces_request().encode_to_vec(),
+        )
+        .await;
+        let trace = event.as_trace();
+        assert_eq!(
+            trace
+                .metadata()
+                .value()
+                .get(path!("opentelemetry", "headers"))
+                .unwrap()
+                .get("AbsentHeader")
+                .unwrap(),
+            &Value::Null
+        );
+        assert_eq!(
+            trace
+                .metadata()
+                .value()
+                .get(path!("opentelemetry", "headers"))
+                .unwrap()
+                .get("User-Agent")
+                .unwrap(),
+            &value!("Test")
+        );
+    })
+    .await;
+}
+
 pub struct OTelTestEnv {
     pub grpc_addr: String,
     pub config: OpentelemetryConfig,
diff --git a/src/sources/util/http/headers.rs b/src/sources/util/http/headers.rs
index 8a4b73ff212df..ef8376f695723 100644
--- a/src/sources/util/http/headers.rs
+++ b/src/sources/util/http/headers.rs
@@ -24,14 +24,22 @@ pub fn add_headers(
                 let value = headers.get(header_name).map(HeaderValue::as_bytes);
 
                 for event in events.iter_mut() {
-                    if let Event::Log(log) = event {
-                        log_namespace.insert_source_metadata(
-                            source_name,
-                            log,
-                            Some(LegacyKey::InsertIfEmpty(path!(header_name))),
-                            path!("headers", header_name),
-                            Value::from(value.map(Bytes::copy_from_slice)),
-                        );
+                    match event {
+                        Event::Log(log) => {
+                            log_namespace.insert_source_metadata(
+                                source_name,
+                                log,
+                                Some(LegacyKey::InsertIfEmpty(path!(header_name))),
+                                path!("headers", header_name),
+                                Value::from(value.map(Bytes::copy_from_slice)),
+                            );
+                        }
+                        Event::Metric(_) | Event::Trace(_) => {
+                            event.metadata_mut().value_mut().insert(
+                                path!(source_name, "headers", header_name),
+                                Value::from(value.map(Bytes::copy_from_slice)),
+                            );
+                        }
                     }
                 }
             }
@@ -45,14 +53,22 @@ pub fn add_headers(
                         let value = headers.get(header_name).map(HeaderValue::as_bytes);
 
                         for event in events.iter_mut() {
-                            if let Event::Log(log) = event {
-                                log_namespace.insert_source_metadata(
-                                    source_name,
-                                    log,
-                                    Some(LegacyKey::InsertIfEmpty(path!(header_name.as_str()))),
-                                    path!("headers", header_name.as_str()),
-                                    Value::from(value.map(Bytes::copy_from_slice)),
-                                );
+                            match event {
+                                Event::Log(log) => {
+                                    log_namespace.insert_source_metadata(
+                                        source_name,
+                                        log,
+                                        Some(LegacyKey::InsertIfEmpty(path!(header_name.as_str()))),
+                                        path!("headers", header_name.as_str()),
+                                        Value::from(value.map(Bytes::copy_from_slice)),
+                                    );
+                                }
+                                Event::Metric(_) | Event::Trace(_) => {
+                                    event.metadata_mut().value_mut().insert(
+                                        path!(source_name, "headers", header_name.as_str()),
+                                        Value::from(value.map(Bytes::copy_from_slice)),
+                                    );
+                                }
                             }
                         }
                     }
@@ -64,12 +80,15 @@ pub fn add_headers(
 
 #[cfg(test)]
 mod tests {
+    use chrono::{DateTime, Utc};
+    use std::time::SystemTime;
     use vector_lib::config::LogNamespace;
     use vrl::{path, value};
     use warp::http::HeaderMap;
 
+    use crate::event::{Event, MetricKind, MetricTags, MetricValue};
     use crate::{
-        event::LogEvent,
+        event::{LogEvent, Metric, TraceEvent},
         sources::{http_server::HttpConfigParamKind, util::add_headers},
     };
 
@@ -109,6 +128,53 @@ mod tests {
                 .get(path!("test", "headers"))
                 .unwrap()
         );
+
+        let mut metric = [Event::from(
+            Metric::new(
+                "some.random.metric",
+                MetricKind::Incremental,
+                MetricValue::Counter { value: 123.4 },
+            )
+            .with_timestamp(Some(DateTime::<Utc>::from(SystemTime::now())))
+            .with_tags(Some(MetricTags::default())),
+        )];
+
+        add_headers(
+            &mut metric,
+            &header_names,
+            &headers,
+            LogNamespace::default(),
+            "test",
+        );
+
+        let mut trace = [TraceEvent::from(btreemap! {
+            "span_id" => "abc123",
+            "trace_id" => "xyz789",
+            "span_name" => "test-span",
+            "service" => "my-service",
+        })
+        .into()];
+
+        add_headers(
+            &mut trace,
+            &header_names,
+            &headers,
+            LogNamespace::default(),
+            "test",
+        );
+
+        assert_eq!(
+            metric[0]
+                .metadata()
+                .value()
+                .get(path!("test", "headers"))
+                .unwrap(),
+            trace[0]
+                .metadata()
+                .value()
+                .get(path!("test", "headers"))
+                .unwrap()
+        );
     }
 
     #[test]
@@ -162,5 +228,81 @@ mod tests {
             "gzip".into(),
             "Checking log contains Content-Encoding header"
         );
+
+        let mut metric = [Event::from(
+            Metric::new(
+                "some.random.metric",
+                MetricKind::Incremental,
+                MetricValue::Counter { value: 123.4 },
+            )
+            .with_timestamp(Some(DateTime::<Utc>::from(SystemTime::now())))
+            .with_tags(Some(MetricTags::default())),
+        )];
+
+        add_headers(
+            &mut metric,
+            &header_names,
+            &headers,
+            LogNamespace::default(),
+            "test",
+        );
+
+        let metric_headers = metric[0]
+            .metadata()
+            .value()
+            .get(path!("test", "headers"))
+            .unwrap();
+
+        assert_eq!(
+            metric_headers.get("content-type").unwrap(),
+            &value!("application/x-protobuf"),
+            "Checking metric contains Content-Type header"
+        );
+        assert!(
+            !metric_headers.contains("user-agent"),
+            "Checking metric does not contain User-Agent header"
+        );
+        assert_eq!(
+            metric_headers.get("content-encoding").unwrap(),
+            &value!("gzip"),
+            "Checking metric contains Content-Encoding header"
+        );
+
+        let mut trace = [TraceEvent::from(btreemap! {
+            "span_id" => "abc123",
+            "trace_id" => "xyz789",
+            "span_name" => "test-span",
+            "service" => "my-service",
+        })
+        .into()];
+
+        add_headers(
+            &mut trace,
+            &header_names,
+            &headers,
+            LogNamespace::default(),
+            "test",
+        );
+
+        let trace_headers = trace[0]
+            .metadata()
+            .value()
+            .get(path!("test", "headers"))
+            .unwrap();
+
+        assert_eq!(
+            trace_headers.get("content-type").unwrap(),
+            &value!("application/x-protobuf"),
+            "Checking trace contains Content-Type header"
+        );
+        assert!(
+            !trace_headers.contains("user-agent"),
+            "Checking trace does not contain User-Agent header"
+        );
+        assert_eq!(
+            trace_headers.get("content-encoding").unwrap(),
+            &value!("gzip"),
+            "Checking trace contains Content-Encoding header"
+        );
     }
 }
diff --git a/website/cue/reference/components/sources/generated/opentelemetry.cue b/website/cue/reference/components/sources/generated/opentelemetry.cue
index d3b498506a323..ca4150550c771 100644
--- a/website/cue/reference/components/sources/generated/opentelemetry.cue
+++ b/website/cue/reference/components/sources/generated/opentelemetry.cue
@@ -170,13 +170,14 @@ generated: components: sources: opentelemetry: configuration: {
 				}
 				headers: {
 					description: """
-						A list of HTTP headers to include in the log event.
+						A list of HTTP headers to include in the event.
 
 						Accepts the wildcard (`*`) character for headers matching a specified pattern.
 
-						Specifying "*" results in all headers included in the log event.
+						Specifying "*" results in all headers included in the event.
 
-						These headers are not included in the JSON payload if a field with a conflicting name exists.
+						For log events in legacy namespace mode, headers are not included if a field with a conflicting name exists.
+						For metrics and traces, headers are always added to event metadata.
 						"""
 					required: false
 					type: array: {

From 498d1daa38432a329d168a2eec97a212922e71bc Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 25 Mar 2026 20:51:47 -0400
Subject: [PATCH 057/326] chore(ci): improve CLA instructions (#25039)

* chore(cla): improve bot message with copy-pastable sign instruction

Add a clearer `custom-notsigned-prcomment` that includes the sign phrase
in a code block (one-click copy in GitHub UI) and a note for contributors
whose commit email is not linked to their GitHub account.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* repurpose

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/cla.yml | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 2f48f1f1d1edf..536e364a402b9 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -14,9 +14,9 @@ jobs:
   CLAAssistant:
     runs-on: ubuntu-latest
     permissions:
-      pull-requests: write   # Required to comment on PRs
-      id-token: write        # Required to federate tokens with dd-octo-sts-action
-      actions: write         # Required to create/update workflow runs
+      pull-requests: write # Required to comment on PRs
+      id-token: write # Required to federate tokens with dd-octo-sts-action
+      actions: write # Required to create/update workflow runs
     steps:
       - name: CLA already verified on PR
         if: github.event_name == 'merge_group'
@@ -36,17 +36,16 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PERSONAL_ACCESS_TOKEN: ${{ steps.octo-sts.outputs.token }}
         with:
-          path-to-signatures: 'cla.json'
-          path-to-document: 'https://gist.github.com/bits-bot/55bdc97a4fdad52d97feb4d6c3d1d618' # e.g. a CLA or a DCO document
-          branch: 'vector'
+          path-to-signatures: "cla.json"
+          path-to-document: "https://gist.github.com/bits-bot/55bdc97a4fdad52d97feb4d6c3d1d618" # e.g. a CLA or a DCO document
+          branch: "vector"
           remote-repository-name: cla-signatures
           remote-organization-name: DataDog
           allowlist: step-security-bot
 
-         # the followings are the optional inputs - If the optional inputs are not given, then default values will be taken
-          #create-file-commit-message: 'For example: Creating file for storing CLA Signatures'
-          #signed-commit-message: 'For example: $contributorName has signed the CLA in $owner/$repo#$pullRequestNo'
-          #custom-notsigned-prcomment: 'pull request comment with Introductory message to ask new contributors to sign'
-          #custom-pr-sign-comment: 'The signature to be committed in order to sign the CLA'
-          #custom-allsigned-prcomment: 'pull request comment when all contributors has signed, defaults to **CLA Assistant Lite bot** All Contributors have signed the CLA.'
-          #lock-pullrequest-aftermerge: false - if you don't want this bot to automatically lock the pull request after merging (default - true)
+          custom-notsigned-prcomment: |
+            Thank you for your contribution! Before we can merge this PR, please sign our [Contributor License Agreement](https://gist.github.com/bits-bot/55bdc97a4fdad52d97feb4d6c3d1d618).
+
+            To sign, copy and post the phrase below as a new comment on this PR.
+
+            > **Note:** If the bot says your username was not found, the email used in your git commit may not be linked to your GitHub account. Fix this at [github.com/settings/emails](https://github.com/settings/emails), then comment `recheck` to retry.

From bc1e6bdde6b07f51efd4764c65d75c32d056499c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 15:10:51 +0000
Subject: [PATCH 058/326] chore(deps): bump uuid from 1.18.1 to 1.22.0 (#25025)

* chore(deps): bump uuid from 1.18.1 to 1.22.0

Bumps [uuid](https://github.com/uuid-rs/uuid) from 1.18.1 to 1.22.0.
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](https://github.com/uuid-rs/uuid/compare/v1.18.1...v1.22.0)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 1.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update licenses

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock           | 49 +++++++++++++++++++++++++++++++-------------
 Cargo.toml           |  2 +-
 LICENSE-3rdparty.csv |  1 +
 3 files changed, 37 insertions(+), 15 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c5efc9802ce97..4a6ddc9d8b9e6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -32,7 +32,7 @@ checksum = "ac1f845298e95f983ff1944b728ae08b8cebab80d684f0a832ed0fc74dfa27e2"
 dependencies = [
  "cfg-if",
  "cipher",
- "cpufeatures",
+ "cpufeatures 0.2.11",
 ]
 
 [[package]]
@@ -2215,7 +2215,18 @@ checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
 dependencies = [
  "cfg-if",
  "cipher",
- "cpufeatures",
+ "cpufeatures 0.2.11",
+]
+
+[[package]]
+name = "chacha20"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.0",
 ]
 
 [[package]]
@@ -2225,7 +2236,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
 dependencies = [
  "aead",
- "chacha20",
+ "chacha20 0.9.1",
  "cipher",
  "poly1305",
  "zeroize",
@@ -2768,6 +2779,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc"
 version = "3.3.0"
@@ -3019,7 +3039,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.11",
  "curve25519-dalek-derive",
  "digest",
  "fiat-crypto",
@@ -5797,7 +5817,7 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
 dependencies = [
- "cpufeatures",
+ "cpufeatures 0.2.11",
 ]
 
 [[package]]
@@ -7815,7 +7835,7 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
 dependencies = [
- "cpufeatures",
+ "cpufeatures 0.2.11",
  "opaque-debug",
  "universal-hash",
 ]
@@ -8592,6 +8612,7 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
 dependencies = [
+ "chacha20 0.10.0",
  "getrandom 0.4.2",
  "rand_core 0.10.0",
 ]
@@ -9954,7 +9975,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f5058ada175748e33390e40e872bd0fe59a19f265d0158daa551c5a88a76009c"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.11",
  "digest",
 ]
 
@@ -9965,7 +9986,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.11",
  "digest",
 ]
 
@@ -9976,7 +9997,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.11",
  "digest",
 ]
 
@@ -12092,14 +12113,14 @@ checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
 
 [[package]]
 name = "uuid"
-version = "1.18.1"
+version = "1.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2"
+checksum = "a68d3c8f01c0cfa54a75291d83601161799e4a89a39e0929f4b0354d88757a37"
 dependencies = [
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "js-sys",
- "rand 0.9.2",
- "serde",
+ "rand 0.10.0",
+ "serde_core",
  "wasm-bindgen",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 06b83efedb33e..5dc1dda8072da 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -204,7 +204,7 @@ tonic-reflection = { version = "0.11", default-features = false, features = ["se
 tracing = { version = "0.1.44", default-features = false }
 tracing-subscriber = { version = "0.3.22", default-features = false, features = ["fmt"]  }
 url = { version = "2.5.4", default-features = false, features = ["serde"] }
-uuid = { version = "1.18.1", features = ["v4", "v7", "serde", "fast-rng"] }
+uuid = { version = "1.22.0", features = ["v4", "v7", "serde", "fast-rng"] }
 vector-config = { path = "lib/vector-config" }
 vector-config-common = { path = "lib/vector-config-common" }
 vector-config-macros = { path = "lib/vector-config-macros" }
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 8a5759685500e..8dbc10abc4f7e 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -144,6 +144,7 @@ cesu8,https://github.com/emk/cesu8-rs,Apache-2.0 OR MIT,Eric Kidd <git@randomhac
 cfb-mode,https://github.com/RustCrypto/block-modes,MIT OR Apache-2.0,RustCrypto Developers
 cfg-if,https://github.com/rust-lang/cfg-if,MIT OR Apache-2.0,Alex Crichton <alex@alexcrichton.com>
 chacha20,https://github.com/RustCrypto/stream-ciphers,Apache-2.0 OR MIT,RustCrypto Developers
+chacha20,https://github.com/RustCrypto/stream-ciphers,MIT OR Apache-2.0,RustCrypto Developers
 chacha20poly1305,https://github.com/RustCrypto/AEADs/tree/master/chacha20poly1305,Apache-2.0 OR MIT,RustCrypto Developers
 charset,https://github.com/hsivonen/charset,MIT OR Apache-2.0,Henri Sivonen <hsivonen@hsivonen.fi>
 chrono,https://github.com/chronotope/chrono,MIT OR Apache-2.0,The chrono Authors

From 072f6284c83279cd920177b32114f10f8fd5164c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 15:15:29 +0000
Subject: [PATCH 059/326] chore(deps): bump snafu from 0.8.9 to 0.9.0 (#25029)

Bumps [snafu](https://github.com/shepmaster/snafu) from 0.8.9 to 0.9.0.
- [Changelog](https://github.com/shepmaster/snafu/blob/main/CHANGELOG.md)
- [Commits](https://github.com/shepmaster/snafu/compare/0.8.9...0.9.0)

---
updated-dependencies:
- dependency-name: snafu
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock | 45 +++++++++++++++++++++++++++++++++------------
 Cargo.toml |  2 +-
 2 files changed, 34 insertions(+), 13 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 4a6ddc9d8b9e6..05055530add86 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2455,7 +2455,7 @@ dependencies = [
  "serde_with",
  "similar-asserts",
  "smallvec",
- "snafu 0.8.9",
+ "snafu 0.9.0",
  "strum 0.28.0",
  "syslog_loose 0.23.0",
  "tokio",
@@ -3435,7 +3435,7 @@ dependencies = [
  "criterion",
  "data-encoding",
  "hickory-proto 0.25.2",
- "snafu 0.8.9",
+ "snafu 0.9.0",
 ]
 
 [[package]]
@@ -3452,7 +3452,7 @@ dependencies = [
  "pastey",
  "prost 0.12.6",
  "prost-build 0.12.6",
- "snafu 0.8.9",
+ "snafu 0.9.0",
  "tracing 0.1.44",
  "vector-common",
  "vector-config",
@@ -3474,7 +3474,7 @@ dependencies = [
  "anyhow",
  "serde",
  "serde_json",
- "snafu 0.8.9",
+ "snafu 0.9.0",
  "tracing 0.1.44",
  "vector-config",
  "vector-config-common",
@@ -3681,7 +3681,7 @@ dependencies = [
  "const-str",
  "dyn-clone",
  "indoc",
- "snafu 0.8.9",
+ "snafu 0.9.0",
  "vector-vrl-category",
  "vrl",
 ]
@@ -8096,7 +8096,7 @@ dependencies = [
  "prost 0.12.6",
  "prost-build 0.12.6",
  "prost-types 0.12.6",
- "snafu 0.8.9",
+ "snafu 0.9.0",
  "vector-common",
 ]
 
@@ -10210,10 +10210,19 @@ name = "snafu"
 version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e84b3f4eacbf3a1ce05eac6763b4d629d60cbc94d632e4092c54ade71f1e1a2"
+dependencies = [
+ "snafu-derive 0.8.9",
+]
+
+[[package]]
+name = "snafu"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1d4bced6a69f90b2056c03dcff2c4737f98d6fb9e0853493996e1d253ca29c6"
 dependencies = [
  "futures-core",
  "pin-project",
- "snafu-derive 0.8.9",
+ "snafu-derive 0.9.0",
 ]
 
 [[package]]
@@ -10240,6 +10249,18 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "snafu-derive"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54254b8531cafa275c5e096f62d48c81435d1015405a91198ddb11e967301d40"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2 1.0.106",
+ "quote 1.0.44",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "snap"
 version = "1.1.1"
@@ -12342,7 +12363,7 @@ dependencies = [
  "similar-asserts",
  "smallvec",
  "smpl_jwt",
- "snafu 0.8.9",
+ "snafu 0.9.0",
  "snap",
  "socket2 0.5.10",
  "sqlx",
@@ -12402,7 +12423,7 @@ dependencies = [
  "prost 0.12.6",
  "prost-build 0.12.6",
  "prost-types 0.12.6",
- "snafu 0.8.9",
+ "snafu 0.9.0",
  "tokio",
  "tokio-stream",
  "tonic 0.11.0",
@@ -12441,7 +12462,7 @@ dependencies = [
  "rkyv",
  "serde",
  "serde_yaml",
- "snafu 0.8.9",
+ "snafu 0.9.0",
  "temp-dir",
  "tokio",
  "tokio-test",
@@ -12504,7 +12525,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_with",
- "snafu 0.8.9",
+ "snafu 0.9.0",
  "toml",
  "tracing 0.1.44",
  "url",
@@ -12598,7 +12619,7 @@ dependencies = [
  "serde_yaml",
  "similar-asserts",
  "smallvec",
- "snafu 0.8.9",
+ "snafu 0.9.0",
  "socket2 0.5.10",
  "tokio",
  "tokio-openssl",
diff --git a/Cargo.toml b/Cargo.toml
index 5dc1dda8072da..42e2b2c24a12f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -189,7 +189,7 @@ semver = { version = "1.0.27", default-features = false, features = ["serde", "s
 serde = { version = "1.0.219", default-features = false, features = ["alloc", "derive", "rc"] }
 serde_json = { version = "1.0.143", default-features = false, features = ["preserve_order", "raw_value", "std"] }
 serde_yaml = { version = "0.9.34", default-features = false }
-snafu = { version = "0.8.9", default-features = false, features = ["futures", "std"] }
+snafu = { version = "0.9.0", default-features = false, features = ["futures", "std"] }
 socket2 = { version = "0.5.10", default-features = false }
 tempfile = "3.23.0"
 tokio = { version = "1.49.0", default-features = false }

From 041769359ba0a9d68017e10e6e84cb7a83b3df27 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 15:22:32 +0000
Subject: [PATCH 060/326] chore(website deps): bump picomatch from 2.3.1 to
 2.3.2 in /website (#25047)

Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 website/yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/website/yarn.lock b/website/yarn.lock
index 57cd6d50741c0..95702b3c49289 100644
--- a/website/yarn.lock
+++ b/website/yarn.lock
@@ -3055,9 +3055,9 @@ picocolors@^1.0.0, picocolors@^1.1.1:
   integrity sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==
 
 picomatch@^2.0.4, picomatch@^2.2.1, picomatch@^2.3.1:
-  version "2.3.1"
-  resolved "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz"
-  integrity sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==
+  version "2.3.2"
+  resolved "https://registry.yarnpkg.com/picomatch/-/picomatch-2.3.2.tgz#5a942915e26b372dc0f0e6753149a16e6b1c5601"
+  integrity sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==
 
 pify@^2.3.0:
   version "2.3.0"

From d0c6cea89661577079d3eec790e4c054772de7d6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 15:25:49 +0000
Subject: [PATCH 061/326] chore(website deps): bump yaml from 1.10.2 to 1.10.3
 in /website (#25043)

Bumps [yaml](https://github.com/eemeli/yaml) from 1.10.2 to 1.10.3.
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](https://github.com/eemeli/yaml/compare/v1.10.2...v1.10.3)

---
updated-dependencies:
- dependency-name: yaml
  dependency-version: 1.10.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 website/yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/website/yarn.lock b/website/yarn.lock
index 95702b3c49289..f7cedc6f6748f 100644
--- a/website/yarn.lock
+++ b/website/yarn.lock
@@ -3876,9 +3876,9 @@ yallist@^3.0.2:
   integrity sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==
 
 yaml@^1.10.0, yaml@^1.10.2:
-  version "1.10.2"
-  resolved "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz"
-  integrity sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==
+  version "1.10.3"
+  resolved "https://registry.yarnpkg.com/yaml/-/yaml-1.10.3.tgz#76e407ed95c42684fb8e14641e5de62fe65bbcb3"
+  integrity sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==
 
 yargs-parser@^20.2.2:
   version "20.2.9"

From 5fcf1516151f659b5832fc433a4e10a219e31c7b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 15:26:25 +0000
Subject: [PATCH 062/326] chore(deps): bump ipnet from 2.11.0 to 2.12.0
 (#25030)

Bumps [ipnet](https://github.com/krisprice/ipnet) from 2.11.0 to 2.12.0.
- [Release notes](https://github.com/krisprice/ipnet/releases)
- [Changelog](https://github.com/krisprice/ipnet/blob/master/RELEASES.md)
- [Commits](https://github.com/krisprice/ipnet/compare/2.11.0...2.12.0)

---
updated-dependencies:
- dependency-name: ipnet
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 05055530add86..76f557baf7a8a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5542,9 +5542,9 @@ dependencies = [
 
 [[package]]
 name = "ipnet"
-version = "2.11.0"
+version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 dependencies = [
  "serde",
 ]

From 09629f02d60614a38b20b49cb10acbce47a9f6cc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 15:49:33 +0000
Subject: [PATCH 063/326] chore(ci): bump docker/setup-buildx-action from
 3.12.0 to 4.0.0 (#25003)

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.12.0 to 4.0.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/environment.yml | 2 +-
 .github/workflows/publish.yml     | 2 +-
 .github/workflows/regression.yml  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/environment.yml b/.github/workflows/environment.yml
index fce6b25c3c181..75680427712a5 100644
--- a/.github/workflows/environment.yml
+++ b/.github/workflows/environment.yml
@@ -43,7 +43,7 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
       - name: Login to DockerHub
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         if: env.SHOULD_PUBLISH == 'true'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3c533c593aeb6..9b5385a38b39f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -347,7 +347,7 @@ jobs:
           platforms: all
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
         with:
           version: latest
       - name: Download all Linux package artifacts
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index a8c6981e53a9d..75a84c0fc1afe 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -209,7 +209,7 @@ jobs:
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build 'vector' target image
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
@@ -252,7 +252,7 @@ jobs:
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build 'vector' target image
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2

From 3255b66b2e8a2fb7ec3412904b856a8349a236ab Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 15:49:57 +0000
Subject: [PATCH 064/326] chore(ci): bump actions/cache from 5.0.3 to 5.0.4
 (#25002)

Bumps [actions/cache](https://github.com/actions/cache) from 5.0.3 to 5.0.4.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/cdf6c1fa76f9f475f3d7449005a359c84ca0f306...668228422ae6a00e4ad889ee87cd7109ec5666a7)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/cross.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/cross.yml b/.github/workflows/cross.yml
index 8cf8706b1a42c..9519a7d79df94 100644
--- a/.github/workflows/cross.yml
+++ b/.github/workflows/cross.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           ref: ${{ inputs.ref }}
 
-      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         name: Cache Cargo registry + index
         with:
           path: |

From 9337c80bb9d2491a8d617df408c20a88385d719a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 15:50:14 +0000
Subject: [PATCH 065/326] chore(ci): bump docker/login-action from 3.7.0 to
 4.0.0 (#25001)

Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.0.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...b45d80f862d83dbcd57f89517bcf500b2ab88fb2)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build-test-runner.yml | 2 +-
 .github/workflows/environment.yml       | 2 +-
 .github/workflows/publish.yml           | 4 ++--
 .github/workflows/regression.yml        | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build-test-runner.yml b/.github/workflows/build-test-runner.yml
index 50a46fd4bd30f..7a7596651ed2c 100644
--- a/.github/workflows/build-test-runner.yml
+++ b/.github/workflows/build-test-runner.yml
@@ -36,7 +36,7 @@ jobs:
           vdev: true
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/environment.yml b/.github/workflows/environment.yml
index 75680427712a5..cf6313e4ce894 100644
--- a/.github/workflows/environment.yml
+++ b/.github/workflows/environment.yml
@@ -45,7 +45,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
       - name: Login to DockerHub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         if: env.SHOULD_PUBLISH == 'true'
         with:
           username: ${{ secrets.CI_DOCKER_USERNAME }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9b5385a38b39f..0594151b2db23 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -331,12 +331,12 @@ jobs:
         with:
           ref: ${{ inputs.git_ref }}
       - name: Login to DockerHub
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           username: ${{ secrets.CI_DOCKER_USERNAME }}
           password: ${{ secrets.CI_DOCKER_PASSWORD }}
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 75a84c0fc1afe..f2216df39e684 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -326,7 +326,7 @@ jobs:
         uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
 
       - name: Docker Login to ECR
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ${{ steps.login-ecr.outputs.registry }}
 
@@ -366,7 +366,7 @@ jobs:
         uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
 
       - name: Docker Login to ECR
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ${{ steps.login-ecr.outputs.registry }}
 

From 84abc68df859d58b2a7681757e52aca7a8094ad2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 20:24:22 +0000
Subject: [PATCH 066/326] chore(deps): bump bollard from 0.19.2 to 0.20.2
 (#25026)

* chore(deps): bump bollard from 0.19.2 to 0.20.2

Bumps [bollard](https://github.com/fussybeaver/bollard) from 0.19.2 to 0.20.2.
- [Release notes](https://github.com/fussybeaver/bollard/releases)
- [Changelog](https://github.com/fussybeaver/bollard/blob/master/RELEASE.md)
- [Commits](https://github.com/fussybeaver/bollard/compare/v0.19.2...v0.20.2)

---
updated-dependencies:
- dependency-name: bollard
  dependency-version: 0.20.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump bollard in Cargo.toml

* Fix incompatible changes

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock                       | 11 ++++-------
 Cargo.toml                       |  2 +-
 src/docker.rs                    |  5 ++---
 src/sources/docker_logs/tests.rs |  4 ++--
 4 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 76f557baf7a8a..be47e7ba18697 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1882,9 +1882,9 @@ dependencies = [
 
 [[package]]
 name = "bollard"
-version = "0.19.2"
+version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8796b390a5b4c86f9f2e8173a68c2791f4fa6b038b84e96dbc01c016d1e6722c"
+checksum = "ee04c4c84f1f811b017f2fbb7dd8815c976e7ca98593de9c1e2afad0f636bff4"
 dependencies = [
  "base64 0.22.1",
  "bollard-stubs",
@@ -1905,12 +1905,10 @@ dependencies = [
  "pin-project-lite",
  "rustls 0.23.23",
  "rustls-native-certs 0.8.1",
- "rustls-pemfile 2.1.0",
  "rustls-pki-types",
  "serde",
  "serde_derive",
  "serde_json",
- "serde_repr",
  "serde_urlencoded",
  "thiserror 2.0.17",
  "tokio",
@@ -1922,15 +1920,14 @@ dependencies = [
 
 [[package]]
 name = "bollard-stubs"
-version = "1.49.0-rc.28.3.3"
+version = "1.52.1-rc.29.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e7814991259013d5a5bee4ae28657dae0747d843cf06c40f7fc0c2894d6fa38"
+checksum = "0f0a8ca8799131c1837d1282c3f81f31e76ceb0ce426e04a7fe1ccee3287c066"
 dependencies = [
  "chrono",
  "serde",
  "serde_json",
  "serde_repr",
- "serde_with",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 42e2b2c24a12f..a139a477d5ab2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -354,7 +354,7 @@ arrow-schema = { version = "56.2.0", default-features = false, optional = true }
 axum = { version = "0.6.20", default-features = false }
 base64 = { workspace = true, optional = true }
 bloomy = { version = "1.2.0", default-features = false, optional = true }
-bollard = { version = "0.19.1", default-features = false, features = ["pipe", "ssl", "chrono"], optional = true }
+bollard = { version = "0.20", default-features = false, features = ["pipe", "ssl", "chrono"], optional = true }
 bytes = { workspace = true, features = ["serde"] }
 bytesize = { version = "2.0.1", default-features = false }
 chrono.workspace = true
diff --git a/src/docker.rs b/src/docker.rs
index cd13a4c4c54ce..381ffddac0219 100644
--- a/src/docker.rs
+++ b/src/docker.rs
@@ -4,12 +4,11 @@ use std::{collections::HashMap, env, path::PathBuf};
 use bollard::{
     API_DEFAULT_VERSION, Docker,
     errors::Error as DockerError,
-    models::HostConfig,
+    models::{ContainerCreateBody, HostConfig},
     query_parameters::{
         CreateContainerOptionsBuilder, CreateImageOptionsBuilder, ListImagesOptionsBuilder,
         RemoveContainerOptions, StartContainerOptions, StopContainerOptions,
     },
-    secret::ContainerCreateBody,
 };
 use futures::StreamExt;
 use http::uri::Uri;
@@ -130,7 +129,7 @@ async fn pull_image(docker: &Docker, image: &str, tag: &str) {
             .create_image(options, None, None)
             .for_each(|item| async move {
                 let info = item.unwrap();
-                if let Some(error) = info.error {
+                if let Some(error) = info.error_detail {
                     panic!("{error:?}");
                 }
             })
diff --git a/src/sources/docker_logs/tests.rs b/src/sources/docker_logs/tests.rs
index f5af697c1b9f1..4270f45843122 100644
--- a/src/sources/docker_logs/tests.rs
+++ b/src/sources/docker_logs/tests.rs
@@ -30,12 +30,12 @@ mod integration_tests {
     }
 
     use bollard::{
+        models::ContainerCreateBody,
         query_parameters::{
             CreateContainerOptionsBuilder, CreateImageOptionsBuilder, KillContainerOptions,
             ListImagesOptionsBuilder, RemoveContainerOptions, StartContainerOptions,
             WaitContainerOptions,
         },
-        secret::ContainerCreateBody,
     };
     use futures::{FutureExt, stream::TryStreamExt};
     use itertools::Itertools as _;
@@ -182,7 +182,7 @@ mod integration_tests {
                 .create_image(options, None, None)
                 .for_each(|item| async move {
                     let info = item.unwrap();
-                    if let Some(error) = info.error {
+                    if let Some(error) = info.error_detail {
                         panic!("{error:?}");
                     }
                 })

From 6267fcc78d8cd347f6405ab03ca100b97944a5ef Mon Sep 17 00:00:00 2001
From: bas smit <474727+fbs@users.noreply.github.com>
Date: Thu, 26 Mar 2026 22:31:32 +0000
Subject: [PATCH 067/326] fix(opentelemetry source): log error (#24708)

* fix(source opentelemetry): log error

If the HTTP opentelemetry source fails to build it is currently
silently ignored, without logging any info to the 'user'. The only
indication you have that something is wrong is that the log line about
the http listener starting is _not_ there.

With this change the error condition is logged the same way the gRPC
error is logged.

Before:

```
$ vector -c vector-otel.yaml
...
2026-02-23T09:15:50.053251Z  INFO vector: Vector has started. debug="false" version="0.52.0" arch="aarch64" revision="ca5bf26 2025-12-16 14:56:07.290167996"
2026-02-23T09:15:50.053468Z  INFO source{component_kind="source" component_id=otel component_type=opentelemetry}: vector::sources::util::grpc: Building gRPC server. address=127.0.0.1:4317
```

now:

```
$ target/debug/vector --config vector-otel.yaml
2026-02-23T09:16:49.397436Z  INFO vector: Vector has started. debug="true" version="0.54.0" arch="aarch64" revision=""
2026-02-23T09:16:49.398497Z  INFO source{component_kind="source" component_id=otel component_type=opentelemetry}: vector::sources::util::grpc: Building gRPC server. address=127.0.0.1:4317
2026-02-23T09:16:49.400243Z ERROR source{component_kind="source" component_id=otel component_type=opentelemetry}: vector::sources::opentelemetry::config: Source future failed. error=TCP bind failed: Address family not supported by protocol family (os error 47)
```

* improve error messages

* add changelog

* Fix CI errors

Co-authored-by: Thomas <thomasqueirozb@gmail.com>

* fix(opentelemetry source): improve error message wording

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Co-authored-by: Thomas <thomasqueirozb@gmail.com>
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
---
 changelog.d/24708_log_error.fix.md  | 5 +++++
 src/sources/opentelemetry/config.rs | 7 +++++--
 2 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/24708_log_error.fix.md

diff --git a/changelog.d/24708_log_error.fix.md b/changelog.d/24708_log_error.fix.md
new file mode 100644
index 0000000000000..d53626b09af05
--- /dev/null
+++ b/changelog.d/24708_log_error.fix.md
@@ -0,0 +1,5 @@
+The `opentelemetry` source now logs an error if it fails to start up or during runtime.
+This can happen when the configuration is invalid, for example trying to bind to the wrong
+IP or when hitting the open file limit.
+
+authors: fbs
diff --git a/src/sources/opentelemetry/config.rs b/src/sources/opentelemetry/config.rs
index 89f6163da0595..827bbd213360d 100644
--- a/src/sources/opentelemetry/config.rs
+++ b/src/sources/opentelemetry/config.rs
@@ -328,7 +328,7 @@ impl SourceConfig for OpentelemetryConfig {
             cx.shutdown.clone(),
         )
         .map_err(|error| {
-            error!(message = "Source future failed.", %error);
+            error!(message = "OpenTelemetry source gRPC server failed.", %error);
         });
 
         let http_tls_settings = MaybeTlsSettings::from_config(self.http.tls.as_ref(), true)?;
@@ -355,7 +355,10 @@ impl SourceConfig for OpentelemetryConfig {
             filters,
             cx.shutdown,
             self.http.keepalive.clone(),
-        );
+        )
+        .map_err(|error| {
+            error!(message = "OpenTelemetry source HTTP server failed.", %error);
+        });
 
         Ok(join(grpc_source, http_source).map(|_| Ok(())).boxed())
     }

From e8526b2a3ef7ac257d0fb816f611cddbc494a478 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 22:32:43 +0000
Subject: [PATCH 068/326] chore(deps): bump deadpool from 0.12.2 to 0.13.0
 (#25014)

* chore(deps): bump deadpool from 0.12.2 to 0.13.0

Bumps [deadpool](https://github.com/deadpool-rs/deadpool) from 0.12.2 to 0.13.0.
- [Changelog](https://github.com/deadpool-rs/deadpool/blob/main/release.toml)
- [Commits](https://github.com/deadpool-rs/deadpool/compare/deadpool-v0.12.2...deadpool-v0.13.0)

---
updated-dependencies:
- dependency-name: deadpool
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update Cargo.toml and licenses

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock           | 23 ++++++++++++++++++++---
 Cargo.toml           |  2 +-
 LICENSE-3rdparty.csv |  4 ++--
 3 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index be47e7ba18697..0a3f2830ec51d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3196,7 +3196,18 @@ version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5ed5957ff93768adf7a65ab167a17835c3d2c3c50d084fe305174c112f468e2f"
 dependencies = [
- "deadpool-runtime",
+ "deadpool-runtime 0.1.3",
+ "num_cpus",
+ "tokio",
+]
+
+[[package]]
+name = "deadpool"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "883466cb8db62725aee5f4a6011e8a5d42912b42632df32aad57fc91127c6e04"
+dependencies = [
+ "deadpool-runtime 0.3.1",
  "num_cpus",
  "tokio",
 ]
@@ -3206,6 +3217,12 @@ name = "deadpool-runtime"
 version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63dfa964fe2a66f3fde91fc70b267fe193d822c7e603e2a675a49a7f46ad3f49"
+
+[[package]]
+name = "deadpool-runtime"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2657f61fb1dd8bf37a8d51093cc7cee4e77125b22f7753f49b289f831bec2bae"
 dependencies = [
  "tokio",
 ]
@@ -12257,7 +12274,7 @@ dependencies = [
  "criterion",
  "csv",
  "databend-client",
- "deadpool",
+ "deadpool 0.13.0",
  "derivative",
  "dirs-next",
  "dnsmsg-parser",
@@ -13844,7 +13861,7 @@ checksum = "08db1edfb05d9b3c1542e521aea074442088292f00b5f28e435c714a98f85031"
 dependencies = [
  "assert-json-diff",
  "base64 0.22.1",
- "deadpool",
+ "deadpool 0.12.2",
  "futures",
  "http 1.3.1",
  "http-body-util",
diff --git a/Cargo.toml b/Cargo.toml
index a139a477d5ab2..7676ebe174ea3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -336,7 +336,7 @@ smpl_jwt = { version = "0.8.0", default-features = false, optional = true }
 # AMQP
 lapin = { version = "4.3.0", default-features = false, features = ["tokio", "native-tls"], optional = true }
 async-rs = { version = "0.8", default-features = false, features = ["tokio"], optional = true }
-deadpool = { version = "0.12.2", default-features = false, features = ["managed", "rt_tokio_1"], optional = true }
+deadpool = { version = "0.13.0", default-features = false, features = ["managed", "rt_tokio_1"], optional = true }
 
 # Opentelemetry
 
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 8dbc10abc4f7e..9a135f0479f51 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -216,8 +216,8 @@ data-encoding,https://github.com/ia0/data-encoding,MIT,Julien Cretin <git@ia0.eu
 data-url,https://github.com/servo/rust-url,MIT OR Apache-2.0,Simon Sapin <simon.sapin@exyr.org>
 databend-client,https://github.com/databendlabs/bendsql,Apache-2.0,Databend Authors <opensource@databend.com>
 dbl,https://github.com/RustCrypto/utils,MIT OR Apache-2.0,RustCrypto Developers
-deadpool,https://github.com/bikeshedder/deadpool,MIT OR Apache-2.0,Michael P. Jung <michael.jung@terreon.de>
-deadpool-runtime,https://github.com/bikeshedder/deadpool,MIT OR Apache-2.0,Michael P. Jung <michael.jung@terreon.de>
+deadpool,https://github.com/deadpool-rs/deadpool,MIT OR Apache-2.0,Michael P. Jung <michael.jung@terreon.de>
+deadpool-runtime,https://github.com/deadpool-rs/deadpool,MIT OR Apache-2.0,Michael P. Jung <michael.jung@terreon.de>
 der,https://github.com/RustCrypto/formats/tree/master/der,Apache-2.0 OR MIT,RustCrypto Developers
 deranged,https://github.com/jhpratt/deranged,MIT OR Apache-2.0,Jacob Pratt <jacob@jhpratt.dev>
 derivative,https://github.com/mcarton/rust-derivative,MIT OR Apache-2.0,mcarton <cartonmartin+git@gmail.com>

From af15a5a595f342038fd3368854fa75c74c31e932 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 26 Mar 2026 21:09:12 -0400
Subject: [PATCH 069/326] fix(dev): vanila `cargo build` should run on windows
 (#24991)

* fix(deps): gate Unix-only dependencies to enable Windows MSVC builds

Move `tikv-jemallocator` to a Unix-only target dependency (it requires
autoconf which is unavailable with MSVC). Enable `rdkafka/cmake_build`
on Windows via a target-specific dependency entry so rdkafka builds
using cmake instead of the Unix autotools path. Gate `sources-dnstap`
module declarations on Unix to match the Unix-only `framestream` crate
it depends on. Add `#[cfg(unix)]` to jemalloc allocator blocks in
`src/lib.rs`.

Tested on Windows with Cyrus SASL installed via MSYS2.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: apply rustfmt

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor: make rdkafka a workspace dependency

Avoids version string duplication across dependency sections.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: pront <pront@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 Cargo.toml                 | 6 ++++--
 src/internal_events/mod.rs | 4 ++--
 src/lib.rs                 | 8 ++++++--
 src/sources/mod.rs         | 2 +-
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 7676ebe174ea3..4bc52384f0a06 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -182,6 +182,7 @@ prost-types = { version = "0.12", default-features = false }
 quickcheck = { version = "1.1.0" }
 rand = { version = "0.9.2", default-features = false, features = ["small_rng", "thread_rng"] }
 rand_distr = { version = "0.5.1", default-features = false }
+rdkafka = { version = "0.39.0", default-features = false }
 regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
 reqwest = { version = "0.11", features = ["json"] }
 rust_decimal = { version = "1.37.0", default-features = false, features = ["std"] }
@@ -411,7 +412,7 @@ pulsar = { version = "6.7.0", default-features = false, features = ["tokio-runti
 quick-junit = { version = "0.6.0" }
 rand.workspace = true
 rand_distr.workspace = true
-rdkafka = { version = "0.39.0", default-features = false, features = ["curl-static", "tokio", "libz", "ssl", "zstd"], optional = true }
+rdkafka = { workspace = true, features = ["curl-static", "tokio", "libz", "ssl", "zstd"], optional = true }
 redis = { version = "0.32.4", default-features = false, features = ["connection-manager", "sentinel", "tokio-comp", "tokio-native-tls-comp"], optional = true }
 regex.workspace = true
 roaring = { version = "0.11.2", default-features = false, features = ["std"], optional = true }
@@ -425,7 +426,6 @@ sqlx = { version = "0.8.6", default-features = false, features = ["derive", "pos
 stream-cancel = { version = "0.8.2", default-features = false }
 strip-ansi-escapes = { version = "0.2.1", default-features = false }
 syslog = { version = "6.1.1", default-features = false, optional = true }
-tikv-jemallocator = { version = "0.6.0", default-features = false, features = ["unprefixed_malloc_on_supported_platforms"], optional = true }
 tokio-postgres = { version = "0.7.13", default-features = false, features = ["runtime", "with-chrono-0_4"], optional = true }
 tokio-tungstenite = { workspace = true, features = ["connect"], optional = true }
 toml.workspace = true
@@ -453,9 +453,11 @@ byteorder = "1.5.0"
 windows-service = "0.8.0"
 windows = { version = "0.58", features = ["Win32_System_EventLog", "Win32_Foundation", "Win32_System_Com", "Win32_Security", "Win32_Security_Authorization", "Win32_System_Threading", "Win32_Storage_FileSystem"], optional = true }
 quick-xml = { version = "0.31", default-features = false, features = ["serialize"], optional = true }
+rdkafka = { workspace = true, features = ["cmake_build"], optional = true }
 
 [target.'cfg(unix)'.dependencies]
 nix = { version = "0.31", default-features = false, features = ["socket", "signal", "fs"] }
+tikv-jemallocator = { version = "0.6.0", default-features = false, features = ["unprefixed_malloc_on_supported_platforms"], optional = true }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 procfs = { version = "0.18.0", default-features = false }
diff --git a/src/internal_events/mod.rs b/src/internal_events/mod.rs
index 02b7460856f2d..d111134e97adf 100644
--- a/src/internal_events/mod.rs
+++ b/src/internal_events/mod.rs
@@ -40,7 +40,7 @@ mod datadog_traces;
 mod dedupe;
 #[cfg(feature = "sources-demo_logs")]
 mod demo_logs;
-#[cfg(feature = "sources-dnstap")]
+#[cfg(all(unix, feature = "sources-dnstap"))]
 mod dnstap;
 #[cfg(feature = "sources-docker_logs")]
 mod docker_logs;
@@ -194,7 +194,7 @@ pub(crate) use self::datadog_traces::*;
 pub(crate) use self::dedupe::*;
 #[cfg(feature = "sources-demo_logs")]
 pub(crate) use self::demo_logs::*;
-#[cfg(feature = "sources-dnstap")]
+#[cfg(all(unix, feature = "sources-dnstap"))]
 pub(crate) use self::dnstap::*;
 #[cfg(feature = "sources-docker_logs")]
 pub(crate) use self::docker_logs::*;
diff --git a/src/lib.rs b/src/lib.rs
index d4d4ab1eeb38a..8d26a3b080ecf 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -35,11 +35,15 @@ pub use indoc::indoc;
 // re-export codecs for convenience
 pub use vector_lib::codecs;
 
-#[cfg(all(feature = "tikv-jemallocator", not(feature = "allocation-tracing")))]
+#[cfg(all(
+    unix,
+    feature = "tikv-jemallocator",
+    not(feature = "allocation-tracing")
+))]
 #[global_allocator]
 static ALLOC: tikv_jemallocator::Jemalloc = tikv_jemallocator::Jemalloc;
 
-#[cfg(all(feature = "tikv-jemallocator", feature = "allocation-tracing"))]
+#[cfg(all(unix, feature = "tikv-jemallocator", feature = "allocation-tracing"))]
 #[global_allocator]
 static ALLOC: self::internal_telemetry::allocations::Allocator<tikv_jemallocator::Jemalloc> =
     self::internal_telemetry::allocations::get_grouped_tracing_allocator(
diff --git a/src/sources/mod.rs b/src/sources/mod.rs
index cdc03f46fdcbb..2384b096f630b 100644
--- a/src/sources/mod.rs
+++ b/src/sources/mod.rs
@@ -17,7 +17,7 @@ pub mod aws_sqs;
 pub mod datadog_agent;
 #[cfg(feature = "sources-demo_logs")]
 pub mod demo_logs;
-#[cfg(feature = "sources-dnstap")]
+#[cfg(all(unix, feature = "sources-dnstap"))]
 pub mod dnstap;
 #[cfg(feature = "sources-docker_logs")]
 pub mod docker_logs;

From 4e6b49d6951b1f6ed9e2851aec674577ccc4c2b2 Mon Sep 17 00:00:00 2001
From: Yoenn Burban <62966490+gwenaskell@users.noreply.github.com>
Date: Fri, 27 Mar 2026 12:47:55 +0100
Subject: [PATCH 070/326] fix(metrics): deduct downstream utilization on task
 transforms (#24731)

* add output utilization on task transforms

* add changelog

* fix formatting

* avoid pin_project on OutputUtilization

* replace wrap functions with constructors

* Apply suggestions from code review

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>

* fix formatting

* woops

* improve changelog

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 .../24641-task-transform-utilization.fix.md   |   5 +
 src/topology/builder.rs                       |  11 +-
 src/utilization.rs                            | 223 ++++++++++++++++--
 3 files changed, 221 insertions(+), 18 deletions(-)
 create mode 100644 changelog.d/24641-task-transform-utilization.fix.md

diff --git a/changelog.d/24641-task-transform-utilization.fix.md b/changelog.d/24641-task-transform-utilization.fix.md
new file mode 100644
index 0000000000000..f59a9c8a8eddf
--- /dev/null
+++ b/changelog.d/24641-task-transform-utilization.fix.md
@@ -0,0 +1,5 @@
+Fixed utilization for task transforms to not account for time spent when downstream
+is not polling. If the transform is frequently blocked on downstream components,
+the reported utilization should be lower.
+
+authors: gwenaskell
diff --git a/src/topology/builder.rs b/src/topology/builder.rs
index 4fda56f9b35b3..8048b7a6073ed 100644
--- a/src/topology/builder.rs
+++ b/src/topology/builder.rs
@@ -52,7 +52,10 @@ use crate::{
     spawn_named,
     topology::task::TaskError,
     transforms::{SyncTransform, TaskTransform, Transform, TransformOutputs, TransformOutputsBuf},
-    utilization::{UtilizationComponentSender, UtilizationEmitter, UtilizationRegistry, wrap},
+    utilization::{
+        OutputUtilization, Utilization, UtilizationComponentSender, UtilizationEmitter,
+        UtilizationRegistry,
+    },
 };
 
 static ENRICHMENT_TABLES: LazyLock<vector_lib::enrichment::TableRegistry> =
@@ -641,7 +644,7 @@ impl<'a> Builder<'a> {
                     .take()
                     .expect("Task started but input has been taken.");
 
-                let mut rx = wrap(utilization_sender, component_key.clone(), rx);
+                let mut rx = Utilization::new(utilization_sender, component_key.clone(), rx);
 
                 let events_received = register!(EventsReceived);
                 sink.run(
@@ -801,7 +804,8 @@ impl<'a> Builder<'a> {
         let sender = self
             .utilization_registry
             .add_component(key.clone(), gauge!("utilization"));
-        let input_rx = wrap(sender, key.clone(), input_rx.into_stream());
+        let output_sender = sender.clone();
+        let input_rx = Utilization::new(sender, key.clone(), input_rx.into_stream());
 
         let events_received = register!(EventsReceived);
         let filtered = input_rx
@@ -846,6 +850,7 @@ impl<'a> Builder<'a> {
                     events.estimated_json_encoded_size_of(),
                 ));
             });
+        let stream = OutputUtilization::new(output_sender, stream);
         let transform = async move {
             debug!("Task transform starting.");
 
diff --git a/src/utilization.rs b/src/utilization.rs
index 413505b8fc9f5..b3496b998f1c5 100644
--- a/src/utilization.rs
+++ b/src/utilization.rs
@@ -24,6 +24,11 @@ use vector_lib::{id::ComponentKey, shutdown::ShutdownSignal, stats};
 
 const UTILIZATION_EMITTER_DURATION: Duration = Duration::from_secs(5);
 
+/// Stream wrappers used to approximate component utilization from poll timing.
+///
+/// Current model:
+///
+///
 #[pin_project]
 pub(crate) struct Utilization<S> {
     intervals: IntervalStream,
@@ -33,6 +38,23 @@ pub(crate) struct Utilization<S> {
 }
 
 impl<S> Utilization<S> {
+    /// Output-side utilization wrapper for task transforms.
+    ///
+    /// Measures the time after the wrapped stream yields an item until downstream
+    /// polls it again.
+    pub(crate) fn new(
+        timer_tx: UtilizationComponentSender,
+        component_key: ComponentKey,
+        inner: S,
+    ) -> Self {
+        Self {
+            intervals: IntervalStream::new(interval(Duration::from_secs(5))),
+            timer_tx,
+            component_key,
+            inner,
+        }
+    }
+
     /// Consumes this wrapper and returns the inner stream.
     ///
     /// This can't be constant because destructors can't be run in a const context, and we're
@@ -160,6 +182,7 @@ enum UtilizationTimerMessage {
     StopWait(ComponentKey, Instant),
 }
 
+#[derive(Clone)]
 pub(crate) struct UtilizationComponentSender {
     component_key: ComponentKey,
     timer_tx: Sender<UtilizationTimerMessage>,
@@ -277,23 +300,43 @@ impl UtilizationEmitter {
     }
 }
 
-/// Wrap a stream to emit stats about utilization. This is designed for use with
-/// the input channels of transform and sinks components, and measures the
-/// amount of time that the stream is waiting for input from upstream. We make
-/// the simplifying assumption that this wait time is when the component is idle
-/// and the rest of the time it is doing useful work. This is more true for
-/// sinks than transforms, which can be blocked by downstream components, but
-/// with knowledge of the config the data is still useful.
-pub(crate) fn wrap<S>(
+/// Output-side counterpart of [`Utilization`]. Wraps the output stream of a
+/// task transform to track time spent waiting for downstream to accept items.
+///
+/// While [`Utilization`] measures idle time as "waiting for upstream input",
+/// this wrapper measures the complementary case: after yielding an item, the
+/// time until the consumer polls again is counted as downstream wait (idle).
+/// Both wrappers share a single [`Timer`] per component, and the idempotent
+/// `start_wait`/`stop_wait` transitions ensure no double-counting.
+pub(crate) struct OutputUtilization<S> {
     timer_tx: UtilizationComponentSender,
-    component_key: ComponentKey,
     inner: S,
-) -> Utilization<S> {
-    Utilization {
-        intervals: IntervalStream::new(interval(Duration::from_secs(5))),
-        timer_tx,
-        component_key,
-        inner,
+}
+
+impl<S> Stream for OutputUtilization<S>
+where
+    S: Stream + Unpin,
+{
+    type Item = S::Item;
+
+    fn poll_next(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
+        let this = self.get_mut();
+        this.timer_tx.try_send_stop_wait();
+        let result = ready!(this.inner.poll_next_unpin(cx));
+        if result.is_some() {
+            this.timer_tx.try_send_start_wait();
+        }
+        Poll::Ready(result)
+    }
+}
+
+impl<S> OutputUtilization<S> {
+    /// Wrap a task transform stream to track time spent waiting for downstream
+    /// to consume items. This is the output-side counterpart to
+    /// [`Utilization::new`], designed for use with task transforms where the
+    /// framework cannot otherwise detect downstream backpressure.
+    pub(crate) const fn new(timer_tx: UtilizationComponentSender, inner: S) -> Self {
+        Self { timer_tx, inner }
     }
 }
 
@@ -429,4 +472,154 @@ mod tests {
         let avg = timer.ewma.average().unwrap();
         assert_approx_eq(avg, 1.0, "near 1.0 (never waiting)");
     }
+
+    /// Mock task transform that passes events through unchanged, simulating
+    /// a configurable processing delay by advancing MockClock per item.
+    struct MockTaskTransform {
+        processing_time: Duration,
+    }
+
+    use crate::event::EventArray;
+    use crate::transforms::TaskTransform;
+
+    impl TaskTransform<EventArray> for MockTaskTransform {
+        fn transform(
+            self: Box<Self>,
+            task: Pin<Box<dyn Stream<Item = EventArray> + Send>>,
+        ) -> Pin<Box<dyn Stream<Item = EventArray> + Send>> {
+            let processing_time = self.processing_time;
+            task.map(move |events| {
+                MockClock::advance(processing_time);
+                events
+            })
+            .boxed()
+        }
+    }
+
+    /// End-to-end test exercising the Utilization (input) and
+    /// OutputUtilization (output) stream wrappers with a mock TaskTransform,
+    /// wired up the same way `build_task_transform` does in the builder.
+    ///
+    /// Pipeline: channel → Utilization(input) → TaskTransform → OutputUtilization(output)
+    ///
+    /// Timeline (10s):
+    ///   T=100..103  waiting for input       (3s wait)
+    ///   T=103..105  transform processing    (2s work)
+    ///   T=105..108  blocked on downstream   (3s wait, even though input has data)
+    ///   T=108..110  transform processing    (2s work)
+    ///
+    /// Expected utilization = 4/10 = 0.4
+    #[tokio::test]
+    #[serial]
+    async fn test_task_transform_utilization_end_to_end() {
+        use crate::event::{EventArray, LogEvent};
+        use crate::transforms::TaskTransform;
+        use futures::SinkExt;
+        use futures::channel::mpsc as futures_mpsc;
+
+        MockClock::set_time(Duration::from_secs(100));
+
+        let (mut emitter, registry) = UtilizationEmitter::new();
+        let key = ComponentKey::from("test_transform");
+
+        let sender = registry.add_component(key.clone(), metrics::gauge!("utilization"));
+        let output_sender = sender.clone();
+
+        // Upstream channel carrying EventArrays.
+        let (mut input_tx, input_rx) = futures_mpsc::channel::<EventArray>(10);
+
+        // Wire up the pipeline exactly like build_task_transform:
+        //   Utilization(input) → transform.transform() → OutputUtilization(output)
+        let input_wrapped = Utilization::new(sender, key.clone(), input_rx);
+        let transform = Box::new(MockTaskTransform {
+            processing_time: Duration::from_secs(2),
+        });
+        let transform_output = transform.transform(Box::pin(input_wrapped));
+        let mut pipeline = OutputUtilization::new(output_sender, transform_output);
+
+        let waker = futures::task::noop_waker();
+        let mut cx = std::task::Context::from_waker(&waker);
+
+        // -- Phase 1: poll transform, no input available --
+        // T=100: start_wait sent by input wrapper.
+        assert!(Pin::new(&mut pipeline).poll_next(&mut cx).is_pending());
+        MockClock::advance(Duration::from_secs(3));
+        // T=103: 3s of input wait. Period: 0s work / 3s → util = 0.0.
+        check_timer_utilization(&mut emitter, &key, 0.0, "0.0 (phase 1: all input wait)");
+
+        // -- Phase 2: send input, poll pipeline → transform processes --
+        input_tx
+            .send(EventArray::from(LogEvent::default()))
+            .await
+            .unwrap();
+        assert!(Pin::new(&mut pipeline).poll_next(&mut cx).is_ready());
+        // T=105: MockClock advanced 2s inside transform. start_wait sent by
+        // output wrapper. Period: 2s work / 0s wait → util = 1.0.
+        // EWMA: 0.9×1.0 + 0.1×0.0 = 0.9
+        check_timer_utilization(&mut emitter, &key, 0.9, "0.9 (phase 2: all work)");
+
+        // -- Phase 3: send another event, simulate downstream blocking --
+        // Data is available in the input channel, but the transform is not
+        // polled so no progress is made: the time counts as downstream wait.
+        input_tx
+            .send(EventArray::from(LogEvent::default()))
+            .await
+            .unwrap();
+        MockClock::advance(Duration::from_secs(3));
+        // T=108: 3s downstream wait. Period: 0s work / 3s → util = 0.0.
+        // EWMA: 0.9×0.0 + 0.1×0.9 = 0.09
+        check_timer_utilization(
+            &mut emitter,
+            &key,
+            0.09,
+            "0.09 (phase 3: downstream wait despite buffered input)",
+        );
+
+        // -- Phase 4: poll pipeline, processes the queued event --
+        assert!(Pin::new(&mut pipeline).poll_next(&mut cx).is_ready());
+        // T=110: MockClock advanced 2s inside transform. Period: 2s work / 0s wait → util = 1.0.
+        // EWMA: 0.9×1.0 + 0.1×0.09 ≈ 0.909
+        check_timer_utilization(
+            &mut emitter,
+            &key,
+            0.909,
+            "0.909 (phase 4: queued event processed)",
+        );
+    }
+
+    /// Drain pending timer messages and assert the current EWMA utilization
+    /// for a single reporting period.
+    fn check_timer_utilization(
+        emitter: &mut UtilizationEmitter,
+        key: &ComponentKey,
+        expected: f64,
+        description: &str,
+    ) {
+        drain_emitter_messages(emitter);
+        let mut timers = emitter.timers.lock().expect("mutex poisoned");
+        let timer = timers.get_mut(key).expect("timer should exist");
+        timer.update_utilization();
+        let avg = timer.ewma.average().unwrap();
+        assert_approx_eq(avg, expected, description);
+    }
+
+    /// Drain all pending messages from the emitter's channel into the timers,
+    /// simulating what `run_utilization` does in a loop.
+    fn drain_emitter_messages(emitter: &mut UtilizationEmitter) {
+        while let Ok(message) = emitter.timer_rx.try_recv() {
+            let mut timers = emitter.timers.lock().expect("mutex poisoned");
+            match message {
+                UtilizationTimerMessage::StartWait(key, at) => {
+                    if let Some(timer) = timers.get_mut(&key) {
+                        timer.start_wait(at);
+                    }
+                }
+                UtilizationTimerMessage::StopWait(key, at) => {
+                    if let Some(timer) = timers.get_mut(&key) {
+                        timer.stop_wait(at);
+                    }
+                }
+            }
+        }
+    }
 }

From a7450cdbba3eb86782d67bea39b81e5b641067d9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 10:50:50 -0400
Subject: [PATCH 071/326] chore(deps): bump tempfile from 3.23.0 to 3.27.0
 (#25016)

Bumps [tempfile](https://github.com/Stebalien/tempfile) from 3.23.0 to 3.27.0.
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Stebalien/tempfile/compare/v3.23.0...v3.27.0)

---
updated-dependencies:
- dependency-name: tempfile
  dependency-version: 3.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock | 26 +++++++++++++-------------
 Cargo.toml |  2 +-
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 0a3f2830ec51d..5bbba19140aa9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -765,7 +765,7 @@ dependencies = [
  "cfg-if",
  "event-listener 5.3.1",
  "futures-lite",
- "rustix 1.0.1",
+ "rustix 1.1.4",
 ]
 
 [[package]]
@@ -2925,7 +2925,7 @@ dependencies = [
  "futures-core",
  "mio",
  "parking_lot",
- "rustix 1.0.1",
+ "rustix 1.1.4",
  "signal-hook",
  "signal-hook-mio",
  "winapi",
@@ -6213,9 +6213,9 @@ checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.9.2"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db9c683daf087dc577b7506e9695b3d556a9f3849903fa28186283afd6809e9"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "listenfd"
@@ -8088,7 +8088,7 @@ checksum = "25485360a54d6861439d60facef26de713b1e126bf015ec8f98239467a2b82f7"
 dependencies = [
  "bitflags 2.10.0",
  "procfs-core",
- "rustix 1.0.1",
+ "rustix 1.1.4",
 ]
 
 [[package]]
@@ -9397,15 +9397,15 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.0.1"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dade4812df5c384711475be5fcd8c162555352945401aed22a35bffeab61f657"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
  "bitflags 2.10.0",
  "errno",
  "libc",
- "linux-raw-sys 0.9.2",
- "windows-sys 0.59.0",
+ "linux-raw-sys 0.12.1",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -10890,14 +10890,14 @@ checksum = "83176759e9416cf81ee66cb6508dbfe9c96f20b8b56265a39917551c23c70964"
 
 [[package]]
 name = "tempfile"
-version = "3.23.0"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
- "rustix 1.0.1",
+ "rustix 1.1.4",
  "windows-sys 0.61.0",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 4bc52384f0a06..b2670983edbe2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -192,7 +192,7 @@ serde_json = { version = "1.0.143", default-features = false, features = ["prese
 serde_yaml = { version = "0.9.34", default-features = false }
 snafu = { version = "0.9.0", default-features = false, features = ["futures", "std"] }
 socket2 = { version = "0.5.10", default-features = false }
-tempfile = "3.23.0"
+tempfile = "3.27.0"
 tokio = { version = "1.49.0", default-features = false }
 tokio-stream = { version = "0.1.18", default-features = false }
 tokio-test = "0.4.5"

From 7066adccecc24fe005f1fb7c934bbda4b557ea6c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 10:51:39 -0400
Subject: [PATCH 072/326] chore(deps): bump proptest from 1.10.0 to 1.11.0
 (#25021)

* chore(deps): bump proptest from 1.10.0 to 1.11.0

Bumps [proptest](https://github.com/proptest-rs/proptest) from 1.10.0 to 1.11.0.
- [Release notes](https://github.com/proptest-rs/proptest/releases)
- [Changelog](https://github.com/proptest-rs/proptest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/proptest-rs/proptest/compare/v1.10.0...v1.11.0)

---
updated-dependencies:
- dependency-name: proptest
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Use workspace proptest

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock                    | 4 ++--
 Cargo.toml                    | 2 +-
 lib/vector-buffers/Cargo.toml | 2 +-
 lib/vector-core/Cargo.toml    | 4 ++--
 lib/vector-stream/Cargo.toml  | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 5bbba19140aa9..3c1cd0979e24d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8116,9 +8116,9 @@ dependencies = [
 
 [[package]]
 name = "proptest"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37566cb3fdacef14c0737f9546df7cfeadbfbc9fef10991038bf5015d0c80532"
+checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744"
 dependencies = [
  "bit-set",
  "bit-vec",
diff --git a/Cargo.toml b/Cargo.toml
index b2670983edbe2..d4c3fb4c46c65 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -173,7 +173,7 @@ nom = { version = "8.0.0", default-features = false }
 ordered-float = { version = "4.6.0", default-features = false }
 pastey = { version = "0.2", default-features = false }
 pin-project = { version = "1.1.11", default-features = false }
-proptest = { version = "1.10" }
+proptest = { version = "1.11" }
 proptest-derive = { version = "0.6.0" }
 prost = { version = "0.12", default-features = false, features = ["std"] }
 prost-build = { version = "0.12", default-features = false }
diff --git a/lib/vector-buffers/Cargo.toml b/lib/vector-buffers/Cargo.toml
index 04ad96436baf1..4f27f3ef369e1 100644
--- a/lib/vector-buffers/Cargo.toml
+++ b/lib/vector-buffers/Cargo.toml
@@ -42,7 +42,7 @@ crossbeam-queue = "0.3.12"
 hdrhistogram = "7.5.4"
 metrics-tracing-context.workspace = true
 metrics-util = { workspace = true, features = ["debugging"] }
-proptest = "1.10"
+proptest.workspace = true
 quickcheck.workspace = true
 rand.workspace = true
 serde_yaml.workspace = true
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index a7e33377bc09c..41ad3d4b86b5b 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -37,7 +37,7 @@ ordered-float.workspace = true
 openssl = { version = "0.10.75", default-features = false, features = ["vendored"] }
 parking_lot = { version = "0.12.5", default-features = false }
 pin-project.workspace = true
-proptest = { version = "1.10", optional = true }
+proptest = { workspace = true, optional = true }
 prost-types.workspace = true
 prost.workspace = true
 quanta = { version = "0.12.6", default-features = false }
@@ -82,7 +82,7 @@ criterion = { workspace = true, features = ["html_reports"] }
 env-test-util = "1.0.1"
 quickcheck.workspace = true
 quickcheck_macros = "1"
-proptest = "1.10"
+proptest.workspace = true
 similar-asserts = "1.7.0"
 tokio-test.workspace = true
 toml.workspace = true
diff --git a/lib/vector-stream/Cargo.toml b/lib/vector-stream/Cargo.toml
index b16138436eb82..21b9f1a9a2d7b 100644
--- a/lib/vector-stream/Cargo.toml
+++ b/lib/vector-stream/Cargo.toml
@@ -19,7 +19,7 @@ vector-common = { path = "../vector-common" }
 vector-core = { path = "../vector-core" }
 
 [dev-dependencies]
-proptest = "1.10"
+proptest.workspace = true
 rand.workspace = true
 rand_distr.workspace = true
 tokio = { workspace = true, features = ["test-util"] }

From 3ca3374c5b0359a3839f6c8091e2c3632faec719 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 15:02:57 +0000
Subject: [PATCH 073/326] chore(deps): bump rust_decimal from 1.39.0 to 1.40.0
 (#24799)

Bumps [rust_decimal](https://github.com/paupino/rust-decimal) from 1.39.0 to 1.40.0.
- [Release notes](https://github.com/paupino/rust-decimal/releases)
- [Changelog](https://github.com/paupino/rust-decimal/blob/master/CHANGELOG.md)
- [Commits](https://github.com/paupino/rust-decimal/compare/1.39.0...1.40.0)

---
updated-dependencies:
- dependency-name: rust_decimal
  dependency-version: 1.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 4 ++--
 Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3c1cd0979e24d..a9809924cfd68 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9343,9 +9343,9 @@ dependencies = [
 
 [[package]]
 name = "rust_decimal"
-version = "1.39.0"
+version = "1.40.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35affe401787a9bd846712274d97654355d21b2a2c092a3139aabe31e9022282"
+checksum = "61f703d19852dbf87cbc513643fa81428361eb6940f1ac14fd58155d295a3eb0"
 dependencies = [
  "arrayvec",
  "borsh",
diff --git a/Cargo.toml b/Cargo.toml
index d4c3fb4c46c65..21c40c793a9bf 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -185,7 +185,7 @@ rand_distr = { version = "0.5.1", default-features = false }
 rdkafka = { version = "0.39.0", default-features = false }
 regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
 reqwest = { version = "0.11", features = ["json"] }
-rust_decimal = { version = "1.37.0", default-features = false, features = ["std"] }
+rust_decimal = { version = "1.40.0", default-features = false, features = ["std"] }
 semver = { version = "1.0.27", default-features = false, features = ["serde", "std"] }
 serde = { version = "1.0.219", default-features = false, features = ["alloc", "derive", "rc"] }
 serde_json = { version = "1.0.143", default-features = false, features = ["preserve_order", "raw_value", "std"] }

From c1f34ef803fe5365a5be54f46877590bc8c91ba6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 16:44:05 +0000
Subject: [PATCH 074/326] chore(website deps): bump brace-expansion from 1.1.12
 to 1.1.13 in /website (#25056)

chore(website deps): bump brace-expansion in /website

Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.13.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.13)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 website/yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/website/yarn.lock b/website/yarn.lock
index f7cedc6f6748f..da88eb1b5980f 100644
--- a/website/yarn.lock
+++ b/website/yarn.lock
@@ -1744,9 +1744,9 @@ boolbase@^1.0.0:
   integrity sha1-aN/1++YMUes3cl6p4+0xDcwed24=
 
 brace-expansion@^1.1.7:
-  version "1.1.12"
-  resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz"
-  integrity sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==
+  version "1.1.13"
+  resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.13.tgz#d37875c01dc9eff988dd49d112a57cb67b54efe6"
+  integrity sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==
   dependencies:
     balanced-match "^1.0.0"
     concat-map "0.0.1"

From d29a524ea05dcbb6f823121ffdff449ecd960673 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 16:49:17 +0000
Subject: [PATCH 075/326] chore(deps): bump security-framework from 3.5.1 to
 3.6.0 (#24763)

Bumps [security-framework](https://github.com/kornelski/rust-security-framework) from 3.5.1 to 3.6.0.
- [Commits](https://github.com/kornelski/rust-security-framework/compare/v3.5.1...v3.6.0)

---
updated-dependencies:
- dependency-name: security-framework
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock                 | 12 ++++++------
 lib/vector-core/Cargo.toml |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a9809924cfd68..a557cd2ced9e5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9471,7 +9471,7 @@ dependencies = [
  "openssl-probe",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.5.1",
+ "security-framework 3.6.0",
 ]
 
 [[package]]
@@ -9711,9 +9711,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "3.5.1"
+version = "3.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef"
+checksum = "d17b898a6d6948c3a8ee4372c17cb384f90d2e6e912ef00895b14fd7ab54ec38"
 dependencies = [
  "bitflags 2.10.0",
  "core-foundation 0.10.1",
@@ -9724,9 +9724,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.15.0"
+version = "2.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -12626,7 +12626,7 @@ dependencies = [
  "regex",
  "ryu",
  "schannel",
- "security-framework 3.5.1",
+ "security-framework 3.6.0",
  "serde",
  "serde_json",
  "serde_with",
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index 41ad3d4b86b5b..8a512884b2c32 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -67,7 +67,7 @@ vrl.workspace = true
 cfg-if.workspace = true
 
 [target.'cfg(target_os = "macos")'.dependencies]
-security-framework = "3.5.1"
+security-framework = "3.6.0"
 
 [target.'cfg(windows)'.dependencies]
 schannel = "0.1.28"

From 89e5c343c631e36090d2543106b88685d7a1c908 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 16:55:57 -0400
Subject: [PATCH 076/326] chore(ci): bump juliangruber/read-file-action from
 1.1.7 to 1.1.8 (#25000)

Bumps [juliangruber/read-file-action](https://github.com/juliangruber/read-file-action) from 1.1.7 to 1.1.8.
- [Release notes](https://github.com/juliangruber/read-file-action/releases)
- [Commits](https://github.com/juliangruber/read-file-action/compare/b549046febe0fe86f8cb4f93c24e284433f9ab58...271ff311a4947af354c6abcd696a306553b9ec18)

---
updated-dependencies:
- dependency-name: juliangruber/read-file-action
  dependency-version: 1.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/regression.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index f2216df39e684..1b93487a54ec2 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -538,7 +538,7 @@ jobs:
 
       - name: Read regression report
         id: read-analysis
-        uses: juliangruber/read-file-action@b549046febe0fe86f8cb4f93c24e284433f9ab58 # v1.1.7
+        uses: juliangruber/read-file-action@271ff311a4947af354c6abcd696a306553b9ec18 # v1.1.8
         with:
           path: ${{ runner.temp }}/outputs/report.md
 

From 55be10e5860afd47656a67a08335bb17a1d641c8 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 30 Mar 2026 12:14:44 -0400
Subject: [PATCH 077/326] fix(ci): add missing `contents: read` permission to
 integration review jobs (#25067)

fix(ci): add missing contents:read permission to integration review jobs
---
 .github/workflows/ci-integration-review.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci-integration-review.yml b/.github/workflows/ci-integration-review.yml
index 1195b4372d97b..a2a73c39e7d0e 100644
--- a/.github/workflows/ci-integration-review.yml
+++ b/.github/workflows/ci-integration-review.yml
@@ -85,6 +85,7 @@ jobs:
   build-test-runner:
     needs: prep-pr
     permissions:
+      contents: read
       packages: write   # Required to push test runner image to GHCR
     uses: ./.github/workflows/build-test-runner.yml
     with:
@@ -98,6 +99,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 90
     permissions:
+      contents: read
       packages: read    # Required to pull test runner image from GHCR
     strategy:
       fail-fast: false
@@ -140,6 +142,7 @@ jobs:
     runs-on: ubuntu-24.04-8core
     timeout-minutes: 30
     permissions:
+      contents: read
       packages: read    # Required to pull test runner image from GHCR
     strategy:
       fail-fast: false

From d906ba19487c0552be7557d49a3f1dbfcd2405d9 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 30 Mar 2026 17:12:33 -0400
Subject: [PATCH 078/326] chore(deps): upgrade rustls from 0.23.23 to 0.23.37
 (#25075)

Upgrade rustls from 0.23.23 to 0.23.37
---
 Cargo.lock | 38 +++++++++++++++++++++++++-------------
 1 file changed, 25 insertions(+), 13 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a557cd2ced9e5..76e4c912d09ee 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1903,7 +1903,7 @@ dependencies = [
  "hyperlocal",
  "log",
  "pin-project-lite",
- "rustls 0.23.23",
+ "rustls 0.23.37",
  "rustls-native-certs 0.8.1",
  "rustls-pki-types",
  "serde",
@@ -5147,7 +5147,7 @@ dependencies = [
  "http 1.3.1",
  "hyper 1.7.0",
  "hyper-util",
- "rustls 0.23.23",
+ "rustls 0.23.37",
  "rustls-native-certs 0.8.1",
  "rustls-pki-types",
  "tokio",
@@ -6735,7 +6735,7 @@ dependencies = [
  "percent-encoding",
  "rand 0.8.5",
  "rustc_version_runtime",
- "rustls 0.23.23",
+ "rustls 0.23.37",
  "rustversion",
  "serde",
  "serde_bytes",
@@ -8505,7 +8505,7 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash",
- "rustls 0.23.23",
+ "rustls 0.23.37",
  "socket2 0.5.10",
  "thiserror 2.0.17",
  "tokio",
@@ -8524,7 +8524,7 @@ dependencies = [
  "rand 0.9.2",
  "ring",
  "rustc-hash",
- "rustls 0.23.23",
+ "rustls 0.23.37",
  "rustls-pki-types",
  "slab",
  "thiserror 2.0.17",
@@ -9094,7 +9094,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.23",
+ "rustls 0.23.37",
  "rustls-native-certs 0.8.1",
  "rustls-pki-types",
  "serde",
@@ -9436,15 +9436,15 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.23"
+version = "0.23.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47796c98c480fce5406ef69d1c76378375492c3b0a0de587be0c1d9feb12f395"
+checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
 dependencies = [
  "log",
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.102.8",
+ "rustls-webpki 0.103.10",
  "subtle",
  "zeroize",
 ]
@@ -9495,11 +9495,12 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.10.1"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2bf47e6ff922db3825eb750c4e2ff784c6ff8fb9e13046ef6a1d1c5401b0b37"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
 dependencies = [
  "web-time",
+ "zeroize",
 ]
 
 [[package]]
@@ -9523,6 +9524,17 @@ dependencies = [
  "untrusted",
 ]
 
+[[package]]
+name = "rustls-webpki"
+version = "0.103.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.22"
@@ -10378,7 +10390,7 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rustls 0.23.23",
+ "rustls 0.23.37",
  "serde",
  "serde_json",
  "sha2",
@@ -11230,7 +11242,7 @@ version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e727b36a1a0e8b74c376ac2211e40c2c8af09fb4013c60d910495810f008e9b"
 dependencies = [
- "rustls 0.23.23",
+ "rustls 0.23.37",
  "tokio",
 ]
 

From 6a50bd50c9d482511f5a2a21466a3427dd752263 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 30 Mar 2026 17:27:02 -0400
Subject: [PATCH 079/326] chore(internal docs): update security policy
 structure and content (#25074)

* docs(security): update security policy structure and content

* Re-add meta/review schedule

* Add whitespace

* Revert changes to User Privileges

* Finish CI/CD paragraph
---
 SECURITY.md | 102 ++++++++++++++++++++++------------------------------
 1 file changed, 43 insertions(+), 59 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index 667a3f7b19d8e..e56f752785d91 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -19,9 +19,11 @@ possible on our security efforts.
     - [Open Source](#open-source)
     - [Workflow](#workflow)
   - [Version Control](#version-control)
-    - [Git](#git)
+    - [Pull Requests](#pull-requests)
+    - [Reviews & Approvals](#reviews--approvals)
     - [Signed Commits](#signed-commits)
     - [Protected Branches](#protected-branches)
+    - [Merge Policies](#merge-policies)
 - [Personnel](#personnel)
   - [Education](#education)
   - [Policies](#policies)
@@ -34,26 +36,22 @@ possible on our security efforts.
     - [Unsafe Code](#unsafe-code)
     - [User Privileges](#user-privileges)
   - [Dependencies](#dependencies)
-  - [Change Control](#change-control)
-    - [Pull Requests](#pull-requests)
-    - [Reviews & Approvals](#reviews--approvals)
-    - [Merge Policies](#merge-policies)
   - [Automated Checks](#automated-checks)
     - [Vulnerability Scans & Security Advisories](#vulnerability-scans--security-advisories)
     - [Vulnerability Remediation](#vulnerability-remediation)
-    - [Fuzz Testing](#fuzz-testing)
 - [Infrastructure](#infrastructure)
   - [CI/CD](#cicd)
-    - [Runtime Isolation](#runtime-isolation)
   - [Network Security](#network-security)
-    - [Penetration Testing](#penetration-testing)
     - [Protocols](#protocols)
   - [Release Artifacts & Channels](#release-artifacts--channels)
     - [Asset Audit Logging](#asset-audit-logging)
     - [Asset Signatures & Checksums](#asset-signatures--checksums)
+- [Vulnerability Reporting](#vulnerability-reporting)
 - [Meta](#meta)
   - [Review Schedule](#review-schedule)
   - [Vulnerability Reporting](#vulnerability-reporting)
+    - [Vector CI](#vector-ci)
+    - [Other reports](#other-reports)
 
 ## Project Structure
 
@@ -84,10 +82,19 @@ are all publicly available.
 
 Version control ensures that all code changes are audited and authentic.
 
-#### Git
+Vector uses [Git][urls.git] to ensure that changes are auditable and traceable.
+
+#### Pull Requests
+
+All changes to Vector must go through a pull request review process.
+
+#### Reviews & Approvals
+
+All pull requests must be reviewed by at least one Vector team member. The
+review process takes into account many factors, all of which are detailed in
+our [Reviewing guide](REVIEWING.md). In exceptional circumstances, this
+approval can be retroactive.
 
-Vector leverages the [Git][urls.git] version-control system. This ensures all
-changes are audited and traceable.
 
 #### Signed Commits
 
@@ -107,6 +114,12 @@ are [protected][urls.github_protected_branches]. The exact requirements are:
 - Signed commits are required.
 - Administrators are included in these checks.
 
+#### Merge Policies
+
+Vector requires pull requests to pass all [automated checks](#automated-checks).
+Once passed, the pull request must be squashed and merged. This creates a clean
+linear history with a Vector team member's co-sign.
+
 ## Personnel
 
 ### Education
@@ -116,7 +129,7 @@ the [contributing](CONTRIBUTING.md) and [reviewing](REVIEWING.md) documents.
 
 ### Policies
 
-Vector maintains this security policy. Changed are communicated to all Vector
+Vector maintains this security policy. Changes are communicated to all Vector
 team members.
 
 ### Two-factor Authentication
@@ -150,8 +163,9 @@ catch many common sources of vulnerabilities at compile time.
 
 #### Unsafe Code
 
-Vector does not allow the use of unsafe code except in circumstances where it
-is required, such as dealing with CFFI.
+Vector uses unsafe code sparingly. Unsafe is sometimes required, such as dealing
+with CFFI. We may occasionally also use unsafe code for performance reasons but
+those changes are kept to a minimum.
 
 #### User Privileges
 
@@ -164,27 +178,6 @@ Vector aims to reduce the number of dependencies it relies on. If a dependency
 is added it goes through a comprehensive review process that is detailed in
 the [Reviewing guide](REVIEWING.md#dependencies).
 
-### Change Control
-
-As noted above Vector uses the Git version control system on GitHub.
-
-#### Pull Requests
-
-All changes to Vector must go through a pull request review process.
-
-#### Reviews & Approvals
-
-All pull requests must be reviewed by at least one Vector team member. The
-review process takes into account many factors, all of which are detailed in
-our [Reviewing guide](REVIEWING.md). In exceptional circumstances, this
-approval can be retroactive.
-
-#### Merge Policies
-
-Vector requires pull requests to pass all [automated checks](#automated-checks).
-Once passed, the pull request must be squashed and merged. This creates a clean
-linear history with a Vector team member's co-sign.
-
 ### Automated Checks
 
 When possible, we'll create automated checks to enforce security policies.
@@ -195,25 +188,21 @@ When possible, we'll create automated checks to enforce security policies.
   is part of the [Rust Security advisory database][urls.rust_sec]. The configuration, and a
   list of currently accepted advisories, are maintained in the
   [Cargo Deny configuration][urls.cargo_deny_configuration]. The check is run
-  [on every incoming PR][urls.cargo_deny_schedule] to the Vector project.
+  on every PR to the Vector project.
 - Vector implements [Dependabot][urls.dependabot] which performs automated
   upgrades on dependencies and [alerts][urls.dependabot_alerts] about any
   dependency-related security vulnerabilities.
 
 #### Vulnerability Remediation
 
-If the advisory check fails then the PR will not be merged. We review each advisory to
-determine what action to take. If possible, we update the dependency to a version
-where the vulnerability has been addressed. If this isn't possible we either record
-the acceptance of the vulnerability or replace the dependency. If we accept the
-vulnerability we open a ticket to track its remediation, generally awaiting a fix
-upstream. If the risk is deemed unacceptable we revisit the code and dependency
-to find a more secure alternative.
-
-#### Fuzz Testing
-
-Vector implements automated fuzz testing to probe our code for other sources
-of potential vulnerabilities.
+If the advisory check fails due to changes made in the PR, it will not be
+merged. We review each advisory to determine what action to take. Whenever
+possible, we update the dependency to a version where the vulnerability has been
+addressed. If this isn't possible we either record the acceptance of the
+vulnerability or replace the dependency. If we accept the vulnerability we open
+a ticket to track its remediation, generally awaiting a fix upstream. If the
+risk is deemed unacceptable we revisit the code and dependency to find a more
+secure alternative.
 
 ## Infrastructure
 
@@ -223,16 +212,12 @@ Vector's infrastructure and how we secure them.
 
 ### CI/CD
 
-#### Runtime Isolation
-
-All builds run in an isolated sandbox that is destroyed after each use.
+All builds run in GitHub Actions runners which are ephemeral and don't maintain
+state after the job is completed. We ensure we are following [OpenSSF best
+practices](https://bestpractices.dev/) to minimize CI risk and exposure.
 
 ### Network Security
 
-#### Penetration Testing
-
-Vector performs quarterly pen tests on vector.dev.
-
 #### Protocols
 
 All network traffic is secured via TLS and SSH. This includes checking out
@@ -260,7 +245,7 @@ Vector reviews this policy and all user access levels on a quarterly basis.
 
 We deeply appreciate any effort to discover and disclose security vulnerabilities responsibly.
 
-## Vector CI
+#### Vector CI
 
 If you would like to report a Vector CI vulnerability or have any security concerns with other Datadog products,
 please e-mail security@datadoghq.com.
@@ -270,9 +255,9 @@ and verify the vulnerability before taking the necessary steps to fix it. After
 our initial reply to your disclosure, which should be directly after receiving
 it, we will periodically update you with the status of the fix.
 
-## Other reports
+#### Other reports
 
-Due to the nature of a open-source project, Vector deployments are fully managed by users. Thus vulnerabilities in Vector deployments could
+Due to the nature of an open-source project, Vector deployments are fully managed by users. Thus vulnerabilities in Vector deployments could
 potentially be exploited by malicious actors who already have access to the user’s infrastructure. We encourage responsible disclosure
 via opening an [open an issue][urls.new_security_report] so that risks can be properly assessed and mitigated.
 
@@ -286,7 +271,6 @@ following when reporting:
 
 [urls.cargo_deny]: https://github.com/EmbarkStudios/cargo-deny
 [urls.cargo_deny_configuration]: https://github.com/vectordotdev/vector/blob/master/deny.toml
-[urls.cargo_deny_schedule]: https://github.com/vectordotdev/vector/blob/master/.github/workflows/test.yml#L267
 [urls.dependabot]: https://github.com/marketplace/dependabot-preview
 [urls.dependabot_alerts]: https://github.com/vectordotdev/vector/network/alerts
 [urls.git]: https://git-scm.com/

From 122cca4678172bbc0c067c65fcc909c6b7aa9ce6 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 30 Mar 2026 17:51:55 -0400
Subject: [PATCH 080/326] chore(ci): update GHCR cleanup workflow (#25037)

* chore(ci): improve GHCR cleanup workflow

- Add step to delete dated nightly tags older than 30 days, guarded
  against semver/release tags
- Increase test-runner cleanup batch size from 50 to 100
- Add continue-on-error to test-runner step
- Update workflow name and header comment

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(ci): replace gh CLI step with action for dated nightly cleanup

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* use ubuntu-24.04

* keep 30 nightlies

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/cleanup-ghcr-images.yml | 32 +++++++++++++----------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/cleanup-ghcr-images.yml b/.github/workflows/cleanup-ghcr-images.yml
index c11ecbf6a0c9d..dced4f4f0d449 100644
--- a/.github/workflows/cleanup-ghcr-images.yml
+++ b/.github/workflows/cleanup-ghcr-images.yml
@@ -2,39 +2,43 @@
 #
 # This workflow cleans up old images from GitHub Container Registry
 # to prevent unlimited storage growth. It runs weekly and removes:
-# 1. Untagged images from all packages (intermediate build artifacts)
-# 2. Old test-runner versions (keeps 50 most recent, deletes up to 50 oldest)
+# 1. Old dated nightly tags for vector (keeps last ~8)
+# 2. Old test-runner versions (keeps 5 most recent)
 
-name: Cleanup Untagged GHCR Images
+name: Cleanup GHCR Images
 
 on:
   schedule:
     # Run weekly on Sundays at 2 AM UTC
-    - cron: '0 2 * * 0'
+    - cron: "0 2 * * 0"
   workflow_dispatch:
 
 permissions:
-  contents: read  # Restrictive default
+  contents: read # Restrictive default
 
 jobs:
-  cleanup:
-    runs-on: ubuntu-latest
+  cleanup-vector-nightlies:
+    runs-on: ubuntu-24.04
     permissions:
-      packages: write   # Required to delete package versions from GHCR
+      packages: write # Required to delete package versions from GHCR
     steps:
-      - name: Delete untagged vector images
+      - name: Delete old dated nightly vector images
         uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
         with:
           package-name: vector
           package-type: container
-          min-versions-to-keep: 0
-          delete-only-untagged-versions: true
-        continue-on-error: true
+          min-versions-to-keep: 30
+          ignore-versions: '^(nightly$|\d+\.\d+)'
 
-      - name: Delete old vector-test-runner images
+  cleanup-test-runner:
+    runs-on: ubuntu-24.04
+    permissions:
+      packages: write # Required to delete package versions from GHCR
+    steps:
+      - name: Delete old test-runner images
         uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
         with:
           package-name: test-runner
           package-type: container
           min-versions-to-keep: 5
-          num-old-versions-to-delete: 50
+          num-old-versions-to-delete: 100

From 87ed519cc40011224208914f1dd79b7240f7e1d7 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 31 Mar 2026 09:36:52 -0400
Subject: [PATCH 081/326] chore(dev): consolidate advisory ignores with issue
 links (#25076)

chore(deny): consolidate advisory ignores with issue links
---
 deny.toml | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/deny.toml b/deny.toml
index 5a3f7dee13c4d..b8e0be77f41c8 100644
--- a/deny.toml
+++ b/deny.toml
@@ -40,16 +40,8 @@ license-files = [
 
 [advisories]
 ignore = [
-  # Vulnerability in `rsa` crate: https://rustsec.org/advisories/RUSTSEC-2023-0071.html
-  # There is not fix available yet.
-  # https://github.com/vectordotdev/vector/issues/19262
-  "RUSTSEC-2023-0071",
-  { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained" },
-  { id = "RUSTSEC-2024-0384", reason = "instant is unmaintained" },
-  { id = "RUSTSEC-2025-0012", reason = "backoff is unmaintained" },
-  # rustls-pemfile is unmaintained. Blocked by both async-nats and http 1.0.0 upgrade.
-  { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile is unmaintained" },
-  # rustls-webpki 0.101.7 vulnerability. Fix requires upgrading rustls from 0.21 to 0.23+,
-  # which is a significant chain upgrade through aws-smithy-http-client, hyper-rustls, tokio-rustls, etc.
-  { id = "RUSTSEC-2026-0049", reason = "Fix requires major rustls upgrade (0.21 -> 0.23+); tracked for future upgrade" },
+  { id = "RUSTSEC-2023-0071", reason = "rsa marvin attack - unpatched upstream (https://github.com/vectordotdev/vector/issues/19262)" },
+  { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained (https://github.com/vectordotdev/vector/issues/24940)" },
+  { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile is unmaintained - unpatched crate (https://github.com/bytebeamio/rumqtt/issues/1010) & tonic/reqwest upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
+  { id = "RUSTSEC-2026-0049", reason = "rustls-webpki 0.102 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
 ]

From 84c7af2264deacb1afc0529671d53c8c6792bf88 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 31 Mar 2026 09:41:49 -0400
Subject: [PATCH 082/326] fix(ci): install vdev via setup action in
 ci-integration-review workflow (#25077)

chore(ci): install vdev via setup action in ci-integration-review workflow
---
 .github/workflows/ci-integration-review.yml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci-integration-review.yml b/.github/workflows/ci-integration-review.yml
index a2a73c39e7d0e..30e359e366f30 100644
--- a/.github/workflows/ci-integration-review.yml
+++ b/.github/workflows/ci-integration-review.yml
@@ -117,14 +117,17 @@ jobs:
           submodules: "recursive"
           ref: ${{ github.event.review.commit_id }}
 
+      - uses: ./.github/actions/setup
+        with:
+          vdev: true
+          datadog-ci: true
+
       - name: Pull test runner image
         uses: ./.github/actions/pull-test-runner
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           commit_sha: ${{ github.event.review.commit_id }}
 
-      - run: bash scripts/environment/prepare.sh --modules=datadog-ci
-
       - name: Integration Tests - ${{ matrix.service }}
         if: ${{ startsWith(github.event.review.body, '/ci-run-integration-all')
           || startsWith(github.event.review.body, '/ci-run-all')
@@ -156,14 +159,17 @@ jobs:
           submodules: "recursive"
           ref: ${{ github.event.review.commit_id }}
 
+      - uses: ./.github/actions/setup
+        with:
+          vdev: true
+          datadog-ci: true
+
       - name: Pull test runner image
         uses: ./.github/actions/pull-test-runner
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           commit_sha: ${{ github.event.review.commit_id }}
 
-      - run: bash scripts/environment/prepare.sh --modules=datadog-ci
-
       - name: E2E Tests - ${{ matrix.service }}
         if: ${{ startsWith(github.event.review.body, '/ci-run-e2e-all')
           || startsWith(github.event.review.body, '/ci-run-all')

From d732259aaa6b5e156b001672ccf0e59be5e84802 Mon Sep 17 00:00:00 2001
From: StepSecurity Bot <bot@stepsecurity.io>
Date: Tue, 31 Mar 2026 10:08:30 -0700
Subject: [PATCH 083/326] chore(ci): pin GitHub actions to full sha (#25080)

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/integration_windows.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/integration_windows.yml b/.github/workflows/integration_windows.yml
index 5e89827f52e3a..39289d786fd24 100644
--- a/.github/workflows/integration_windows.yml
+++ b/.github/workflows/integration_windows.yml
@@ -16,7 +16,7 @@ jobs:
       windows: ${{ steps.filter.outputs.windows }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: filter
         with:
           filters: |

From 0943dd938f247b0a1963e6bcb1a464ae49392c5f Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 31 Mar 2026 14:54:02 -0400
Subject: [PATCH 084/326] chore(ci): migrate from markdownlint-cli to
 markdownlint-cli2 (#25081)

* chore(ci): migrate from markdownlint-cli to markdownlint-cli2

markdownlint-cli is the legacy CLI wrapper. markdownlint-cli2 is the
modern replacement used by all major editors (Zed, VS Code, JetBrains)
and auto-detects .markdownlint.jsonc without an explicit --config flag.

This unifies the linting tool between CI and local editor environments,
so developers see the same results in their IDE as in CI.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(ci): rename markdownlint input to markdownlint-cli2

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/actions/setup/action.yml    | 8 ++++----
 .github/workflows/test.yml          | 2 +-
 .markdownlint.jsonc                 | 5 +----
 Makefile                            | 2 +-
 scripts/environment/prepare.sh      | 8 ++++----
 vdev/src/commands/check/markdown.rs | 7 ++-----
 6 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 379afd232341c..f9037aebb68e8 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -76,10 +76,10 @@ inputs:
     description: "Install vdev CLI tool (cached by vdev/ directory changes)."
 
   # prepare.sh - npm
-  markdownlint:
+  markdownlint-cli2:
     required: false
     default: false
-    description: "Install markdownlint (npm)."
+    description: "Install markdownlint-cli2 (npm)."
   datadog-ci:
     required: false
     default: false
@@ -267,7 +267,7 @@ runs:
           ~/.cargo/bin/cargo-llvm-cov
           ~/.cargo/bin/dd-rust-license-tool
           ~/.cargo/bin/wasm-pack
-          /usr/local/bin/markdownlint
+          /usr/local/bin/markdownlint-cli2
           /usr/local/bin/datadog-ci
         key: ${{ runner.os }}-prepare-binaries-${{ hashFiles('scripts/environment/*') }}
         restore-keys: |
@@ -287,7 +287,7 @@ runs:
         [[ "${{ inputs.cargo-llvm-cov }}" == "true" ]] && mods+=("cargo-llvm-cov")
         [[ "${{ inputs.dd-rust-license-tool }}" == "true" ]] && mods+=("dd-rust-license-tool")
         [[ "${{ inputs.wasm-pack }}" == "true" ]] && mods+=("wasm-pack")
-        [[ "${{ inputs.markdownlint }}" == "true" ]] && mods+=("markdownlint")
+        [[ "${{ inputs.markdownlint-cli2 }}" == "true" ]] && mods+=("markdownlint-cli2")
         [[ "${{ inputs.datadog-ci }}" == "true" ]] && mods+=("datadog-ci")
         csm=$(IFS=,; echo "${mods[*]}")
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5572b2d3f8d9d..986b145305f78 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -147,7 +147,7 @@ jobs:
       - uses: ./.github/actions/setup
         with:
           rust: true
-          markdownlint: true
+          markdownlint-cli2: true
       - run: make check-markdown
 
   check-generated-docs:
diff --git a/.markdownlint.jsonc b/.markdownlint.jsonc
index 5bca38386599b..5e442a0162df4 100644
--- a/.markdownlint.jsonc
+++ b/.markdownlint.jsonc
@@ -1,7 +1,4 @@
-// This config is auto-detected by markdownlint-cli2 (used by Zed, VS Code, and most modern editors).
-// The CI check currently uses markdownlint-cli (legacy). Migrate CI to markdownlint-cli2 to unify tooling:
-//   npm install -g markdownlint-cli2
-//   markdownlint-cli2 "**/*.md"
+// Auto-detected by markdownlint-cli2 and editors (Zed, VS Code, JetBrains).
 {
   "default": true,
 
diff --git a/Makefile b/Makefile
index 8b1b856647b9c..5c52c367c11b7 100644
--- a/Makefile
+++ b/Makefile
@@ -508,7 +508,7 @@ check-markdown: ## Check that markdown is styled properly
 
 .PHONY: fix-markdown
 fix-markdown: ## Auto-fix markdown style issues
-	${MAYBE_ENVIRONMENT_EXEC} markdownlint --fix --config .markdownlint.jsonc $(shell git ls-files '*.md')
+	${MAYBE_ENVIRONMENT_EXEC} markdownlint-cli2 --fix $(shell git ls-files '*.md')
 
 .PHONY: check-examples
 check-examples: ## Check that the config/examples files are valid
diff --git a/scripts/environment/prepare.sh b/scripts/environment/prepare.sh
index 5bd5a29a79ac2..397fefbb464a8 100755
--- a/scripts/environment/prepare.sh
+++ b/scripts/environment/prepare.sh
@@ -37,7 +37,7 @@ CARGO_HACK_VERSION="0.6.43"
 DD_RUST_LICENSE_TOOL_VERSION="1.0.6"
 CARGO_LLVM_COV_VERSION="0.8.4"
 WASM_PACK_VERSION="0.13.1"
-MARKDOWNLINT_VERSION="0.45.0"
+MARKDOWNLINT_CLI2_VERSION="0.22.0"
 DATADOG_CI_VERSION="5.9.0"
 VDEV_VERSION="0.3.0"
 
@@ -52,7 +52,7 @@ ALL_MODULES=(
   cargo-llvm-cov
   dd-rust-license-tool
   wasm-pack
-  markdownlint
+  markdownlint-cli2
   datadog-ci
   release-flags  # Not a tool - sources release-flags.sh to set CI env vars
   vdev
@@ -92,7 +92,7 @@ Modules:
   cargo-llvm-cov
   dd-rust-license-tool
   wasm-pack
-  markdownlint
+  markdownlint-cli2
   datadog-ci
   vdev
 
@@ -218,5 +218,5 @@ maybe_install_cargo_tool dd-rust-license-tool "${DD_RUST_LICENSE_TOOL_VERSION}"
 maybe_install_cargo_tool wasm-pack "${WASM_PACK_VERSION}"
 maybe_install_cargo_tool vdev "${VDEV_VERSION}"
 
-maybe_install_npm_package markdownlint markdownlint-cli "${MARKDOWNLINT_VERSION}"
+maybe_install_npm_package markdownlint-cli2 markdownlint-cli2 "${MARKDOWNLINT_CLI2_VERSION}"
 maybe_install_npm_package datadog-ci "@datadog/datadog-ci" "${DATADOG_CI_VERSION}" "v${DATADOG_CI_VERSION}" "version"
diff --git a/vdev/src/commands/check/markdown.rs b/vdev/src/commands/check/markdown.rs
index 3ecf0c91f3201..1e10126a14e5e 100644
--- a/vdev/src/commands/check/markdown.rs
+++ b/vdev/src/commands/check/markdown.rs
@@ -14,11 +14,8 @@ impl Cli {
             return Ok(());
         }
 
-        let args: Vec<&str> = vec!["--config", ".markdownlint.jsonc"]
-            .into_iter()
-            .chain(files.iter().map(String::as_str))
-            .collect();
+        let args: Vec<&str> = files.iter().map(String::as_str).collect();
 
-        app::exec("markdownlint", &args, true)
+        app::exec("markdownlint-cli2", &args, true)
     }
 }

From 50345d5929ecb45d74e1355e612f044c24ff4a93 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 31 Mar 2026 14:27:15 -0400
Subject: [PATCH 085/326] chore(ci): skip test runner pull, datadog-ci install,
 and checkout when int tests won't run (#25068)

* chore(ci): skip test runner pull, datadog-ci install, and checkout when int tests won't run

* chore(ci): evaluate int/e2e run conditions once via step output
---
 .github/workflows/ci-integration-review.yml |  36 ++++--
 .github/workflows/integration.yml           | 118 ++++++++++----------
 2 files changed, 80 insertions(+), 74 deletions(-)

diff --git a/.github/workflows/ci-integration-review.yml b/.github/workflows/ci-integration-review.yml
index 30e359e366f30..72d2b4e660151 100644
--- a/.github/workflows/ci-integration-review.yml
+++ b/.github/workflows/ci-integration-review.yml
@@ -105,14 +105,19 @@ jobs:
       fail-fast: false
       matrix:
         service: [
-          "amqp", "appsignal", "aws", "axiom", "azure", "clickhouse", "databend", "datadog-agent",
-          "datadog-logs", "datadog-metrics", "datadog-traces", "dnstap", "docker-logs", "elasticsearch",
+          "amqp", "appsignal", "axiom", "aws", "azure", "clickhouse", "databend", "datadog-agent",
+          "datadog-logs", "datadog-metrics", "datadog-traces", "dnstap", "docker-logs", "doris", "elasticsearch",
           "eventstoredb", "fluent", "gcp", "greptimedb", "http-client", "influxdb", "kafka", "logstash",
-          "loki", "mongodb", "nats", "nginx", "opentelemetry", "postgres", "prometheus", "pulsar",
-          "redis", "splunk", "webhdfs"
+          "loki", "mqtt", "mongodb", "nats", "nginx", "opentelemetry", "postgres", "prometheus", "pulsar",
+          "redis", "webhdfs"
         ]
     steps:
+      - name: Evaluate run condition
+        id: run_condition
+        run: echo "should_run=${{ startsWith(github.event.review.body, '/ci-run-integration-all') || startsWith(github.event.review.body, '/ci-run-all') || startsWith(github.event.review.body, format('/ci-run-integration-{0}', matrix.service)) }}" >> $GITHUB_OUTPUT
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        if: steps.run_condition.outputs.should_run == 'true'
         with:
           submodules: "recursive"
           ref: ${{ github.event.review.commit_id }}
@@ -123,20 +128,21 @@ jobs:
           datadog-ci: true
 
       - name: Pull test runner image
+        if: steps.run_condition.outputs.should_run == 'true'
         uses: ./.github/actions/pull-test-runner
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           commit_sha: ${{ github.event.review.commit_id }}
 
       - name: Integration Tests - ${{ matrix.service }}
-        if: ${{ startsWith(github.event.review.body, '/ci-run-integration-all')
-          || startsWith(github.event.review.body, '/ci-run-all')
-          || startsWith(github.event.review.body, format('/ci-run-integration-{0}', matrix.service)) }}
+        if: steps.run_condition.outputs.should_run == 'true'
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
         with:
           timeout_minutes: 30
           max_attempts: 3
-          command: bash scripts/run-integration-test.sh int ${{ matrix.service }}
+          command: |
+            bash scripts/environment/prepare.sh --modules=datadog-ci
+            bash scripts/run-integration-test.sh int ${{ matrix.service }}
 
   e2e-tests:
     needs:
@@ -154,7 +160,12 @@ jobs:
           "datadog-logs", "datadog-metrics", "opentelemetry-logs", "opentelemetry-metrics"
         ]
     steps:
+      - name: Evaluate run condition
+        id: run_condition
+        run: echo "should_run=${{ startsWith(github.event.review.body, '/ci-run-e2e-all') || startsWith(github.event.review.body, '/ci-run-all') || startsWith(github.event.review.body, format('/ci-run-e2e-{0}', matrix.service)) }}" >> $GITHUB_OUTPUT
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        if: steps.run_condition.outputs.should_run == 'true'
         with:
           submodules: "recursive"
           ref: ${{ github.event.review.commit_id }}
@@ -165,20 +176,21 @@ jobs:
           datadog-ci: true
 
       - name: Pull test runner image
+        if: steps.run_condition.outputs.should_run == 'true'
         uses: ./.github/actions/pull-test-runner
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           commit_sha: ${{ github.event.review.commit_id }}
 
       - name: E2E Tests - ${{ matrix.service }}
-        if: ${{ startsWith(github.event.review.body, '/ci-run-e2e-all')
-          || startsWith(github.event.review.body, '/ci-run-all')
-          || startsWith(github.event.review.body, format('/ci-run-e2e-{0}', matrix.service)) }}
+        if: steps.run_condition.outputs.should_run == 'true'
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
         with:
           timeout_minutes: 35
           max_attempts: 3
-          command: bash scripts/run-integration-test.sh e2e ${{ matrix.service }}
+          command: |
+            bash scripts/environment/prepare.sh --modules=datadog-ci
+            bash scripts/run-integration-test.sh e2e ${{ matrix.service }}
 
 
   update-pr-status:
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 20fae17be16ae..861913c315cd4 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -84,59 +84,56 @@ jobs:
         ]
     timeout-minutes: 90
     steps:
+      - name: Download JSON artifact from changes.yml
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        if: github.event_name == 'merge_group'
+        with:
+          name: int_tests_changes
+
+      - name: Determine if test should run
+        id: check
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" || \
+                "${{ needs.changes.outputs.dependencies }}" == "true" || \
+                "${{ needs.changes.outputs.integration-yml }}" == "true" ]]; then
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+          elif [[ "${{ needs.changes.outputs.website_only }}" == "true" ]]; then
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          elif [[ -f int_tests_changes.json ]]; then
+            should_run=$(jq -r '."${{ matrix.service }}" // false' int_tests_changes.json)
+            echo "should_run=${should_run}" >> "$GITHUB_OUTPUT"
+          else
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        if: steps.check.outputs.should_run == 'true'
         with:
           submodules: "recursive"
 
       - uses: ./.github/actions/setup
+        if: steps.check.outputs.should_run == 'true'
         with:
           vdev: true
           mold: false
           cargo-cache: false
-
-      - name: Download JSON artifact from changes.yml
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
-        if: github.event_name == 'merge_group'
-        with:
-          name: int_tests_changes
+          datadog-ci: true
 
       - name: Pull test runner image
+        if: steps.check.outputs.should_run == 'true'
         uses: ./.github/actions/pull-test-runner
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           commit_sha: ${{ github.sha }}
 
       - name: Run Integration Tests for ${{ matrix.service }}
+        if: steps.check.outputs.should_run == 'true'
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
         with:
           timeout_minutes: 30
           max_attempts: 3
           command: |
-            if [[ -f int_tests_changes.json ]]; then
-              # Parse the JSON and check if the specific integration test should run.
-              should_run=$(jq -r '."${{ matrix.service }}" // false' int_tests_changes.json)
-            else
-              # The `changes` job did not run (manual run) or the file is missing, default to false.
-              should_run=false
-            fi
-
-            if [[ "${{ needs.changes.outputs.website_only }}" == "true" ]]; then
-              echo "Skipping ${{ matrix.service }} test since only website changes were detected"
-              exit 0
-            fi
-
-            # Check if any of the three conditions is true
-            if [[ "${{ github.event_name }}" == "workflow_dispatch" || \
-                  "${{ needs.changes.outputs.dependencies }}" == "true" || \
-                  "${{ needs.changes.outputs.integration-yml }}" == "true" || \
-                  "$should_run" == "true" ]]; then
-              # Only install dep if test runs
-              bash scripts/environment/prepare.sh --modules=datadog-ci
-              echo "Running test for ${{ matrix.service }}"
-              bash scripts/run-integration-test.sh int ${{ matrix.service }}
-            else
-              echo "Skipping ${{ matrix.service }} test as the value is false or conditions not met."
-            fi
+            bash scripts/run-integration-test.sh int ${{ matrix.service }}
 
 
   e2e-tests:
@@ -152,59 +149,56 @@ jobs:
     timeout-minutes: 90
 
     steps:
+      - name: Download JSON artifact from changes.yml
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        if: github.event_name == 'merge_group'
+        with:
+          name: e2e_tests_changes
+
+      - name: Determine if test should run
+        id: check
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" || \
+                "${{ needs.changes.outputs.dependencies }}" == "true" || \
+                "${{ needs.changes.outputs.integration-yml }}" == "true" ]]; then
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+          elif [[ "${{ needs.changes.outputs.website_only }}" == "true" ]]; then
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          elif [[ -f e2e_tests_changes.json ]]; then
+            should_run=$(jq -r '."${{ matrix.service }}" // false' e2e_tests_changes.json)
+            echo "should_run=${should_run}" >> "$GITHUB_OUTPUT"
+          else
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        if: steps.check.outputs.should_run == 'true'
         with:
           submodules: "recursive"
 
       - uses: ./.github/actions/setup
+        if: steps.check.outputs.should_run == 'true'
         with:
           vdev: true
           mold: false
           cargo-cache: false
-
-      - name: Download JSON artifact from changes.yml
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
-        if: github.event_name == 'merge_group'
-        with:
-          name: e2e_tests_changes
+          datadog-ci: true
 
       - name: Pull test runner image
+        if: steps.check.outputs.should_run == 'true'
         uses: ./.github/actions/pull-test-runner
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           commit_sha: ${{ github.sha }}
 
       - name: Run E2E Tests for ${{ matrix.service }}
+        if: steps.check.outputs.should_run == 'true'
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
         with:
           timeout_minutes: 30
           max_attempts: 3
           command: |
-            if [[ -f e2e_tests_changes.json ]]; then
-              # Parse the JSON and check if the specific e2e test should run.
-              should_run=$(jq -r '."${{ matrix.service }}" // false' e2e_tests_changes.json)
-            else
-              # The `changes` job did not run (manual run) or the file is missing, default to false.
-              should_run=false
-            fi
-
-            if [[ "${{ needs.changes.outputs.website_only }}" == "true" ]]; then
-              echo "Skipping ${{ matrix.service }} test since only website changes were detected"
-              exit 0
-            fi
-
-            # Check if any of the three conditions is true
-            if [[ "${{ github.event_name }}" == "workflow_dispatch" || \
-                  "${{ needs.changes.outputs.dependencies }}" == "true" || \
-                  "${{ needs.changes.outputs.integration-yml }}" == "true" ]] || \
-                  "$should_run" == "true" ]]; then
-              # Only install dep if test runs
-              bash scripts/environment/prepare.sh --modules=datadog-ci
-              echo "Running test for ${{ matrix.service }}"
-              bash scripts/run-integration-test.sh e2e ${{ matrix.service }}
-            else
-              echo "Skipping ${{ matrix.service }} test as the value is false or conditions not met."
-            fi
+            bash scripts/run-integration-test.sh e2e ${{ matrix.service }}
 
   integration-test-suite:
     name: Integration Test Suite

From 24d8db42e01e28b590e5484fede9279908805901 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 31 Mar 2026 18:04:57 -0400
Subject: [PATCH 086/326] chore(ci): remove unused publish-homebrew workflow
 (#25085)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/publish-homebrew.yml | 36 --------------------------
 1 file changed, 36 deletions(-)
 delete mode 100644 .github/workflows/publish-homebrew.yml

diff --git a/.github/workflows/publish-homebrew.yml b/.github/workflows/publish-homebrew.yml
deleted file mode 100644
index 117fe087c8441..0000000000000
--- a/.github/workflows/publish-homebrew.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: Publish to Homebrew
-
-on:
-  workflow_dispatch:
-    inputs:
-      vector_version:
-        description: "Vector version to publish"
-        required: true
-        type: string
-
-  workflow_call:
-    inputs:
-      git_ref:
-        required: true
-        type: string
-      vector_version:
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  publish-homebrew:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    env:
-      GITHUB_TOKEN: ${{ secrets.HOMEBREW_PAT }}
-    steps:
-      - name: Checkout Vector
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ inputs.git_ref || github.ref_name }}
-
-      - name: Publish update to Homebrew tap
-        run: make release-homebrew VECTOR_VERSION=${{ inputs.vector_version }}

From df00c7eec91ecb35eb0a8db0249701562de7dc87 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 1 Apr 2026 15:37:50 -0400
Subject: [PATCH 087/326] fix(ci): pin Pulsar integration test image to 4.1.3
 (#25097)

The `apachepulsar/pulsar:latest` image moved to a version that breaks
TLS connectivity, causing `pulsar_happy_tls` and
`consumes_event_with_tls` to fail consistently in CI.

Pin to 4.1.3 to unblock the merge queue. Re-enabling `latest` is
tracked in #25096.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 tests/integration/pulsar/config/test.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/integration/pulsar/config/test.yaml b/tests/integration/pulsar/config/test.yaml
index 9d7f33f60dac5..a273fb4e9f163 100644
--- a/tests/integration/pulsar/config/test.yaml
+++ b/tests/integration/pulsar/config/test.yaml
@@ -7,7 +7,9 @@ env:
   PULSAR_HOST: pulsar
 
 matrix:
-  version: [latest]
+  # TODO: re-enable `latest` once TLS tests pass with newer Pulsar images.
+  # See https://github.com/vectordotdev/vector/issues/25096
+  version: ["4.1.3"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch

From 639c924c733442bcc7443817d16ea0dd737ded54 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Apr 2026 20:24:01 +0000
Subject: [PATCH 088/326] chore(deps): bump debian from `1d3c811` to `26f98cc`
 in /distribution/docker/debian in the docker-images group across 1 directory
 (#24996)

chore(deps): bump debian

Bumps the docker-images group in /distribution/docker/debian with 1 update: debian.


Updates `debian` from `1d3c811` to `26f98cc`

---
updated-dependencies:
- dependency-name: debian
  dependency-version: trixie-slim
  dependency-type: direct:production
  dependency-group: docker-images
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 distribution/docker/debian/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/distribution/docker/debian/Dockerfile b/distribution/docker/debian/Dockerfile
index a726f8a72004c..4922e12ef9a60 100644
--- a/distribution/docker/debian/Dockerfile
+++ b/distribution/docker/debian/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/debian:trixie-slim@sha256:1d3c811171a08a5adaa4a163fbafd96b61b87aa871bbc7aa15431ac275d3d430 AS builder
+FROM docker.io/debian:trixie-slim@sha256:26f98ccd92fd0a44d6928ce8ff8f4921b4d2f535bfa07555ee5d18f61429cf0c AS builder
 
 WORKDIR /vector
 
@@ -7,7 +7,7 @@ RUN dpkg -i vector_*_"$(dpkg --print-architecture)".deb
 
 RUN mkdir -p /var/lib/vector
 
-FROM docker.io/debian:trixie-slim@sha256:1d3c811171a08a5adaa4a163fbafd96b61b87aa871bbc7aa15431ac275d3d430
+FROM docker.io/debian:trixie-slim@sha256:26f98ccd92fd0a44d6928ce8ff8f4921b4d2f535bfa07555ee5d18f61429cf0c
 
 # https://github.com/opencontainers/image-spec/blob/main/annotations.md
 LABEL org.opencontainers.image.url="https://vector.dev"

From 9dbdb0662b668867ac8db6e444ac710d4346a037 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Apr 2026 20:25:08 +0000
Subject: [PATCH 089/326] chore(deps): bump distroless/static from `28efbe9` to
 `47b2d72` in /distribution/docker/distroless-static in the docker-images
 group across 1 directory (#24998)

chore(deps): bump distroless/static

Bumps the docker-images group in /distribution/docker/distroless-static with 1 update: distroless/static.


Updates `distroless/static` from `28efbe9` to `47b2d72`

---
updated-dependencies:
- dependency-name: distroless/static
  dependency-version: latest
  dependency-type: direct:production
  dependency-group: docker-images
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 distribution/docker/distroless-static/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/distribution/docker/distroless-static/Dockerfile b/distribution/docker/distroless-static/Dockerfile
index 9518be0c4492c..312190cda5302 100644
--- a/distribution/docker/distroless-static/Dockerfile
+++ b/distribution/docker/distroless-static/Dockerfile
@@ -9,7 +9,7 @@ RUN mkdir -p /var/lib/vector
 
 # distroless doesn't use static tags
 # hadolint ignore=DL3007
-FROM gcr.io/distroless/static:latest@sha256:28efbe90d0b2f2a3ee465cc5b44f3f2cf5533514cf4d51447a977a5dc8e526d0
+FROM gcr.io/distroless/static:latest@sha256:47b2d72ff90843eb8a768b5c2f89b40741843b639d065b9b937b07cd59b479c6
 
 # https://github.com/opencontainers/image-spec/blob/main/annotations.md
 LABEL org.opencontainers.image.url="https://vector.dev"

From 3c879836d586695701e9cf60fed3e7ef4b408f2e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Apr 2026 20:25:30 +0000
Subject: [PATCH 090/326] chore(deps): bump debian from `1d3c811` to `26f98cc`
 in /distribution/docker/distroless-libc in the docker-images group across 1
 directory (#24997)

chore(deps): bump debian

Bumps the docker-images group in /distribution/docker/distroless-libc with 1 update: debian.


Updates `debian` from `1d3c811` to `26f98cc`

---
updated-dependencies:
- dependency-name: debian
  dependency-version: trixie-slim
  dependency-type: direct:production
  dependency-group: docker-images
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 distribution/docker/distroless-libc/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/distribution/docker/distroless-libc/Dockerfile b/distribution/docker/distroless-libc/Dockerfile
index 2e3988b7403fe..0ae19e00e17d8 100644
--- a/distribution/docker/distroless-libc/Dockerfile
+++ b/distribution/docker/distroless-libc/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/debian:trixie-slim@sha256:1d3c811171a08a5adaa4a163fbafd96b61b87aa871bbc7aa15431ac275d3d430 AS builder
+FROM docker.io/debian:trixie-slim@sha256:26f98ccd92fd0a44d6928ce8ff8f4921b4d2f535bfa07555ee5d18f61429cf0c AS builder
 
 WORKDIR /vector
 

From 9f484c2b9c1c219f44c2fd5289c40e3a4b63f6e3 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 1 Apr 2026 19:26:12 -0400
Subject: [PATCH 091/326] fix(ci): prevent script injection in integration
 review workflow (#25106)

---
 .github/workflows/ci-integration-review.yml | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-integration-review.yml b/.github/workflows/ci-integration-review.yml
index 72d2b4e660151..029ea40e05963 100644
--- a/.github/workflows/ci-integration-review.yml
+++ b/.github/workflows/ci-integration-review.yml
@@ -114,7 +114,15 @@ jobs:
     steps:
       - name: Evaluate run condition
         id: run_condition
-        run: echo "should_run=${{ startsWith(github.event.review.body, '/ci-run-integration-all') || startsWith(github.event.review.body, '/ci-run-all') || startsWith(github.event.review.body, format('/ci-run-integration-{0}', matrix.service)) }}" >> $GITHUB_OUTPUT
+        env:
+          REVIEW_BODY: ${{ github.event.review.body }}
+          SERVICE: ${{ matrix.service }}
+        run: |
+          if [[ "$REVIEW_BODY" == /ci-run-integration-all* ]] || [[ "$REVIEW_BODY" == /ci-run-all* ]] || [[ "$REVIEW_BODY" == "/ci-run-integration-${SERVICE}"* ]]; then
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          fi
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: steps.run_condition.outputs.should_run == 'true'
@@ -162,7 +170,15 @@ jobs:
     steps:
       - name: Evaluate run condition
         id: run_condition
-        run: echo "should_run=${{ startsWith(github.event.review.body, '/ci-run-e2e-all') || startsWith(github.event.review.body, '/ci-run-all') || startsWith(github.event.review.body, format('/ci-run-e2e-{0}', matrix.service)) }}" >> $GITHUB_OUTPUT
+        env:
+          REVIEW_BODY: ${{ github.event.review.body }}
+          SERVICE: ${{ matrix.service }}
+        run: |
+          if [[ "$REVIEW_BODY" == /ci-run-e2e-all* ]] || [[ "$REVIEW_BODY" == /ci-run-all* ]] || [[ "$REVIEW_BODY" == "/ci-run-e2e-${SERVICE}"* ]]; then
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+          fi
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: steps.run_condition.outputs.should_run == 'true'

From 9055388bc0c89a56177f6df60de7a7e09fe74de1 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 2 Apr 2026 09:48:09 -0400
Subject: [PATCH 092/326] chore(dev): add repo-wide prettier config for YAML,
 JS, TS, and JSON (#25082)

* chore: add repo-wide prettier for YAML/JS/TS/JSON formatting

Add a root .prettierrc.json (auto-detected by Zed, VS Code, JetBrains)
and .prettierignore to skip Hugo templates, generated files, and VRL
configs with triple-quoted strings.

- Pin prettier@3.5.3 in prepare.sh and .github/actions/setup
- Integrate prettier into vdev check fmt / vdev fmt
- Add check-prettier and fix-prettier Makefile targets
- Add prettier path filter in changes.yml so check-fmt triggers on
  YAML/JS/TS/JSON changes
- Remove website/.prettierrc.json (superseded by root config)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: format all YAML/JS/TS/JSON files with prettier

Run make fix-prettier to establish a consistent formatting baseline.
Changes are purely cosmetic: whitespace cleanup, quote normalization,
and array formatting.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: use git ls-files instead of globs for prettier file discovery

Shell globs expand to include untracked directories. Use git ls-files
to only format tracked files, consistent with how markdownlint works.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: pass --ignore-path .prettierignore when using git ls-files

When prettier receives explicit file paths it skips .prettierignore.
Pass --ignore-path explicitly so exclusions (lib/codecs/tests/data,
config examples with VRL triple-quotes, Hugo build output, etc.) are
still respected.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: suppress file list echo in prettier Makefile targets

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: invoke prettier per file extension to avoid ARG_MAX

Running prettier with all tracked files in a single invocation can
exceed macOS ARG_MAX (262 KB) since this repo has ~4400 matching paths.
Invoke prettier once per extension type instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: log per-extension prettier invocations in vdev

Move info! inside the loop so each extension type logs its own
progress line.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: bump prettier to 3.8.1 to match local version

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: address PR feedback on prettier setup

- Remove unused vendor/ entry from .prettierignore
- Deduplicate PRETTIER_EXTENSIONS constant between fmt and check/fmt

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/DISCUSSION_TEMPLATE/q-a.yml           |    2 +-
 .github/ISSUE_TEMPLATE/bug.yml                |  152 +--
 .github/ISSUE_TEMPLATE/config.yml             |    1 -
 .github/ISSUE_TEMPLATE/feature.yml            |  167 ++-
 .github/actions/install-vdev/action.yml       |    2 +-
 .github/actions/pull-test-runner/action.yml   |    4 +-
 .github/actions/setup/action.yml              |    7 +-
 .github/dependabot.yml                        |   52 +-
 .github/labeler.yml                           |   24 +-
 .github/workflows/build-test-runner.yml       |    8 +-
 .github/workflows/build_preview_sites.yml     |   32 +-
 .github/workflows/changes.yml                 |  222 +--
 .github/workflows/ci-integration-review.yml   |   67 +-
 .github/workflows/ci-review-trigger.yml       |   28 +-
 .github/workflows/component_features.yml      |    6 +-
 .github/workflows/coverage.yml                |    4 +-
 .github/workflows/create_preview_sites.yml    |   12 +-
 .github/workflows/cross.yml                   |    2 +-
 .github/workflows/custom_builds.yml           |    6 +-
 .github/workflows/deny.yml                    |    6 +-
 .github/workflows/environment.yml             |    6 +-
 .github/workflows/install-sh.yml              |    4 +-
 .github/workflows/integration-test.yml        |    2 +-
 .github/workflows/integration.yml             |   51 +-
 .github/workflows/k8s_e2e.yml                 |    6 +-
 .github/workflows/labeler.yml                 |    8 +-
 .github/workflows/nightly.yml                 |    8 +-
 .github/workflows/preview_site_trigger.yml    |    6 +-
 .github/workflows/protobuf.yml                |   10 +-
 .github/workflows/publish.yml                 |   16 +-
 .github/workflows/regression.yml              |   27 +-
 .github/workflows/release.yml                 |    6 +-
 .github/workflows/scorecard.yml               |    4 +-
 .github/workflows/spelling.yml                |  105 +-
 .github/workflows/static-analysis.yml         |    4 +-
 .github/workflows/test-make-command.yml       |   11 +-
 .github/workflows/test.yml                    |    5 +-
 .github/workflows/unit_mac.yml                |    3 +-
 .github/workflows/unit_windows.yml            |    3 +-
 .github/workflows/vdev_publish.yml            |    6 +-
 .prettierignore                               |   30 +
 .prettierrc.json                              |    4 +
 Makefile                                      |   18 +
 config/examples/environment_variables.yaml    |    6 +-
 .../examples/file_to_cloudwatch_metrics.yaml  |   12 +-
 .../namespacing/sinks/es_cluster.yaml         |    6 +-
 .../namespacing/sinks/s3_archives.yaml        |   12 +-
 .../namespacing/transforms/apache_sample.yaml |    2 +-
 config/examples/stdio.yaml                    |    2 +-
 config/examples/wrapped_json.yaml             |    6 +-
 .../collector/logs/v1/logs_service_http.yaml  |    9 +-
 .../metrics/v1/metrics_service_http.yaml      |    9 +-
 .../trace/v1/trace_service_http.yaml          |    8 +-
 .../data/fixtures/log_event/malformed.json    |    2 +-
 .../resources/json-schema_definition.json     |   11 +-
 lib/vector-vrl/web-playground/public/index.js |  552 ++++----
 .../web-playground/public/vrl-highlighter.js  | 1199 ++++++++---------
 .../lading/lading.yaml                        |   37 +-
 .../vector/vector.yaml                        |   36 +-
 .../lading/lading.yaml                        |   37 +-
 .../vector/vector.yaml                        |   36 +-
 .../lading/lading.yaml                        |   36 +-
 .../vector/vector.yaml                        |   30 +-
 .../lading/lading.yaml                        |   36 +-
 .../vector/vector.yaml                        |   30 +-
 .../file_100_to_blackhole/lading/lading.yaml  |   37 +-
 .../file_100_to_blackhole/vector/vector.yaml  |   10 +-
 .../file_to_blackhole/lading/lading.yaml      |   37 +-
 .../file_to_blackhole/vector/vector.yaml      |   10 +-
 .../fluent_elasticsearch/lading/lading.yaml   |   37 +-
 .../fluent_elasticsearch/vector/vector.yaml   |   16 +-
 .../http_elasticsearch/lading/lading.yaml     |   37 +-
 .../http_elasticsearch/vector/vector.yaml     |   16 +-
 .../http_text_to_http_json/lading/lading.yaml |   37 +-
 .../http_text_to_http_json/vector/vector.yaml |   10 +-
 .../http_to_http_acks/lading/lading.yaml      |   37 +-
 .../http_to_http_acks/vector/vector.yaml      |   16 +-
 .../http_to_http_disk_buffer/experiment.yaml  |    1 -
 .../lading/lading.yaml                        |   38 +-
 .../vector/vector.yaml                        |   12 +-
 .../http_to_http_json/lading/lading.yaml      |   37 +-
 .../http_to_http_json/vector/vector.yaml      |   16 +-
 .../http_to_http_noack/lading/lading.yaml     |   37 +-
 .../http_to_http_noack/vector/vector.yaml     |   16 +-
 .../cases/http_to_s3/lading/lading.yaml       |   36 +-
 .../cases/http_to_s3/vector/vector.yaml       |   18 +-
 .../otlp_grpc_to_blackhole/lading/lading.yaml |   37 +-
 .../otlp_grpc_to_blackhole/vector/vector.yaml |   10 +-
 .../otlp_http_to_blackhole/lading/lading.yaml |   37 +-
 .../otlp_http_to_blackhole/vector/vector.yaml |   10 +-
 .../lading/lading.yaml                        |   37 +-
 .../vector/vector.yaml                        |   14 +-
 .../lading/lading.yaml                        |   37 +-
 .../vector/vector.yaml                        |   10 +-
 .../splunk_hec_route_s3/lading/lading.yaml    |   36 +-
 .../splunk_hec_route_s3/vector/vector.yaml    |   36 +-
 .../lading/lading.yaml                        |   36 +-
 .../vector/vector.yaml                        |   14 +-
 .../lading/lading.yaml                        |   36 +-
 .../vector/vector.yaml                        |   14 +-
 .../lading/lading.yaml                        |   36 +-
 .../syslog_humio_logs/lading/lading.yaml      |   36 +-
 .../syslog_humio_logs/vector/vector.yaml      |   16 +-
 .../lading/lading.yaml                        |   36 +-
 .../vector/vector.yaml                        |   20 +-
 .../lading/lading.yaml                        |   36 +-
 .../vector/vector.yaml                        |   20 +-
 .../lading/lading.yaml                        |   36 +-
 .../vector/vector.yaml                        |   22 +-
 .../cases/syslog_loki/lading/lading.yaml      |   37 +-
 .../cases/syslog_loki/vector/vector.yaml      |   16 +-
 .../lading/lading.yaml                        |   36 +-
 .../vector/vector.yaml                        |   26 +-
 .../syslog_splunk_hec_logs/lading/lading.yaml |   36 +-
 .../syslog_splunk_hec_logs/vector/vector.yaml |   16 +-
 regression/config.yaml                        |    1 -
 scripts/environment/prepare.sh                |    4 +
 tests/data/cmd/config/config_3.json           |    8 +-
 tests/data/secret-backends/file-secrets.json  |    2 +-
 tests/e2e/datadog-logs/config/compose.yaml    |   22 +-
 tests/e2e/datadog-logs/config/test.yaml       |   25 +-
 tests/e2e/datadog-logs/data/agent_only.yaml   |    4 +-
 tests/e2e/datadog-logs/data/agent_vector.yaml |    4 +-
 tests/e2e/datadog-metrics/config/compose.yaml |   15 +-
 tests/e2e/datadog-metrics/config/test.yaml    |   26 +-
 .../e2e/datadog-metrics/data/agent_only.yaml  |    2 +-
 .../datadog-metrics/data/agent_vector.yaml    |    2 +-
 .../opentelemetry-logs/config/compose.yaml    |    6 +-
 tests/e2e/opentelemetry-logs/config/test.yaml |   10 +-
 .../data/collector-sink.yaml                  |   10 +-
 .../data/collector-source.yaml                |   16 +-
 .../data/vector_default.yaml                  |    3 +-
 .../opentelemetry-metrics/config/compose.yaml |    6 +-
 .../opentelemetry-metrics/config/test.yaml    |    8 +-
 .../data/collector-sink.yaml                  |   10 +-
 .../data/collector-source.yaml                |   10 +-
 tests/integration/amqp/config/compose.yaml    |    2 +-
 tests/integration/amqp/config/test.yaml       |   18 +-
 tests/integration/appsignal/config/test.yaml  |    8 +-
 tests/integration/aws/config/compose.yaml     |   12 +-
 tests/integration/aws/config/test.yaml        |   18 +-
 tests/integration/axiom/config/test.yaml      |   10 +-
 tests/integration/azure/config/compose.yaml   |    4 +-
 tests/integration/azure/config/test.yaml      |   10 +-
 .../clickhouse/config/compose.yaml            |    2 +-
 tests/integration/clickhouse/config/test.yaml |   12 +-
 .../integration/databend/config/compose.yaml  |    2 +-
 tests/integration/databend/config/test.yaml   |   12 +-
 .../datadog-agent/config/compose.yaml         |   40 +-
 .../datadog-agent/config/test.yaml            |   14 +-
 .../integration/datadog-logs/config/test.yaml |   14 +-
 .../datadog-metrics/config/test.yaml          |   14 +-
 .../datadog-traces/config/compose.yaml        |   46 +-
 .../datadog-traces/config/test.yaml           |   18 +-
 tests/integration/dnstap/config/test.yaml     |   14 +-
 .../integration/docker-logs/config/test.yaml  |   12 +-
 tests/integration/doris/config/test.yaml      |   16 +-
 .../elasticsearch/config/compose.yaml         |   30 +-
 .../elasticsearch/config/test.yaml            |   10 +-
 .../eventstoredb/config/compose.yaml          |    4 +-
 .../integration/eventstoredb/config/test.yaml |   12 +-
 tests/integration/fluent/config/test.yaml     |   10 +-
 tests/integration/gcp/config/compose.yaml     |   14 +-
 tests/integration/gcp/config/invalidauth.json |    2 +-
 tests/integration/gcp/config/test.yaml        |   20 +-
 .../greptimedb/config/compose.yaml            |    2 +-
 tests/integration/greptimedb/config/test.yaml |    8 +-
 .../http-client/config/compose.yaml           |   34 +-
 .../integration/http-client/config/test.yaml  |   10 +-
 .../http-client/data/serve/logs/json.json     |    2 +-
 .../data/serve/metrics/native.json            |    2 +-
 .../http-client/data/serve/traces/native.json |    2 +-
 tests/integration/humio/config/compose.yaml   |    2 +-
 tests/integration/humio/config/test.yaml      |   10 +-
 .../integration/influxdb/config/compose.yaml  |   16 +-
 tests/integration/influxdb/config/test.yaml   |   14 +-
 tests/integration/kafka/config/compose.yaml   |   48 +-
 tests/integration/kafka/config/test.yaml      |   18 +-
 .../integration/logstash/config/compose.yaml  |   10 +-
 tests/integration/logstash/config/test.yaml   |   10 +-
 tests/integration/logstash/data/heartbeat.yml |   10 +-
 tests/integration/loki/config/compose.yaml    |    2 +-
 tests/integration/loki/config/test.yaml       |   12 +-
 tests/integration/mongodb/config/compose.yaml |   38 +-
 tests/integration/mongodb/config/test.yaml    |   12 +-
 tests/integration/mqtt/config/compose.yaml    |    4 +-
 tests/integration/mqtt/config/test.yaml       |   14 +-
 tests/integration/nats/config/compose.yaml    |   44 +-
 tests/integration/nginx/config/compose.yaml   |   16 +-
 tests/integration/nginx/config/test.yaml      |   12 +-
 .../opentelemetry/config/compose.yaml         |    4 +-
 .../opentelemetry/config/test.yaml            |   10 +-
 .../opentelemetry/data/config.yaml            |    6 +-
 .../integration/postgres/config/compose.yaml  |   12 +-
 tests/integration/postgres/config/test.yaml   |   16 +-
 .../prometheus/config/compose.yaml            |   20 +-
 tests/integration/prometheus/config/test.yaml |   20 +-
 .../prometheus/data/prometheus.yaml           |    8 +-
 tests/integration/pulsar/config/compose.yaml  |    2 +-
 tests/integration/pulsar/config/test.yaml     |   12 +-
 tests/integration/redis/config/compose.yaml   |    2 +-
 tests/integration/redis/config/test.yaml      |   14 +-
 .../integration/shutdown/config/compose.yaml  |   48 +-
 tests/integration/shutdown/config/test.yaml   |    6 +-
 tests/integration/splunk/config/compose.yaml  |   16 +-
 tests/integration/splunk/config/test.yaml     |   16 +-
 tests/integration/webhdfs/config/compose.yaml |    2 +-
 tests/integration/webhdfs/config/test.yaml    |   12 +-
 .../windows-event-log/config/test.yaml        |   10 +-
 .../ignore-invalid/sinks/es_cluster.json      |    6 +-
 .../namespacing/success/sinks/es_cluster.json |    6 +-
 vdev/src/commands/check/fmt.rs                |   19 +-
 vdev/src/commands/fmt.rs                      |   22 +-
 website/.htmltest.external.yml                |   16 +-
 website/.prettierrc.json                      |   17 -
 website/algolia.json                          |   33 +-
 website/assets/js/below.js                    |   16 +-
 website/assets/js/home.tsx                    |  346 +++--
 website/assets/js/search.tsx                  |  209 ++-
 website/babel.config.js                       |   18 +-
 website/data/redirects.yaml                   |  132 +-
 website/postcss.config.js                     |   16 +-
 website/scripts/create-config-examples.js     |  143 +-
 website/scripts/typesense-index.ts            |   50 +-
 website/scripts/typesense-sync.ts             |   13 +-
 website/typesense.config.json                 |    2 +-
 226 files changed, 4028 insertions(+), 2779 deletions(-)
 create mode 100644 .prettierignore
 create mode 100644 .prettierrc.json
 delete mode 100644 website/.prettierrc.json

diff --git a/.github/DISCUSSION_TEMPLATE/q-a.yml b/.github/DISCUSSION_TEMPLATE/q-a.yml
index 23cb1f8467745..cc4942b0976ce 100644
--- a/.github/DISCUSSION_TEMPLATE/q-a.yml
+++ b/.github/DISCUSSION_TEMPLATE/q-a.yml
@@ -1,5 +1,5 @@
 title: "Q&A"
-labels: [ q-a ]
+labels: [q-a]
 body:
   - type: markdown
     attributes:
diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml
index 47354ec1ba30e..ff1c7df5e83ca 100644
--- a/.github/ISSUE_TEMPLATE/bug.yml
+++ b/.github/ISSUE_TEMPLATE/bug.yml
@@ -1,94 +1,94 @@
 name: Bug
 description: 🐛 Let us know about an unexpected error, a crash, or an incorrect behavior.
-type: 'Bug'
+type: "Bug"
 body:
-- type: markdown
-  attributes:
-    value: |
-      Thank you for opening 🐛 bug report!
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for opening 🐛 bug report!
 
-- type: textarea
-  attributes:
-    label: A note for the community
-    value: |
-      <!-- Please keep this note for the community -->
-      * Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
-      * If you are interested in working on this issue or have submitted a pull request, please leave a comment
-      <!-- Thank you for keeping this note for the community -->
+  - type: textarea
+    attributes:
+      label: A note for the community
+      value: |
+        <!-- Please keep this note for the community -->
+        * Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
+        * If you are interested in working on this issue or have submitted a pull request, please leave a comment
+        <!-- Thank you for keeping this note for the community -->
 
-- type: textarea
-  id: problem
-  attributes:
-    label: Problem
-    description: >
-      Please provide a clear and concise description of what the bug is,
-      including what currently happens and what you expected to happen.
-  validations:
-    required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: >
+        Please provide a clear and concise description of what the bug is,
+        including what currently happens and what you expected to happen.
+    validations:
+      required: true
 
-- type: textarea
-  id: config
-  attributes:
-    label: Configuration
-    description: |
-      Paste the relevant parts of your Vector configuration file.
+  - type: textarea
+    id: config
+    attributes:
+      label: Configuration
+      description: |
+        Paste the relevant parts of your Vector configuration file.
 
-      !! If your config files contain sensitive information please remove it !!
-    render: text
+        !! If your config files contain sensitive information please remove it !!
+      render: text
 
-- type: input
-  id: version
-  attributes:
-    label: Version
-    description: |
-      Please paste the output of running `vector --version`.
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: |
+        Please paste the output of running `vector --version`.
 
-      If you are not running the latest version of Vector, please try upgrading
-      because your issue may have already been fixed.
-  validations:
-    required: true
+        If you are not running the latest version of Vector, please try upgrading
+        because your issue may have already been fixed.
+    validations:
+      required: true
 
-- type: textarea
-  id: debug
-  attributes:
-    label: Debug Output
-    description: |
-      Full debug output can be obtained by running Vector with the following:
+  - type: textarea
+    id: debug
+    attributes:
+      label: Debug Output
+      description: |
+        Full debug output can be obtained by running Vector with the following:
 
-      ```
-      RUST_BACKTRACE=full vector -vvv <rest of commands>
-      ```
+        ```
+        RUST_BACKTRACE=full vector -vvv <rest of commands>
+        ```
 
-      If the debug output is long, please create a GitHub Gist containing the debug output and paste the link here.
+        If the debug output is long, please create a GitHub Gist containing the debug output and paste the link here.
 
-      !! Debug output may contain sensitive information. Please review it before posting publicly. !!
-    render: text
+        !! Debug output may contain sensitive information. Please review it before posting publicly. !!
+      render: text
 
-- type: textarea
-  id: data
-  attributes:
-    label: Example Data
-    description: |
-      Please provide any example data that will help debug the issue, for example:
+  - type: textarea
+    id: data
+    attributes:
+      label: Example Data
+      description: |
+        Please provide any example data that will help debug the issue, for example:
 
-      ```
-      201.69.207.46 - kemmer6752 [07/06/2019:14:53:55 -0400] "PATCH /innovative/interfaces" 301 669
-      ```
+        ```
+        201.69.207.46 - kemmer6752 [07/06/2019:14:53:55 -0400] "PATCH /innovative/interfaces" 301 669
+        ```
 
-- type: textarea
-  id: context
-  attributes:
-    label: Additional Context
-    description: |
-      Is there anything atypical about your situation that we should know? For
-      example: is Vector running in Kubernetes? Are you passing any unusual command
-      line options or environment variables to opt-in to non-default behavior?
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: |
+        Is there anything atypical about your situation that we should know? For
+        example: is Vector running in Kubernetes? Are you passing any unusual command
+        line options or environment variables to opt-in to non-default behavior?
 
-- type: textarea
-  id: references
-  attributes:
-    label: References
-    description: |
-      Are there any other GitHub issues (open or closed) or Pull Requests that should be linked here? For example:
+  - type: textarea
+    id: references
+    attributes:
+      label: References
+      description: |
+        Are there any other GitHub issues (open or closed) or Pull Requests that should be linked here? For example:
 
-      - #6017
+        - #6017
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index ea44ff1b06562..df12e12af4f76 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -12,4 +12,3 @@ contact_links:
   - name: Twitter
     url: https://twitter.com/vectordotdev
     about: Follow us and stay up to date with Vector.
-
diff --git a/.github/ISSUE_TEMPLATE/feature.yml b/.github/ISSUE_TEMPLATE/feature.yml
index f2e066bb37303..8b7a6fc139185 100644
--- a/.github/ISSUE_TEMPLATE/feature.yml
+++ b/.github/ISSUE_TEMPLATE/feature.yml
@@ -1,87 +1,86 @@
 name: Feature
-type: 'Feature'
+type: "Feature"
 description: 🚀 Suggest a new feature.
 body:
-- type: markdown
-  attributes:
-    value: |
-      Thank you for opening 🚀 feature request!
-
-      For general questions about Vector usage, please see
-      https://discussions.vector.dev.
-
-- type: textarea
-  attributes:
-    label: A note for the community
-    value: |
-      <!-- Please keep this note for the community -->
-      * Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
-      * If you are interested in working on this issue or have submitted a pull request, please leave a comment
-      <!-- Thank you for keeping this note for the community -->
-
-- type: textarea
-  id: use-cases
-  attributes:
-    label: Use Cases
-    description: |
-      In order to properly evaluate a feature request, it is necessary to
-      understand the use-cases for it.
-
-      Please describe below the _end goal_ you are trying to achieve that has
-      led you to request this feature.
-
-      Please keep this section focused on the problem and not on the suggested
-      solution. We'll get to that in a moment, below!
-
-
-- type: textarea
-  id: attempted-solutions
-  attributes:
-    label: Attempted Solutions
-    description: |
-      If you've already tried to solve the problem within Vector's existing
-      features and found a limitation that prevented you from succeeding, please
-      describe it below in as much detail as possible.
-
-      Ideally, this would include real configuration snippets that you tried
-      and what results you got in each case.
-
-      Please remove any sensitive information such as passwords before sharing
-      configuration snippets and command lines.
-
-- type: textarea
-  id: proposal
-  attributes:
-    label: Proposal
-    description: |
-      If you have an idea for a way to address the problem via a change to
-      Vector features, please describe it below.
-
-      In this section, it's helpful to include specific examples of how what
-      you are suggesting might look in configuration files, or on the command line,
-      since that allows us to understand the full picture of what you are proposing.
-
-      If you're not sure of some details, don't worry! When we evaluate the
-      feature request we may suggest modifications as necessary to work within the
-      design constraints of Vector.
-
-- type: textarea
-  id: references
-  attributes:
-    label: References
-    description: |
-      Are there any other GitHub issues, whether open or closed, that are
-      related to the problem you've described above or to the suggested solution? If
-      so, please create a list below that mentions each of them. For example:
-
-      - #7023
-
-- type: input
-  id: version
-  attributes:
-    label: Version
-    description: |
-      Please paste the output of running `vector --version`.
-
-      This will record which version was current at the time of your feature request,
-      to help manage the request backlog.
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for opening 🚀 feature request!
+
+        For general questions about Vector usage, please see
+        https://discussions.vector.dev.
+
+  - type: textarea
+    attributes:
+      label: A note for the community
+      value: |
+        <!-- Please keep this note for the community -->
+        * Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
+        * If you are interested in working on this issue or have submitted a pull request, please leave a comment
+        <!-- Thank you for keeping this note for the community -->
+
+  - type: textarea
+    id: use-cases
+    attributes:
+      label: Use Cases
+      description: |
+        In order to properly evaluate a feature request, it is necessary to
+        understand the use-cases for it.
+
+        Please describe below the _end goal_ you are trying to achieve that has
+        led you to request this feature.
+
+        Please keep this section focused on the problem and not on the suggested
+        solution. We'll get to that in a moment, below!
+
+  - type: textarea
+    id: attempted-solutions
+    attributes:
+      label: Attempted Solutions
+      description: |
+        If you've already tried to solve the problem within Vector's existing
+        features and found a limitation that prevented you from succeeding, please
+        describe it below in as much detail as possible.
+
+        Ideally, this would include real configuration snippets that you tried
+        and what results you got in each case.
+
+        Please remove any sensitive information such as passwords before sharing
+        configuration snippets and command lines.
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: |
+        If you have an idea for a way to address the problem via a change to
+        Vector features, please describe it below.
+
+        In this section, it's helpful to include specific examples of how what
+        you are suggesting might look in configuration files, or on the command line,
+        since that allows us to understand the full picture of what you are proposing.
+
+        If you're not sure of some details, don't worry! When we evaluate the
+        feature request we may suggest modifications as necessary to work within the
+        design constraints of Vector.
+
+  - type: textarea
+    id: references
+    attributes:
+      label: References
+      description: |
+        Are there any other GitHub issues, whether open or closed, that are
+        related to the problem you've described above or to the suggested solution? If
+        so, please create a list below that mentions each of them. For example:
+
+        - #7023
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: |
+        Please paste the output of running `vector --version`.
+
+        This will record which version was current at the time of your feature request,
+        to help manage the request backlog.
diff --git a/.github/actions/install-vdev/action.yml b/.github/actions/install-vdev/action.yml
index da04417f67358..e98d9731f2a5d 100644
--- a/.github/actions/install-vdev/action.yml
+++ b/.github/actions/install-vdev/action.yml
@@ -9,7 +9,7 @@ inputs:
   skip-cache:
     description: "Skip cache lookup and force compilation"
     required: false
-    default: 'false'
+    default: "false"
 
 runs:
   using: "composite"
diff --git a/.github/actions/pull-test-runner/action.yml b/.github/actions/pull-test-runner/action.yml
index b46a47fde93e8..8cded209f8a6f 100644
--- a/.github/actions/pull-test-runner/action.yml
+++ b/.github/actions/pull-test-runner/action.yml
@@ -3,10 +3,10 @@ description: Login to GHCR and pull the pre-built test runner image for integrat
 
 inputs:
   github_token:
-    description: 'GitHub token for GHCR authentication'
+    description: "GitHub token for GHCR authentication"
     required: true
   commit_sha:
-    description: 'Commit SHA used to tag the test runner image'
+    description: "Commit SHA used to tag the test runner image"
     required: true
 
 runs:
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index f9037aebb68e8..fde57a4b33303 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -80,6 +80,10 @@ inputs:
     required: false
     default: false
     description: "Install markdownlint-cli2 (npm)."
+  prettier:
+    required: false
+    default: false
+    description: "Install prettier (npm)."
   datadog-ci:
     required: false
     default: false
@@ -140,7 +144,6 @@ runs:
           echo "CARGO_TERM_COLOR=always" >> "$GITHUB_ENV"
         fi
 
-
     - name: Enable rust matcher
       if: ${{ env.NEEDS_RUST == 'true' }}
       run: echo "::add-matcher::.github/matchers/rust.json"
@@ -268,6 +271,7 @@ runs:
           ~/.cargo/bin/dd-rust-license-tool
           ~/.cargo/bin/wasm-pack
           /usr/local/bin/markdownlint-cli2
+          /usr/local/bin/prettier
           /usr/local/bin/datadog-ci
         key: ${{ runner.os }}-prepare-binaries-${{ hashFiles('scripts/environment/*') }}
         restore-keys: |
@@ -288,6 +292,7 @@ runs:
         [[ "${{ inputs.dd-rust-license-tool }}" == "true" ]] && mods+=("dd-rust-license-tool")
         [[ "${{ inputs.wasm-pack }}" == "true" ]] && mods+=("wasm-pack")
         [[ "${{ inputs.markdownlint-cli2 }}" == "true" ]] && mods+=("markdownlint-cli2")
+        [[ "${{ inputs.prettier }}" == "true" ]] && mods+=("prettier")
         [[ "${{ inputs.datadog-ci }}" == "true" ]] && mods+=("datadog-ci")
         csm=$(IFS=,; echo "${mods[*]}")
 
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index fd32d14deed15..609da972baa98 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,51 +15,51 @@ updates:
       patches:
         applies-to: version-updates
         patterns:
-        - "*"
+          - "*"
         update-types:
-        - "patch"
+          - "patch"
 
       amq:
         patterns:
-        - "amq-*"
+          - "amq-*"
       aws:
         patterns:
-        - "aws-*"
+          - "aws-*"
       aws-security:
         applies-to: security-updates
         patterns:
-        - "aws-*"
+          - "aws-*"
       azure:
         patterns:
-        - "azure_*"
+          - "azure_*"
       clap:
         patterns:
-        - "clap*"
+          - "clap*"
       crossbeam:
         patterns:
-        - "crossbeam*"
+          - "crossbeam*"
       csv:
         patterns:
-        - "csv*"
+          - "csv*"
       futures:
         patterns:
-        - "futures"
-        - "futures-util"
+          - "futures"
+          - "futures-util"
       metrics:
         patterns:
-        - "metrics"
-        - "metrics-tracing-context"
-        - "metrics-util"
+          - "metrics"
+          - "metrics-tracing-context"
+          - "metrics-util"
       netlink:
         patterns:
-        - "netlink-*"
+          - "netlink-*"
       phf:
         patterns:
-        - "phf*"
+          - "phf*"
       prost:
         patterns:
-        - "prost"
-        - "prost-*"
+          - "prost"
+          - "prost-*"
       serde:
         patterns:
           - "serde"
@@ -70,22 +70,22 @@ updates:
           - "tokio-*"
       tonic:
         patterns:
-        - "tonic"
-        - "tonic-*"
+          - "tonic"
+          - "tonic-*"
       tower:
         patterns:
-        - "tower"
-        - "tower-*"
+          - "tower"
+          - "tower-*"
       tracing:
         patterns:
           - "tracing"
           - "tracing-*"
       wasm-bindgen:
         patterns:
-        - "wasm-bindgen-*"
+          - "wasm-bindgen-*"
       zstd:
         patterns:
-        - "zstd*"
+          - "zstd*"
   - package-ecosystem: "docker"
     directory: "/distribution/docker/alpine"
     schedule:
@@ -158,8 +158,8 @@ updates:
     groups:
       artifact:
         patterns:
-        - "actions/download-artifact"
-        - "actions/upload-artifact"
+          - "actions/download-artifact"
+          - "actions/upload-artifact"
   - package-ecosystem: "npm"
     directory: "website/"
     schedule:
diff --git a/.github/labeler.yml b/.github/labeler.yml
index b5fe9e5e4eede..687dea74ce164 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -1,48 +1,48 @@
 # Generic component-level labels and high-level groupings.
 "domain: sources":
   - changed-files:
-    - any-glob-to-any-file: ["src/sources/**/*"]
+      - any-glob-to-any-file: ["src/sources/**/*"]
 
 "domain: sinks":
   - changed-files:
-    - any-glob-to-any-file: ["src/sinks/**/*"]
+      - any-glob-to-any-file: ["src/sinks/**/*"]
 
 "domain: transforms":
   - changed-files:
-    - any-glob-to-any-file: ["src/transforms/**/*"]
+      - any-glob-to-any-file: ["src/transforms/**/*"]
 
 "domain: topology":
   - changed-files:
-    - any-glob-to-any-file: ["src/topology/**/*"]
+      - any-glob-to-any-file: ["src/topology/**/*"]
 
 "domain: codecs":
   - changed-files:
-    - any-glob-to-any-file: ["src/codecs/**/*"]
+      - any-glob-to-any-file: ["src/codecs/**/*"]
 
 "domain: core":
   - changed-files:
-    - any-glob-to-any-file: ["lib/vector-core/**/*"]
+      - any-glob-to-any-file: ["lib/vector-core/**/*"]
 
 "domain: vrl":
   - changed-files:
-    - any-glob-to-any-file: ["lib/vrl/**/*"]
+      - any-glob-to-any-file: ["lib/vrl/**/*"]
 
 "domain: ci":
   - changed-files:
-    - any-glob-to-any-file: [".github/workflows/*", ".github/actions/**/*", ".github/*.yml"]
+      - any-glob-to-any-file: [".github/workflows/*", ".github/actions/**/*", ".github/*.yml"]
 
 "domain: vdev":
   - changed-files:
-    - any-glob-to-any-file: ["vdev/**/*"]
+      - any-glob-to-any-file: ["vdev/**/*"]
 
 "domain: releasing":
   - changed-files:
-    - any-glob-to-any-file: ["distribution/**/*", "scripts/package-*", "scripts/release-*"]
+      - any-glob-to-any-file: ["distribution/**/*", "scripts/package-*", "scripts/release-*"]
 
 "domain: rfc":
   - changed-files:
-    - any-glob-to-any-file: ["rfcs/**/*"]
+      - any-glob-to-any-file: ["rfcs/**/*"]
 
 "domain: external docs":
   - changed-files:
-    - any-glob-to-any-file: ["website/cue/**/*"]
+      - any-glob-to-any-file: ["website/cue/**/*"]
diff --git a/.github/workflows/build-test-runner.yml b/.github/workflows/build-test-runner.yml
index 7a7596651ed2c..ca8e51b0b6944 100644
--- a/.github/workflows/build-test-runner.yml
+++ b/.github/workflows/build-test-runner.yml
@@ -9,11 +9,11 @@ on:
   workflow_call:
     inputs:
       commit_sha:
-        description: 'Commit SHA to use for image tag'
+        description: "Commit SHA to use for image tag"
         required: true
         type: string
       checkout_ref:
-        description: 'Git ref to checkout (defaults to commit_sha)'
+        description: "Git ref to checkout (defaults to commit_sha)"
         required: false
         type: string
 
@@ -24,8 +24,8 @@ jobs:
   build:
     runs-on: ubuntu-24.04
     permissions:
-      contents: read   # Required by actions/checkout
-      packages: write  # Required to push test runner image to GitHub Container Registry
+      contents: read # Required by actions/checkout
+      packages: write # Required to push test runner image to GitHub Container Registry
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
diff --git a/.github/workflows/build_preview_sites.yml b/.github/workflows/build_preview_sites.yml
index 9df10ce781379..829571deda5da 100644
--- a/.github/workflows/build_preview_sites.yml
+++ b/.github/workflows/build_preview_sites.yml
@@ -7,17 +7,17 @@ on:
       - completed
 
 permissions:
-  contents: read  # Restrictive default
+  contents: read # Restrictive default
 
 jobs:
   deploy_vector_preview_site:
     if: ${{ github.event.workflow_run.conclusion == 'success' && contains(github.event.workflow_run.head_branch, 'website') }}
     permissions:
-      contents: read          # Required by the reusable workflow
-      actions: read           # Required to download artifacts
-      issues: write           # Required to post preview link comments
-      pull-requests: write    # Required to post preview link comments
-      statuses: write         # Required to update commit status
+      contents: read # Required by the reusable workflow
+      actions: read # Required to download artifacts
+      issues: write # Required to post preview link comments
+      pull-requests: write # Required to post preview link comments
+      statuses: write # Required to update commit status
     uses: ./.github/workflows/create_preview_sites.yml
     with:
       APP_ID: "d1a7j77663uxsc"
@@ -30,11 +30,11 @@ jobs:
   deploy_rust_doc_preview_site:
     if: ${{ github.event.workflow_run.conclusion == 'success' && contains(github.event.workflow_run.head_branch, 'website') }}
     permissions:
-      contents: read          # Required by the reusable workflow
-      actions: read           # Required to download artifacts
-      issues: write           # Required to post preview link comments
-      pull-requests: write    # Required to post preview link comments
-      statuses: write         # Required to update commit status
+      contents: read # Required by the reusable workflow
+      actions: read # Required to download artifacts
+      issues: write # Required to post preview link comments
+      pull-requests: write # Required to post preview link comments
+      statuses: write # Required to update commit status
     uses: ./.github/workflows/create_preview_sites.yml
     with:
       APP_ID: "d1hoyoksbulg25"
@@ -47,11 +47,11 @@ jobs:
   deploy_vrl_playground_preview_site:
     if: ${{ github.event.workflow_run.conclusion == 'success' && contains(github.event.workflow_run.head_branch, 'website') }}
     permissions:
-      contents: read          # Required by the reusable workflow
-      actions: read           # Required to download artifacts
-      issues: write           # Required to post preview link comments
-      pull-requests: write    # Required to post preview link comments
-      statuses: write         # Required to update commit status
+      contents: read # Required by the reusable workflow
+      actions: read # Required to download artifacts
+      issues: write # Required to post preview link comments
+      pull-requests: write # Required to post preview link comments
+      statuses: write # Required to update commit status
     uses: ./.github/workflows/create_preview_sites.yml
     with:
       APP_ID: "d2lr4eds605rpz"
diff --git a/.github/workflows/changes.yml b/.github/workflows/changes.yml
index 25599942b02c9..999548111e9a7 100644
--- a/.github/workflows/changes.yml
+++ b/.github/workflows/changes.yml
@@ -48,6 +48,8 @@ on:
         value: ${{ jobs.source.outputs.website_only }}
       install:
         value: ${{ jobs.source.outputs.install }}
+      prettier:
+        value: ${{ jobs.source.outputs.prettier }}
       test-yml:
         value: ${{ jobs.source.outputs.test-yml }}
       integration-yml:
@@ -152,7 +154,7 @@ on:
 
 # Workflow-level permissions - read access to repository contents
 permissions:
-  contents: read  # Required to checkout code
+  contents: read # Required to checkout code
 
 env:
   BASE_SHA: ${{ inputs.base_ref || (github.event_name == 'merge_group' && github.event.merge_group.base_sha) || github.event.pull_request.base.sha }}
@@ -176,6 +178,7 @@ jobs:
       install: ${{ steps.filter.outputs.install }}
       k8s: ${{ steps.filter.outputs.k8s }}
       website_only: ${{ steps.filter.outputs.website == 'true' && steps.filter.outputs.not_website == 'false' }}
+      prettier: ${{ steps.filter.outputs.prettier }}
       test-yml: ${{ steps.filter.outputs.test-yml }}
       integration-yml: ${{ steps.filter.outputs.integration-yml }}
       test-make-command-yml: ${{ steps.filter.outputs.test-make-command-yml }}
@@ -184,109 +187,118 @@ jobs:
       unit_mac-yml: ${{ steps.filter.outputs.unit_mac-yml }}
       unit_windows-yml: ${{ steps.filter.outputs.unit_windows-yml }}
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-    - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
-      id: filter
-      with:
-        base: ${{ env.BASE_SHA }}
-        ref:  ${{ env.HEAD_SHA }}
-        filters: |
-          source:
-            - ".cargo/**"
-            - "benches/**"
-            - "lib/**"
-            - "proto/**"
-            - "scripts/**"
-            - "src/**"
-            - "tests/**"
-            - "build.rs"
-            - "Cargo.lock"
-            - "Cargo.toml"
-            - "Makefile"
-            - "rust-toolchain.toml"
-            - "vdev/**"
-            - ".github/workflows/changes.yml"
-          dependencies:
-            - ".cargo/**"
-            - 'Cargo.toml'
-            - 'Cargo.lock'
-            - 'rust-toolchain.toml'
-            - 'Makefile'
-            - 'scripts/cross/**'
-            - "vdev/**"
-            - ".github/workflows/changes.yml"
-          deny:
-            - '**/Cargo.toml'
-            - 'Cargo.lock'
-            - ".github/workflows/deny.yml"
-          cue:
-            - 'website/cue/**'
-            - "vdev/**"
-            - ".github/workflows/changes.yml"
-          component_docs:
-            - 'scripts/generate-component-docs.rb'
-            - "vdev/**"
-            - 'website/cue/**/*.cue'
-            - 'docs/generated/**'
-            # If changes to the VRL sha is made the combined generated cue file will change which
-            # may cause issues
-            - 'Cargo.lock'
-            - ".github/workflows/changes.yml"
-          markdown:
-            - '**/**.md'
-            - "vdev/**"
-            - ".github/workflows/changes.yml"
-          scripts:
-            - '**/**.sh'
-            - ".github/workflows/changes.yml"
-          internal_events:
-            - 'src/internal_events/**'
-            - "vdev/**"
-            - ".github/workflows/changes.yml"
-          docker:
-            - 'distribution/docker/**'
-            - "vdev/**"
-            - ".github/workflows/changes.yml"
-          install:
-            - ".github/workflows/install-sh.yml"
-            - "distribution/install.sh"
-            - ".github/workflows/changes.yml"
-          k8s:
-            - "src/sources/kubernetes_logs/**"
-            - "lib/k8s-e2e-tests/**"
-            - "lib/k8s-test-framework/**"
-            - "scripts/test-e2e-kubernetes.sh"
-            - "scripts/build-docker.sh"
-            - "scripts/deploy-chart-test.sh"
-            - ".github/workflows/k8s_e2e.yml"
-            - ".github/workflows/changes.yml"
-          website:
-            - "website/**"
-          not_website:
-            - "!website/**"
-          test-yml:
-            - ".github/workflows/test.yml"
-            - ".github/workflows/changes.yml"
-          integration-yml:
-            - ".github/workflows/integration.yml"
-            - ".github/workflows/changes.yml"
-          test-make-command-yml:
-            - ".github/workflows/test-make-command.yml"
-            - ".github/workflows/changes.yml"
-          msrv-yml:
-            - ".github/workflows/msrv.yml"
-            - ".github/workflows/changes.yml"
-          cross-yml:
-            - ".github/workflows/cross.yml"
-            - ".github/workflows/changes.yml"
-          unit_mac-yml:
-            - ".github/workflows/unit_mac.yml"
-            - ".github/workflows/changes.yml"
-          unit_windows-yml:
-            - ".github/workflows/unit_windows.yml"
-            - ".github/workflows/changes.yml"
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        id: filter
+        with:
+          base: ${{ env.BASE_SHA }}
+          ref: ${{ env.HEAD_SHA }}
+          filters: |
+            source:
+              - ".cargo/**"
+              - "benches/**"
+              - "lib/**"
+              - "proto/**"
+              - "scripts/**"
+              - "src/**"
+              - "tests/**"
+              - "build.rs"
+              - "Cargo.lock"
+              - "Cargo.toml"
+              - "Makefile"
+              - "rust-toolchain.toml"
+              - "vdev/**"
+              - ".github/workflows/changes.yml"
+            dependencies:
+              - ".cargo/**"
+              - 'Cargo.toml'
+              - 'Cargo.lock'
+              - 'rust-toolchain.toml'
+              - 'Makefile'
+              - 'scripts/cross/**'
+              - "vdev/**"
+              - ".github/workflows/changes.yml"
+            deny:
+              - '**/Cargo.toml'
+              - 'Cargo.lock'
+              - ".github/workflows/deny.yml"
+            cue:
+              - 'website/cue/**'
+              - "vdev/**"
+              - ".github/workflows/changes.yml"
+            component_docs:
+              - 'scripts/generate-component-docs.rb'
+              - "vdev/**"
+              - 'website/cue/**/*.cue'
+              - 'docs/generated/**'
+              # If changes to the VRL sha is made the combined generated cue file will change which
+              # may cause issues
+              - 'Cargo.lock'
+              - ".github/workflows/changes.yml"
+            markdown:
+              - '**/**.md'
+              - "vdev/**"
+              - ".github/workflows/changes.yml"
+            scripts:
+              - '**/**.sh'
+              - ".github/workflows/changes.yml"
+            internal_events:
+              - 'src/internal_events/**'
+              - "vdev/**"
+              - ".github/workflows/changes.yml"
+            docker:
+              - 'distribution/docker/**'
+              - "vdev/**"
+              - ".github/workflows/changes.yml"
+            install:
+              - ".github/workflows/install-sh.yml"
+              - "distribution/install.sh"
+              - ".github/workflows/changes.yml"
+            k8s:
+              - "src/sources/kubernetes_logs/**"
+              - "lib/k8s-e2e-tests/**"
+              - "lib/k8s-test-framework/**"
+              - "scripts/test-e2e-kubernetes.sh"
+              - "scripts/build-docker.sh"
+              - "scripts/deploy-chart-test.sh"
+              - ".github/workflows/k8s_e2e.yml"
+              - ".github/workflows/changes.yml"
+            website:
+              - "website/**"
+            not_website:
+              - "!website/**"
+            prettier:
+              - "**/*.yml"
+              - "**/*.yaml"
+              - "**/*.js"
+              - "**/*.ts"
+              - "**/*.tsx"
+              - "**/*.json"
+              - ".prettierrc.json"
+              - ".prettierignore"
+              - ".github/workflows/changes.yml"
+            test-yml:
+              - ".github/workflows/test.yml"
+              - ".github/workflows/changes.yml"
+            integration-yml:
+              - ".github/workflows/integration.yml"
+              - ".github/workflows/changes.yml"
+            test-make-command-yml:
+              - ".github/workflows/test-make-command.yml"
+              - ".github/workflows/changes.yml"
+            msrv-yml:
+              - ".github/workflows/msrv.yml"
+              - ".github/workflows/changes.yml"
+            cross-yml:
+              - ".github/workflows/cross.yml"
+              - ".github/workflows/changes.yml"
+            unit_mac-yml:
+              - ".github/workflows/unit_mac.yml"
+              - ".github/workflows/changes.yml"
+            unit_windows-yml:
+              - ".github/workflows/unit_windows.yml"
+              - ".github/workflows/changes.yml"
 
   # Detects changes that are specific to integration tests
   int_tests:
@@ -352,7 +364,7 @@ jobs:
         id: filter
         with:
           base: ${{ env.BASE_SHA }}
-          ref:  ${{ env.HEAD_SHA }}
+          ref: ${{ env.HEAD_SHA }}
           filters: int_test_filters.yaml
 
       # This JSON hack was introduced because GitHub Actions does not support dynamic expressions in the
@@ -446,7 +458,7 @@ jobs:
         id: filter
         with:
           base: ${{ env.BASE_SHA }}
-          ref:  ${{ env.HEAD_SHA }}
+          ref: ${{ env.HEAD_SHA }}
           filters: int_test_filters.yaml
 
       # This JSON hack was introduced because GitHub Actions does not support dynamic expressions in the
diff --git a/.github/workflows/ci-integration-review.yml b/.github/workflows/ci-integration-review.yml
index 029ea40e05963..67fae9ea864d7 100644
--- a/.github/workflows/ci-integration-review.yml
+++ b/.github/workflows/ci-integration-review.yml
@@ -30,7 +30,7 @@ name: CI Integration Review Trigger
 
 on:
   pull_request_review:
-    types: [ submitted ]
+    types: [submitted]
 
 permissions:
   contents: read
@@ -55,7 +55,7 @@ jobs:
     timeout-minutes: 5
     if: startsWith(github.event.review.body, '/ci-run-integration') || startsWith(github.event.review.body, '/ci-run-e2e') || contains(github.event.review.body, '/ci-run-all')
     permissions:
-      statuses: write   # Required to set commit status to pending
+      statuses: write # Required to set commit status to pending
     steps:
       - name: Generate authentication token
         id: generate_token
@@ -68,7 +68,7 @@ jobs:
         uses: tspascoal/get-user-teams-membership@57e9f42acd78f4d0f496b3be4368fc5f62696662 # v3.0.0
         with:
           username: ${{ github.actor }}
-          team: 'Vector'
+          team: "Vector"
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
 
       - name: Validate author membership
@@ -86,7 +86,7 @@ jobs:
     needs: prep-pr
     permissions:
       contents: read
-      packages: write   # Required to push test runner image to GHCR
+      packages: write # Required to push test runner image to GHCR
     uses: ./.github/workflows/build-test-runner.yml
     with:
       commit_sha: ${{ github.event.review.commit_id }}
@@ -100,17 +100,47 @@ jobs:
     timeout-minutes: 90
     permissions:
       contents: read
-      packages: read    # Required to pull test runner image from GHCR
+      packages: read # Required to pull test runner image from GHCR
     strategy:
       fail-fast: false
       matrix:
-        service: [
-          "amqp", "appsignal", "axiom", "aws", "azure", "clickhouse", "databend", "datadog-agent",
-          "datadog-logs", "datadog-metrics", "datadog-traces", "dnstap", "docker-logs", "doris", "elasticsearch",
-          "eventstoredb", "fluent", "gcp", "greptimedb", "http-client", "influxdb", "kafka", "logstash",
-          "loki", "mqtt", "mongodb", "nats", "nginx", "opentelemetry", "postgres", "prometheus", "pulsar",
-          "redis", "webhdfs"
-        ]
+        service:
+          [
+            "amqp",
+            "appsignal",
+            "axiom",
+            "aws",
+            "azure",
+            "clickhouse",
+            "databend",
+            "datadog-agent",
+            "datadog-logs",
+            "datadog-metrics",
+            "datadog-traces",
+            "dnstap",
+            "docker-logs",
+            "doris",
+            "elasticsearch",
+            "eventstoredb",
+            "fluent",
+            "gcp",
+            "greptimedb",
+            "http-client",
+            "influxdb",
+            "kafka",
+            "logstash",
+            "loki",
+            "mqtt",
+            "mongodb",
+            "nats",
+            "nginx",
+            "opentelemetry",
+            "postgres",
+            "prometheus",
+            "pulsar",
+            "redis",
+            "webhdfs"
+          ]
     steps:
       - name: Evaluate run condition
         id: run_condition
@@ -160,13 +190,11 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: read
-      packages: read    # Required to pull test runner image from GHCR
+      packages: read # Required to pull test runner image from GHCR
     strategy:
       fail-fast: false
       matrix:
-        service: [
-          "datadog-logs", "datadog-metrics", "opentelemetry-logs", "opentelemetry-metrics"
-        ]
+        service: ["datadog-logs", "datadog-metrics", "opentelemetry-logs", "opentelemetry-metrics"]
     steps:
       - name: Evaluate run condition
         id: run_condition
@@ -208,7 +236,6 @@ jobs:
             bash scripts/environment/prepare.sh --modules=datadog-ci
             bash scripts/run-integration-test.sh e2e ${{ matrix.service }}
 
-
   update-pr-status:
     name: Signal result to PR
     runs-on: ubuntu-24.04
@@ -218,7 +245,7 @@ jobs:
       - e2e-tests
     if: always() && (startsWith(github.event.review.body, '/ci-run-integration') || contains(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-e2e'))
     permissions:
-      statuses: write   # Required to set final commit status
+      statuses: write # Required to set final commit status
     env:
       FAILED: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
     steps:
@@ -234,7 +261,7 @@ jobs:
         uses: tspascoal/get-user-teams-membership@57e9f42acd78f4d0f496b3be4368fc5f62696662 # v3.0.0
         with:
           username: ${{ github.actor }}
-          team: 'Vector'
+          team: "Vector"
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
 
       - name: (PR review) Submit PR result as success
@@ -243,7 +270,7 @@ jobs:
         with:
           sha: ${{ github.event.review.commit_id }}
           token: ${{ secrets.GITHUB_TOKEN }}
-          status: 'success'
+          status: "success"
 
       - name: Check all jobs status
         run: |
diff --git a/.github/workflows/ci-review-trigger.yml b/.github/workflows/ci-review-trigger.yml
index ce4e85f392b35..8a2eb206efdcd 100644
--- a/.github/workflows/ci-review-trigger.yml
+++ b/.github/workflows/ci-review-trigger.yml
@@ -54,19 +54,19 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     if: |
-        startsWith(github.event.review.body, '/ci-run-all')
-        || startsWith(github.event.review.body, '/ci-run-cli')
-        || startsWith(github.event.review.body, '/ci-run-test-vector-api')
-        || startsWith(github.event.review.body, '/ci-run-test-behavior')
-        || startsWith(github.event.review.body, '/ci-run-check-examples')
-        || startsWith(github.event.review.body, '/ci-run-test-docs')
-        || startsWith(github.event.review.body, '/ci-run-deny')
-        || startsWith(github.event.review.body, '/ci-run-component-features')
-        || startsWith(github.event.review.body, '/ci-run-cross')
-        || startsWith(github.event.review.body, '/ci-run-unit-mac')
-        || startsWith(github.event.review.body, '/ci-run-unit-windows')
-        || startsWith(github.event.review.body, '/ci-run-environment')
-        || startsWith(github.event.review.body, '/ci-run-k8s')
+      startsWith(github.event.review.body, '/ci-run-all')
+      || startsWith(github.event.review.body, '/ci-run-cli')
+      || startsWith(github.event.review.body, '/ci-run-test-vector-api')
+      || startsWith(github.event.review.body, '/ci-run-test-behavior')
+      || startsWith(github.event.review.body, '/ci-run-check-examples')
+      || startsWith(github.event.review.body, '/ci-run-test-docs')
+      || startsWith(github.event.review.body, '/ci-run-deny')
+      || startsWith(github.event.review.body, '/ci-run-component-features')
+      || startsWith(github.event.review.body, '/ci-run-cross')
+      || startsWith(github.event.review.body, '/ci-run-unit-mac')
+      || startsWith(github.event.review.body, '/ci-run-unit-windows')
+      || startsWith(github.event.review.body, '/ci-run-environment')
+      || startsWith(github.event.review.body, '/ci-run-k8s')
     steps:
       - name: Generate authentication token
         id: generate_token
@@ -79,7 +79,7 @@ jobs:
         uses: tspascoal/get-user-teams-membership@57e9f42acd78f4d0f496b3be4368fc5f62696662 # v3.0.0
         with:
           username: ${{ github.actor }}
-          team: 'Vector'
+          team: "Vector"
           GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
 
       - name: Validate author membership
diff --git a/.github/workflows/component_features.yml b/.github/workflows/component_features.yml
index 9770b4ab81383..5803451f1dd6c 100644
--- a/.github/workflows/component_features.yml
+++ b/.github/workflows/component_features.yml
@@ -13,17 +13,17 @@ on:
   workflow_call:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
   workflow_dispatch:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
   schedule:
-    - cron: '0 10 * * 1' # 10:00 UTC Monday (6 AM EST NYC)
+    - cron: "0 10 * * 1" # 10:00 UTC Monday (6 AM EST NYC)
 
 permissions:
   contents: read
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index a4a4c39d4f760..db19d27ffd582 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -4,14 +4,14 @@ on:
   push:
     branches:
       - master
-  workflow_dispatch:  # Allow manual trigger from GitHub UI
+  workflow_dispatch: # Allow manual trigger from GitHub UI
 
 permissions:
   contents: read
 
 env:
   CI: true
-  CARGO_INCREMENTAL: '0'  # Disable incremental compilation for coverage
+  CARGO_INCREMENTAL: "0" # Disable incremental compilation for coverage
 
 jobs:
   coverage:
diff --git a/.github/workflows/create_preview_sites.yml b/.github/workflows/create_preview_sites.yml
index dbb93e6432a33..6cd7edf89bdb9 100644
--- a/.github/workflows/create_preview_sites.yml
+++ b/.github/workflows/create_preview_sites.yml
@@ -23,18 +23,18 @@ on:
         required: true
 
 permissions:
-  contents: read  # Restrictive default
+  contents: read # Restrictive default
 
 jobs:
   create_preview_site:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:
-      contents: read          # Required for repository context
-      actions: read           # Required to download artifacts
-      issues: write           # Required to post preview link comments
-      pull-requests: write    # Required to post preview link comments
-      statuses: write         # Required to update commit status
+      contents: read # Required for repository context
+      actions: read # Required to download artifacts
+      issues: write # Required to post preview link comments
+      pull-requests: write # Required to post preview link comments
+      statuses: write # Required to update commit status
     steps:
       # Get the artifacts with the PR number and branch name
       - name: Download artifact
diff --git a/.github/workflows/cross.yml b/.github/workflows/cross.yml
index 9519a7d79df94..b554a45d45c09 100644
--- a/.github/workflows/cross.yml
+++ b/.github/workflows/cross.yml
@@ -4,7 +4,7 @@ on:
   workflow_call:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
 
diff --git a/.github/workflows/custom_builds.yml b/.github/workflows/custom_builds.yml
index 98a7b3647295f..60e1bc8dc6bed 100644
--- a/.github/workflows/custom_builds.yml
+++ b/.github/workflows/custom_builds.yml
@@ -1,7 +1,7 @@
 name: Custom Builds
 
 permissions:
-  contents: read  # Restrictive default
+  contents: read # Restrictive default
 
 on:
   workflow_dispatch: {}
@@ -9,8 +9,8 @@ on:
 jobs:
   Custom:
     permissions:
-      contents: write   # Required to create/update releases and tags
-      packages: write   # Required to push container images to GHCR
+      contents: write # Required to create/update releases and tags
+      packages: write # Required to push container images to GHCR
     uses: ./.github/workflows/publish.yml
     with:
       git_ref: ${{ github.ref }}
diff --git a/.github/workflows/deny.yml b/.github/workflows/deny.yml
index 52b40d1e1d535..cef811743e716 100644
--- a/.github/workflows/deny.yml
+++ b/.github/workflows/deny.yml
@@ -14,14 +14,14 @@ on:
   workflow_call:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
 
   workflow_dispatch:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
 
@@ -30,7 +30,7 @@ on:
     types: [checks_requested]
   schedule:
     # Same schedule as nightly.yml
-    - cron: "0 5 * * 2-6"  # Runs at 5:00 AM UTC, Tuesday through Saturday
+    - cron: "0 5 * * 2-6" # Runs at 5:00 AM UTC, Tuesday through Saturday
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
diff --git a/.github/workflows/environment.yml b/.github/workflows/environment.yml
index cf6313e4ce894..de519e0cbc955 100644
--- a/.github/workflows/environment.yml
+++ b/.github/workflows/environment.yml
@@ -4,7 +4,7 @@ on:
   workflow_call:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
 
@@ -15,12 +15,12 @@ on:
         type: boolean
         default: false
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
 
   schedule:
-    - cron: '0 6 * * 1'  # Every Monday at 06:00 UTC
+    - cron: "0 6 * * 1" # Every Monday at 06:00 UTC
 
 env:
   VERBOSE: true
diff --git a/.github/workflows/install-sh.yml b/.github/workflows/install-sh.yml
index 69777ead18d83..7d371baa27388 100644
--- a/.github/workflows/install-sh.yml
+++ b/.github/workflows/install-sh.yml
@@ -4,13 +4,13 @@ on:
   workflow_call:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
   workflow_dispatch:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
 
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index 48b4deeb218d3..74b782aa7d336 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -16,7 +16,7 @@ on:
 
 # Workflow-level permissions - read access to repository contents
 permissions:
-  contents: read  # Required to checkout code
+  contents: read # Required to checkout code
 
 env:
   AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }}
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 861913c315cd4..64cfe8c6da004 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
   pull_request:
   merge_group:
-    types: [ checks_requested ]
+    types: [checks_requested]
 
 concurrency:
   # `github.event.number` exists for pull requests, otherwise fall back to SHA for merge queue
@@ -58,7 +58,7 @@ jobs:
       needs.changes.outputs.integration-yml == 'true' ||
       needs.changes.outputs.int-tests-any == 'true' ||
       needs.changes.outputs.e2e-tests-any == 'true')))
-     }}
+      }}
     uses: ./.github/workflows/build-test-runner.yml
     with:
       commit_sha: ${{ github.sha }}
@@ -75,13 +75,43 @@ jobs:
       matrix:
         # TODO: Add "splunk" back once https://github.com/vectordotdev/vector/issues/23474 is fixed.
         # If you modify this list, please also update the `int_tests` job in changes.yml.
-        service: [
-          "amqp", "appsignal", "axiom", "aws", "azure", "clickhouse", "databend", "datadog-agent",
-          "datadog-logs", "datadog-metrics", "datadog-traces", "dnstap", "docker-logs", "doris", "elasticsearch",
-          "eventstoredb", "fluent", "gcp", "greptimedb", "http-client", "influxdb", "kafka", "logstash",
-          "loki", "mqtt", "mongodb", "nats", "nginx", "opentelemetry", "postgres", "prometheus", "pulsar",
-          "redis", "webhdfs"
-        ]
+        service:
+          [
+            "amqp",
+            "appsignal",
+            "axiom",
+            "aws",
+            "azure",
+            "clickhouse",
+            "databend",
+            "datadog-agent",
+            "datadog-logs",
+            "datadog-metrics",
+            "datadog-traces",
+            "dnstap",
+            "docker-logs",
+            "doris",
+            "elasticsearch",
+            "eventstoredb",
+            "fluent",
+            "gcp",
+            "greptimedb",
+            "http-client",
+            "influxdb",
+            "kafka",
+            "logstash",
+            "loki",
+            "mqtt",
+            "mongodb",
+            "nats",
+            "nginx",
+            "opentelemetry",
+            "postgres",
+            "prometheus",
+            "pulsar",
+            "redis",
+            "webhdfs"
+          ]
     timeout-minutes: 90
     steps:
       - name: Download JSON artifact from changes.yml
@@ -135,7 +165,6 @@ jobs:
           command: |
             bash scripts/run-integration-test.sh int ${{ matrix.service }}
 
-
   e2e-tests:
     runs-on: ubuntu-24.04-8core
     needs:
@@ -145,7 +174,7 @@ jobs:
       (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch') }}
     strategy:
       matrix:
-        service: [ "datadog-logs", "datadog-metrics", "opentelemetry-logs", "opentelemetry-metrics" ]
+        service: ["datadog-logs", "datadog-metrics", "opentelemetry-logs", "opentelemetry-metrics"]
     timeout-minutes: 90
 
     steps:
diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index 0aa171f0daacd..afdcc01252e20 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -21,20 +21,20 @@ on:
   workflow_dispatch:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
   workflow_call:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
   pull_request:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: '0 1 * * 2-6' # 01:00 UTC Tue-Sat
+    - cron: "0 1 * * 2-6" # 01:00 UTC Tue-Sat
 
 concurrency:
   # In flight runs will be canceled through re-trigger in the merge queue, scheduled run, or if
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index e94a4bb384ec6..8bfb4b5fb26c9 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -13,7 +13,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-    - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
-        sync-labels: true
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          sync-labels: true
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 848bed90f8299..b37bfdbc20e25 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -1,18 +1,18 @@
 name: Nightly
 
 permissions:
-  contents: read  # Restrictive default
+  contents: read # Restrictive default
 
 on:
   workflow_dispatch:
   schedule:
-    - cron: "0 5 * * 2-6"  # Runs at 5:00 AM UTC, Tuesday through Saturday
+    - cron: "0 5 * * 2-6" # Runs at 5:00 AM UTC, Tuesday through Saturday
 
 jobs:
   Nightly:
     permissions:
-      contents: write   # Required to create/update releases and tags
-      packages: write   # Required to push container images to GHCR
+      contents: write # Required to create/update releases and tags
+      packages: write # Required to push container images to GHCR
     uses: ./.github/workflows/publish.yml
     with:
       git_ref: ${{ github.ref }}
diff --git a/.github/workflows/preview_site_trigger.yml b/.github/workflows/preview_site_trigger.yml
index 08ff26836ca20..98c5a6a2df720 100644
--- a/.github/workflows/preview_site_trigger.yml
+++ b/.github/workflows/preview_site_trigger.yml
@@ -5,15 +5,15 @@ on:
 
 # Restrictive default permissions
 permissions:
-  contents: read  # Required for repository context
+  contents: read # Required for repository context
 
 jobs:
   approval_check:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:
-      contents: read  # Required for repository context
-      actions: write  # Required to upload artifacts that trigger the preview build workflow
+      contents: read # Required for repository context
+      actions: write # Required to upload artifacts that trigger the preview build workflow
     # Only run for PRs with 'website' in the branch name
     if: ${{ contains(github.head_ref, 'website') }}
     steps:
diff --git a/.github/workflows/protobuf.yml b/.github/workflows/protobuf.yml
index 06e8411a81541..bc9cca9baf473 100644
--- a/.github/workflows/protobuf.yml
+++ b/.github/workflows/protobuf.yml
@@ -6,15 +6,15 @@ permissions:
 on:
   pull_request:
     paths:
-        - "proto/**"
-        - "lib/vector-core/proto/**"
+      - "proto/**"
+      - "lib/vector-core/proto/**"
   merge_group:
     types: [checks_requested]
 
 concurrency:
-    # `github.ref` is unique for MQ runs and PRs
-    group: ${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: true
+  # `github.ref` is unique for MQ runs and PRs
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   validate-protos:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0594151b2db23..4c66ff585e173 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -59,14 +59,14 @@ jobs:
     strategy:
       matrix:
         include:
-          - target: x86_64-unknown-linux-musl       # .tar.gz
-          - target: x86_64-unknown-linux-gnu        # .tar.gz, .deb, .rpm
-          - target: aarch64-unknown-linux-musl      # .tar.gz
-          - target: aarch64-unknown-linux-gnu       # .tar.gz, .deb, .rpm
-          - target: armv7-unknown-linux-gnueabihf   # .tar.gz, .deb, .rpm
-          - target: armv7-unknown-linux-musleabihf  # .tar.gz
-          - target: arm-unknown-linux-gnueabi       # .tar.gz, .deb
-          - target: arm-unknown-linux-musleabi      # .tar.gz
+          - target: x86_64-unknown-linux-musl # .tar.gz
+          - target: x86_64-unknown-linux-gnu # .tar.gz, .deb, .rpm
+          - target: aarch64-unknown-linux-musl # .tar.gz
+          - target: aarch64-unknown-linux-gnu # .tar.gz, .deb, .rpm
+          - target: armv7-unknown-linux-gnueabihf # .tar.gz, .deb, .rpm
+          - target: armv7-unknown-linux-musleabihf # .tar.gz
+          - target: arm-unknown-linux-gnueabi # .tar.gz, .deb
+          - target: arm-unknown-linux-musleabi # .tar.gz
     steps:
       - name: Checkout Vector
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 1b93487a54ec2..167dc0186bada 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -32,11 +32,11 @@ on:
         description: "The SHA to use for comparison (optional). If not provided, it defaults to the current HEAD of the origin/master branch."
         required: false
   schedule:
-    - cron: '0 7 * * 1' # Runs at 7 AM UTC on Mondays
+    - cron: "0 7 * * 1" # Runs at 7 AM UTC on Mondays
 
 # Workflow-level permissions - read access to repository contents
 permissions:
-  contents: read  # Required to checkout code
+  contents: read # Required to checkout code
 
 env:
   SINGLE_MACHINE_PERFORMANCE_API: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_API }}
@@ -44,7 +44,6 @@ env:
   SMP_REPLICAS: 100 # default is 10
 
 jobs:
-
   resolve-inputs:
     runs-on: ubuntu-24.04
     outputs:
@@ -57,7 +56,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          fetch-depth: 0  # need to pull repository history to find merge bases
+          fetch-depth: 0 # need to pull repository history to find merge bases
 
       - name: Set and Validate SHAs
         id: set_and_validate_shas
@@ -195,8 +194,8 @@ jobs:
       - resolve-inputs
     # Job-level permissions for artifact upload
     permissions:
-      contents: read  # Required to checkout code
-      actions: write  # Required to upload artifacts
+      contents: read # Required to checkout code
+      actions: write # Required to upload artifacts
     steps:
       - uses: colpal/actions-clean@36e6ca1abd35efe61cb60f912bd7837f67887c8a # v1.1.1
 
@@ -238,8 +237,8 @@ jobs:
       - resolve-inputs
     # Job-level permissions for artifact upload
     permissions:
-      contents: read  # Required to checkout code
-      actions: write  # Required to upload artifacts
+      contents: read # Required to checkout code
+      actions: write # Required to upload artifacts
     steps:
       - uses: colpal/actions-clean@36e6ca1abd35efe61cb60f912bd7837f67887c8a # v1.1.1
 
@@ -305,7 +304,7 @@ jobs:
       - confirm-valid-credentials
       - build-baseline
     steps:
-      - name: 'Download baseline image'
+      - name: "Download baseline image"
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           name: baseline-image
@@ -345,7 +344,7 @@ jobs:
       - confirm-valid-credentials
       - build-comparison
     steps:
-      - name: 'Download comparison image'
+      - name: "Download comparison image"
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           name: comparison-image
@@ -386,8 +385,8 @@ jobs:
       - upload-comparison-image-to-ecr
     # Job-level permissions for artifact upload
     permissions:
-      contents: read  # Required to checkout code
-      actions: write  # Required to upload artifacts
+      contents: read # Required to checkout code
+      actions: write # Required to upload artifacts
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -502,8 +501,8 @@ jobs:
       - resolve-inputs
     # Job-level permissions for artifact upload
     permissions:
-      contents: read  # Required to checkout code
-      actions: write  # Required to upload artifacts
+      contents: read # Required to checkout code
+      actions: write # Required to upload artifacts
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e9965f4d6193c..04192306a1a77 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,7 +1,7 @@
 name: Release Suite
 
 permissions:
-  contents: read  # Restrictive default
+  contents: read # Restrictive default
 
 on:
   push:
@@ -12,8 +12,8 @@ on:
 jobs:
   Release:
     permissions:
-      contents: write   # Required to create/update releases and tags
-      packages: write   # Required to push container images to GHCR
+      contents: write # Required to create/update releases and tags
+      packages: write # Required to push container images to GHCR
     uses: ./.github/workflows/publish.yml
     with:
       git_ref: ${{ github.ref }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c43853e5a7d51..7a8fd8c9a7d47 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -10,9 +10,9 @@ on:
   # To guarantee Maintained check is occasionally updated. See
   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
   schedule:
-    - cron: '0 6 * * 1' # 6 AM UTC every Monday
+    - cron: "0 6 * * 1" # 6 AM UTC every Monday
   push:
-    branches: [ "master" ]
+    branches: ["master"]
 
 # Declare default permissions as read only.
 permissions: read-all
diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index 425111667a5e8..e95e1183fc593 100644
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -59,13 +59,13 @@ name: Check Spelling
 on:
   pull_request_target:
     branches:
-    - "**"
+      - "**"
     tags-ignore:
-    - "**"
+      - "**"
     types:
-    - 'opened'
-    - 'reopened'
-    - 'synchronize'
+      - "opened"
+      - "reopened"
+      - "synchronize"
 
 permissions:
   contents: read
@@ -88,51 +88,50 @@ jobs:
       # note: If you use only_check_changed_files, you do not want cancel-in-progress
       cancel-in-progress: true
     steps:
-    - name: check-spelling
-      id: spelling
-      uses: check-spelling/check-spelling@c635c2f3f714eec2fcf27b643a1919b9a811ef2e # v0.0.25
-      with:
-        suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
-        checkout: true
-        check_file_names: 1
-        spell_check_this: check-spelling/spell-check-this@prerelease
-        post_comment: 0
-        use_sarif: ${{ (!github.event.pull_request || (github.event.pull_request.head.repo.full_name == github.repository)) && 1 }}
-        extra_dictionary_limit: 20
-        extra_dictionaries:
-          cspell:aws/aws.txt
-          cspell:cpp/src/compiler-clang-attributes.txt
-          cspell:cpp/src/compiler-msvc.txt
-          cspell:cpp/src/ecosystem.txt
-          cspell:cpp/src/lang-jargon.txt
-          cspell:cpp/src/stdlib-cpp.txt
-          cspell:css/dict/css.txt
-          cspell:django/dict/django.txt
-          cspell:docker/src/docker-words.txt
-          cspell:dotnet/dict/dotnet.txt
-          cspell:elixir/dict/elixir.txt
-          cspell:filetypes/filetypes.txt
-          cspell:fullstack/dict/fullstack.txt
-          cspell:golang/dict/go.txt
-          cspell:html-symbol-entities/entities.txt
-          cspell:html/dict/html.txt
-          cspell:java/src/java-terms.txt
-          cspell:java/src/java.txt
-          cspell:k8s/dict/k8s.txt
-          cspell:lorem-ipsum/dictionary.txt
-          cspell:lua/dict/lua.txt
-          cspell:node/dict/node.txt
-          cspell:npm/dict/npm.txt
-          cspell:php/dict/php.txt
-          cspell:public-licenses/src/generated/public-licenses.txt
-          cspell:python/src/common/extra.txt
-          cspell:python/src/python/python-lib.txt
-          cspell:python/src/python/python.txt
-          cspell:r/src/r.txt
-          cspell:ruby/dict/ruby.txt
-          cspell:rust/dict/rust.txt
-          cspell:shell/dict/shell-all-words.txt
-          cspell:software-terms/dict/softwareTerms.txt
-          cspell:swift/src/swift.txt
-          cspell:typescript/dict/typescript.txt
-        check_extra_dictionaries: ''
+      - name: check-spelling
+        id: spelling
+        uses: check-spelling/check-spelling@c635c2f3f714eec2fcf27b643a1919b9a811ef2e # v0.0.25
+        with:
+          suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
+          checkout: true
+          check_file_names: 1
+          spell_check_this: check-spelling/spell-check-this@prerelease
+          post_comment: 0
+          use_sarif: ${{ (!github.event.pull_request || (github.event.pull_request.head.repo.full_name == github.repository)) && 1 }}
+          extra_dictionary_limit: 20
+          extra_dictionaries: cspell:aws/aws.txt
+            cspell:cpp/src/compiler-clang-attributes.txt
+            cspell:cpp/src/compiler-msvc.txt
+            cspell:cpp/src/ecosystem.txt
+            cspell:cpp/src/lang-jargon.txt
+            cspell:cpp/src/stdlib-cpp.txt
+            cspell:css/dict/css.txt
+            cspell:django/dict/django.txt
+            cspell:docker/src/docker-words.txt
+            cspell:dotnet/dict/dotnet.txt
+            cspell:elixir/dict/elixir.txt
+            cspell:filetypes/filetypes.txt
+            cspell:fullstack/dict/fullstack.txt
+            cspell:golang/dict/go.txt
+            cspell:html-symbol-entities/entities.txt
+            cspell:html/dict/html.txt
+            cspell:java/src/java-terms.txt
+            cspell:java/src/java.txt
+            cspell:k8s/dict/k8s.txt
+            cspell:lorem-ipsum/dictionary.txt
+            cspell:lua/dict/lua.txt
+            cspell:node/dict/node.txt
+            cspell:npm/dict/npm.txt
+            cspell:php/dict/php.txt
+            cspell:public-licenses/src/generated/public-licenses.txt
+            cspell:python/src/common/extra.txt
+            cspell:python/src/python/python-lib.txt
+            cspell:python/src/python/python.txt
+            cspell:r/src/r.txt
+            cspell:ruby/dict/ruby.txt
+            cspell:rust/dict/rust.txt
+            cspell:shell/dict/shell-all-words.txt
+            cspell:software-terms/dict/softwareTerms.txt
+            cspell:swift/src/swift.txt
+            cspell:typescript/dict/typescript.txt
+          check_extra_dictionaries: ""
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index d3330f07b7280..04ed6b19d9f25 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -4,8 +4,8 @@ on:
   push:
     branches:
       - master
-      - "**"  # Run on all branches (includes PR branches)
-  workflow_dispatch:  # Allow manual trigger from GitHub UI
+      - "**" # Run on all branches (includes PR branches)
+  workflow_dispatch: # Allow manual trigger from GitHub UI
 
 permissions:
   contents: read
diff --git a/.github/workflows/test-make-command.yml b/.github/workflows/test-make-command.yml
index f10ceaa3c45ad..79c27d54792f4 100644
--- a/.github/workflows/test-make-command.yml
+++ b/.github/workflows/test-make-command.yml
@@ -4,29 +4,28 @@ on:
   workflow_call:
     inputs:
       command:
-        description: 'Make command to run (e.g., test-behavior, check-examples, test-docs)'
+        description: "Make command to run (e.g., test-behavior, check-examples, test-docs)"
         required: true
         type: string
       job_name:
-        description: 'Display name for the job/status check'
+        description: "Display name for the job/status check"
         required: true
         type: string
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
       cargo_nextest:
-        description: 'Whether to install cargo-nextest'
+        description: "Whether to install cargo-nextest"
         required: false
         type: boolean
         default: false
       upload_test_results:
-        description: 'Whether to upload nextest test results (for commands that use cargo nextest)'
+        description: "Whether to upload nextest test results (for commands that use cargo nextest)"
         required: false
         type: boolean
         default: false
 
-
 permissions:
   contents: read
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 986b145305f78..81ceef93ca5f1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,7 +7,7 @@ on:
 
 # Workflow-level permissions - read access to repository contents
 permissions:
-  contents: read  # Required to checkout code
+  contents: read # Required to checkout code
 
 concurrency:
   # `github.ref` is unique for MQ runs and PRs
@@ -31,13 +31,14 @@ jobs:
   check-fmt:
     name: Check code format
     runs-on: ubuntu-24.04
-    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true' }}
+    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true' || needs.changes.outputs.prettier == 'true' }}
     needs: changes
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/setup
         with:
           rust: true
+          prettier: true
       - run: make check-fmt
 
   check-clippy:
diff --git a/.github/workflows/unit_mac.yml b/.github/workflows/unit_mac.yml
index b177b018d13ef..e0d367b530959 100644
--- a/.github/workflows/unit_mac.yml
+++ b/.github/workflows/unit_mac.yml
@@ -4,11 +4,10 @@ on:
   workflow_call:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
 
-
 permissions:
   contents: read
 
diff --git a/.github/workflows/unit_windows.yml b/.github/workflows/unit_windows.yml
index 831eec042f869..a4553b4a0b751 100644
--- a/.github/workflows/unit_windows.yml
+++ b/.github/workflows/unit_windows.yml
@@ -4,11 +4,10 @@ on:
   workflow_call:
     inputs:
       ref:
-        description: 'Git ref to checkout'
+        description: "Git ref to checkout"
         required: false
         type: string
 
-
 permissions:
   contents: read
 
diff --git a/.github/workflows/vdev_publish.yml b/.github/workflows/vdev_publish.yml
index edb2f36674731..3a46822098beb 100644
--- a/.github/workflows/vdev_publish.yml
+++ b/.github/workflows/vdev_publish.yml
@@ -1,16 +1,16 @@
 name: Publish vdev
 on:
   push:
-    tags: [ "vdev-v*.*.*" ]
+    tags: ["vdev-v*.*.*"]
 
 permissions:
-  contents: read  # Restrictive default
+  contents: read # Restrictive default
 
 jobs:
   build:
     runs-on: ${{ matrix.os }}
     permissions:
-      contents: write   # Required to upload release assets
+      contents: write # Required to upload release assets
     strategy:
       matrix:
         include:
diff --git a/.prettierignore b/.prettierignore
new file mode 100644
index 0000000000000..f7b79d1ba7d52
--- /dev/null
+++ b/.prettierignore
@@ -0,0 +1,30 @@
+# Build artifacts
+target/
+node_modules/
+
+# Generated / test fixture files
+docs/generated/
+lib/codecs/tests/data/
+
+# Hugo templates and assets (Go template syntax breaks prettier)
+website/**/*.html
+website/assets/js/app.js
+website/assets/js/dd-browser-logs-rum.js
+website/layouts/
+
+# Hugo build output and generated resources
+website/public/
+website/resources/
+website/data/
+website/assets/jsconfig.json
+
+# CUE files (not supported by prettier)
+website/cue/
+
+# Config examples using VRL triple-quoted strings
+config/examples/docs_example.yaml
+config/examples/file_to_prometheus.yaml
+
+# Lock files
+Cargo.lock
+website/yarn.lock
diff --git a/.prettierrc.json b/.prettierrc.json
new file mode 100644
index 0000000000000..a4643ee91d31c
--- /dev/null
+++ b/.prettierrc.json
@@ -0,0 +1,4 @@
+{
+  "trailingComma": "none",
+  "printWidth": 120
+}
diff --git a/Makefile b/Makefile
index 5c52c367c11b7..a923806254d9f 100644
--- a/Makefile
+++ b/Makefile
@@ -510,6 +510,24 @@ check-markdown: ## Check that markdown is styled properly
 fix-markdown: ## Auto-fix markdown style issues
 	${MAYBE_ENVIRONMENT_EXEC} markdownlint-cli2 --fix $(shell git ls-files '*.md')
 
+.PHONY: check-prettier
+check-prettier: ## Check that JS/TS/YAML/JSON files are formatted with prettier
+	@for ext in yml yaml js ts tsx json; do \
+		files=$$(git ls-files "*.$$ext"); \
+		if [ -n "$$files" ]; then \
+			${MAYBE_ENVIRONMENT_EXEC} prettier --ignore-path .prettierignore --check $$files || exit 1; \
+		fi; \
+	done
+
+.PHONY: fix-prettier
+fix-prettier: ## Auto-fix JS/TS/YAML/JSON formatting with prettier
+	@for ext in yml yaml js ts tsx json; do \
+		files=$$(git ls-files "*.$$ext"); \
+		if [ -n "$$files" ]; then \
+			${MAYBE_ENVIRONMENT_EXEC} prettier --ignore-path .prettierignore --write $$files || exit 1; \
+		fi; \
+	done
+
 .PHONY: check-examples
 check-examples: ## Check that the config/examples files are valid
 	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check examples
diff --git a/config/examples/environment_variables.yaml b/config/examples/environment_variables.yaml
index 2f73528397ad1..d8421c1cc8e01 100644
--- a/config/examples/environment_variables.yaml
+++ b/config/examples/environment_variables.yaml
@@ -13,7 +13,7 @@ data_dir: "/var/lib/vector"
 sources:
   apache_logs:
     type: "file"
-    include: [ "/var/log/apache2/*.log" ]
+    include: ["/var/log/apache2/*.log"]
     # ignore files older than 1 day
     ignore_older_secs: 86400
 
@@ -21,7 +21,7 @@ sources:
 # Docs: https://vector.dev/docs/reference/configuration/transforms/remap
 transforms:
   add_host:
-    inputs: [ "apache_logs" ]
+    inputs: ["apache_logs"]
     type: "remap"
     source: |
       '''
@@ -32,7 +32,7 @@ transforms:
 # Docs: https://vector.dev/docs/reference/configuration/sinks/console
 sinks:
   out:
-    inputs: [ "add_host" ]
+    inputs: ["add_host"]
     type: "console"
     encoding:
       codec: "json"
diff --git a/config/examples/file_to_cloudwatch_metrics.yaml b/config/examples/file_to_cloudwatch_metrics.yaml
index f322ab8f091b0..138f9d20ceac2 100644
--- a/config/examples/file_to_cloudwatch_metrics.yaml
+++ b/config/examples/file_to_cloudwatch_metrics.yaml
@@ -8,13 +8,13 @@ data_dir: "/var/lib/vector"
 sources:
   file:
     type: "file"
-    include: [ "sample.log" ]
+    include: ["sample.log"]
     start_at_beginning: true
 
 # Structure and parse the data
 transforms:
   remap:
-    inputs: [ "file" ]
+    inputs: ["file"]
     type: "remap"
     drop_on_error: false
     source: |
@@ -22,7 +22,7 @@ transforms:
 
   # Transform into metrics
   log_to_metric:
-    inputs: [ "remap" ]
+    inputs: ["remap"]
     type: "log_to_metric"
     metrics:
       - type: "counter"
@@ -35,19 +35,19 @@ transforms:
 # Output data
 sinks:
   console_metrics:
-    inputs: [ "log_to_metric" ]
+    inputs: ["log_to_metric"]
     type: "console"
     encoding:
       codec: "json"
 
   console_logs:
-    inputs: [ "remap" ]
+    inputs: ["remap"]
     type: "console"
     encoding:
       codec: "json"
 
   cloudwatch:
-    inputs: [ "log_to_metric" ]
+    inputs: ["log_to_metric"]
     type: "aws_cloudwatch_metrics"
     namespace: "vector"
     endpoint: "http://localhost:4566"
diff --git a/config/examples/namespacing/sinks/es_cluster.yaml b/config/examples/namespacing/sinks/es_cluster.yaml
index 820a49080b474..f916dac1b7180 100644
--- a/config/examples/namespacing/sinks/es_cluster.yaml
+++ b/config/examples/namespacing/sinks/es_cluster.yaml
@@ -1,6 +1,6 @@
 # Send structured data to a short-term storage
-inputs: ["apache_sample"]          # only take sampled data
+inputs: ["apache_sample"] # only take sampled data
 type: "elasticsearch"
-endpoint: "http://79.12.221.222:9200"      # local or external host
+endpoint: "http://79.12.221.222:9200" # local or external host
 bulk:
-  index: "vector-%Y-%m-%d"        # daily indices
+  index: "vector-%Y-%m-%d" # daily indices
diff --git a/config/examples/namespacing/sinks/s3_archives.yaml b/config/examples/namespacing/sinks/s3_archives.yaml
index a72c27027e8a1..6de3cd4df8f56 100644
--- a/config/examples/namespacing/sinks/s3_archives.yaml
+++ b/config/examples/namespacing/sinks/s3_archives.yaml
@@ -1,13 +1,13 @@
 # Send structured data to a cost-effective long-term storage
-inputs: ["apache_parser"]           # don't sample for S3
+inputs: ["apache_parser"] # don't sample for S3
 type: "aws_s3"
 region: "us-east-1"
 bucket: "my-log-archives"
-key_prefix: "date=%Y-%m-%d"         # daily partitions, hive friendly format
-compression: "gzip"                 # compress final objects
+key_prefix: "date=%Y-%m-%d" # daily partitions, hive friendly format
+compression: "gzip" # compress final objects
 framing:
-  method: "newline_delimited"       # new line delimited...
+  method: "newline_delimited" # new line delimited...
 encoding:
-  codec: "json"                     # ...JSON
+  codec: "json" # ...JSON
 batch:
-  max_bytes: 10000000               # 10mb uncompressed
+  max_bytes: 10000000 # 10mb uncompressed
diff --git a/config/examples/namespacing/transforms/apache_sample.yaml b/config/examples/namespacing/transforms/apache_sample.yaml
index 91b789e1016f2..cca25cf0989af 100644
--- a/config/examples/namespacing/transforms/apache_sample.yaml
+++ b/config/examples/namespacing/transforms/apache_sample.yaml
@@ -1,4 +1,4 @@
 # Sample the data to save on cost
 inputs: ["apache_parser"]
 type: "sample"
-rate: 2  # only keep 50% (1/`rate`)
+rate: 2 # only keep 50% (1/`rate`)
diff --git a/config/examples/stdio.yaml b/config/examples/stdio.yaml
index cbe6429d8afae..7ca39a81876da 100644
--- a/config/examples/stdio.yaml
+++ b/config/examples/stdio.yaml
@@ -11,7 +11,7 @@ sources:
 
 sinks:
   out:
-    inputs: [ "in" ]
+    inputs: ["in"]
     type: "console"
     encoding:
       codec: "text"
diff --git a/config/examples/wrapped_json.yaml b/config/examples/wrapped_json.yaml
index 90fed711f2a18..4bd6ab0a79f58 100644
--- a/config/examples/wrapped_json.yaml
+++ b/config/examples/wrapped_json.yaml
@@ -12,14 +12,14 @@ data_dir: "/var/lib/vector"
 sources:
   logs:
     type: "file"
-    include: [ "/var/log/*.log" ]
+    include: ["/var/log/*.log"]
     ignore_older_secs: 86400 # 1 day
 
 # Parse the data as JSON
 # Docs: https://vector.dev/docs/reference/configuration/transforms/remap
 transforms:
   parse_json:
-    inputs: [ "logs" ]
+    inputs: ["logs"]
     type: "remap"
     drop_on_error: false
     source: |
@@ -36,7 +36,7 @@ transforms:
 # Docs: https://vector.dev/docs/reference/configuration/sinks/console
 sinks:
   out:
-    inputs: [ "parse_json" ]
+    inputs: ["parse_json"]
     type: "console"
     encoding:
       codec: "json"
diff --git a/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/logs/v1/logs_service_http.yaml b/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/logs/v1/logs_service_http.yaml
index 4d913387252ef..4dd744f5d2c02 100644
--- a/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/logs/v1/logs_service_http.yaml
+++ b/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/logs/v1/logs_service_http.yaml
@@ -3,8 +3,7 @@
 type: google.api.Service
 config_version: 3
 http:
- rules:
- - selector: opentelemetry.proto.collector.logs.v1.LogsService.Export
-   post: /v1/logs
-   body: "*"
-
+  rules:
+    - selector: opentelemetry.proto.collector.logs.v1.LogsService.Export
+      post: /v1/logs
+      body: "*"
diff --git a/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/metrics/v1/metrics_service_http.yaml b/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/metrics/v1/metrics_service_http.yaml
index 7ff39d4b406c6..7643be4125831 100644
--- a/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/metrics/v1/metrics_service_http.yaml
+++ b/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/metrics/v1/metrics_service_http.yaml
@@ -3,8 +3,7 @@
 type: google.api.Service
 config_version: 3
 http:
- rules:
- - selector: opentelemetry.proto.collector.metrics.v1.MetricsService.Export
-   post: /v1/metrics
-   body: "*"
-
+  rules:
+    - selector: opentelemetry.proto.collector.metrics.v1.MetricsService.Export
+      post: /v1/metrics
+      body: "*"
diff --git a/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/trace/v1/trace_service_http.yaml b/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/trace/v1/trace_service_http.yaml
index d091b3a8d53d7..7eaa4e548c33a 100644
--- a/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/trace/v1/trace_service_http.yaml
+++ b/lib/opentelemetry-proto/src/proto/opentelemetry-proto/opentelemetry/proto/collector/trace/v1/trace_service_http.yaml
@@ -3,7 +3,7 @@
 type: google.api.Service
 config_version: 3
 http:
- rules:
- - selector: opentelemetry.proto.collector.trace.v1.TraceService.Export
-   post: /v1/traces
-   body: "*"
+  rules:
+    - selector: opentelemetry.proto.collector.trace.v1.TraceService.Export
+      post: /v1/traces
+      body: "*"
diff --git a/lib/vector-core/tests/data/fixtures/log_event/malformed.json b/lib/vector-core/tests/data/fixtures/log_event/malformed.json
index 6f956957a7b81..32603adb1fb2f 100644
--- a/lib/vector-core/tests/data/fixtures/log_event/malformed.json
+++ b/lib/vector-core/tests/data/fixtures/log_event/malformed.json
@@ -1,4 +1,4 @@
 {
   "foo": "bar",
   "foo": "You're not allowed duplicate keys..."
-}
\ No newline at end of file
+}
diff --git a/lib/vector-vrl/tests/resources/json-schema_definition.json b/lib/vector-vrl/tests/resources/json-schema_definition.json
index 9c4c8a00d0b28..a2e51e99c51d1 100644
--- a/lib/vector-vrl/tests/resources/json-schema_definition.json
+++ b/lib/vector-vrl/tests/resources/json-schema_definition.json
@@ -1 +1,10 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://example.com/product.schema.json","title":"Product","description":"A product from Acme's catalog","type":"object","properties":{"productUser":{"description":"The unique identifier for a product user","type":"string","format":"email"}}}
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://example.com/product.schema.json",
+  "title": "Product",
+  "description": "A product from Acme's catalog",
+  "type": "object",
+  "properties": {
+    "productUser": { "description": "The unique identifier for a product user", "type": "string", "format": "email" }
+  }
+}
diff --git a/lib/vector-vrl/web-playground/public/index.js b/lib/vector-vrl/web-playground/public/index.js
index 4cdc2bf4e0dcc..9f810ec29e74a 100644
--- a/lib/vector-vrl/web-playground/public/index.js
+++ b/lib/vector-vrl/web-playground/public/index.js
@@ -1,5 +1,5 @@
-import init, {run_vrl, vector_link, vector_version, vrl_link, vrl_version} from "./pkg/vector_vrl_web_playground.js";
-import {vrlLanguageDefinition, vrlThemeDefinition} from "./vrl-highlighter.js";
+import init, { run_vrl, vector_link, vector_version, vrl_link, vrl_version } from "./pkg/vector_vrl_web_playground.js";
+import { vrlLanguageDefinition, vrlThemeDefinition } from "./vrl-highlighter.js";
 
 const PROGRAM_EDITOR_DEFAULT_VALUE = `# Remove some fields
 del(.foo)
@@ -42,309 +42,313 @@ You can try validating your JSON here: https://jsonlint.com/
 `;
 
 function loadMonaco() {
-    return new Promise((resolve, reject) => {
-        // require is provided by loader.min.js.
-        require.config({
-            paths: {vs: "https://cdnjs.cloudflare.com/ajax/libs/monaco-editor/0.26.1/min/vs"},
-        });
-        require(["vs/editor/editor.main"], () => resolve(window.monaco), reject);
+  return new Promise((resolve, reject) => {
+    // require is provided by loader.min.js.
+    require.config({
+      paths: { vs: "https://cdnjs.cloudflare.com/ajax/libs/monaco-editor/0.26.1/min/vs" }
     });
+    require(["vs/editor/editor.main"], () => resolve(window.monaco), reject);
+  });
 }
 
 export class VrlWebPlayground {
-    static async create() {
-        const instance = new VrlWebPlayground(true);
-        await instance._initAsync();
-        return instance;
+  static async create() {
+    const instance = new VrlWebPlayground(true);
+    await instance._initAsync();
+    return instance;
+  }
+
+  constructor(_internal = false) {
+    if (!_internal) {
+      // Prefer factory: VrlWebPlayground.create()
+      this._initAsync(); // fire-and-forget fallback
     }
-
-    constructor(_internal = false) {
-        if (!_internal) {
-            // Prefer factory: VrlWebPlayground.create()
-            this._initAsync(); // fire-and-forget fallback
-        }
+  }
+
+  async _initAsync() {
+    // Load wasm/runtime
+    await init();
+
+    // Bind native funcs/versions
+    this.run_vrl = run_vrl;
+    this.vector_version = vector_version();
+    this.vector_link = vector_link();
+    this.vrl_version = vrl_version();
+    this.vrl_link = vrl_link();
+
+    // Load Monaco
+    this.monaco = await loadMonaco();
+
+    // VRL lang + theme
+    this.monaco.languages.register({ id: "vrl" });
+    this.monaco.editor.defineTheme("vrl-theme", vrlThemeDefinition);
+    this.monaco.languages.setMonarchTokensProvider("vrl", vrlLanguageDefinition);
+
+    // Editors
+    this.eventEditor = this.createDefaultEditor("container-event", EVENT_EDITOR_DEFAULT_VALUE, "json", "vs-light");
+    this.outputEditor = this.createDefaultEditor("container-output", OUTPUT_EDITOR_DEFAULT_VALUE, "json", "vs-light");
+    this.programEditor = this.createDefaultEditor(
+      "container-program",
+      PROGRAM_EDITOR_DEFAULT_VALUE,
+      "vrl",
+      "vrl-theme"
+    );
+
+    // Versions
+    this.addVersions();
+
+    // Handle shared state from URL (if present)
+    this._maybeLoadFromUrl();
+  }
+
+  _maybeLoadFromUrl() {
+    const qs = window.location.search;
+    if (!qs) return;
+
+    const urlParams = new URLSearchParams(qs);
+    const stateParam = urlParams.get("state");
+    if (!stateParam) return;
+
+    try {
+      const decoded = atob(decodeURIComponent(stateParam));
+      const urlState = JSON.parse(decoded);
+
+      if (typeof urlState.program === "string") {
+        this.programEditor.setValue(urlState.program);
+      }
+
+      if (urlState.is_jsonl === true && typeof urlState.event === "string") {
+        this.eventEditor.setValue(urlState.event);
+      } else if (urlState.event != null) {
+        this.eventEditor.setValue(JSON.stringify(urlState.event, null, "\t"));
+      }
+
+      // Run immediately with the provided state
+      this.handleRunCode(urlState);
+    } catch (e) {
+      this.disableJsonLinting();
+      this.outputEditor.setValue(`Error reading the shared URL\n${e}`);
     }
+  }
 
-    async _initAsync() {
-        // Load wasm/runtime
-        await init();
-
-        // Bind native funcs/versions
-        this.run_vrl = run_vrl;
-        this.vector_version = vector_version();
-        this.vector_link = vector_link();
-        this.vrl_version = vrl_version();
-        this.vrl_link = vrl_link();
-
-        // Load Monaco
-        this.monaco = await loadMonaco();
-
-        // VRL lang + theme
-        this.monaco.languages.register({id: "vrl"});
-        this.monaco.editor.defineTheme("vrl-theme", vrlThemeDefinition);
-        this.monaco.languages.setMonarchTokensProvider("vrl", vrlLanguageDefinition);
-
-        // Editors
-        this.eventEditor = this.createDefaultEditor("container-event", EVENT_EDITOR_DEFAULT_VALUE, "json", "vs-light");
-        this.outputEditor = this.createDefaultEditor("container-output", OUTPUT_EDITOR_DEFAULT_VALUE, "json", "vs-light");
-        this.programEditor = this.createDefaultEditor("container-program", PROGRAM_EDITOR_DEFAULT_VALUE, "vrl", "vrl-theme");
-
-        // Versions
-        this.addVersions();
-
-        // Handle shared state from URL (if present)
-        this._maybeLoadFromUrl();
+  addVersions() {
+    const vectorLinkElement = document.getElementById("vector-version-link");
+    if (vectorLinkElement) {
+      vectorLinkElement.text = (this.vector_version || "").toString().substring(0, 8);
+      vectorLinkElement.href = this.vector_link || "#";
     }
 
-    _maybeLoadFromUrl() {
-        const qs = window.location.search;
-        if (!qs) return;
-
-        const urlParams = new URLSearchParams(qs);
-        const stateParam = urlParams.get("state");
-        if (!stateParam) return;
-
-        try {
-            const decoded = atob(decodeURIComponent(stateParam));
-            const urlState = JSON.parse(decoded);
-
-            if (typeof urlState.program === "string") {
-                this.programEditor.setValue(urlState.program);
-            }
-
-            if (urlState.is_jsonl === true && typeof urlState.event === "string") {
-                this.eventEditor.setValue(urlState.event);
-            } else if (urlState.event != null) {
-                this.eventEditor.setValue(JSON.stringify(urlState.event, null, "\t"));
-            }
-
-            // Run immediately with the provided state
-            this.handleRunCode(urlState);
-        } catch (e) {
-            this.disableJsonLinting();
-            this.outputEditor.setValue(`Error reading the shared URL\n${e}`);
-        }
+    const vrlLinkElement = document.getElementById("vrl-version-link");
+    if (vrlLinkElement) {
+      vrlLinkElement.text = (this.vrl_version || "").toString().substring(0, 8);
+      vrlLinkElement.href = this.vrl_link || "#";
     }
+  }
 
-    addVersions() {
-        const vectorLinkElement = document.getElementById("vector-version-link");
-        if (vectorLinkElement) {
-            vectorLinkElement.text = (this.vector_version || "").toString().substring(0, 8);
-            vectorLinkElement.href = this.vector_link || "#";
-        }
-
-        const vrlLinkElement = document.getElementById("vrl-version-link");
-        if (vrlLinkElement) {
-            vrlLinkElement.text = (this.vrl_version || "").toString().substring(0, 8);
-            vrlLinkElement.href = this.vrl_link || "#";
-        }
+  createDefaultEditor(elementId, value, language, theme) {
+    const el = document.getElementById(elementId);
+    if (!el) {
+      console.warn(`Editor container #${elementId} not found`);
+      return null;
     }
+    return this.monaco.editor.create(el, {
+      value,
+      language,
+      theme,
+      minimap: { enabled: false },
+      automaticLayout: true,
+      wordWrap: "on"
+    });
+  }
 
-    createDefaultEditor(elementId, value, language, theme) {
-        const el = document.getElementById(elementId);
-        if (!el) {
-            console.warn(`Editor container #${elementId} not found`);
-            return null;
-        }
-        return this.monaco.editor.create(el, {
-            value,
-            language,
-            theme,
-            minimap: {enabled: false},
-            automaticLayout: true,
-            wordWrap: 'on',
-        });
+  _clearOutput() {
+    if (this.outputEditor) {
+      // wipe the buffer so stale values never linger
+      this.outputEditor.setValue("");
     }
-
-    _clearOutput() {
-        if (this.outputEditor) {
-            // wipe the buffer so stale values never linger
-            this.outputEditor.setValue("");
-        }
-        const elapsedEl = document.getElementById("elapsed-time");
-        if (elapsedEl) {
-            elapsedEl.textContent = "";
-        }
+    const elapsedEl = document.getElementById("elapsed-time");
+    if (elapsedEl) {
+      elapsedEl.textContent = "";
     }
+  }
 
-    _formatRunResult(runResult) {
-        if (runResult?.target_value != null) {
-            const isJson = typeof runResult.target_value === "object";
-            const text = isJson
-                ? JSON.stringify(runResult.target_value, null, "\t")
-                : String(runResult.target_value);
-            return {text, isJson};
-        }
-        if (runResult?.msg != null) {
-            return {text: String(runResult.msg), isJson: false};
-        }
-        return {text: "Error - VRL did not return a result.", isJson: false};
+  _formatRunResult(runResult) {
+    if (runResult?.target_value != null) {
+      const isJson = typeof runResult.target_value === "object";
+      const text = isJson ? JSON.stringify(runResult.target_value, null, "\t") : String(runResult.target_value);
+      return { text, isJson };
     }
-
-    _setElapsed(elapsed_time) {
-        const elapsedEl = document.getElementById("elapsed-time");
-        if (elapsedEl && elapsed_time != null) {
-            const ms = elapsed_time.toFixed(4)
-            elapsedEl.textContent = `Duration: ${ms} milliseconds`;
-        }
+    if (runResult?.msg != null) {
+      return { text: String(runResult.msg), isJson: false };
     }
-
-    _safeGet(editor, fallback = "") {
-        return editor?.getValue?.() ?? fallback;
+    return { text: "Error - VRL did not return a result.", isJson: false };
+  }
+
+  _setElapsed(elapsed_time) {
+    const elapsedEl = document.getElementById("elapsed-time");
+    if (elapsedEl && elapsed_time != null) {
+      const ms = elapsed_time.toFixed(4);
+      elapsedEl.textContent = `Duration: ${ms} milliseconds`;
     }
-
-    getState() {
-        if (this.eventEditorIsJsonl()) {
-            return {
-                program: this._safeGet(this.programEditor),
-                event: this.eventEditor.getModel().getLinesContent().join("\n"),
-                is_jsonl: true,
-                error: null,
-            };
-        }
-
-        const editorValue = this._safeGet(this.eventEditor);
-        try {
-            return {
-                program: this._safeGet(this.programEditor),
-                event: JSON.parse(editorValue.length === 0 ? "{}" : editorValue),
-                is_jsonl: false,
-                error: null,
-            };
-        } catch (_err) {
-            return {
-                program: this._safeGet(this.programEditor),
-                event: null,
-                is_jsonl: false,
-                error: `Could not parse JSON event:\n${editorValue}`,
-            };
-        }
+  }
+
+  _safeGet(editor, fallback = "") {
+    return editor?.getValue?.() ?? fallback;
+  }
+
+  getState() {
+    if (this.eventEditorIsJsonl()) {
+      return {
+        program: this._safeGet(this.programEditor),
+        event: this.eventEditor.getModel().getLinesContent().join("\n"),
+        is_jsonl: true,
+        error: null
+      };
     }
 
-    disableJsonLinting() {
-        this.monaco.languages.json.jsonDefaults.setDiagnosticsOptions({validate: false});
+    const editorValue = this._safeGet(this.eventEditor);
+    try {
+      return {
+        program: this._safeGet(this.programEditor),
+        event: JSON.parse(editorValue.length === 0 ? "{}" : editorValue),
+        is_jsonl: false,
+        error: null
+      };
+    } catch (_err) {
+      return {
+        program: this._safeGet(this.programEditor),
+        event: null,
+        is_jsonl: false,
+        error: `Could not parse JSON event:\n${editorValue}`
+      };
     }
-
-    enableJsonLinting() {
-        this.monaco.languages.json.jsonDefaults.setDiagnosticsOptions({validate: true});
+  }
+
+  disableJsonLinting() {
+    this.monaco.languages.json.jsonDefaults.setDiagnosticsOptions({ validate: false });
+  }
+
+  enableJsonLinting() {
+    this.monaco.languages.json.jsonDefaults.setDiagnosticsOptions({ validate: true });
+  }
+
+  tryJsonParse(str) {
+    try {
+      return JSON.parse(str);
+    } catch (_e) {
+      this.disableJsonLinting();
+      const err = ERROR_INVALID_JSONL_EVENT_MSG.toString().replace("{{str}}", str);
+      this.outputEditor.setValue(err);
+      throw new Error(err);
     }
-
-    tryJsonParse(str) {
-        try {
-            return JSON.parse(str);
-        } catch (_e) {
-            this.disableJsonLinting();
-            const err = ERROR_INVALID_JSONL_EVENT_MSG.toString().replace("{{str}}", str);
-            this.outputEditor.setValue(err);
-            throw new Error(err);
-        }
+  }
+
+  /**
+   * Treat as JSONL if there are >1 non-empty lines and at least the second non-empty
+   * line *appears* to be a JSON object. Robust to whitespace.
+   */
+  eventEditorIsJsonl() {
+    const model = this.eventEditor?.getModel?.();
+    if (!model) return false;
+
+    const rawLines = model.getLinesContent();
+    const lines = rawLines.map((l) => l.trim()).filter((l) => l.length > 0);
+    if (lines.length <= 1) return false;
+
+    const second = lines[1];
+    return second.startsWith("{") && second.endsWith("}");
+  }
+
+  _getTimezoneOrDefault() {
+    const tzEl = document.getElementById("timezone-input");
+    return tzEl?.value && tzEl.value.trim().length > 0 ? tzEl.value.trim() : "Default";
+  }
+
+  handleRunCode(input) {
+    this._clearOutput();
+
+    // JSONL path short-circuit
+    if (this.eventEditorIsJsonl()) {
+      return this.handleRunCodeJsonl();
     }
 
-    /**
-     * Treat as JSONL if there are >1 non-empty lines and at least the second non-empty
-     * line *appears* to be a JSON object. Robust to whitespace.
-     */
-    eventEditorIsJsonl() {
-        const model = this.eventEditor?.getModel?.();
-        if (!model) return false;
-
-        const rawLines = model.getLinesContent();
-        const lines = rawLines.map((l) => l.trim()).filter((l) => l.length > 0);
-        if (lines.length <= 1) return false;
-
-        const second = lines[1];
-        return second.startsWith("{") && second.endsWith("}");
+    if (input == null) {
+      input = this.getState();
     }
 
-    _getTimezoneOrDefault() {
-        const tzEl = document.getElementById("timezone-input");
-        return tzEl?.value && tzEl.value.trim().length > 0 ? tzEl.value.trim() : "Default";
+    if (input.error) {
+      console.error(input.error);
+      this.disableJsonLinting();
+      this.outputEditor.setValue(input.error);
+      return input;
     }
 
-    handleRunCode(input) {
-        this._clearOutput();
-
-        // JSONL path short-circuit
-        if (this.eventEditorIsJsonl()) {
-            return this.handleRunCodeJsonl();
-        }
-
-        if (input == null) {
-            input = this.getState();
-        }
-
-        if (input.error) {
-            console.error(input.error);
-            this.disableJsonLinting();
-            this.outputEditor.setValue(input.error);
-            return input;
-        }
-
-        const timezone = this._getTimezoneOrDefault();
-        console.debug("Selected timezone: ", timezone);
-        const runResult = this.run_vrl(input, timezone);
-        console.log("Run result: ", runResult);
-
-        const {text, isJson} = this._formatRunResult(runResult);
-        if (isJson) this.enableJsonLinting(); else this.disableJsonLinting();
-        this.outputEditor.setValue(text);
-
-        this._setElapsed(runResult?.elapsed_time);
-        return runResult;
-    }
-
-    handleRunCodeJsonl() {
-        this._clearOutput();
-
-        const program = this._safeGet(this.programEditor);
-        const model = this.eventEditor?.getModel?.();
-        const rawLines = model ? model.getLinesContent() : [];
-        const lines = rawLines.map(l => l.trim()).filter(l => l.length > 0);
-
-        const timezone = this._getTimezoneOrDefault();
-
-        // Build inputs while validating JSON per line
-        const inputs = lines.map(line => ({
-            program,
-            event: this.tryJsonParse(line),
-            is_jsonl: true,
-        }));
-
-        // Run and collect results
-        const results = inputs.map(input => this.run_vrl(input, timezone));
-
-        const outputs = results.map(r => this._formatRunResult(r).text);
-
-        // Output is not pure JSON (multiple objects / possible errors)
-        this.disableJsonLinting();
-        this.outputEditor.setValue(outputs.join("\n"));
-
-        // Aggregate elapsed time, rounded
-        const total = results.reduce((sum, r) => sum + (typeof r?.elapsed_time === "number" ? r.elapsed_time : 0), 0);
-        this._setElapsed(total);
-
-        return results;
-    }
-
-    handleShareCode() {
-        const state = this.getState();
-        try {
-            const encoded = encodeURIComponent(btoa(JSON.stringify(state)));
-            window.history.pushState(state, "", `?state=${encoded}`);
-            return true;
-        } catch (e) {
-            this.disableJsonLinting();
-            this.outputEditor.setValue(`Error encoding state for URL\n${e}`);
-            return false;
-        }
+    const timezone = this._getTimezoneOrDefault();
+    console.debug("Selected timezone: ", timezone);
+    const runResult = this.run_vrl(input, timezone);
+    console.log("Run result: ", runResult);
+
+    const { text, isJson } = this._formatRunResult(runResult);
+    if (isJson) this.enableJsonLinting();
+    else this.disableJsonLinting();
+    this.outputEditor.setValue(text);
+
+    this._setElapsed(runResult?.elapsed_time);
+    return runResult;
+  }
+
+  handleRunCodeJsonl() {
+    this._clearOutput();
+
+    const program = this._safeGet(this.programEditor);
+    const model = this.eventEditor?.getModel?.();
+    const rawLines = model ? model.getLinesContent() : [];
+    const lines = rawLines.map((l) => l.trim()).filter((l) => l.length > 0);
+
+    const timezone = this._getTimezoneOrDefault();
+
+    // Build inputs while validating JSON per line
+    const inputs = lines.map((line) => ({
+      program,
+      event: this.tryJsonParse(line),
+      is_jsonl: true
+    }));
+
+    // Run and collect results
+    const results = inputs.map((input) => this.run_vrl(input, timezone));
+
+    const outputs = results.map((r) => this._formatRunResult(r).text);
+
+    // Output is not pure JSON (multiple objects / possible errors)
+    this.disableJsonLinting();
+    this.outputEditor.setValue(outputs.join("\n"));
+
+    // Aggregate elapsed time, rounded
+    const total = results.reduce((sum, r) => sum + (typeof r?.elapsed_time === "number" ? r.elapsed_time : 0), 0);
+    this._setElapsed(total);
+
+    return results;
+  }
+
+  handleShareCode() {
+    const state = this.getState();
+    try {
+      const encoded = encodeURIComponent(btoa(JSON.stringify(state)));
+      window.history.pushState(state, "", `?state=${encoded}`);
+      return true;
+    } catch (e) {
+      this.disableJsonLinting();
+      this.outputEditor.setValue(`Error encoding state for URL\n${e}`);
+      return false;
     }
+  }
 }
 
 // Prefer the async factory to ensure everything is loaded before use:
 VrlWebPlayground.create()
-    .then((instance) => {
-        window.vrlPlayground = instance;
-    })
-    .catch((err) => {
-        console.error("Failed to initialize VrlWebPlayground:", err);
-    });
+  .then((instance) => {
+    window.vrlPlayground = instance;
+  })
+  .catch((err) => {
+    console.error("Failed to initialize VrlWebPlayground:", err);
+  });
diff --git a/lib/vector-vrl/web-playground/public/vrl-highlighter.js b/lib/vector-vrl/web-playground/public/vrl-highlighter.js
index 3efaed67a4a4b..527934106530f 100644
--- a/lib/vector-vrl/web-playground/public/vrl-highlighter.js
+++ b/lib/vector-vrl/web-playground/public/vrl-highlighter.js
@@ -1,636 +1,633 @@
 // VRL Language Definition
 export let vrlLanguageDefinition = {
-    defaultToken: "invalid",
-    ignoreCase: true,
-    tokenPostfix: ".vrl",
+  defaultToken: "invalid",
+  ignoreCase: true,
+  tokenPostfix: ".vrl",
 
-    brackets: [
-        { open: "{", close: "}", token: "delimiter.curly" },
-        { open: "[", close: "]", token: "delimiter.square" },
-        { open: "(", close: ")", token: "delimiter.parenthesis" },
-    ],
+  brackets: [
+    { open: "{", close: "}", token: "delimiter.curly" },
+    { open: "[", close: "]", token: "delimiter.square" },
+    { open: "(", close: ")", token: "delimiter.parenthesis" }
+  ],
 
-    regEx: /\/(?!\/\/)(?:[^\/\\]|\\.)*\/[igm]*/,
+  regEx: /\/(?!\/\/)(?:[^\/\\]|\\.)*\/[igm]*/,
 
-    keywords: [
-        "abort",
-        "as",
-        "break",
-        "continue",
-        "else",
-        "false",
-        "for",
-        "if",
-        "impl",
-        "in",
-        "let",
-        "loop",
-        "null",
-        "return",
-        "self",
-        "std",
-        "then",
-        "this",
-        "true",
-        "type",
-        "until",
-        "use",
-        "while",
-    ],
+  keywords: [
+    "abort",
+    "as",
+    "break",
+    "continue",
+    "else",
+    "false",
+    "for",
+    "if",
+    "impl",
+    "in",
+    "let",
+    "loop",
+    "null",
+    "return",
+    "self",
+    "std",
+    "then",
+    "this",
+    "true",
+    "type",
+    "until",
+    "use",
+    "while"
+  ],
 
-    // we include these common regular expressions
-    symbols: /[=><!~?&%|+\-*\/\^\.,\:]+/,
-    escapes: /\\(?:[abfnrtv\\"'$]|x[0-9A-Fa-f]{1,4}|u[0-9A-Fa-f]{4}|U[0-9A-Fa-f]{8})/,
+  // we include these common regular expressions
+  symbols: /[=><!~?&%|+\-*\/\^\.,\:]+/,
+  escapes: /\\(?:[abfnrtv\\"'$]|x[0-9A-Fa-f]{1,4}|u[0-9A-Fa-f]{4}|U[0-9A-Fa-f]{8})/,
 
-    // The main tokenizer for our languages
-    tokenizer: {
-        root: [
-            // function invokes fallible
-            [
-                /([a-zA-Z_!]+)(\!)(\()/,
-                {
-                    cases: {
-                        $3: ['keyword', 'keyword', '']
-                    }
-                    //   log: 'in function invoke::found::\n\n$0'
-                },
-            ],
-            // function invokes
-            [
-                /([a-zA-Z_!]+)(\()/,
-                {
-                    cases: {
-                        $2: ['keyword', '']
-                    }
-                    //   log: 'in function invoke::found::\n\n$0'
-                },
-            ],
+  // The main tokenizer for our languages
+  tokenizer: {
+    root: [
+      // function invokes fallible
+      [
+        /([a-zA-Z_!]+)(\!)(\()/,
+        {
+          cases: {
+            $3: ["keyword", "keyword", ""]
+          }
+          //   log: 'in function invoke::found::\n\n$0'
+        }
+      ],
+      // function invokes
+      [
+        /([a-zA-Z_!]+)(\()/,
+        {
+          cases: {
+            $2: ["keyword", ""]
+          }
+          //   log: 'in function invoke::found::\n\n$0'
+        }
+      ],
 
-            // rstrings
-            [/r'[^']+'/, { token: "regexp" /*log: 'root_r_string::\n\n$0'*/ }],
+      // rstrings
+      [/r'[^']+'/, { token: "regexp" /*log: 'root_r_string::\n\n$0'*/ }],
 
-            // timestamps
-            [/t'[^']+'/, { token: "regexp" /*log: 'function_arg_r_string::\n\n$0'*/ }],
+      // timestamps
+      [/t'[^']+'/, { token: "regexp" /*log: 'function_arg_r_string::\n\n$0'*/ }],
 
-            // field access, eg: .foo
-            [/(\.[^\ \=]+)([\ |\=])/, {
-                cases: {
-                    $2: ["entity", ""]
-                }
-            }],
+      // field access, eg: .foo
+      [
+        /(\.[^\ \=]+)([\ |\=])/,
+        {
+          cases: {
+            $2: ["entity", ""]
+          }
+        }
+      ],
 
-            // sstrings
-            [/s'[^']+'/, { token: "string" /*log: 'root_s_string::\n\n$0'*/ }],
+      // sstrings
+      [/s'[^']+'/, { token: "string" /*log: 'root_s_string::\n\n$0'*/ }],
 
-            // identifiers and keywords
-            [/\@[a-zA-Z_]\w*/, "variable.predefined"],
+      // identifiers and keywords
+      [/\@[a-zA-Z_]\w*/, "variable.predefined"],
 
-            [
-                /[a-zA-Z_]\w*/,
-                {
-                    cases: {
-                    this: "variable.predefined",
-                    "@keywords": { token: "keyword.$0" },
+      [
+        /[a-zA-Z_]\w*/,
+        {
+          cases: {
+            this: "variable.predefined",
+            "@keywords": { token: "keyword.$0" },
 
-                    "@default": "",
-                    },
-                },
-            ],
+            "@default": ""
+          }
+        }
+      ],
 
-            // whitespace
-            [/[ \t\r\n]+/, ""],
+      // whitespace
+      [/[ \t\r\n]+/, ""],
 
-            // Comments
-            [/###/, "comment", "@comment"],
-            [/#.*$/, "comment"],
+      // Comments
+      [/###/, "comment", "@comment"],
+      [/#.*$/, "comment"],
 
-            // Function invokes
+      // Function invokes
 
-            // regular expressions
-            ["///", { token: "regexp", next: "@hereregexp" }],
+      // regular expressions
+      ["///", { token: "regexp", next: "@hereregexp" }],
 
-            [/^(\s*)(@regEx)/, ["", "regexp"]],
-            [/(\()(\s*)(@regEx)/, ["@brackets", "", "regexp"]],
-            [/(\,)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
-            [/(\=)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
-            [/(\:)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
-            [/(\[)(\s*)(@regEx)/, ["@brackets", "", "regexp"]],
-            [/(\!)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
-            [/(\&)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
-            [/(\|)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
-            [/(\?)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
-            [/(\{)(\s*)(@regEx)/, ["@brackets", "", "regexp"]],
-            [/(\;)(\s*)(@regEx)/, ["", "", "regexp"]],
+      [/^(\s*)(@regEx)/, ["", "regexp"]],
+      [/(\()(\s*)(@regEx)/, ["@brackets", "", "regexp"]],
+      [/(\,)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
+      [/(\=)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
+      [/(\:)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
+      [/(\[)(\s*)(@regEx)/, ["@brackets", "", "regexp"]],
+      [/(\!)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
+      [/(\&)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
+      [/(\|)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
+      [/(\?)(\s*)(@regEx)/, ["delimiter", "", "regexp"]],
+      [/(\{)(\s*)(@regEx)/, ["@brackets", "", "regexp"]],
+      [/(\;)(\s*)(@regEx)/, ["", "", "regexp"]],
 
-            // delimiters
-            [
-                /}/,
-                {
-                    cases: {
-                    "$S2==interpolatedstring": {
-                        token: "string",
-                        next: "@pop",
-                    },
-                    "@default": "@brackets",
-                    },
-                },
-            ],
-            [/[{}()\[\]]/, "@brackets"],
-            [/@symbols/, "delimiter"],
+      // delimiters
+      [
+        /}/,
+        {
+          cases: {
+            "$S2==interpolatedstring": {
+              token: "string",
+              next: "@pop"
+            },
+            "@default": "@brackets"
+          }
+        }
+      ],
+      [/[{}()\[\]]/, "@brackets"],
+      [/@symbols/, "delimiter"],
 
-            // numbers
-            [/\d+[eE]([\-+]?\d+)?/, "number.float"],
-            [/\d+\.\d+([eE][\-+]?\d+)?/, "number.float"],
-            [/0[xX][0-9a-fA-F]+/, "number.hex"],
-            [/0[0-7]+(?!\d)/, "number.octal"],
-            [/\d+/, "number"],
+      // numbers
+      [/\d+[eE]([\-+]?\d+)?/, "number.float"],
+      [/\d+\.\d+([eE][\-+]?\d+)?/, "number.float"],
+      [/0[xX][0-9a-fA-F]+/, "number.hex"],
+      [/0[0-7]+(?!\d)/, "number.octal"],
+      [/\d+/, "number"],
 
-            // delimiter: after number because of .\d floats
-            [/[,.]/, "delimiter"],
+      // delimiter: after number because of .\d floats
+      [/[,.]/, "delimiter"],
 
-            // strings:
-            [/"""/, "string", '@herestring."""'],
-            [/'''/, "string", "@herestring.'''"],
-            [
-                /"/,
-                {
-                    cases: {
-                    "@eos": "string",
-                    "@default": { token: "string", next: '@string."' },
-                    },
-                },
-            ],
-            [
-                /'/,
-                {
-                    cases: {
-                    "@eos": "string",
-                    "@default": { token: "string", next: "@string.'" },
-                    },
-                },
-            ],
-        ],
+      // strings:
+      [/"""/, "string", '@herestring."""'],
+      [/'''/, "string", "@herestring.'''"],
+      [
+        /"/,
+        {
+          cases: {
+            "@eos": "string",
+            "@default": { token: "string", next: '@string."' }
+          }
+        }
+      ],
+      [
+        /'/,
+        {
+          cases: {
+            "@eos": "string",
+            "@default": { token: "string", next: "@string.'" }
+          }
+        }
+      ]
+    ],
 
-        string: [
-            [/[^"'\#\\]+/, "string"],
-            [/@escapes/, "string.escape"],
-            [/\./, "string.escape.invalid"],
-            [/\./, "string.escape.invalid"],
+    string: [
+      [/[^"'\#\\]+/, "string"],
+      [/@escapes/, "string.escape"],
+      [/\./, "string.escape.invalid"],
+      [/\./, "string.escape.invalid"],
 
-            [
-                /#{/,
-                {
-                    cases: {
-                    '$S2=="': {
-                        token: "string",
-                        next: "root.interpolatedstring",
-                    },
-                    "@default": "string",
-                    },
-                },
-            ],
+      [
+        /#{/,
+        {
+          cases: {
+            '$S2=="': {
+              token: "string",
+              next: "root.interpolatedstring"
+            },
+            "@default": "string"
+          }
+        }
+      ],
 
-            [
-                /["']/,
-                {
-                    cases: {
-                    "$#==$S2": { token: "string", next: "@pop" },
-                    "@default": "string",
-                    },
-                },
-            ],
-            [/#/, "string"],
-        ],
+      [
+        /["']/,
+        {
+          cases: {
+            "$#==$S2": { token: "string", next: "@pop" },
+            "@default": "string"
+          }
+        }
+      ],
+      [/#/, "string"]
+    ],
 
-        herestring: [
-            [
-                /("""|''')/,
-                {
-                    cases: {
-                    "$1==$S2": { token: "string", next: "@pop" },
-                    "@default": "string",
-                    },
-                },
-            ],
-            [/[^#\\'"]+/, "string"],
-            [/['"]+/, "string"],
-            [/@escapes/, "string.escape"],
-            [/\./, "string.escape.invalid"],
+    herestring: [
+      [
+        /("""|''')/,
+        {
+          cases: {
+            "$1==$S2": { token: "string", next: "@pop" },
+            "@default": "string"
+          }
+        }
+      ],
+      [/[^#\\'"]+/, "string"],
+      [/['"]+/, "string"],
+      [/@escapes/, "string.escape"],
+      [/\./, "string.escape.invalid"],
 
-            [/#{/, { token: "string.quote", next: "root.interpolatedstring" }],
-            [/#/, "string"],
-        ],
+      [/#{/, { token: "string.quote", next: "root.interpolatedstring" }],
+      [/#/, "string"]
+    ],
 
-        comment: [
-            [/[^#]+/, "comment"],
-            [/###/, "comment", "@pop"],
-            [/#/, "comment"],
-        ],
+    comment: [
+      [/[^#]+/, "comment"],
+      [/###/, "comment", "@pop"],
+      [/#/, "comment"]
+    ],
 
-        hereregexp: [
-            [/[^\\\/#]+/, "regexp"],
-            [/\\./, "regexp"],
-            [/#.*$/, "comment"],
-            ["///[igm]*", { token: "regexp", next: "@pop" }],
-            [/\//, "regexp"],
-        ],
+    hereregexp: [
+      [/[^\\\/#]+/, "regexp"],
+      [/\\./, "regexp"],
+      [/#.*$/, "comment"],
+      ["///[igm]*", { token: "regexp", next: "@pop" }],
+      [/\//, "regexp"]
+    ],
 
-        function_arg: [
-            [
-                /([a-zA-Z_!]+)\(/,
-                { cases: { $S1: { token: "keyword", next: "@push", log: "function_arg_nested::\n\n$0" } } },
-            ],
-            // we copy the string highlighters from root and apply them to function arguments as well
-            [/"""/, "string", '@herestring."""'],
-            [/'''/, "string", "@herestring.'''"],
-            [
-                /"/,
-                {
-                    cases: {
-                    "@eos": "string",
-                    "@default": { token: "string", next: '@string."' },
-                    },
-                },
-            ],
-            [
-                /'/,
-                {
-                    cases: {
-                    "@eos": "string",
-                    "@default": { token: "string", next: "@string.'" },
-                    },
-                },
-            ],
-            // TODO: field access inside function parameters sometimes fails, eg: in a
-            // newline func(.foo)
-            // [/(\.)/, { token: "entity" }],
-            // r strings
-            [/r'[^']+'/, { token: "regexp" /*log: 'function_arg_r_string::\n\n$0'*/ }],
-            [/t'[^']+'/, { token: "regexp" /*log: 'function_arg_r_string::\n\n$0'*/ }],
-            // s strings
-            [/s'[^']+'/, { token: "string" /*log: 'root_s_string::\n\n$0'*/ }],
-            [/\)/, { token: "", /*log: 'end_off_function_arg::\n\n$0',*/ next: "@pop" }],
-            [
-            /[\.\[\]\,\\\"\%\{\}\$\:\^\w]+/,
-            { token: "" /*log: 'function_arg_anything_else::\n\n$0'*/ },
-            ],
-        ],
-    },
+    function_arg: [
+      [/([a-zA-Z_!]+)\(/, { cases: { $S1: { token: "keyword", next: "@push", log: "function_arg_nested::\n\n$0" } } }],
+      // we copy the string highlighters from root and apply them to function arguments as well
+      [/"""/, "string", '@herestring."""'],
+      [/'''/, "string", "@herestring.'''"],
+      [
+        /"/,
+        {
+          cases: {
+            "@eos": "string",
+            "@default": { token: "string", next: '@string."' }
+          }
+        }
+      ],
+      [
+        /'/,
+        {
+          cases: {
+            "@eos": "string",
+            "@default": { token: "string", next: "@string.'" }
+          }
+        }
+      ],
+      // TODO: field access inside function parameters sometimes fails, eg: in a
+      // newline func(.foo)
+      // [/(\.)/, { token: "entity" }],
+      // r strings
+      [/r'[^']+'/, { token: "regexp" /*log: 'function_arg_r_string::\n\n$0'*/ }],
+      [/t'[^']+'/, { token: "regexp" /*log: 'function_arg_r_string::\n\n$0'*/ }],
+      // s strings
+      [/s'[^']+'/, { token: "string" /*log: 'root_s_string::\n\n$0'*/ }],
+      [/\)/, { token: "", /*log: 'end_off_function_arg::\n\n$0',*/ next: "@pop" }],
+      [/[\.\[\]\,\\\"\%\{\}\$\:\^\w]+/, { token: "" /*log: 'function_arg_anything_else::\n\n$0'*/ }]
+    ]
+  }
 };
 
 export let vrlThemeDefinition = {
-    "base": "vs",
-    "inherit": true,
-    "rules": [
-      {
-        "background": "ffffff",
-        "token": ""
-      },
-      {
-        "foreground": "d73a49",
-        "token": "vrl-function-invokes"
-      },
-      {
-        "foreground": "d73a49",
-        "token": "vrl-function-invokes-fallible"
-      },
-      {
-        "foreground": "6a737d",
-        "token": "comment"
-      },
-      {
-        "foreground": "6a737d",
-        "token": "punctuation.definition.comment"
-      },
-      {
-        "foreground": "6a737d",
-        "token": "string.comment"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "constant"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "entity.name.constant"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "variable.other.constant"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "variable.language"
-      },
-      {
-        "foreground": "6f42c1",
-        "token": "entity"
-      },
-      {
-        "foreground": "6f42c1",
-        "token": "entity.name"
-      },
-      {
-        "foreground": "24292e",
-        "token": "variable.parameter.function"
-      },
-      {
-        "foreground": "22863a",
-        "token": "entity.name.tag"
-      },
-      {
-        "foreground": "d73a49",
-        "token": "keyword"
-      },
-      {
-        "foreground": "d73a49",
-        "token": "storage"
-      },
-      {
-        "foreground": "d73a49",
-        "token": "storage.type"
-      },
-      {
-        "foreground": "24292e",
-        "token": "storage.modifier.package"
-      },
-      {
-        "foreground": "24292e",
-        "token": "storage.modifier.import"
-      },
-      {
-        "foreground": "24292e",
-        "token": "storage.type.java"
-      },
-      {
-        "foreground": "032f62",
-        "token": "string"
-      },
-      {
-        "foreground": "032f62",
-        "token": "punctuation.definition.string"
-      },
-      {
-        "foreground": "032f62",
-        "token": "string punctuation.section.embedded source"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "support"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "meta.property-name"
-      },
-      {
-        "foreground": "e36209",
-        "token": "variable"
-      },
-      {
-        "foreground": "24292e",
-        "token": "variable.other"
-      },
-      {
-        "foreground": "b31d28",
-        "fontStyle": "bold italic underline",
-        "token": "invalid.broken"
-      },
-      {
-        "foreground": "b31d28",
-        "fontStyle": "bold italic underline",
-        "token": "invalid.deprecated"
-      },
-      {
-        "foreground": "fafbfc",
-        "background": "b31d28",
-        "fontStyle": "italic underline",
-        "token": "invalid.illegal"
-      },
-      {
-        "foreground": "fafbfc",
-        "background": "d73a49",
-        "fontStyle": "italic underline",
-        "token": "carriage-return"
-      },
-      {
-        "foreground": "b31d28",
-        "fontStyle": "bold italic underline",
-        "token": "invalid.unimplemented"
-      },
-      {
-        "foreground": "b31d28",
-        "token": "message.error"
-      },
-      {
-        "foreground": "24292e",
-        "token": "string source"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "string variable"
-      },
-      {
-        "foreground": "032f62",
-        "token": "source.regexp"
-      },
-      {
-        "foreground": "032f62",
-        "token": "string.regexp"
-      },
-      {
-        "foreground": "032f62",
-        "token": "string.regexp.character-class"
-      },
-      {
-        "foreground": "032f62",
-        "token": "string.regexp constant.character.escape"
-      },
-      {
-        "foreground": "032f62",
-        "token": "string.regexp source.ruby.embedded"
-      },
-      {
-        "foreground": "032f62",
-        "token": "string.regexp string.regexp.arbitrary-repitition"
-      },
-      {
-        "foreground": "22863a",
-        "fontStyle": "bold",
-        "token": "string.regexp constant.character.escape"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "support.constant"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "support.variable"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "meta.module-reference"
-      },
-      {
-        "foreground": "735c0f",
-        "token": "markup.list"
-      },
-      {
-        "foreground": "005cc5",
-        "fontStyle": "bold",
-        "token": "markup.heading"
-      },
-      {
-        "foreground": "005cc5",
-        "fontStyle": "bold",
-        "token": "markup.heading entity.name"
-      },
-      {
-        "foreground": "22863a",
-        "token": "markup.quote"
-      },
-      {
-        "foreground": "24292e",
-        "fontStyle": "italic",
-        "token": "markup.italic"
-      },
-      {
-        "foreground": "24292e",
-        "fontStyle": "bold",
-        "token": "markup.bold"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "markup.raw"
-      },
-      {
-        "foreground": "b31d28",
-        "background": "ffeef0",
-        "token": "markup.deleted"
-      },
-      {
-        "foreground": "b31d28",
-        "background": "ffeef0",
-        "token": "meta.diff.header.from-file"
-      },
-      {
-        "foreground": "b31d28",
-        "background": "ffeef0",
-        "token": "punctuation.definition.deleted"
-      },
-      {
-        "foreground": "22863a",
-        "background": "f0fff4",
-        "token": "markup.inserted"
-      },
-      {
-        "foreground": "22863a",
-        "background": "f0fff4",
-        "token": "meta.diff.header.to-file"
-      },
-      {
-        "foreground": "22863a",
-        "background": "f0fff4",
-        "token": "punctuation.definition.inserted"
-      },
-      {
-        "foreground": "e36209",
-        "background": "ffebda",
-        "token": "markup.changed"
-      },
-      {
-        "foreground": "e36209",
-        "background": "ffebda",
-        "token": "punctuation.definition.changed"
-      },
-      {
-        "foreground": "f6f8fa",
-        "background": "005cc5",
-        "token": "markup.ignored"
-      },
-      {
-        "foreground": "f6f8fa",
-        "background": "005cc5",
-        "token": "markup.untracked"
-      },
-      {
-        "foreground": "6f42c1",
-        "fontStyle": "bold",
-        "token": "meta.diff.range"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "meta.diff.header"
-      },
-      {
-        "foreground": "005cc5",
-        "fontStyle": "bold",
-        "token": "meta.separator"
-      },
-      {
-        "foreground": "005cc5",
-        "token": "meta.output"
-      },
-      {
-        "foreground": "586069",
-        "token": "brackethighlighter.tag"
-      },
-      {
-        "foreground": "586069",
-        "token": "brackethighlighter.curly"
-      },
-      {
-        "foreground": "586069",
-        "token": "brackethighlighter.round"
-      },
-      {
-        "foreground": "586069",
-        "token": "brackethighlighter.square"
-      },
-      {
-        "foreground": "586069",
-        "token": "brackethighlighter.angle"
-      },
-      {
-        "foreground": "586069",
-        "token": "brackethighlighter.quote"
-      },
-      {
-        "foreground": "b31d28",
-        "token": "brackethighlighter.unmatched"
-      },
-      {
-        "foreground": "b31d28",
-        "token": "sublimelinter.mark.error"
-      },
-      {
-        "foreground": "e36209",
-        "token": "sublimelinter.mark.warning"
-      },
-      {
-        "foreground": "959da5",
-        "token": "sublimelinter.gutter-mark"
-      },
-      {
-        "foreground": "032f62",
-        "fontStyle": "underline",
-        "token": "constant.other.reference.link"
-      },
-      {
-        "foreground": "032f62",
-        "fontStyle": "underline",
-        "token": "string.other.link"
-      }
-    ],
-    "colors": {
-      "editor.foreground": "#24292e",
-      "editor.background": "#ffffff",
-      "editor.selectionBackground": "#c8c8fa",
-      "editor.inactiveSelectionBackground": "#fafbfc",
-      "editor.lineHighlightBackground": "#fafbfc",
-      "editorCursor.foreground": "#24292e",
-      "editorWhitespace.foreground": "#959da5",
-      "editorIndentGuide.background": "#959da5",
-      "editorIndentGuide.activeBackground": "#24292e",
-      "editor.selectionHighlightBorder": "#fafbfc"
+  base: "vs",
+  inherit: true,
+  rules: [
+    {
+      background: "ffffff",
+      token: ""
+    },
+    {
+      foreground: "d73a49",
+      token: "vrl-function-invokes"
+    },
+    {
+      foreground: "d73a49",
+      token: "vrl-function-invokes-fallible"
+    },
+    {
+      foreground: "6a737d",
+      token: "comment"
+    },
+    {
+      foreground: "6a737d",
+      token: "punctuation.definition.comment"
+    },
+    {
+      foreground: "6a737d",
+      token: "string.comment"
+    },
+    {
+      foreground: "005cc5",
+      token: "constant"
+    },
+    {
+      foreground: "005cc5",
+      token: "entity.name.constant"
+    },
+    {
+      foreground: "005cc5",
+      token: "variable.other.constant"
+    },
+    {
+      foreground: "005cc5",
+      token: "variable.language"
+    },
+    {
+      foreground: "6f42c1",
+      token: "entity"
+    },
+    {
+      foreground: "6f42c1",
+      token: "entity.name"
+    },
+    {
+      foreground: "24292e",
+      token: "variable.parameter.function"
+    },
+    {
+      foreground: "22863a",
+      token: "entity.name.tag"
+    },
+    {
+      foreground: "d73a49",
+      token: "keyword"
+    },
+    {
+      foreground: "d73a49",
+      token: "storage"
+    },
+    {
+      foreground: "d73a49",
+      token: "storage.type"
+    },
+    {
+      foreground: "24292e",
+      token: "storage.modifier.package"
+    },
+    {
+      foreground: "24292e",
+      token: "storage.modifier.import"
+    },
+    {
+      foreground: "24292e",
+      token: "storage.type.java"
+    },
+    {
+      foreground: "032f62",
+      token: "string"
+    },
+    {
+      foreground: "032f62",
+      token: "punctuation.definition.string"
+    },
+    {
+      foreground: "032f62",
+      token: "string punctuation.section.embedded source"
+    },
+    {
+      foreground: "005cc5",
+      token: "support"
+    },
+    {
+      foreground: "005cc5",
+      token: "meta.property-name"
+    },
+    {
+      foreground: "e36209",
+      token: "variable"
+    },
+    {
+      foreground: "24292e",
+      token: "variable.other"
+    },
+    {
+      foreground: "b31d28",
+      fontStyle: "bold italic underline",
+      token: "invalid.broken"
+    },
+    {
+      foreground: "b31d28",
+      fontStyle: "bold italic underline",
+      token: "invalid.deprecated"
+    },
+    {
+      foreground: "fafbfc",
+      background: "b31d28",
+      fontStyle: "italic underline",
+      token: "invalid.illegal"
+    },
+    {
+      foreground: "fafbfc",
+      background: "d73a49",
+      fontStyle: "italic underline",
+      token: "carriage-return"
+    },
+    {
+      foreground: "b31d28",
+      fontStyle: "bold italic underline",
+      token: "invalid.unimplemented"
+    },
+    {
+      foreground: "b31d28",
+      token: "message.error"
+    },
+    {
+      foreground: "24292e",
+      token: "string source"
+    },
+    {
+      foreground: "005cc5",
+      token: "string variable"
+    },
+    {
+      foreground: "032f62",
+      token: "source.regexp"
+    },
+    {
+      foreground: "032f62",
+      token: "string.regexp"
+    },
+    {
+      foreground: "032f62",
+      token: "string.regexp.character-class"
+    },
+    {
+      foreground: "032f62",
+      token: "string.regexp constant.character.escape"
+    },
+    {
+      foreground: "032f62",
+      token: "string.regexp source.ruby.embedded"
+    },
+    {
+      foreground: "032f62",
+      token: "string.regexp string.regexp.arbitrary-repitition"
+    },
+    {
+      foreground: "22863a",
+      fontStyle: "bold",
+      token: "string.regexp constant.character.escape"
+    },
+    {
+      foreground: "005cc5",
+      token: "support.constant"
+    },
+    {
+      foreground: "005cc5",
+      token: "support.variable"
+    },
+    {
+      foreground: "005cc5",
+      token: "meta.module-reference"
+    },
+    {
+      foreground: "735c0f",
+      token: "markup.list"
+    },
+    {
+      foreground: "005cc5",
+      fontStyle: "bold",
+      token: "markup.heading"
+    },
+    {
+      foreground: "005cc5",
+      fontStyle: "bold",
+      token: "markup.heading entity.name"
+    },
+    {
+      foreground: "22863a",
+      token: "markup.quote"
+    },
+    {
+      foreground: "24292e",
+      fontStyle: "italic",
+      token: "markup.italic"
+    },
+    {
+      foreground: "24292e",
+      fontStyle: "bold",
+      token: "markup.bold"
+    },
+    {
+      foreground: "005cc5",
+      token: "markup.raw"
+    },
+    {
+      foreground: "b31d28",
+      background: "ffeef0",
+      token: "markup.deleted"
+    },
+    {
+      foreground: "b31d28",
+      background: "ffeef0",
+      token: "meta.diff.header.from-file"
+    },
+    {
+      foreground: "b31d28",
+      background: "ffeef0",
+      token: "punctuation.definition.deleted"
+    },
+    {
+      foreground: "22863a",
+      background: "f0fff4",
+      token: "markup.inserted"
+    },
+    {
+      foreground: "22863a",
+      background: "f0fff4",
+      token: "meta.diff.header.to-file"
+    },
+    {
+      foreground: "22863a",
+      background: "f0fff4",
+      token: "punctuation.definition.inserted"
+    },
+    {
+      foreground: "e36209",
+      background: "ffebda",
+      token: "markup.changed"
+    },
+    {
+      foreground: "e36209",
+      background: "ffebda",
+      token: "punctuation.definition.changed"
+    },
+    {
+      foreground: "f6f8fa",
+      background: "005cc5",
+      token: "markup.ignored"
+    },
+    {
+      foreground: "f6f8fa",
+      background: "005cc5",
+      token: "markup.untracked"
+    },
+    {
+      foreground: "6f42c1",
+      fontStyle: "bold",
+      token: "meta.diff.range"
+    },
+    {
+      foreground: "005cc5",
+      token: "meta.diff.header"
+    },
+    {
+      foreground: "005cc5",
+      fontStyle: "bold",
+      token: "meta.separator"
+    },
+    {
+      foreground: "005cc5",
+      token: "meta.output"
+    },
+    {
+      foreground: "586069",
+      token: "brackethighlighter.tag"
+    },
+    {
+      foreground: "586069",
+      token: "brackethighlighter.curly"
+    },
+    {
+      foreground: "586069",
+      token: "brackethighlighter.round"
+    },
+    {
+      foreground: "586069",
+      token: "brackethighlighter.square"
+    },
+    {
+      foreground: "586069",
+      token: "brackethighlighter.angle"
+    },
+    {
+      foreground: "586069",
+      token: "brackethighlighter.quote"
+    },
+    {
+      foreground: "b31d28",
+      token: "brackethighlighter.unmatched"
+    },
+    {
+      foreground: "b31d28",
+      token: "sublimelinter.mark.error"
+    },
+    {
+      foreground: "e36209",
+      token: "sublimelinter.mark.warning"
+    },
+    {
+      foreground: "959da5",
+      token: "sublimelinter.gutter-mark"
+    },
+    {
+      foreground: "032f62",
+      fontStyle: "underline",
+      token: "constant.other.reference.link"
+    },
+    {
+      foreground: "032f62",
+      fontStyle: "underline",
+      token: "string.other.link"
     }
-  };
+  ],
+  colors: {
+    "editor.foreground": "#24292e",
+    "editor.background": "#ffffff",
+    "editor.selectionBackground": "#c8c8fa",
+    "editor.inactiveSelectionBackground": "#fafbfc",
+    "editor.lineHighlightBackground": "#fafbfc",
+    "editorCursor.foreground": "#24292e",
+    "editorWhitespace.foreground": "#959da5",
+    "editorIndentGuide.background": "#959da5",
+    "editorIndentGuide.activeBackground": "#24292e",
+    "editor.selectionHighlightBorder": "#fafbfc"
+  }
+};
diff --git a/regression/cases/datadog_agent_remap_blackhole/lading/lading.yaml b/regression/cases/datadog_agent_remap_blackhole/lading/lading.yaml
index b870f2e2675bb..672e98c515b7b 100644
--- a/regression/cases/datadog_agent_remap_blackhole/lading/lading.yaml
+++ b/regression/cases/datadog_agent_remap_blackhole/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-        59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       headers:
         dd-api-key: "DEADBEEF"
       target_uri: "http://localhost:8282/v1/input"
diff --git a/regression/cases/datadog_agent_remap_blackhole/vector/vector.yaml b/regression/cases/datadog_agent_remap_blackhole/vector/vector.yaml
index 36704ea5986e3..9ec1a7665ff7f 100644
--- a/regression/cases/datadog_agent_remap_blackhole/vector/vector.yaml
+++ b/regression/cases/datadog_agent_remap_blackhole/vector/vector.yaml
@@ -9,9 +9,9 @@ sources:
     type: "internal_metrics"
 
   datadog_agent:
-    type:             "datadog_agent"
+    type: "datadog_agent"
     acknowledgements: false
-    address:          "0.0.0.0:8282"
+    address: "0.0.0.0:8282"
 
 ##
 ## Transforms
@@ -19,21 +19,21 @@ sources:
 
 transforms:
   remap:
-    type:   "remap"
-    inputs: [ "datadog_agent" ]
+    type: "remap"
+    inputs: ["datadog_agent"]
     source: |
-            .hostname = "vector"
+      .hostname = "vector"
 
-            if .status == "warning" {
-              .thing = upcase(.hostname)
-            } else if .status == "notice" {
-              .thung = downcase(.hostname)
-            } else {
-              .nong = upcase(.hostname)
-            }
+      if .status == "warning" {
+        .thing = upcase(.hostname)
+      } else if .status == "notice" {
+        .thung = downcase(.hostname)
+      } else {
+        .nong = upcase(.hostname)
+      }
 
-            .matches = { "name": .message, "num": "2" }
-            .origin, .err = .hostname + "/" + .matches.name + "/" + .matches.num
+      .matches = { "name": .message, "num": "2" }
+      .origin, .err = .hostname + "/" + .matches.name + "/" + .matches.num
 
 ##
 ## Sinks
@@ -41,11 +41,11 @@ transforms:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   blackhole:
-    type:                "blackhole"
+    type: "blackhole"
     print_interval_secs: 0
-    inputs: [ "remap" ]
+    inputs: ["remap"]
diff --git a/regression/cases/datadog_agent_remap_blackhole_acks/lading/lading.yaml b/regression/cases/datadog_agent_remap_blackhole_acks/lading/lading.yaml
index b870f2e2675bb..672e98c515b7b 100644
--- a/regression/cases/datadog_agent_remap_blackhole_acks/lading/lading.yaml
+++ b/regression/cases/datadog_agent_remap_blackhole_acks/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-        59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       headers:
         dd-api-key: "DEADBEEF"
       target_uri: "http://localhost:8282/v1/input"
diff --git a/regression/cases/datadog_agent_remap_blackhole_acks/vector/vector.yaml b/regression/cases/datadog_agent_remap_blackhole_acks/vector/vector.yaml
index aaf73d1570cfd..1054c161e4586 100644
--- a/regression/cases/datadog_agent_remap_blackhole_acks/vector/vector.yaml
+++ b/regression/cases/datadog_agent_remap_blackhole_acks/vector/vector.yaml
@@ -9,9 +9,9 @@ sources:
     type: "internal_metrics"
 
   datadog_agent:
-    type:             "datadog_agent"
+    type: "datadog_agent"
     acknowledgements: true
-    address:          "0.0.0.0:8282"
+    address: "0.0.0.0:8282"
 
 ##
 ## Transforms
@@ -19,21 +19,21 @@ sources:
 
 transforms:
   remap:
-    type:   "remap"
-    inputs: [ "datadog_agent" ]
+    type: "remap"
+    inputs: ["datadog_agent"]
     source: |
-            .hostname = "vector"
+      .hostname = "vector"
 
-            if .status == "warning" {
-              .thing = upcase(.hostname)
-            } else if .status == "notice" {
-              .thung = downcase(.hostname)
-            } else {
-              .nong = upcase(.hostname)
-            }
+      if .status == "warning" {
+        .thing = upcase(.hostname)
+      } else if .status == "notice" {
+        .thung = downcase(.hostname)
+      } else {
+        .nong = upcase(.hostname)
+      }
 
-            .matches = { "name": .message, "num": "2" }
-            .origin, .err = .hostname + "/" + .matches.name + "/" + .matches.num
+      .matches = { "name": .message, "num": "2" }
+      .origin, .err = .hostname + "/" + .matches.name + "/" + .matches.num
 
 ##
 ## Sinks
@@ -41,11 +41,11 @@ transforms:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   blackhole:
-    type:                "blackhole"
+    type: "blackhole"
     print_interval_secs: 0
-    inputs: [ "remap" ]
+    inputs: ["remap"]
diff --git a/regression/cases/datadog_agent_remap_datadog_logs/lading/lading.yaml b/regression/cases/datadog_agent_remap_datadog_logs/lading/lading.yaml
index dedc4de0b9819..41810ffad1cf2 100644
--- a/regression/cases/datadog_agent_remap_datadog_logs/lading/lading.yaml
+++ b/regression/cases/datadog_agent_remap_datadog_logs/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       headers:
         dd-api-key: "DEADBEEF"
       target_uri: "http://localhost:8282/v1/input"
diff --git a/regression/cases/datadog_agent_remap_datadog_logs/vector/vector.yaml b/regression/cases/datadog_agent_remap_datadog_logs/vector/vector.yaml
index 4691ea851f14c..faf04c536a0b7 100644
--- a/regression/cases/datadog_agent_remap_datadog_logs/vector/vector.yaml
+++ b/regression/cases/datadog_agent_remap_datadog_logs/vector/vector.yaml
@@ -9,9 +9,9 @@ sources:
     type: "internal_metrics"
 
   datadog_agent:
-    type:             "datadog_agent"
+    type: "datadog_agent"
     acknowledgements: false
-    address:          "0.0.0.0:8282"
+    address: "0.0.0.0:8282"
 
 ##
 ## Transforms
@@ -19,13 +19,13 @@ sources:
 
 transforms:
   parse_message:
-    type:   "remap"
-    inputs: [ "datadog_agent" ]
+    type: "remap"
+    inputs: ["datadog_agent"]
     source: |
-            pyld, err = parse_json(.message)
-            if err == null {
-              .message = pyld.mineral
-            }
+      pyld, err = parse_json(.message)
+      if err == null {
+        .message = pyld.mineral
+      }
 
 ##
 ## Sinks
@@ -33,17 +33,17 @@ transforms:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   datadog_logs:
-    type:            "datadog_logs"
-    inputs: [ "parse_message" ]
-    endpoint:        "http://localhost:8080"
+    type: "datadog_logs"
+    inputs: ["parse_message"]
+    endpoint: "http://localhost:8080"
     default_api_key: "DEADBEEF"
     healthcheck:
       enabled: false
     buffer:
-      type:       "memory"
-      max_events: 50000  # buffer 50 payloads at a time
+      type: "memory"
+      max_events: 50000 # buffer 50 payloads at a time
diff --git a/regression/cases/datadog_agent_remap_datadog_logs_acks/lading/lading.yaml b/regression/cases/datadog_agent_remap_datadog_logs_acks/lading/lading.yaml
index dedc4de0b9819..41810ffad1cf2 100644
--- a/regression/cases/datadog_agent_remap_datadog_logs_acks/lading/lading.yaml
+++ b/regression/cases/datadog_agent_remap_datadog_logs_acks/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       headers:
         dd-api-key: "DEADBEEF"
       target_uri: "http://localhost:8282/v1/input"
diff --git a/regression/cases/datadog_agent_remap_datadog_logs_acks/vector/vector.yaml b/regression/cases/datadog_agent_remap_datadog_logs_acks/vector/vector.yaml
index 2e9d42fd6db20..7586039ee7465 100644
--- a/regression/cases/datadog_agent_remap_datadog_logs_acks/vector/vector.yaml
+++ b/regression/cases/datadog_agent_remap_datadog_logs_acks/vector/vector.yaml
@@ -9,9 +9,9 @@ sources:
     type: "internal_metrics"
 
   datadog_agent:
-    type:             "datadog_agent"
+    type: "datadog_agent"
     acknowledgements: true
-    address:          "0.0.0.0:8282"
+    address: "0.0.0.0:8282"
 
 ##
 ## Transforms
@@ -19,13 +19,13 @@ sources:
 
 transforms:
   parse_message:
-    type:   "remap"
-    inputs: [ "datadog_agent" ]
+    type: "remap"
+    inputs: ["datadog_agent"]
     source: |
-            pyld, err = parse_json(.message)
-            if err == null {
-              .message = pyld.mineral
-            }
+      pyld, err = parse_json(.message)
+      if err == null {
+        .message = pyld.mineral
+      }
 
 ##
 ## Sinks
@@ -33,17 +33,17 @@ transforms:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   datadog_logs:
-    type:            "datadog_logs"
-    inputs: [ "parse_message" ]
-    endpoint:        "http://localhost:8080"
+    type: "datadog_logs"
+    inputs: ["parse_message"]
+    endpoint: "http://localhost:8080"
     default_api_key: "DEADBEEF"
     healthcheck:
       enabled: false
     buffer:
-      type:       "memory"
-      max_events: 50000  # buffer 50 payloads at a time
+      type: "memory"
+      max_events: 50000 # buffer 50 payloads at a time
diff --git a/regression/cases/file_100_to_blackhole/lading/lading.yaml b/regression/cases/file_100_to_blackhole/lading/lading.yaml
index 98cfbb9c9ab20..b44ea4e1915d2 100644
--- a/regression/cases/file_100_to_blackhole/lading/lading.yaml
+++ b/regression/cases/file_100_to_blackhole/lading/lading.yaml
@@ -1,8 +1,41 @@
 generator:
   - file_gen:
       logrotate_fs:
-        seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-               59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+        seed:
+          [
+            2,
+            3,
+            5,
+            7,
+            11,
+            13,
+            17,
+            19,
+            23,
+            29,
+            31,
+            37,
+            41,
+            43,
+            47,
+            53,
+            59,
+            61,
+            67,
+            71,
+            73,
+            79,
+            83,
+            89,
+            97,
+            101,
+            103,
+            107,
+            109,
+            113,
+            127,
+            131
+          ]
         load_profile:
           constant: 100MiB
         concurrent_logs: 100
diff --git a/regression/cases/file_100_to_blackhole/vector/vector.yaml b/regression/cases/file_100_to_blackhole/vector/vector.yaml
index 377ae72154fa9..f06546523893d 100644
--- a/regression/cases/file_100_to_blackhole/vector/vector.yaml
+++ b/regression/cases/file_100_to_blackhole/vector/vector.yaml
@@ -19,14 +19,14 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   socket_sink:
-    type:    "socket"
-    inputs: [ "file" ]
-    mode:    "tcp"
+    type: "socket"
+    inputs: ["file"]
+    mode: "tcp"
     address: "127.0.0.1:15400"
     encoding:
       codec: "json"
diff --git a/regression/cases/file_to_blackhole/lading/lading.yaml b/regression/cases/file_to_blackhole/lading/lading.yaml
index 5017287363f08..2e6a1615b14e1 100644
--- a/regression/cases/file_to_blackhole/lading/lading.yaml
+++ b/regression/cases/file_to_blackhole/lading/lading.yaml
@@ -1,8 +1,41 @@
 generator:
   - file_gen:
       logrotate_fs:
-        seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-               59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+        seed:
+          [
+            2,
+            3,
+            5,
+            7,
+            11,
+            13,
+            17,
+            19,
+            23,
+            29,
+            31,
+            37,
+            41,
+            43,
+            47,
+            53,
+            59,
+            61,
+            67,
+            71,
+            73,
+            79,
+            83,
+            89,
+            97,
+            101,
+            103,
+            107,
+            109,
+            113,
+            127,
+            131
+          ]
         load_profile:
           constant: 100MiB
         concurrent_logs: 4
diff --git a/regression/cases/file_to_blackhole/vector/vector.yaml b/regression/cases/file_to_blackhole/vector/vector.yaml
index 377ae72154fa9..f06546523893d 100644
--- a/regression/cases/file_to_blackhole/vector/vector.yaml
+++ b/regression/cases/file_to_blackhole/vector/vector.yaml
@@ -19,14 +19,14 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   socket_sink:
-    type:    "socket"
-    inputs: [ "file" ]
-    mode:    "tcp"
+    type: "socket"
+    inputs: ["file"]
+    mode: "tcp"
     address: "127.0.0.1:15400"
     encoding:
       codec: "json"
diff --git a/regression/cases/fluent_elasticsearch/lading/lading.yaml b/regression/cases/fluent_elasticsearch/lading/lading.yaml
index 80829c35e3539..392c39482fbd0 100644
--- a/regression/cases/fluent_elasticsearch/lading/lading.yaml
+++ b/regression/cases/fluent_elasticsearch/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - tcp:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-        59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       addr: "0.0.0.0:8282"
       variant: "fluent"
       bytes_per_second: "256 Mb"
diff --git a/regression/cases/fluent_elasticsearch/vector/vector.yaml b/regression/cases/fluent_elasticsearch/vector/vector.yaml
index 217d8b9cf9eb6..a62f315f716a4 100644
--- a/regression/cases/fluent_elasticsearch/vector/vector.yaml
+++ b/regression/cases/fluent_elasticsearch/vector/vector.yaml
@@ -9,7 +9,7 @@ sources:
     type: "internal_metrics"
 
   fluent:
-    type:    "fluent"
+    type: "fluent"
     address: "0.0.0.0:8282"
 
 ##
@@ -24,16 +24,16 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   elasticsearch:
-    type:        "elasticsearch"
-    inputs: [ "fluent" ]
-    endpoint:    "http://0.0.0.0:8080"
-    mode:        "bulk"
-    pipeline:    "pipeline-name"
+    type: "elasticsearch"
+    inputs: ["fluent"]
+    endpoint: "http://0.0.0.0:8080"
+    mode: "bulk"
+    pipeline: "pipeline-name"
     compression: "none"
     bulk:
       index: "vector-%F"
diff --git a/regression/cases/http_elasticsearch/lading/lading.yaml b/regression/cases/http_elasticsearch/lading/lading.yaml
index 69cc36c1de926..a36bc0c04473e 100644
--- a/regression/cases/http_elasticsearch/lading/lading.yaml
+++ b/regression/cases/http_elasticsearch/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-        59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       target_uri: "http://localhost:8282/"
       bytes_per_second: "500 Mb"
       parallel_connections: 10
diff --git a/regression/cases/http_elasticsearch/vector/vector.yaml b/regression/cases/http_elasticsearch/vector/vector.yaml
index e9f136f45a5ad..f34ce75aab7f2 100644
--- a/regression/cases/http_elasticsearch/vector/vector.yaml
+++ b/regression/cases/http_elasticsearch/vector/vector.yaml
@@ -7,7 +7,7 @@ sources:
     type: "internal_metrics"
 
   logs:
-    type:    "http"
+    type: "http"
     address: "0.0.0.0:8282"
     decoding:
       codec: "json"
@@ -24,17 +24,17 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs:  [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   elasticsearch:
-    type:        "elasticsearch"
-    inputs:      [ "logs" ]
-    endpoints:   [ "http://localhost:8080" ]
+    type: "elasticsearch"
+    inputs: ["logs"]
+    endpoints: ["http://localhost:8080"]
     api_version: "v8"
-    mode:        "bulk"
-    pipeline:    "pipeline-name"
+    mode: "bulk"
+    pipeline: "pipeline-name"
     compression: "none"
     bulk:
       index: "vector-%F"
diff --git a/regression/cases/http_text_to_http_json/lading/lading.yaml b/regression/cases/http_text_to_http_json/lading/lading.yaml
index 97b45f7087245..f5608a87d4b41 100644
--- a/regression/cases/http_text_to_http_json/lading/lading.yaml
+++ b/regression/cases/http_text_to_http_json/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-        59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       headers: {}
       target_uri: "http://localhost:8282/"
       bytes_per_second: "500 Mb"
diff --git a/regression/cases/http_text_to_http_json/vector/vector.yaml b/regression/cases/http_text_to_http_json/vector/vector.yaml
index 36c3aa08578dc..9cdbd18b689ea 100644
--- a/regression/cases/http_text_to_http_json/vector/vector.yaml
+++ b/regression/cases/http_text_to_http_json/vector/vector.yaml
@@ -9,7 +9,7 @@ sources:
     type: "internal_metrics"
 
   logs:
-    type:    "http"
+    type: "http"
     address: "0.0.0.0:8282"
     decoding:
       codec: "bytes"
@@ -20,13 +20,13 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs:  [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   http_sink:
     type: "http"
-    uri:  "http://localhost:8080"
-    inputs: [ "logs" ]
+    uri: "http://localhost:8080"
+    inputs: ["logs"]
     encoding:
       codec: "json"
diff --git a/regression/cases/http_to_http_acks/lading/lading.yaml b/regression/cases/http_to_http_acks/lading/lading.yaml
index 7f0bbeef95068..17cd16656b713 100644
--- a/regression/cases/http_to_http_acks/lading/lading.yaml
+++ b/regression/cases/http_to_http_acks/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-        59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       target_uri: "http://localhost:8282/"
       bytes_per_second: "100 Mb"
       parallel_connections: 10
diff --git a/regression/cases/http_to_http_acks/vector/vector.yaml b/regression/cases/http_to_http_acks/vector/vector.yaml
index 3636dfe569d73..ec042dcdf086b 100644
--- a/regression/cases/http_to_http_acks/vector/vector.yaml
+++ b/regression/cases/http_to_http_acks/vector/vector.yaml
@@ -9,9 +9,9 @@ sources:
     type: "internal_metrics"
 
   http_source:
-    type:             "http"
+    type: "http"
     acknowledgements: true
-    address:          "0.0.0.0:8282"
+    address: "0.0.0.0:8282"
 
 ##
 ## Sinks
@@ -19,18 +19,18 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   http_sink:
     type: "http"
-    inputs: [ "http_source" ]
-    uri:  "http://localhost:8080"
+    inputs: ["http_source"]
+    uri: "http://localhost:8080"
     encoding:
       codec: "text"
     healthcheck:
       enabled: false
     buffer:
-      type:       "memory"
-      max_events: 50000  # buffer 50 payloads at a time
+      type: "memory"
+      max_events: 50000 # buffer 50 payloads at a time
diff --git a/regression/cases/http_to_http_disk_buffer/experiment.yaml b/regression/cases/http_to_http_disk_buffer/experiment.yaml
index e7faba7f54b2a..3650e2c1157a2 100644
--- a/regression/cases/http_to_http_disk_buffer/experiment.yaml
+++ b/regression/cases/http_to_http_disk_buffer/experiment.yaml
@@ -8,4 +8,3 @@ target:
 
   environment:
     VECTOR_THREADS: 4
-
diff --git a/regression/cases/http_to_http_disk_buffer/lading/lading.yaml b/regression/cases/http_to_http_disk_buffer/lading/lading.yaml
index a5b1c01a5c222..17cd16656b713 100644
--- a/regression/cases/http_to_http_disk_buffer/lading/lading.yaml
+++ b/regression/cases/http_to_http_disk_buffer/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-        59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       target_uri: "http://localhost:8282/"
       bytes_per_second: "100 Mb"
       parallel_connections: 10
@@ -18,4 +51,3 @@ blackhole:
 target_metrics:
   - prometheus: # internal telemetry
       uri: "http://127.0.0.1:9090/metrics"
-
diff --git a/regression/cases/http_to_http_disk_buffer/vector/vector.yaml b/regression/cases/http_to_http_disk_buffer/vector/vector.yaml
index cd675e05c5ce7..23435dea23d1b 100644
--- a/regression/cases/http_to_http_disk_buffer/vector/vector.yaml
+++ b/regression/cases/http_to_http_disk_buffer/vector/vector.yaml
@@ -9,7 +9,7 @@ sources:
     type: "internal_metrics"
 
   http_source:
-    type:    "http"
+    type: "http"
     acknowledgements: true
     address: "0.0.0.0:8282"
 
@@ -19,19 +19,19 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   http_sink:
     type: "http"
-    inputs: [ "http_source" ]
-    uri:  "http://localhost:8080"
+    inputs: ["http_source"]
+    uri: "http://localhost:8080"
     encoding:
       codec: "text"
     healthcheck:
       enabled: false
     buffer:
-      type:     "disk"
+      type: "disk"
       max_size: 4294967296 # 4GB
 
diff --git a/regression/cases/http_to_http_json/lading/lading.yaml b/regression/cases/http_to_http_json/lading/lading.yaml
index 68b9b25a6b6ff..25260a6683e33 100644
--- a/regression/cases/http_to_http_json/lading/lading.yaml
+++ b/regression/cases/http_to_http_json/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-        59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       target_uri: "http://localhost:8282/"
       bytes_per_second: "100 Mb"
       parallel_connections: 10
diff --git a/regression/cases/http_to_http_json/vector/vector.yaml b/regression/cases/http_to_http_json/vector/vector.yaml
index 3d571dd5b407d..c4f229bba5195 100644
--- a/regression/cases/http_to_http_json/vector/vector.yaml
+++ b/regression/cases/http_to_http_json/vector/vector.yaml
@@ -9,9 +9,9 @@ sources:
     type: "internal_metrics"
 
   http_source:
-    type:             "http"
+    type: "http"
     acknowledgements: false
-    address:          "0.0.0.0:8282"
+    address: "0.0.0.0:8282"
 
 ##
 ## Sinks
@@ -19,18 +19,18 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   http_sink:
     type: "http"
-    inputs: [ "http_source" ]
-    uri:  "http://localhost:8080"
+    inputs: ["http_source"]
+    uri: "http://localhost:8080"
     encoding:
       codec: "text"
     healthcheck:
       enabled: false
     buffer:
-      type:       "memory"
-      max_events: 50000  # buffer 50 payloads at a time
+      type: "memory"
+      max_events: 50000 # buffer 50 payloads at a time
diff --git a/regression/cases/http_to_http_noack/lading/lading.yaml b/regression/cases/http_to_http_noack/lading/lading.yaml
index 7f0bbeef95068..17cd16656b713 100644
--- a/regression/cases/http_to_http_noack/lading/lading.yaml
+++ b/regression/cases/http_to_http_noack/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-        59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       target_uri: "http://localhost:8282/"
       bytes_per_second: "100 Mb"
       parallel_connections: 10
diff --git a/regression/cases/http_to_http_noack/vector/vector.yaml b/regression/cases/http_to_http_noack/vector/vector.yaml
index 3d571dd5b407d..c4f229bba5195 100644
--- a/regression/cases/http_to_http_noack/vector/vector.yaml
+++ b/regression/cases/http_to_http_noack/vector/vector.yaml
@@ -9,9 +9,9 @@ sources:
     type: "internal_metrics"
 
   http_source:
-    type:             "http"
+    type: "http"
     acknowledgements: false
-    address:          "0.0.0.0:8282"
+    address: "0.0.0.0:8282"
 
 ##
 ## Sinks
@@ -19,18 +19,18 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   http_sink:
     type: "http"
-    inputs: [ "http_source" ]
-    uri:  "http://localhost:8080"
+    inputs: ["http_source"]
+    uri: "http://localhost:8080"
     encoding:
       codec: "text"
     healthcheck:
       enabled: false
     buffer:
-      type:       "memory"
-      max_events: 50000  # buffer 50 payloads at a time
+      type: "memory"
+      max_events: 50000 # buffer 50 payloads at a time
diff --git a/regression/cases/http_to_s3/lading/lading.yaml b/regression/cases/http_to_s3/lading/lading.yaml
index 0ce93d58e2ab4..25260a6683e33 100644
--- a/regression/cases/http_to_s3/lading/lading.yaml
+++ b/regression/cases/http_to_s3/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       target_uri: "http://localhost:8282/"
       bytes_per_second: "100 Mb"
       parallel_connections: 10
diff --git a/regression/cases/http_to_s3/vector/vector.yaml b/regression/cases/http_to_s3/vector/vector.yaml
index a41bc700ef805..bf6a915f7e298 100644
--- a/regression/cases/http_to_s3/vector/vector.yaml
+++ b/regression/cases/http_to_s3/vector/vector.yaml
@@ -9,9 +9,9 @@ sources:
     type: "internal_metrics"
 
   http_source:
-    type:             "http"
+    type: "http"
     acknowledgements: false
-    address:          "0.0.0.0:8282"
+    address: "0.0.0.0:8282"
     decoding:
       codec: "json"
 
@@ -21,20 +21,20 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   s3_service:
-    type:     "aws_s3"
-    inputs: [ "http_source" ]
-    region:   "us-west-2"
+    type: "aws_s3"
+    inputs: ["http_source"]
+    region: "us-west-2"
     endpoint: "http://localhost:8080"
-    bucket:   "vector-soak-service"
+    bucket: "vector-soak-service"
     framing:
       method: "newline_delimited"
     encoding:
       codec: "json"
     auth:
-      access_key_id:     "BADDCAFE"
+      access_key_id: "BADDCAFE"
       secret_access_key: "BADDCAFE"
diff --git a/regression/cases/otlp_grpc_to_blackhole/lading/lading.yaml b/regression/cases/otlp_grpc_to_blackhole/lading/lading.yaml
index 763b301d51bf9..e860fff329203 100644
--- a/regression/cases/otlp_grpc_to_blackhole/lading/lading.yaml
+++ b/regression/cases/otlp_grpc_to_blackhole/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - grpc:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-             59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       target_uri: "http://127.0.0.1:4317/opentelemetry.proto.collector.logs.v1.LogsService/Export"
       bytes_per_second: "100 Mb"
       parallel_connections: 5
diff --git a/regression/cases/otlp_grpc_to_blackhole/vector/vector.yaml b/regression/cases/otlp_grpc_to_blackhole/vector/vector.yaml
index ad267d1b9ec8d..31bf236873ef2 100644
--- a/regression/cases/otlp_grpc_to_blackhole/vector/vector.yaml
+++ b/regression/cases/otlp_grpc_to_blackhole/vector/vector.yaml
@@ -21,14 +21,14 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "127.0.0.1:9090"
 
   socket_sink:
-    type:    "socket"
-    inputs: [ "opentelemetry.logs" ]
-    mode:    "tcp"
+    type: "socket"
+    inputs: ["opentelemetry.logs"]
+    mode: "tcp"
     address: "127.0.0.1:15400"
     encoding:
       codec: "json"
diff --git a/regression/cases/otlp_http_to_blackhole/lading/lading.yaml b/regression/cases/otlp_http_to_blackhole/lading/lading.yaml
index 7f71aa751b070..74ac89acd261c 100644
--- a/regression/cases/otlp_http_to_blackhole/lading/lading.yaml
+++ b/regression/cases/otlp_http_to_blackhole/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - http:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-             59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       headers:
         content-type: "application/x-protobuf"
       target_uri: "http://127.0.0.1:4318/v1/logs"
diff --git a/regression/cases/otlp_http_to_blackhole/vector/vector.yaml b/regression/cases/otlp_http_to_blackhole/vector/vector.yaml
index ad267d1b9ec8d..31bf236873ef2 100644
--- a/regression/cases/otlp_http_to_blackhole/vector/vector.yaml
+++ b/regression/cases/otlp_http_to_blackhole/vector/vector.yaml
@@ -21,14 +21,14 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "127.0.0.1:9090"
 
   socket_sink:
-    type:    "socket"
-    inputs: [ "opentelemetry.logs" ]
-    mode:    "tcp"
+    type: "socket"
+    inputs: ["opentelemetry.logs"]
+    mode: "tcp"
     address: "127.0.0.1:15400"
     encoding:
       codec: "json"
diff --git a/regression/cases/socket_to_socket_blackhole/lading/lading.yaml b/regression/cases/socket_to_socket_blackhole/lading/lading.yaml
index 6a6b12171d473..5f0b017588d9e 100644
--- a/regression/cases/socket_to_socket_blackhole/lading/lading.yaml
+++ b/regression/cases/socket_to_socket_blackhole/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - tcp:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-             59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       addr: "0.0.0.0:8282"
       variant: "syslog5424"
       bytes_per_second: "500 Mb"
diff --git a/regression/cases/socket_to_socket_blackhole/vector/vector.yaml b/regression/cases/socket_to_socket_blackhole/vector/vector.yaml
index 76ddd6acf6919..6a43b8037ab68 100644
--- a/regression/cases/socket_to_socket_blackhole/vector/vector.yaml
+++ b/regression/cases/socket_to_socket_blackhole/vector/vector.yaml
@@ -9,9 +9,9 @@ sources:
     type: "internal_metrics"
 
   socket_source:
-    type:    "socket"
+    type: "socket"
     address: "0.0.0.0:8282"
-    mode:    "tcp"
+    mode: "tcp"
 
 ##
 ## Sinks
@@ -19,14 +19,14 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   socket_sink:
-    type:    "socket"
-    inputs: [ "socket_source" ]
-    mode:    "tcp"
+    type: "socket"
+    inputs: ["socket_source"]
+    mode: "tcp"
     address: "localhost:8080"
     encoding:
       codec: "json"
diff --git a/regression/cases/splunk_hec_indexer_ack_blackhole/lading/lading.yaml b/regression/cases/splunk_hec_indexer_ack_blackhole/lading/lading.yaml
index 560a72de2d84c..87f0ee7b8c328 100644
--- a/regression/cases/splunk_hec_indexer_ack_blackhole/lading/lading.yaml
+++ b/regression/cases/splunk_hec_indexer_ack_blackhole/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - splunk_hec:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-        59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       target_uri: "http://localhost:8282/"
       format: "json"
       token: "abcd1234"
diff --git a/regression/cases/splunk_hec_indexer_ack_blackhole/vector/vector.yaml b/regression/cases/splunk_hec_indexer_ack_blackhole/vector/vector.yaml
index d9b277f336517..342fed6840d53 100644
--- a/regression/cases/splunk_hec_indexer_ack_blackhole/vector/vector.yaml
+++ b/regression/cases/splunk_hec_indexer_ack_blackhole/vector/vector.yaml
@@ -9,7 +9,7 @@ sources:
     type: "internal_metrics"
 
   splunk_hec:
-    type:    "splunk_hec"
+    type: "splunk_hec"
     address: "0.0.0.0:8282"
     acknowledgements:
       enabled: true
@@ -20,11 +20,11 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   blackhole:
-    type:                "blackhole"
+    type: "blackhole"
     print_interval_secs: 0
-    inputs: [ "splunk_hec" ]
+    inputs: ["splunk_hec"]
diff --git a/regression/cases/splunk_hec_route_s3/lading/lading.yaml b/regression/cases/splunk_hec_route_s3/lading/lading.yaml
index 308e3c05ce98c..efbc2dc0a9799 100644
--- a/regression/cases/splunk_hec_route_s3/lading/lading.yaml
+++ b/regression/cases/splunk_hec_route_s3/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - splunk_hec:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       target_uri: "http://localhost:8282/"
       format: "json"
       token: "abcd1234"
diff --git a/regression/cases/splunk_hec_route_s3/vector/vector.yaml b/regression/cases/splunk_hec_route_s3/vector/vector.yaml
index c81d227c190d7..801adcd5e814a 100644
--- a/regression/cases/splunk_hec_route_s3/vector/vector.yaml
+++ b/regression/cases/splunk_hec_route_s3/vector/vector.yaml
@@ -10,7 +10,7 @@ sources:
 
   splunk:
     address: "0.0.0.0:8282"
-    type:    "splunk_hec"
+    type: "splunk_hec"
 
 ##
 ## Transforms
@@ -19,7 +19,7 @@ sources:
 transforms:
   container_type:
     type: "route"
-    inputs: [ "splunk" ]
+    inputs: ["splunk"]
     route:
       service: '.attrs.c2cContainerType == "service"'
       sidecar: '.attrs.c2cContainerType != "service"'
@@ -30,38 +30,38 @@ transforms:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   s3_sidecar:
-    type:       "aws_s3"
-    inputs: [ "container_type.sidecar" ]
-    region:     "us-west-2"
-    endpoint:   "http://localhost:8080"
-    bucket:     "vector-soak-sidecar"
+    type: "aws_s3"
+    inputs: ["container_type.sidecar"]
+    region: "us-west-2"
+    endpoint: "http://localhost:8080"
+    bucket: "vector-soak-sidecar"
     framing:
       method: "newline_delimited"
     encoding:
       codec: "json"
-      except_fields: [ "timestamp" ]
+      except_fields: ["timestamp"]
     key_prefix: "v1/source_type/sidecar/aws_account_id/{{attrs.aws_account}}/system_id/{{attrs.systemid}}/service/{{attrs.c2cService}}/partition/{{attrs.c2cPartition}}/stage/{{attrs.c2cStage}}/year/%Y/month/%m/day/%d/hour/%H"
     auth:
-      access_key_id:     "BADDCAFE"
+      access_key_id: "BADDCAFE"
       secret_access_key: "BADDCAFE"
 
   s3_service:
-    type:       "aws_s3"
-    inputs: [ "container_type.service" ]
-    region:     "us-west-2"
-    endpoint:   "http://localhost:8080"
-    bucket:     "vector-soak-service"
+    type: "aws_s3"
+    inputs: ["container_type.service"]
+    region: "us-west-2"
+    endpoint: "http://localhost:8080"
+    bucket: "vector-soak-service"
     framing:
       method: "newline_delimited"
     encoding:
       codec: "json"
-      except_fields: [ "timestamp" ]
+      except_fields: ["timestamp"]
     key_prefix: "v1/source_type/app/system_id/{{attrs.systemid}}/service/{{attrs.c2cService}}/partition/{{attrs.c2cPartition}}/stage/{{attrs.c2cStage}}/year/%Y/month/%m/day/%d/hour/%H"
     auth:
-      access_key_id:     "BADDCAFE"
+      access_key_id: "BADDCAFE"
       secret_access_key: "BADDCAFE"
diff --git a/regression/cases/splunk_hec_to_splunk_hec_logs_acks/lading/lading.yaml b/regression/cases/splunk_hec_to_splunk_hec_logs_acks/lading/lading.yaml
index a84c3fb60727b..2e28e6c294f85 100644
--- a/regression/cases/splunk_hec_to_splunk_hec_logs_acks/lading/lading.yaml
+++ b/regression/cases/splunk_hec_to_splunk_hec_logs_acks/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - splunk_hec:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       target_uri: "http://localhost:8282/"
       format: "json"
       token: "abcd1234"
diff --git a/regression/cases/splunk_hec_to_splunk_hec_logs_acks/vector/vector.yaml b/regression/cases/splunk_hec_to_splunk_hec_logs_acks/vector/vector.yaml
index 39cb209c758f5..4f1818291b97d 100644
--- a/regression/cases/splunk_hec_to_splunk_hec_logs_acks/vector/vector.yaml
+++ b/regression/cases/splunk_hec_to_splunk_hec_logs_acks/vector/vector.yaml
@@ -9,9 +9,9 @@ sources:
     type: "internal_metrics"
 
   splunk_hec:
-    type:             "splunk_hec"
+    type: "splunk_hec"
     acknowledgements: true
-    address:          "0.0.0.0:8282"
+    address: "0.0.0.0:8282"
 
 ##
 ## Sinks
@@ -19,17 +19,17 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   splunk_hec_logs:
-    type:     "splunk_hec_logs"
-    inputs: [ "splunk_hec" ]
+    type: "splunk_hec_logs"
+    inputs: ["splunk_hec"]
     endpoint: "http://localhost:8080"
     encoding:
       codec: "json"
-    token:    "abcd1234"
+    token: "abcd1234"
     healthcheck:
       enabled: false
     acknowledgements:
diff --git a/regression/cases/splunk_hec_to_splunk_hec_logs_noack/lading/lading.yaml b/regression/cases/splunk_hec_to_splunk_hec_logs_noack/lading/lading.yaml
index a487150adf69b..97264370ad03f 100644
--- a/regression/cases/splunk_hec_to_splunk_hec_logs_noack/lading/lading.yaml
+++ b/regression/cases/splunk_hec_to_splunk_hec_logs_noack/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - splunk_hec:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       target_uri: "http://localhost:8282/"
       format: "json"
       token: "abcd1234"
diff --git a/regression/cases/splunk_hec_to_splunk_hec_logs_noack/vector/vector.yaml b/regression/cases/splunk_hec_to_splunk_hec_logs_noack/vector/vector.yaml
index b19ec94b5dcd2..b2de7a3241798 100644
--- a/regression/cases/splunk_hec_to_splunk_hec_logs_noack/vector/vector.yaml
+++ b/regression/cases/splunk_hec_to_splunk_hec_logs_noack/vector/vector.yaml
@@ -9,9 +9,9 @@ sources:
     type: "internal_metrics"
 
   splunk_hec:
-    type:             "splunk_hec"
+    type: "splunk_hec"
     acknowledgements: false
-    address:          "0.0.0.0:8282"
+    address: "0.0.0.0:8282"
 
 ##
 ## Sinks
@@ -19,17 +19,17 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   splunk_hec_logs:
-    type:     "splunk_hec_logs"
-    inputs: [ "splunk_hec" ]
+    type: "splunk_hec_logs"
+    inputs: ["splunk_hec"]
     endpoint: "http://localhost:8080"
     encoding:
       codec: "json"
-    token:    "abcd1234"
+    token: "abcd1234"
     healthcheck:
       enabled: false
     acknowledgements:
diff --git a/regression/cases/statsd_to_datadog_metrics/lading/lading.yaml b/regression/cases/statsd_to_datadog_metrics/lading/lading.yaml
index 3494ed826fd6f..43eda824248c0 100644
--- a/regression/cases/statsd_to_datadog_metrics/lading/lading.yaml
+++ b/regression/cases/statsd_to_datadog_metrics/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - tcp:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       addr: "0.0.0.0:8125"
       variant:
         dogstatsd: {}
diff --git a/regression/cases/syslog_humio_logs/lading/lading.yaml b/regression/cases/syslog_humio_logs/lading/lading.yaml
index 8c8c616ea4488..170cc63205295 100644
--- a/regression/cases/syslog_humio_logs/lading/lading.yaml
+++ b/regression/cases/syslog_humio_logs/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - tcp:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       addr: "0.0.0.0:8282"
       variant: "syslog5424"
       bytes_per_second: "500 Mb"
diff --git a/regression/cases/syslog_humio_logs/vector/vector.yaml b/regression/cases/syslog_humio_logs/vector/vector.yaml
index 485e2a8911d61..b464dac8c238d 100644
--- a/regression/cases/syslog_humio_logs/vector/vector.yaml
+++ b/regression/cases/syslog_humio_logs/vector/vector.yaml
@@ -9,10 +9,10 @@ sources:
     type: "internal_metrics"
 
   syslog:
-    type:       "syslog"
-    address:    "0.0.0.0:8282"
+    type: "syslog"
+    address: "0.0.0.0:8282"
     max_length: 1500000
-    mode:       "tcp"
+    mode: "tcp"
 
 ##
 ## Sinks
@@ -20,16 +20,16 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   humio_logs:
-    type:     "humio_logs"
-    inputs: [ "syslog" ]
+    type: "humio_logs"
+    inputs: ["syslog"]
     endpoint: "http://0.0.0.0:8080"
     encoding:
       codec: "json"
-    token:    "humio_token"
+    token: "humio_token"
     healthcheck:
       enabled: false
diff --git a/regression/cases/syslog_log2metric_humio_metrics/lading/lading.yaml b/regression/cases/syslog_log2metric_humio_metrics/lading/lading.yaml
index 8c8c616ea4488..170cc63205295 100644
--- a/regression/cases/syslog_log2metric_humio_metrics/lading/lading.yaml
+++ b/regression/cases/syslog_log2metric_humio_metrics/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - tcp:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       addr: "0.0.0.0:8282"
       variant: "syslog5424"
       bytes_per_second: "500 Mb"
diff --git a/regression/cases/syslog_log2metric_humio_metrics/vector/vector.yaml b/regression/cases/syslog_log2metric_humio_metrics/vector/vector.yaml
index 780fc384c4ea2..91a652737852e 100644
--- a/regression/cases/syslog_log2metric_humio_metrics/vector/vector.yaml
+++ b/regression/cases/syslog_log2metric_humio_metrics/vector/vector.yaml
@@ -7,10 +7,10 @@ sources:
     type: "internal_metrics"
 
   syslog:
-    type:       "syslog"
-    address:    "0.0.0.0:8282"
+    type: "syslog"
+    address: "0.0.0.0:8282"
     max_length: 1500000
-    mode:       "tcp"
+    mode: "tcp"
 
 ##
 ## Transforms
@@ -19,9 +19,9 @@ sources:
 transforms:
   log2metric:
     type: "log_to_metric"
-    inputs: [ "syslog" ]
+    inputs: ["syslog"]
     metrics:
-      - type:  "gauge"
+      - type: "gauge"
         field: "procid"
         tags:
           hostname: "{{ hostname }}"
@@ -34,14 +34,14 @@ transforms:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   humio_metrics:
-    type:     "humio_metrics"
-    inputs: [ "log2metric" ]
+    type: "humio_metrics"
+    inputs: ["log2metric"]
     endpoint: "http://0.0.0.0:8080"
-    token:    "humio_token"
+    token: "humio_token"
     healthcheck:
       enabled: false
diff --git a/regression/cases/syslog_log2metric_splunk_hec_metrics/lading/lading.yaml b/regression/cases/syslog_log2metric_splunk_hec_metrics/lading/lading.yaml
index 8c8c616ea4488..170cc63205295 100644
--- a/regression/cases/syslog_log2metric_splunk_hec_metrics/lading/lading.yaml
+++ b/regression/cases/syslog_log2metric_splunk_hec_metrics/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - tcp:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       addr: "0.0.0.0:8282"
       variant: "syslog5424"
       bytes_per_second: "500 Mb"
diff --git a/regression/cases/syslog_log2metric_splunk_hec_metrics/vector/vector.yaml b/regression/cases/syslog_log2metric_splunk_hec_metrics/vector/vector.yaml
index 86036373115d4..05a0144d2c1a8 100644
--- a/regression/cases/syslog_log2metric_splunk_hec_metrics/vector/vector.yaml
+++ b/regression/cases/syslog_log2metric_splunk_hec_metrics/vector/vector.yaml
@@ -9,10 +9,10 @@ sources:
     type: "internal_metrics"
 
   syslog:
-    type:       "syslog"
-    address:    "0.0.0.0:8282"
+    type: "syslog"
+    address: "0.0.0.0:8282"
     max_length: 1500000
-    mode:       "tcp"
+    mode: "tcp"
 
 ##
 ## Transforms
@@ -21,9 +21,9 @@ sources:
 transforms:
   log2metric:
     type: "log_to_metric"
-    inputs: [ "syslog" ]
+    inputs: ["syslog"]
     metrics:
-      - type:  "gauge"
+      - type: "gauge"
         field: "procid"
         tags:
           hostname: "{{ hostname }}"
@@ -36,14 +36,14 @@ transforms:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   splunk_hec_metrics:
-    type:     "splunk_hec_metrics"
-    inputs: [ "log2metric" ]
+    type: "splunk_hec_metrics"
+    inputs: ["log2metric"]
     endpoint: "http://0.0.0.0:8080"
-    token:    "splunk_token"
+    token: "splunk_token"
     healthcheck:
       enabled: false
diff --git a/regression/cases/syslog_log2metric_tag_cardinality_limit_blackhole/lading/lading.yaml b/regression/cases/syslog_log2metric_tag_cardinality_limit_blackhole/lading/lading.yaml
index e8d45f0936c2c..c054ff9d2fc7f 100644
--- a/regression/cases/syslog_log2metric_tag_cardinality_limit_blackhole/lading/lading.yaml
+++ b/regression/cases/syslog_log2metric_tag_cardinality_limit_blackhole/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - tcp:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       addr: "0.0.0.0:8282"
       variant: "syslog5424"
       bytes_per_second: "500 Mb"
diff --git a/regression/cases/syslog_log2metric_tag_cardinality_limit_blackhole/vector/vector.yaml b/regression/cases/syslog_log2metric_tag_cardinality_limit_blackhole/vector/vector.yaml
index e3ed776dac8bb..74fac88991b7d 100644
--- a/regression/cases/syslog_log2metric_tag_cardinality_limit_blackhole/vector/vector.yaml
+++ b/regression/cases/syslog_log2metric_tag_cardinality_limit_blackhole/vector/vector.yaml
@@ -9,10 +9,10 @@ sources:
     type: "internal_metrics"
 
   syslog:
-    type:       "syslog"
-    address:    "0.0.0.0:8282"
+    type: "syslog"
+    address: "0.0.0.0:8282"
     max_length: 1500000
-    mode:       "tcp"
+    mode: "tcp"
 
 ##
 ## Transforms
@@ -20,16 +20,16 @@ sources:
 
 transforms:
   remap:
-    type:   "remap"
-    inputs: [ "syslog" ]
+    type: "remap"
+    inputs: ["syslog"]
     source: |-
       .cardinality_1000 = random_int(0, 1000)
 
   log2metric:
     type: "log_to_metric"
-    inputs: [ "remap" ]
+    inputs: ["remap"]
     metrics:
-      - type:  "counter"
+      - type: "counter"
         field: "procid"
         tags:
           hostname: "{{ host }}"
@@ -39,7 +39,7 @@ transforms:
 
   cardinality_control:
     type: "tag_cardinality_limit"
-    inputs: [ "log2metric" ]
+    inputs: ["log2metric"]
     limit_exceeded_action: "drop_tag"
     mode: "probabilistic"
     value_limit: 100
@@ -50,11 +50,11 @@ transforms:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   blackhole:
     type: "blackhole"
     print_interval_secs: 0
-    inputs: [ "cardinality_control" ]
+    inputs: ["cardinality_control"]
diff --git a/regression/cases/syslog_loki/lading/lading.yaml b/regression/cases/syslog_loki/lading/lading.yaml
index adf4f48e5ef5d..c84225159e11e 100644
--- a/regression/cases/syslog_loki/lading/lading.yaml
+++ b/regression/cases/syslog_loki/lading/lading.yaml
@@ -1,7 +1,40 @@
 generator:
   - tcp:
-      seed: [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53,
-             59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          17,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131
+        ]
       addr: "0.0.0.0:8282"
       variant: "syslog5424"
       bytes_per_second: "500 Mb"
diff --git a/regression/cases/syslog_loki/vector/vector.yaml b/regression/cases/syslog_loki/vector/vector.yaml
index 778842f59b526..c91513aeec217 100644
--- a/regression/cases/syslog_loki/vector/vector.yaml
+++ b/regression/cases/syslog_loki/vector/vector.yaml
@@ -9,10 +9,10 @@ sources:
     type: "internal_metrics"
 
   syslog:
-    type:       "syslog"
-    address:    "0.0.0.0:8282"
+    type: "syslog"
+    address: "0.0.0.0:8282"
     max_length: 1500000
-    mode:       "tcp"
+    mode: "tcp"
 
 ##
 ## Sinks
@@ -20,14 +20,14 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   loki:
-    type:                "loki"
-    inputs: [ "syslog" ]
-    endpoint:            "http://0.0.0.0:8080"
+    type: "loki"
+    inputs: ["syslog"]
+    endpoint: "http://0.0.0.0:8080"
     encoding:
       codec: "json"
     out_of_order_action: "accept"
diff --git a/regression/cases/syslog_regex_logs2metric_ddmetrics/lading/lading.yaml b/regression/cases/syslog_regex_logs2metric_ddmetrics/lading/lading.yaml
index 8c8c616ea4488..170cc63205295 100644
--- a/regression/cases/syslog_regex_logs2metric_ddmetrics/lading/lading.yaml
+++ b/regression/cases/syslog_regex_logs2metric_ddmetrics/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - tcp:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       addr: "0.0.0.0:8282"
       variant: "syslog5424"
       bytes_per_second: "500 Mb"
diff --git a/regression/cases/syslog_regex_logs2metric_ddmetrics/vector/vector.yaml b/regression/cases/syslog_regex_logs2metric_ddmetrics/vector/vector.yaml
index 5d50c63e57e6e..7b195176258fc 100644
--- a/regression/cases/syslog_regex_logs2metric_ddmetrics/vector/vector.yaml
+++ b/regression/cases/syslog_regex_logs2metric_ddmetrics/vector/vector.yaml
@@ -9,10 +9,10 @@ sources:
     type: "internal_metrics"
 
   syslog:
-    type:       "syslog"
-    address:    "0.0.0.0:8282"
+    type: "syslog"
+    address: "0.0.0.0:8282"
     max_length: 1500000
-    mode:       "tcp"
+    mode: "tcp"
 
 ##
 ## Transforms
@@ -20,15 +20,15 @@ sources:
 
 transforms:
   remap:
-    type:   "remap"
-    inputs: [ "syslog" ]
+    type: "remap"
+    inputs: ["syslog"]
     source: ". |= parse_regex!(.host, r'^(?P<hostname>[a-z]+)\\.(?P<tld>[a-z]+)')"
 
   log2metric:
     type: "log_to_metric"
-    inputs: [ "remap" ]
+    inputs: ["remap"]
     metrics:
-      - type:  "counter"
+      - type: "counter"
         field: "procid"
         tags:
           hostname: "{{ hostname }}"
@@ -41,13 +41,13 @@ transforms:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   datadog_metrics:
-    type:              "datadog_metrics"
-    inputs: [ "log2metric" ]
-    endpoint:          "http://0.0.0.0:8080"
-    default_api_key:   "DEADBEEF"
+    type: "datadog_metrics"
+    inputs: ["log2metric"]
+    endpoint: "http://0.0.0.0:8080"
+    default_api_key: "DEADBEEF"
     default_namespace: "vector"
diff --git a/regression/cases/syslog_splunk_hec_logs/lading/lading.yaml b/regression/cases/syslog_splunk_hec_logs/lading/lading.yaml
index 8c8c616ea4488..170cc63205295 100644
--- a/regression/cases/syslog_splunk_hec_logs/lading/lading.yaml
+++ b/regression/cases/syslog_splunk_hec_logs/lading/lading.yaml
@@ -1,6 +1,40 @@
 generator:
   - tcp:
-      seed: [2, 3, 5, 7, 11, 13, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137]
+      seed:
+        [
+          2,
+          3,
+          5,
+          7,
+          11,
+          13,
+          19,
+          23,
+          29,
+          31,
+          37,
+          41,
+          43,
+          47,
+          53,
+          59,
+          61,
+          67,
+          71,
+          73,
+          79,
+          83,
+          89,
+          97,
+          101,
+          103,
+          107,
+          109,
+          113,
+          127,
+          131,
+          137
+        ]
       addr: "0.0.0.0:8282"
       variant: "syslog5424"
       bytes_per_second: "500 Mb"
diff --git a/regression/cases/syslog_splunk_hec_logs/vector/vector.yaml b/regression/cases/syslog_splunk_hec_logs/vector/vector.yaml
index e4d63f4e23b41..8c5874e22b718 100644
--- a/regression/cases/syslog_splunk_hec_logs/vector/vector.yaml
+++ b/regression/cases/syslog_splunk_hec_logs/vector/vector.yaml
@@ -9,10 +9,10 @@ sources:
     type: "internal_metrics"
 
   syslog:
-    type:       "syslog"
-    address:    "0.0.0.0:8282"
+    type: "syslog"
+    address: "0.0.0.0:8282"
     max_length: 1500000
-    mode:       "tcp"
+    mode: "tcp"
 
 ##
 ## Sinks
@@ -20,16 +20,16 @@ sources:
 
 sinks:
   prometheus:
-    type:    "prometheus_exporter"
-    inputs: [ "internal_metrics" ]
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
     address: "0.0.0.0:9090"
 
   splunk_hec_logs:
-    type:     "splunk_hec_logs"
-    inputs: [ "syslog" ]
+    type: "splunk_hec_logs"
+    inputs: ["syslog"]
     endpoint: "http://0.0.0.0:8080"
     encoding:
       codec: "json"
-    token:    "abcd1234"
+    token: "abcd1234"
     healthcheck:
       enabled: false
diff --git a/regression/config.yaml b/regression/config.yaml
index e7a3f5b1e5dab..9b80bae63a965 100644
--- a/regression/config.yaml
+++ b/regression/config.yaml
@@ -3,7 +3,6 @@ lading:
 
 target:
 
-
 # Link templates for reports.
 #
 # Values may be removed to disable corresponding links in reports.
diff --git a/scripts/environment/prepare.sh b/scripts/environment/prepare.sh
index 397fefbb464a8..e74aba915ad5f 100755
--- a/scripts/environment/prepare.sh
+++ b/scripts/environment/prepare.sh
@@ -38,6 +38,7 @@ DD_RUST_LICENSE_TOOL_VERSION="1.0.6"
 CARGO_LLVM_COV_VERSION="0.8.4"
 WASM_PACK_VERSION="0.13.1"
 MARKDOWNLINT_CLI2_VERSION="0.22.0"
+PRETTIER_VERSION="3.8.1"
 DATADOG_CI_VERSION="5.9.0"
 VDEV_VERSION="0.3.0"
 
@@ -53,6 +54,7 @@ ALL_MODULES=(
   dd-rust-license-tool
   wasm-pack
   markdownlint-cli2
+  prettier
   datadog-ci
   release-flags  # Not a tool - sources release-flags.sh to set CI env vars
   vdev
@@ -93,6 +95,7 @@ Modules:
   dd-rust-license-tool
   wasm-pack
   markdownlint-cli2
+  prettier
   datadog-ci
   vdev
 
@@ -219,4 +222,5 @@ maybe_install_cargo_tool wasm-pack "${WASM_PACK_VERSION}"
 maybe_install_cargo_tool vdev "${VDEV_VERSION}"
 
 maybe_install_npm_package markdownlint-cli2 markdownlint-cli2 "${MARKDOWNLINT_CLI2_VERSION}"
+maybe_install_npm_package prettier prettier "${PRETTIER_VERSION}"
 maybe_install_npm_package datadog-ci "@datadog/datadog-ci" "${DATADOG_CI_VERSION}" "v${DATADOG_CI_VERSION}" "version"
diff --git a/tests/data/cmd/config/config_3.json b/tests/data/cmd/config/config_3.json
index 3517f16295177..a5e68a2ffd678 100644
--- a/tests/data/cmd/config/config_3.json
+++ b/tests/data/cmd/config/config_3.json
@@ -16,9 +16,7 @@
   },
   "transforms": {
     "transform0": {
-      "inputs": [
-        "source0"
-      ],
+      "inputs": ["source0"],
       "drop_on_abort": false,
       "drop_on_error": false,
       "metric_tag_values": "single",
@@ -29,9 +27,7 @@
   },
   "sinks": {
     "sink0": {
-      "inputs": [
-        "transform0"
-      ],
+      "inputs": ["transform0"],
       "target": "stdout",
       "type": "console",
       "encoding": {
diff --git a/tests/data/secret-backends/file-secrets.json b/tests/data/secret-backends/file-secrets.json
index 8de9e8b673504..861c0cbdbc1a0 100644
--- a/tests/data/secret-backends/file-secrets.json
+++ b/tests/data/secret-backends/file-secrets.json
@@ -1 +1 @@
-{"ghi":"ghi.retrieved"}
+{ "ghi": "ghi.retrieved" }
diff --git a/tests/e2e/datadog-logs/config/compose.yaml b/tests/e2e/datadog-logs/config/compose.yaml
index a144abed68cc5..774a47db4c729 100644
--- a/tests/e2e/datadog-logs/config/compose.yaml
+++ b/tests/e2e/datadog-logs/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3.8'
+version: "3.8"
 
 services:
   # Generates random log data for consumption by the custom Agent check
@@ -28,11 +28,11 @@ services:
     depends_on:
       - fakeintake-agent
     environment:
-    - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
-    - DD_HOSTNAME=datadog-agent
-    - DD_ENABLE_PAYLOADS_EVENTS=false
-    - DD_ENABLE_PAYLOADS_SERVICE_CHECKS=false
-    - DD_CONTAINER_EXCLUDE="name:.*"
+      - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
+      - DD_HOSTNAME=datadog-agent
+      - DD_ENABLE_PAYLOADS_EVENTS=false
+      - DD_ENABLE_PAYLOADS_SERVICE_CHECKS=false
+      - DD_CONTAINER_EXCLUDE="name:.*"
     volumes:
       # The Agent config file
       - type: bind
@@ -58,11 +58,11 @@ services:
     depends_on:
       - vector
     environment:
-    - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
-    - DD_HOSTNAME=datadog-agent-vector
-    - DD_ENABLE_PAYLOADS_EVENTS=false
-    - DD_ENABLE_PAYLOADS_SERVICE_CHECKS=false
-    - DD_CONTAINER_EXCLUDE="name:.*"
+      - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
+      - DD_HOSTNAME=datadog-agent-vector
+      - DD_ENABLE_PAYLOADS_EVENTS=false
+      - DD_ENABLE_PAYLOADS_SERVICE_CHECKS=false
+      - DD_CONTAINER_EXCLUDE="name:.*"
     volumes:
       # The Agent config file
       - type: bind
diff --git a/tests/e2e/datadog-logs/config/test.yaml b/tests/e2e/datadog-logs/config/test.yaml
index 2ce4641b04e96..6582946497e7a 100644
--- a/tests/e2e/datadog-logs/config/test.yaml
+++ b/tests/e2e/datadog-logs/config/test.yaml
@@ -1,5 +1,5 @@
 features:
-- e2e-tests-datadog
+  - e2e-tests-datadog
 
 test: "e2e"
 
@@ -7,22 +7,21 @@ test_filter: "datadog::logs::"
 
 runner:
   env:
-    EXPECTED_LOG_EVENTS: '1000'
-    VECTOR_RECEIVE_PORT: '8081'
-    FAKE_INTAKE_AGENT_ENDPOINT: 'http://fakeintake-agent:80'
-    FAKE_INTAKE_VECTOR_ENDPOINT: 'http://fakeintake-vector:80'
+    EXPECTED_LOG_EVENTS: "1000"
+    VECTOR_RECEIVE_PORT: "8081"
+    FAKE_INTAKE_AGENT_ENDPOINT: "http://fakeintake-agent:80"
+    FAKE_INTAKE_VECTOR_ENDPOINT: "http://fakeintake-vector:80"
 
 matrix:
   # validate against the latest Agent nightly and also stable v6 and v7
-  agent_version: ['latest', '6', '7']
-
+  agent_version: ["latest", "6", "7"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/common/datadog.rs"
-- "src/sources/datadog_agent/**"
-- "src/internal_events/datadog_*"
-- "src/sinks/datadog/logs/**"
-- "src/sinks/util/**"
-- "tests/e2e/datadog-logs/**"
+  - "src/common/datadog.rs"
+  - "src/sources/datadog_agent/**"
+  - "src/internal_events/datadog_*"
+  - "src/sinks/datadog/logs/**"
+  - "src/sinks/util/**"
+  - "tests/e2e/datadog-logs/**"
diff --git a/tests/e2e/datadog-logs/data/agent_only.yaml b/tests/e2e/datadog-logs/data/agent_only.yaml
index b92e08db48f05..5f97845ce9b0e 100644
--- a/tests/e2e/datadog-logs/data/agent_only.yaml
+++ b/tests/e2e/datadog-logs/data/agent_only.yaml
@@ -1,5 +1,5 @@
 api_key: DEADBEEF
-log_level: 'debug'
+log_level: "debug"
 
 # disable bunch of stuff we don't need
 inventories_configuration_enabled: false
@@ -29,4 +29,4 @@ logs_config:
   batch_wait: 1
 
 # Required per https://github.com/DataDog/datadog-agent/tree/main/test/fakeintake#docker
-dd_url: 'http://fakeintake-agent:80'
+dd_url: "http://fakeintake-agent:80"
diff --git a/tests/e2e/datadog-logs/data/agent_vector.yaml b/tests/e2e/datadog-logs/data/agent_vector.yaml
index 57ca8bff2d5e7..dd5432566d7c0 100644
--- a/tests/e2e/datadog-logs/data/agent_vector.yaml
+++ b/tests/e2e/datadog-logs/data/agent_vector.yaml
@@ -1,5 +1,5 @@
 api_key: DEADBEEF
-log_level: 'debug'
+log_level: "debug"
 
 # disable bunch of stuff we don't need
 inventories_configuration_enabled: false
@@ -34,4 +34,4 @@ vector:
     url: "http://vector:8181"
 
 # Required per https://github.com/DataDog/datadog-agent/tree/main/test/fakeintake#docker
-dd_url: 'http://fakeintake-agent:80'
+dd_url: "http://fakeintake-agent:80"
diff --git a/tests/e2e/datadog-metrics/config/compose.yaml b/tests/e2e/datadog-metrics/config/compose.yaml
index 84c0f89278863..6a317c156182f 100644
--- a/tests/e2e/datadog-metrics/config/compose.yaml
+++ b/tests/e2e/datadog-metrics/config/compose.yaml
@@ -1,12 +1,11 @@
-version: '3'
+version: "3"
 
 services:
-
   # Emits metrics to the Agent only path
   dogstatsd-client-agent:
     build: ../dogstatsd_client
     environment:
-    - STATSD_HOST=datadog-agent
+      - STATSD_HOST=datadog-agent
     depends_on:
       - datadog-agent
 
@@ -14,7 +13,7 @@ services:
   dogstatsd-client-vector:
     build: ../dogstatsd_client
     environment:
-    - STATSD_HOST=datadog-agent-vector
+      - STATSD_HOST=datadog-agent-vector
     depends_on:
       - datadog-agent-vector
 
@@ -24,8 +23,8 @@ services:
     depends_on:
       - fakeintake-agent
     environment:
-    - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
-    - DD_HOSTNAME=datadog-agent
+      - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
+      - DD_HOSTNAME=datadog-agent
     volumes:
       # The Agent config file
       - ../data/agent_only.yaml:/etc/datadog-agent/datadog.yaml
@@ -36,8 +35,8 @@ services:
     depends_on:
       - vector
     environment:
-    - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
-    - DD_HOSTNAME=datadog-agent-vector
+      - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
+      - DD_HOSTNAME=datadog-agent-vector
     volumes:
       # The Agent config file
       - ../data/agent_vector.yaml:/etc/datadog-agent/datadog.yaml
diff --git a/tests/e2e/datadog-metrics/config/test.yaml b/tests/e2e/datadog-metrics/config/test.yaml
index 2b551be47c147..87b30504ace2f 100644
--- a/tests/e2e/datadog-metrics/config/test.yaml
+++ b/tests/e2e/datadog-metrics/config/test.yaml
@@ -1,28 +1,28 @@
 features:
-- e2e-tests-datadog
+  - e2e-tests-datadog
 
 test: "e2e"
 
-test_filter: 'datadog::metrics::'
+test_filter: "datadog::metrics::"
 
 runner:
   env:
-    VECTOR_RECEIVE_PORT: '8081'
-    FAKE_INTAKE_AGENT_ENDPOINT: 'http://fakeintake-agent:80'
-    FAKE_INTAKE_VECTOR_ENDPOINT: 'http://fakeintake-vector:80'
+    VECTOR_RECEIVE_PORT: "8081"
+    FAKE_INTAKE_AGENT_ENDPOINT: "http://fakeintake-agent:80"
+    FAKE_INTAKE_VECTOR_ENDPOINT: "http://fakeintake-vector:80"
 
 matrix:
   # validate against the Agent latest nightly and also stable v6 and v7
-  agent_version: ['latest', '6', '7']
+  agent_version: ["latest", "6", "7"]
   # validate both series API versions
-  series_api_version: ['v1', 'v2']
+  series_api_version: ["v1", "v2"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/common/datadog.rs"
-- "src/sources/datadog_agent/**"
-- "src/internal_events/datadog_*"
-- "src/sinks/datadog/metrics/**"
-- "src/sinks/util/**"
-- "tests/e2e/datadog-metrics/**"
+  - "src/common/datadog.rs"
+  - "src/sources/datadog_agent/**"
+  - "src/internal_events/datadog_*"
+  - "src/sinks/datadog/metrics/**"
+  - "src/sinks/util/**"
+  - "tests/e2e/datadog-metrics/**"
diff --git a/tests/e2e/datadog-metrics/data/agent_only.yaml b/tests/e2e/datadog-metrics/data/agent_only.yaml
index 0ed0518c84b18..6b69a11cdf2cc 100644
--- a/tests/e2e/datadog-metrics/data/agent_only.yaml
+++ b/tests/e2e/datadog-metrics/data/agent_only.yaml
@@ -1,5 +1,5 @@
 api_key: DEADBEEF
-log_level: 'warn'
+log_level: "warn"
 
 # disable bunch of stuff we don't need
 inventories_configuration_enabled: false
diff --git a/tests/e2e/datadog-metrics/data/agent_vector.yaml b/tests/e2e/datadog-metrics/data/agent_vector.yaml
index c1566946a96b6..22709586bbd7b 100644
--- a/tests/e2e/datadog-metrics/data/agent_vector.yaml
+++ b/tests/e2e/datadog-metrics/data/agent_vector.yaml
@@ -1,5 +1,5 @@
 api_key: DEADBEEF
-log_level: 'warn'
+log_level: "warn"
 
 # disable bunch of stuff we don't need
 inventories_configuration_enabled: false
diff --git a/tests/e2e/opentelemetry-logs/config/compose.yaml b/tests/e2e/opentelemetry-logs/config/compose.yaml
index 62b3d48c44aa6..4066a553d2257 100644
--- a/tests/e2e/opentelemetry-logs/config/compose.yaml
+++ b/tests/e2e/opentelemetry-logs/config/compose.yaml
@@ -12,7 +12,7 @@ services:
     ports:
       - "${OTEL_COLLECTOR_SOURCE_GRPC_PORT:-4317}:4317"
       - "${OTEL_COLLECTOR_SOURCE_HTTP_PORT:-4318}:4318"
-    command: [ "--config=/etc/otelcol-contrib/config.yaml" ]
+    command: ["--config=/etc/otelcol-contrib/config.yaml"]
 
   logs-generator:
     container_name: logs-generator
@@ -49,7 +49,7 @@ services:
         CONFIG_COLLECTOR_VERSION: ${CONFIG_COLLECTOR_VERSION}
     init: true
     user: "0:0" # test only, override special user with root
-    command: [ "--config", "/etc/otelcol-contrib/config.yaml" ]
+    command: ["--config", "/etc/otelcol-contrib/config.yaml"]
     volumes:
       - type: bind
         source: ../data/collector-sink.yaml
@@ -76,7 +76,7 @@ services:
     environment:
       - VECTOR_LOG=${VECTOR_LOG:-info}
       - FEATURES=e2e-tests-opentelemetry
-    command: [ "vector", "-c", "/etc/vector/vector.yaml" ]
+    command: ["vector", "-c", "/etc/vector/vector.yaml"]
 
 volumes:
   vector_target:
diff --git a/tests/e2e/opentelemetry-logs/config/test.yaml b/tests/e2e/opentelemetry-logs/config/test.yaml
index 54aa7063e632c..e1c5cb85267d2 100644
--- a/tests/e2e/opentelemetry-logs/config/test.yaml
+++ b/tests/e2e/opentelemetry-logs/config/test.yaml
@@ -8,14 +8,14 @@ test_filter: "opentelemetry::logs::"
 runner:
   needs_docker_socket: true
   env:
-    OTEL_COLLECTOR_SOURCE_GRPC_PORT: '4317'
-    OTEL_COLLECTOR_SOURCE_HTTP_PORT: '4318'
-    OTEL_COLLECTOR_SINK_HTTP_PORT: '5318'
+    OTEL_COLLECTOR_SOURCE_GRPC_PORT: "4317"
+    OTEL_COLLECTOR_SOURCE_HTTP_PORT: "4318"
+    OTEL_COLLECTOR_SINK_HTTP_PORT: "5318"
 
 matrix:
   # Determines which `otel/opentelemetry-collector-contrib` version to use
-  collector_version: [ 'latest' ]
-  vector_config: [ 'vector_default.yaml', 'vector_otlp.yaml' ]
+  collector_version: ["latest"]
+  vector_config: ["vector_default.yaml", "vector_otlp.yaml"]
 
 # Only trigger this integration test if relevant OTEL source/sink files change
 paths:
diff --git a/tests/e2e/opentelemetry-logs/data/collector-sink.yaml b/tests/e2e/opentelemetry-logs/data/collector-sink.yaml
index e22f62f91d558..1da64319f6926 100644
--- a/tests/e2e/opentelemetry-logs/data/collector-sink.yaml
+++ b/tests/e2e/opentelemetry-logs/data/collector-sink.yaml
@@ -5,10 +5,10 @@ receivers:
         endpoint: "0.0.0.0:5318"
 
 processors:
-  batch: { }
+  batch: {}
 
 exporters:
-  debug: { }
+  debug: {}
   file:
     path: /output/opentelemetry-logs/collector-file-exporter.log
     rotation:
@@ -18,9 +18,9 @@ exporters:
 service:
   pipelines:
     logs:
-      receivers: [ otlp ]
-      processors: [ batch ]
-      exporters: [ debug, file ]
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [debug, file]
   telemetry:
     logs:
       level: "debug"
diff --git a/tests/e2e/opentelemetry-logs/data/collector-source.yaml b/tests/e2e/opentelemetry-logs/data/collector-source.yaml
index 1a41636209e78..d3f8427a47f33 100644
--- a/tests/e2e/opentelemetry-logs/data/collector-source.yaml
+++ b/tests/e2e/opentelemetry-logs/data/collector-source.yaml
@@ -6,7 +6,7 @@ receivers:
       grpc:
 
 processors:
-  batch: { }
+  batch: {}
 
 exporters:
   otlp/grpc:
@@ -17,16 +17,16 @@ exporters:
     endpoint: http://vector:4318
     tls:
       insecure: true
-  debug: { }
+  debug: {}
 
 service:
   pipelines:
     logs:
-      receivers: [ otlp ]
-      processors: [ batch ]
-      exporters: [ debug, otlp/grpc, otlphttp/vector ]
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [debug, otlp/grpc, otlphttp/vector]
 
     metrics:
-      receivers: [ otlp ]
-      processors: [ batch ]
-      exporters: [ debug ]
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [debug]
diff --git a/tests/e2e/opentelemetry-logs/data/vector_default.yaml b/tests/e2e/opentelemetry-logs/data/vector_default.yaml
index 1f3fd9b119d09..b8e3f6ef9dad3 100644
--- a/tests/e2e/opentelemetry-logs/data/vector_default.yaml
+++ b/tests/e2e/opentelemetry-logs/data/vector_default.yaml
@@ -46,10 +46,9 @@ transforms:
         ]
       }
 
-
 sinks:
   otel_sink:
-    inputs: [ "remap_otel" ]
+    inputs: ["remap_otel"]
     type: opentelemetry
     protocol:
       type: http
diff --git a/tests/e2e/opentelemetry-metrics/config/compose.yaml b/tests/e2e/opentelemetry-metrics/config/compose.yaml
index fba9c2a19b247..44d17475c55b2 100644
--- a/tests/e2e/opentelemetry-metrics/config/compose.yaml
+++ b/tests/e2e/opentelemetry-metrics/config/compose.yaml
@@ -12,7 +12,7 @@ services:
     ports:
       - "${OTEL_COLLECTOR_SOURCE_GRPC_PORT:-4317}:4317"
       - "${OTEL_COLLECTOR_SOURCE_HTTP_PORT:-4318}:4318"
-    command: [ "--config=/etc/otelcol-contrib/config.yaml" ]
+    command: ["--config=/etc/otelcol-contrib/config.yaml"]
 
   metrics-generator:
     container_name: metrics-generator
@@ -86,7 +86,7 @@ services:
         CONFIG_COLLECTOR_VERSION: ${CONFIG_COLLECTOR_VERSION}
     init: true
     user: "0:0" # test only, override special user with root
-    command: [ "--config", "/etc/otelcol-contrib/config.yaml" ]
+    command: ["--config", "/etc/otelcol-contrib/config.yaml"]
     volumes:
       - type: bind
         source: ../data/collector-sink.yaml
@@ -113,7 +113,7 @@ services:
     environment:
       - VECTOR_LOG=${VECTOR_LOG:-info}
       - FEATURES=e2e-tests-opentelemetry
-    command: [ "vector", "-c", "/etc/vector/vector.yaml" ]
+    command: ["vector", "-c", "/etc/vector/vector.yaml"]
 
 volumes:
   vector_target:
diff --git a/tests/e2e/opentelemetry-metrics/config/test.yaml b/tests/e2e/opentelemetry-metrics/config/test.yaml
index 507cddfd2b21d..4d5b0bf4d5256 100644
--- a/tests/e2e/opentelemetry-metrics/config/test.yaml
+++ b/tests/e2e/opentelemetry-metrics/config/test.yaml
@@ -8,13 +8,13 @@ test_filter: "opentelemetry::metrics::"
 runner:
   needs_docker_socket: true
   env:
-    OTEL_COLLECTOR_SOURCE_GRPC_PORT: '4317'
-    OTEL_COLLECTOR_SOURCE_HTTP_PORT: '4318'
-    OTEL_COLLECTOR_SINK_HTTP_PORT: '5318'
+    OTEL_COLLECTOR_SOURCE_GRPC_PORT: "4317"
+    OTEL_COLLECTOR_SOURCE_HTTP_PORT: "4318"
+    OTEL_COLLECTOR_SINK_HTTP_PORT: "5318"
 
 matrix:
   # Determines which `otel/opentelemetry-collector-contrib` version to use
-  collector_version: [ 'latest' ]
+  collector_version: ["latest"]
 
 # Only trigger this integration test if relevant OTEL source/sink files change
 paths:
diff --git a/tests/e2e/opentelemetry-metrics/data/collector-sink.yaml b/tests/e2e/opentelemetry-metrics/data/collector-sink.yaml
index 120b29ff8e20f..6fb3eb25e1522 100644
--- a/tests/e2e/opentelemetry-metrics/data/collector-sink.yaml
+++ b/tests/e2e/opentelemetry-metrics/data/collector-sink.yaml
@@ -5,10 +5,10 @@ receivers:
         endpoint: "0.0.0.0:5318"
 
 processors:
-  batch: { }
+  batch: {}
 
 exporters:
-  debug: { }
+  debug: {}
   file:
     path: /output/opentelemetry-metrics/collector-file-exporter.log
     rotation:
@@ -18,9 +18,9 @@ exporters:
 service:
   pipelines:
     metrics:
-      receivers: [ otlp ]
-      processors: [ batch ]
-      exporters: [ debug, file ]
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [debug, file]
   telemetry:
     logs:
       level: "debug"
diff --git a/tests/e2e/opentelemetry-metrics/data/collector-source.yaml b/tests/e2e/opentelemetry-metrics/data/collector-source.yaml
index 6f1ba27560e87..bf40ac05aa78c 100644
--- a/tests/e2e/opentelemetry-metrics/data/collector-source.yaml
+++ b/tests/e2e/opentelemetry-metrics/data/collector-source.yaml
@@ -6,7 +6,7 @@ receivers:
       grpc:
 
 processors:
-  batch: { }
+  batch: {}
 
 exporters:
   otlp/grpc:
@@ -17,11 +17,11 @@ exporters:
     endpoint: http://vector:4318
     tls:
       insecure: true
-  debug: { }
+  debug: {}
 
 service:
   pipelines:
     metrics:
-      receivers: [ otlp ]
-      processors: [ batch ]
-      exporters: [ debug, otlp/grpc, otlphttp/vector ]
+      receivers: [otlp]
+      processors: [batch]
+      exporters: [debug, otlp/grpc, otlphttp/vector]
diff --git a/tests/integration/amqp/config/compose.yaml b/tests/integration/amqp/config/compose.yaml
index 3eb859f93aa60..643f0b13f083f 100644
--- a/tests/integration/amqp/config/compose.yaml
+++ b/tests/integration/amqp/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3'
+version: "3"
 
 services:
   rabbitmq:
diff --git a/tests/integration/amqp/config/test.yaml b/tests/integration/amqp/config/test.yaml
index 94c080a18559d..40a43748cd12d 100644
--- a/tests/integration/amqp/config/test.yaml
+++ b/tests/integration/amqp/config/test.yaml
@@ -1,17 +1,17 @@
 features:
-- amqp-integration-tests
+  - amqp-integration-tests
 
-test_filter: '::amqp::'
+test_filter: "::amqp::"
 
 matrix:
-  version: ['3.8']
+  version: ["3.8"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/amqp.rs"
-- "src/internal_events/amqp.rs"
-- "src/sinks/amqp/**"
-- "src/sources/amqp.rs"
-- "src/sources/util/**"
-- "src/sinks/util/**"
+  - "src/amqp.rs"
+  - "src/internal_events/amqp.rs"
+  - "src/sinks/amqp/**"
+  - "src/sources/amqp.rs"
+  - "src/sources/util/**"
+  - "src/sinks/util/**"
diff --git a/tests/integration/appsignal/config/test.yaml b/tests/integration/appsignal/config/test.yaml
index d110306916df0..da826955f726a 100644
--- a/tests/integration/appsignal/config/test.yaml
+++ b/tests/integration/appsignal/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- appsignal-integration-tests
+  - appsignal-integration-tests
 
-test_filter: '::appsignal::integration_tests::'
+test_filter: "::appsignal::integration_tests::"
 
 runner:
   env:
@@ -13,5 +13,5 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sinks/appsignal/**"
-- "src/sinks/util/**"
+  - "src/sinks/appsignal/**"
+  - "src/sinks/util/**"
diff --git a/tests/integration/aws/config/compose.yaml b/tests/integration/aws/config/compose.yaml
index 4fbbd62f6e120..a468d8e4c0a96 100644
--- a/tests/integration/aws/config/compose.yaml
+++ b/tests/integration/aws/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3'
+version: "3"
 
 services:
   mock-ec2-metadata:
@@ -6,15 +6,15 @@ services:
   mock-localstack:
     image: docker.io/localstack/localstack@sha256:46302bcb91a7e8008e6394be8afafdbfa40fb77a54d4046a38be35992042d5de
     environment:
-    - SERVICES=kinesis,s3,cloudwatch,es,firehose,kms,sqs,sns,logs
+      - SERVICES=kinesis,s3,cloudwatch,es,firehose,kms,sqs,sns,logs
   mock-ecs:
     image: docker.io/amazon/amazon-ecs-local-container-endpoints:latest
     environment:
-    # https://github.com/vectordotdev/vector/issues/24687
-    - DOCKER_API_VERSION=1.44
+      # https://github.com/vectordotdev/vector/issues/24687
+      - DOCKER_API_VERSION=1.44
     volumes:
-    - $DOCKER_SOCKET:/var/run/docker.sock
-    - $HOME/.aws/:/home/.aws/
+      - $DOCKER_SOCKET:/var/run/docker.sock
+      - $HOME/.aws/:/home/.aws/
 
 networks:
   default:
diff --git a/tests/integration/aws/config/test.yaml b/tests/integration/aws/config/test.yaml
index 956f724978fa3..d27214d9499de 100644
--- a/tests/integration/aws/config/test.yaml
+++ b/tests/integration/aws/config/test.yaml
@@ -1,5 +1,5 @@
 features:
-- aws-integration-tests
+  - aws-integration-tests
 
 test_filter: ::aws_
 
@@ -22,11 +22,11 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/aws/**"
-- "src/internal_events/aws_*"
-- "src/sources/aws_*/**"
-- "src/sources/util/**"
-- "src/sinks/aws_*/**"
-- "src/sinks/util/**"
-- "src/transforms/aws_*"
-- "tests/integration/aws/**"
+  - "src/aws/**"
+  - "src/internal_events/aws_*"
+  - "src/sources/aws_*/**"
+  - "src/sources/util/**"
+  - "src/sinks/aws_*/**"
+  - "src/sinks/util/**"
+  - "src/transforms/aws_*"
+  - "tests/integration/aws/**"
diff --git a/tests/integration/axiom/config/test.yaml b/tests/integration/axiom/config/test.yaml
index 934bd739eeaca..ed542ece401d7 100644
--- a/tests/integration/axiom/config/test.yaml
+++ b/tests/integration/axiom/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- axiom-integration-tests
+  - axiom-integration-tests
 
-test_filter: '::axiom::'
+test_filter: "::axiom::"
 
 runner:
   env:
@@ -16,6 +16,6 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sinks/axiom.rs"
-- "src/sinks/util/**"
-- "tests/integration/axiom/**"
+  - "src/sinks/axiom.rs"
+  - "src/sinks/util/**"
+  - "tests/integration/axiom/**"
diff --git a/tests/integration/azure/config/compose.yaml b/tests/integration/azure/config/compose.yaml
index 933a72d235a24..fe3541bf2a07c 100644
--- a/tests/integration/azure/config/compose.yaml
+++ b/tests/integration/azure/config/compose.yaml
@@ -1,11 +1,11 @@
-version: '3'
+version: "3"
 
 services:
   local-azure-blob:
     image: mcr.microsoft.com/azure-storage/azurite:${CONFIG_VERSION}
     command: azurite --blobHost 0.0.0.0 --loose
     volumes:
-    - /var/run:/var/run
+      - /var/run:/var/run
 
 networks:
   default:
diff --git a/tests/integration/azure/config/test.yaml b/tests/integration/azure/config/test.yaml
index 191bea7256cea..da00ceed79ad4 100644
--- a/tests/integration/azure/config/test.yaml
+++ b/tests/integration/azure/config/test.yaml
@@ -1,5 +1,5 @@
 features:
-- azure-integration-tests
+  - azure-integration-tests
 
 test_filter: ::azure_
 
@@ -9,11 +9,11 @@ env:
   LOGSTASH_ADDRESS: 0.0.0.0:8081
 
 matrix:
-  version: [ 3.35.0 ]
+  version: [3.35.0]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sinks/azure_**"
-- "src/sinks/util/**"
-- "tests/integration/azure/**"
+  - "src/sinks/azure_**"
+  - "src/sinks/util/**"
+  - "tests/integration/azure/**"
diff --git a/tests/integration/clickhouse/config/compose.yaml b/tests/integration/clickhouse/config/compose.yaml
index fd823897ec4c2..e861c92c736f0 100644
--- a/tests/integration/clickhouse/config/compose.yaml
+++ b/tests/integration/clickhouse/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3'
+version: "3"
 
 services:
   clickhouse:
diff --git a/tests/integration/clickhouse/config/test.yaml b/tests/integration/clickhouse/config/test.yaml
index 3418d810fa638..3f88eedf5a654 100644
--- a/tests/integration/clickhouse/config/test.yaml
+++ b/tests/integration/clickhouse/config/test.yaml
@@ -1,17 +1,17 @@
 features:
-- clickhouse-integration-tests
+  - clickhouse-integration-tests
 
-test_filter: '::clickhouse::'
+test_filter: "::clickhouse::"
 
 env:
   CLICKHOUSE_ADDRESS: http://clickhouse:8123
 
 matrix:
-  version: ['23']
+  version: ["23"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sinks/clickhouse/**"
-- "src/sinks/util/**"
-- "tests/integration/clickhouse/**"
+  - "src/sinks/clickhouse/**"
+  - "src/sinks/util/**"
+  - "tests/integration/clickhouse/**"
diff --git a/tests/integration/databend/config/compose.yaml b/tests/integration/databend/config/compose.yaml
index 213fb20af70fe..e98305ba2ea01 100644
--- a/tests/integration/databend/config/compose.yaml
+++ b/tests/integration/databend/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3'
+version: "3"
 
 services:
   minio:
diff --git a/tests/integration/databend/config/test.yaml b/tests/integration/databend/config/test.yaml
index eaa9f5ad50d86..0ec4b2c9d57f4 100644
--- a/tests/integration/databend/config/test.yaml
+++ b/tests/integration/databend/config/test.yaml
@@ -1,18 +1,18 @@
 features:
-- databend-integration-tests
+  - databend-integration-tests
 
-test_filter: '::databend::'
+test_filter: "::databend::"
 
 runner:
   env:
     DATABEND_ENDPOINT: databend://vector:vector@databend:8000?sslmode=disable&presign=detect
 
 matrix:
-  version: ['latest']
+  version: ["latest"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sinks/databend/**"
-- "src/sinks/util/**"
-- "tests/integration/databend/**"
+  - "src/sinks/databend/**"
+  - "src/sinks/util/**"
+  - "tests/integration/databend/**"
diff --git a/tests/integration/datadog-agent/config/compose.yaml b/tests/integration/datadog-agent/config/compose.yaml
index 4ccf95ff24e00..c63089ac620a9 100644
--- a/tests/integration/datadog-agent/config/compose.yaml
+++ b/tests/integration/datadog-agent/config/compose.yaml
@@ -1,32 +1,32 @@
-version: '3'
+version: "3"
 
 services:
   datadog-agent:
     image: docker.io/datadog/agent:${CONFIG_VERSION}
     environment:
-    - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
-    - DD_APM_ENABLED=false
-    - DD_LOGS_ENABLED=true
-    - DD_LOGS_CONFIG_LOGS_DD_URL=runner:8080
-    - DD_LOGS_CONFIG_LOGS_NO_SSL=true
-    - DD_LOGS_CONFIG_USE_HTTP=true
-    - DD_HEALTH_PORT=8182
-    - DD_CMD_PORT=5001
-    - DD_USE_DOGSTATSD=false
-    - DD_HOSTNAME=datadog-agent
-    - DD_SERIALIZER_COMPRESSOR_KIND=zstd
+      - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
+      - DD_APM_ENABLED=false
+      - DD_LOGS_ENABLED=true
+      - DD_LOGS_CONFIG_LOGS_DD_URL=runner:8080
+      - DD_LOGS_CONFIG_LOGS_NO_SSL=true
+      - DD_LOGS_CONFIG_USE_HTTP=true
+      - DD_HEALTH_PORT=8182
+      - DD_CMD_PORT=5001
+      - DD_USE_DOGSTATSD=false
+      - DD_HOSTNAME=datadog-agent
+      - DD_SERIALIZER_COMPRESSOR_KIND=zstd
     volumes:
-    - ../data/conf.yaml:/etc/datadog-agent/conf.d/test.d/conf.yaml
+      - ../data/conf.yaml:/etc/datadog-agent/conf.d/test.d/conf.yaml
   datadog-trace-agent:
     image: docker.io/datadog/agent:7.31.0
     environment:
-    - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
-    - DD_APM_ENABLED=true
-    - DD_APM_DD_URL=http://runner:8081
-    - DD_HEALTH_PORT=8183
-    - DD_CMD_PORT=5002
-    - DD_USE_DOGSTATSD=false
-    - DD_HOSTNAME=datadog-trace-agent
+      - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
+      - DD_APM_ENABLED=true
+      - DD_APM_DD_URL=http://runner:8081
+      - DD_HEALTH_PORT=8183
+      - DD_CMD_PORT=5002
+      - DD_USE_DOGSTATSD=false
+      - DD_HOSTNAME=datadog-trace-agent
 
 networks:
   default:
diff --git a/tests/integration/datadog-agent/config/test.yaml b/tests/integration/datadog-agent/config/test.yaml
index c1d3ec50d7592..353c1c9e02188 100644
--- a/tests/integration/datadog-agent/config/test.yaml
+++ b/tests/integration/datadog-agent/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- datadog-agent-integration-tests
+  - datadog-agent-integration-tests
 
-test_filter: 'sources::datadog_agent::integration_tests::'
+test_filter: "sources::datadog_agent::integration_tests::"
 
 env:
   AGENT_ADDRESS: datadog-agent:8181
@@ -11,12 +11,12 @@ env:
   TEST_DATADOG_API_KEY:
 
 matrix:
-  version: ['7']
+  version: ["7"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/common/datadog.rs"
-- "src/internal_events/datadog_*"
-- "src/sources/datadog_agent/**"
-- "tests/integration/datadog-agent/**"
+  - "src/common/datadog.rs"
+  - "src/internal_events/datadog_*"
+  - "src/sources/datadog_agent/**"
+  - "tests/integration/datadog-agent/**"
diff --git a/tests/integration/datadog-logs/config/test.yaml b/tests/integration/datadog-logs/config/test.yaml
index f10db04ef5661..3e33d0ffc8922 100644
--- a/tests/integration/datadog-logs/config/test.yaml
+++ b/tests/integration/datadog-logs/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- datadog-logs-integration-tests
+  - datadog-logs-integration-tests
 
-test_filter: '::datadog::logs::integration_tests::'
+test_filter: "::datadog::logs::integration_tests::"
 
 runner:
   env:
@@ -13,8 +13,8 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/common/datadog.rs"
-- "src/internal_events/datadog_*"
-- "src/sinks/datadog/logs/**"
-- "src/sinks/util/**"
-- "tests/integration/datadog-logs/**"
+  - "src/common/datadog.rs"
+  - "src/internal_events/datadog_*"
+  - "src/sinks/datadog/logs/**"
+  - "src/sinks/util/**"
+  - "tests/integration/datadog-logs/**"
diff --git a/tests/integration/datadog-metrics/config/test.yaml b/tests/integration/datadog-metrics/config/test.yaml
index 55282a361eccb..a0cdf30b036a1 100644
--- a/tests/integration/datadog-metrics/config/test.yaml
+++ b/tests/integration/datadog-metrics/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- datadog-metrics-integration-tests
+  - datadog-metrics-integration-tests
 
-test_filter: '::datadog::metrics::integration_tests'
+test_filter: "::datadog::metrics::integration_tests"
 
 runner:
   env:
@@ -13,8 +13,8 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/common/datadog.rs"
-- "src/internal_events/datadog_*"
-- "src/sinks/datadog/metrics/**"
-- "src/sinks/util/**"
-- "tests/integration/datadog-metrics/**"
+  - "src/common/datadog.rs"
+  - "src/internal_events/datadog_*"
+  - "src/sinks/datadog/metrics/**"
+  - "src/sinks/util/**"
+  - "tests/integration/datadog-metrics/**"
diff --git a/tests/integration/datadog-traces/config/compose.yaml b/tests/integration/datadog-traces/config/compose.yaml
index f94ee0b53d089..847db7b3c1387 100644
--- a/tests/integration/datadog-traces/config/compose.yaml
+++ b/tests/integration/datadog-traces/config/compose.yaml
@@ -1,34 +1,34 @@
-version: '3'
+version: "3"
 
 services:
   datadog-trace-agent:
     image: docker.io/datadog/agent:${CONFIG_VERSION}
     environment:
-    - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
-    - DD_APM_ENABLED=true
-    - DD_APM_DD_URL=http://runner:8082
-    - DD_HEALTH_PORT=8183
-    - DD_CMD_PORT=5002
-    - DD_USE_DOGSTATSD=false
-    - DD_APM_MAX_TPS=999999
-    - DD_APM_ERROR_TPS=999999
-    - DD_APM_MAX_MEMORY=0
-    - DD_APM_MAX_CPU_PERCENT=0
-    - DD_HOSTNAME=datadog-trace-agent
+      - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
+      - DD_APM_ENABLED=true
+      - DD_APM_DD_URL=http://runner:8082
+      - DD_HEALTH_PORT=8183
+      - DD_CMD_PORT=5002
+      - DD_USE_DOGSTATSD=false
+      - DD_APM_MAX_TPS=999999
+      - DD_APM_ERROR_TPS=999999
+      - DD_APM_MAX_MEMORY=0
+      - DD_APM_MAX_CPU_PERCENT=0
+      - DD_HOSTNAME=datadog-trace-agent
   datadog-trace-agent-to-vector:
     image: docker.io/datadog/agent:${CONFIG_VERSION}
     environment:
-    - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
-    - DD_APM_ENABLED=true
-    - DD_APM_DD_URL=http://runner:8081
-    - DD_HEALTH_PORT=8183
-    - DD_CMD_PORT=5002
-    - DD_USE_DOGSTATSD=false
-    - DD_APM_MAX_TPS=999999
-    - DD_APM_ERROR_TPS=999999
-    - DD_APM_MAX_MEMORY=0
-    - DD_APM_MAX_CPU_PERCENT=0
-    - DD_HOSTNAME=datadog-trace-agent-to-vector
+      - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
+      - DD_APM_ENABLED=true
+      - DD_APM_DD_URL=http://runner:8081
+      - DD_HEALTH_PORT=8183
+      - DD_CMD_PORT=5002
+      - DD_USE_DOGSTATSD=false
+      - DD_APM_MAX_TPS=999999
+      - DD_APM_ERROR_TPS=999999
+      - DD_APM_MAX_MEMORY=0
+      - DD_APM_MAX_CPU_PERCENT=0
+      - DD_HOSTNAME=datadog-trace-agent-to-vector
 
 networks:
   default:
diff --git a/tests/integration/datadog-traces/config/test.yaml b/tests/integration/datadog-traces/config/test.yaml
index 2a3f162e61b30..7f72063f617c7 100644
--- a/tests/integration/datadog-traces/config/test.yaml
+++ b/tests/integration/datadog-traces/config/test.yaml
@@ -1,14 +1,14 @@
 features:
-- datadog-traces-integration-tests
+  - datadog-traces-integration-tests
 
-test_filter: '::datadog::traces::'
+test_filter: "::datadog::traces::"
 
 env:
-  AGENT_PORT: '8082'
+  AGENT_PORT: "8082"
   VECTOR_LOG: ${VECTOR_LOG}
   TRACE_AGENT_TO_VECTOR_URL: http://datadog-trace-agent-to-vector:8126/v0.3/traces
   TRACE_AGENT_URL: http://datadog-trace-agent:8126/v0.3/traces
-  VECTOR_PORT: '8081'
+  VECTOR_PORT: "8081"
   TEST_DATADOG_API_KEY:
 
 matrix:
@@ -17,8 +17,8 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/common/datadog.rs"
-- "src/internal_events/datadog_*"
-- "src/sinks/datadog/traces/**"
-- "src/sinks/util/**"
-- "tests/integration/datadog-traces/**"
+  - "src/common/datadog.rs"
+  - "src/internal_events/datadog_*"
+  - "src/sinks/datadog/traces/**"
+  - "src/sinks/util/**"
+  - "tests/integration/datadog-traces/**"
diff --git a/tests/integration/dnstap/config/test.yaml b/tests/integration/dnstap/config/test.yaml
index ed0de1d3ea411..8ff55500cbf59 100644
--- a/tests/integration/dnstap/config/test.yaml
+++ b/tests/integration/dnstap/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- dnstap-integration-tests
+  - dnstap-integration-tests
 
-test_filter: '::dnstap::'
+test_filter: "::dnstap::"
 
 runner:
   env:
@@ -11,12 +11,12 @@ runner:
     dnstap_dnstap-sockets: /run/bind/socket
 
 matrix:
-  version: ['latest']
+  version: ["latest"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/dnstap.rs"
-- "src/sources/dnstap/**"
-- "src/sources/util/**"
-- "tests/integration/dnstap/**"
+  - "src/internal_events/dnstap.rs"
+  - "src/sources/dnstap/**"
+  - "src/sources/util/**"
+  - "tests/integration/dnstap/**"
diff --git a/tests/integration/docker-logs/config/test.yaml b/tests/integration/docker-logs/config/test.yaml
index 0ac64071bd516..2ddd643652e9c 100644
--- a/tests/integration/docker-logs/config/test.yaml
+++ b/tests/integration/docker-logs/config/test.yaml
@@ -1,5 +1,5 @@
 features:
-- docker-logs-integration-tests
+  - docker-logs-integration-tests
 
 test_filter: "::docker_logs::"
 
@@ -12,8 +12,8 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/docker.rs"
-- "src/internal_events/docker_logs.rs"
-- "src/sources/docker_logs/**"
-- "src/sources/util/**"
-- "tests/integration/docker-logs/**"
+  - "src/docker.rs"
+  - "src/internal_events/docker_logs.rs"
+  - "src/sources/docker_logs/**"
+  - "src/sources/util/**"
+  - "tests/integration/docker-logs/**"
diff --git a/tests/integration/doris/config/test.yaml b/tests/integration/doris/config/test.yaml
index 799a369d19a2f..e09e964991eb4 100644
--- a/tests/integration/doris/config/test.yaml
+++ b/tests/integration/doris/config/test.yaml
@@ -1,19 +1,19 @@
 features:
-- sinks-doris
-- doris-integration-tests
+  - sinks-doris
+  - doris-integration-tests
 
-test_filter: 'sinks::doris::integration_test::'
+test_filter: "sinks::doris::integration_test::"
 
 env:
   DORIS_ADDRESS: http://doris:8040
 
 matrix:
-  version: ['2.1.7']
+  version: ["2.1.7"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/doris.rs"
-- "src/sinks/doris/**"
-- "src/sinks/util/**"
-- "tests/integration/doris/**"
+  - "src/internal_events/doris.rs"
+  - "src/sinks/doris/**"
+  - "src/sinks/util/**"
+  - "tests/integration/doris/**"
diff --git a/tests/integration/elasticsearch/config/compose.yaml b/tests/integration/elasticsearch/config/compose.yaml
index 4dcb6636bf4cb..cb6d0bcc2f392 100644
--- a/tests/integration/elasticsearch/config/compose.yaml
+++ b/tests/integration/elasticsearch/config/compose.yaml
@@ -1,30 +1,30 @@
-version: '3'
+version: "3"
 
 services:
   localstack:
     image: docker.io/localstack/localstack@sha256:f21f1fc770ee4bfd5012afdc902154c56b7fb18c14cf672de151b65569c8251e
     environment:
-    - SERVICES=elasticsearch:4571
+      - SERVICES=elasticsearch:4571
   elasticsearch:
     image: docker.io/elasticsearch:${CONFIG_VERSION}
     environment:
-    - discovery.type=single-node
-    - ES_JAVA_OPTS=-Xms400m -Xmx400m
+      - discovery.type=single-node
+      - ES_JAVA_OPTS=-Xms400m -Xmx400m
   elasticsearch-secure:
     image: docker.io/elasticsearch:${CONFIG_VERSION}
     environment:
-    - discovery.type=single-node
-    - xpack.security.enabled=true
-    - xpack.security.http.ssl.enabled=true
-    - xpack.security.http.ssl.certificate=certs/intermediate_server/certs/elasticsearch-secure-chain.cert.pem
-    - xpack.security.http.ssl.key=certs/intermediate_server/private/elasticsearch-secure.key.pem
-    - xpack.security.transport.ssl.enabled=true
-    - xpack.security.transport.ssl.certificate=certs/intermediate_server/certs/elasticsearch-secure-chain.cert.pem
-    - xpack.security.transport.ssl.key=certs/intermediate_server/private/elasticsearch-secure.key.pem
-    - ELASTIC_PASSWORD=vector
-    - ES_JAVA_OPTS=-Xms400m -Xmx400m
+      - discovery.type=single-node
+      - xpack.security.enabled=true
+      - xpack.security.http.ssl.enabled=true
+      - xpack.security.http.ssl.certificate=certs/intermediate_server/certs/elasticsearch-secure-chain.cert.pem
+      - xpack.security.http.ssl.key=certs/intermediate_server/private/elasticsearch-secure.key.pem
+      - xpack.security.transport.ssl.enabled=true
+      - xpack.security.transport.ssl.certificate=certs/intermediate_server/certs/elasticsearch-secure-chain.cert.pem
+      - xpack.security.transport.ssl.key=certs/intermediate_server/private/elasticsearch-secure.key.pem
+      - ELASTIC_PASSWORD=vector
+      - ES_JAVA_OPTS=-Xms400m -Xmx400m
     volumes:
-    - ../../../data/ca:/usr/share/elasticsearch/config/certs:ro
+      - ../../../data/ca:/usr/share/elasticsearch/config/certs:ro
 
 networks:
   default:
diff --git a/tests/integration/elasticsearch/config/test.yaml b/tests/integration/elasticsearch/config/test.yaml
index cdf1eedbbb4a7..984932cb08540 100644
--- a/tests/integration/elasticsearch/config/test.yaml
+++ b/tests/integration/elasticsearch/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- es-integration-tests
+  - es-integration-tests
 
-test_filter: '::elasticsearch::integration_tests::'
+test_filter: "::elasticsearch::integration_tests::"
 
 env:
   AWS_ACCESS_KEY_ID: dummy
@@ -16,6 +16,6 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sinks/elasticsearch/**"
-- "src/sinks/util/**"
-- "tests/integration/elasticsearch/**"
+  - "src/sinks/elasticsearch/**"
+  - "src/sinks/util/**"
+  - "tests/integration/elasticsearch/**"
diff --git a/tests/integration/eventstoredb/config/compose.yaml b/tests/integration/eventstoredb/config/compose.yaml
index 01e6a14ea4117..76d9c45a8528b 100644
--- a/tests/integration/eventstoredb/config/compose.yaml
+++ b/tests/integration/eventstoredb/config/compose.yaml
@@ -1,11 +1,11 @@
-version: '3'
+version: "3"
 
 services:
   eventstoredb:
     image: docker.io/eventstore/eventstore:${CONFIG_VERSION}
     command: --insecure --stats-period-sec=1
     volumes:
-    - ../../../data:/etc/vector:ro
+      - ../../../data:/etc/vector:ro
 
 networks:
   default:
diff --git a/tests/integration/eventstoredb/config/test.yaml b/tests/integration/eventstoredb/config/test.yaml
index 2dab755bfd032..60c6d8e148cc8 100644
--- a/tests/integration/eventstoredb/config/test.yaml
+++ b/tests/integration/eventstoredb/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- eventstoredb_metrics-integration-tests
+  - eventstoredb_metrics-integration-tests
 
-test_filter: '::eventstoredb_metrics::'
+test_filter: "::eventstoredb_metrics::"
 
 matrix:
   version: ["24.2", "24.6", "latest"]
@@ -9,7 +9,7 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/eventstoredb_metrics.rs"
-- "src/sources/eventstoredb_metrics/**"
-- "src/sources/util/**"
-- "tests/integration/eventstoredb/**"
+  - "src/internal_events/eventstoredb_metrics.rs"
+  - "src/sources/eventstoredb_metrics/**"
+  - "src/sources/util/**"
+  - "tests/integration/eventstoredb/**"
diff --git a/tests/integration/fluent/config/test.yaml b/tests/integration/fluent/config/test.yaml
index f5f977aa1f637..41151d5abd8af 100644
--- a/tests/integration/fluent/config/test.yaml
+++ b/tests/integration/fluent/config/test.yaml
@@ -1,5 +1,5 @@
 features:
-- fluent-integration-tests
+  - fluent-integration-tests
 
 test_filter: "::fluent::"
 
@@ -14,7 +14,7 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/fluent.rs"
-- "src/sources/fluent/**"
-- "src/sources/util/**"
-- "tests/integration/fluent/**"
+  - "src/internal_events/fluent.rs"
+  - "src/sources/fluent/**"
+  - "src/sources/util/**"
+  - "tests/integration/fluent/**"
diff --git a/tests/integration/gcp/config/compose.yaml b/tests/integration/gcp/config/compose.yaml
index f317c23a5604c..d911f9fad8872 100644
--- a/tests/integration/gcp/config/compose.yaml
+++ b/tests/integration/gcp/config/compose.yaml
@@ -1,20 +1,20 @@
-version: '3'
+version: "3"
 
 services:
   gcloud-pubsub:
     image: docker.io/messagebird/gcloud-pubsub-emulator:${CONFIG_VERSION}
     environment:
-    - PUBSUB_PROJECT1=testproject,topic1:subscription1
-    - PUBSUB_PROJECT2=sourceproject,topic2:subscription2
+      - PUBSUB_PROJECT1=testproject,topic1:subscription1
+      - PUBSUB_PROJECT2=sourceproject,topic2:subscription2
   chronicle-emulator:
     image: docker.io/timberio/chronicle-emulator:${CONFIG_VERSION}
     ports:
-    - 3000:3000
+      - 3000:3000
     volumes:
-    - ./public.pem:/public.pem:ro
+      - ./public.pem:/public.pem:ro
     command:
-    - -p
-    - /public.pem
+      - -p
+      - /public.pem
 
 networks:
   default:
diff --git a/tests/integration/gcp/config/invalidauth.json b/tests/integration/gcp/config/invalidauth.json
index 7126a1b4afbf6..0963bfc473027 100644
--- a/tests/integration/gcp/config/invalidauth.json
+++ b/tests/integration/gcp/config/invalidauth.json
@@ -2,7 +2,7 @@
   "type": "service_account",
   "project_id": "chronicle-test",
   "private_key_id": "1",
-    "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIICXgIBAAKBgQDouHdVDVz0/M6PGe60Kf/g0nyOxCvbZgiUAZNzFimXDU+RpZ54\n6/oETl6VpRkbp8a4Xb8avll2lsamdHvGcsgnjJXdpp7LfWYLqHEpn0/XFM+womXg\nvglWCDwAsXmrmwpZKEC82mmyFigheyPA/sfuN6z+wa7P5B65xzIdDQX7nQIDAQAB\nAoGBANID/rUDrTrtll8v8Oon6OH0MjIIuOdzKhSfY3h9rKTDf2YaB2xq0KLoMpVr\ne8AoZb5l45t34naR1M3M2xKY7SSDAVJFfg/3Vxeot86DQ23IGLXj7LnNxXnvklXa\nEXaD8LNz/MXxS7/Lu0R+lEtjEkf23+BRb11fL6Q/EDToNHnhAkEA/FnwHhKMc/Bm\nXsS8bENuZP3SV2v7TU6MFTtXJFmsoZBxHnsM8UUi0gq9gBnApmdhy7v2N/Mv9gFI\nviSdr7vm1QJBAOwV3cHAciRHVK71TweOWIJKZBM9ZVut0VDs5GrBYZxGMBiOr3BI\ns7+0ugTKxVimuei6c0KNXw1kg3Vtc5+utakCQQDklAbXBpAomJHxt5zBKBc/7VXx\nEANyk/p5ZOXbLEsdkXuVU3p2tNwEi+v4s9r4H97Kr3goV+SSnbkpWntm6fn9AkBn\nFnE7rlXpA4C12QYGTaDWW7dxM0j0DGUvChH/j6uYuok73+o5hHWAy2DCwOwFduAN\nAIVd1S9hQLeqaf2oB3jpAkEAnRT+bAlMjtUOBO6XPNO4IbYwWJvGMcIEO7zu6AdB\nPJy3/U+bLimxFuYdrs6SnIHIUVdl35AlckHqzT54a5YKqQ==\n-----END RSA PRIVATE KEY-----",
+  "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIICXgIBAAKBgQDouHdVDVz0/M6PGe60Kf/g0nyOxCvbZgiUAZNzFimXDU+RpZ54\n6/oETl6VpRkbp8a4Xb8avll2lsamdHvGcsgnjJXdpp7LfWYLqHEpn0/XFM+womXg\nvglWCDwAsXmrmwpZKEC82mmyFigheyPA/sfuN6z+wa7P5B65xzIdDQX7nQIDAQAB\nAoGBANID/rUDrTrtll8v8Oon6OH0MjIIuOdzKhSfY3h9rKTDf2YaB2xq0KLoMpVr\ne8AoZb5l45t34naR1M3M2xKY7SSDAVJFfg/3Vxeot86DQ23IGLXj7LnNxXnvklXa\nEXaD8LNz/MXxS7/Lu0R+lEtjEkf23+BRb11fL6Q/EDToNHnhAkEA/FnwHhKMc/Bm\nXsS8bENuZP3SV2v7TU6MFTtXJFmsoZBxHnsM8UUi0gq9gBnApmdhy7v2N/Mv9gFI\nviSdr7vm1QJBAOwV3cHAciRHVK71TweOWIJKZBM9ZVut0VDs5GrBYZxGMBiOr3BI\ns7+0ugTKxVimuei6c0KNXw1kg3Vtc5+utakCQQDklAbXBpAomJHxt5zBKBc/7VXx\nEANyk/p5ZOXbLEsdkXuVU3p2tNwEi+v4s9r4H97Kr3goV+SSnbkpWntm6fn9AkBn\nFnE7rlXpA4C12QYGTaDWW7dxM0j0DGUvChH/j6uYuok73+o5hHWAy2DCwOwFduAN\nAIVd1S9hQLeqaf2oB3jpAkEAnRT+bAlMjtUOBO6XPNO4IbYwWJvGMcIEO7zu6AdB\nPJy3/U+bLimxFuYdrs6SnIHIUVdl35AlckHqzT54a5YKqQ==\n-----END RSA PRIVATE KEY-----",
   "client_email": "test@test.com",
   "client_id": "1",
   "auth_uri": "http://chronicle-emulator:3000/o/oauth2/auth",
diff --git a/tests/integration/gcp/config/test.yaml b/tests/integration/gcp/config/test.yaml
index b700b8283f831..474826afd6aed 100644
--- a/tests/integration/gcp/config/test.yaml
+++ b/tests/integration/gcp/config/test.yaml
@@ -1,8 +1,8 @@
 features:
-- gcp-integration-tests
-- chronicle-integration-tests
+  - gcp-integration-tests
+  - chronicle-integration-tests
 
-test_filter: '::gcp'
+test_filter: "::gcp"
 
 env:
   EMULATOR_ADDRESS: http://gcloud-pubsub:8681
@@ -14,10 +14,10 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/gcp_pubsub.rs"
-- "src/sources/gcp_pubsub.rs"
-- "src/sources/util/**"
-- "src/sinks/gcp/**"
-- "src/sinks/util/**"
-- "src/gcp.rs"
-- "tests/integration/gcp/**"
+  - "src/internal_events/gcp_pubsub.rs"
+  - "src/sources/gcp_pubsub.rs"
+  - "src/sources/util/**"
+  - "src/sinks/gcp/**"
+  - "src/sinks/util/**"
+  - "src/gcp.rs"
+  - "tests/integration/gcp/**"
diff --git a/tests/integration/greptimedb/config/compose.yaml b/tests/integration/greptimedb/config/compose.yaml
index 02a68364e7a31..01abc946761e1 100644
--- a/tests/integration/greptimedb/config/compose.yaml
+++ b/tests/integration/greptimedb/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3'
+version: "3"
 
 services:
   greptimedb:
diff --git a/tests/integration/greptimedb/config/test.yaml b/tests/integration/greptimedb/config/test.yaml
index 17593b891df8c..2ec3984938617 100644
--- a/tests/integration/greptimedb/config/test.yaml
+++ b/tests/integration/greptimedb/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- greptimedb-integration-tests
+  - greptimedb-integration-tests
 
-test_filter: '::greptimedb::'
+test_filter: "::greptimedb::"
 
 runner:
   env:
@@ -17,5 +17,5 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sinks/greptimedb/**"
-- "tests/integration/greptimedb/**"
+  - "src/sinks/greptimedb/**"
+  - "tests/integration/greptimedb/**"
diff --git a/tests/integration/http-client/config/compose.yaml b/tests/integration/http-client/config/compose.yaml
index 7ad5dfc47386b..91eaa066886eb 100644
--- a/tests/integration/http-client/config/compose.yaml
+++ b/tests/integration/http-client/config/compose.yaml
@@ -1,34 +1,34 @@
-version: '3'
+version: "3"
 
 services:
   dufs:
     image: docker.io/sigoden/dufs:${CONFIG_VERSION}
     command:
-    - /data
+      - /data
     volumes:
-    - ../data/serve:/data
+      - ../data/serve:/data
   dufs-auth:
     image: docker.io/sigoden/dufs:${CONFIG_VERSION}
     command:
-    - -a
-    - "user:pass@/"
-    - --auth-method
-    - basic
-    - /data
+      - -a
+      - "user:pass@/"
+      - --auth-method
+      - basic
+      - /data
     volumes:
-    - ../data/serve:/data
+      - ../data/serve:/data
   dufs-https:
     image: docker.io/sigoden/dufs:${CONFIG_VERSION}
     command:
-    - --tls-cert
-    - /certs/ca.cert.pem
-    - --tls-key
-    - /certs/ca.key.pem
-    - /data
+      - --tls-cert
+      - /certs/ca.cert.pem
+      - --tls-key
+      - /certs/ca.key.pem
+      - /data
     volumes:
-    - ../data/serve:/data
-    - ../../../data/ca/intermediate_server/certs/dufs-https-chain.cert.pem:/certs/ca.cert.pem
-    - ../../../data/ca/intermediate_server/private/dufs-https.key.pem:/certs/ca.key.pem
+      - ../data/serve:/data
+      - ../../../data/ca/intermediate_server/certs/dufs-https-chain.cert.pem:/certs/ca.cert.pem
+      - ../../../data/ca/intermediate_server/private/dufs-https.key.pem:/certs/ca.key.pem
 
 networks:
   default:
diff --git a/tests/integration/http-client/config/test.yaml b/tests/integration/http-client/config/test.yaml
index a56570dc5cf81..bf52050571683 100644
--- a/tests/integration/http-client/config/test.yaml
+++ b/tests/integration/http-client/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- http-client-integration-tests
+  - http-client-integration-tests
 
-test_filter: 'sources::http_client::'
+test_filter: "sources::http_client::"
 
 env:
   DUFS_ADDRESS: http://dufs:5000
@@ -14,6 +14,6 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sources/http_client/**"
-- "src/sources/util/**"
-- "tests/integration/http-client/**"
+  - "src/sources/http_client/**"
+  - "src/sources/util/**"
+  - "tests/integration/http-client/**"
diff --git a/tests/integration/http-client/data/serve/logs/json.json b/tests/integration/http-client/data/serve/logs/json.json
index 9672096ad8861..9cc07fbc01e5d 100644
--- a/tests/integration/http-client/data/serve/logs/json.json
+++ b/tests/integration/http-client/data/serve/logs/json.json
@@ -1 +1 @@
-{ "foo" : "baz" }
+{ "foo": "baz" }
diff --git a/tests/integration/http-client/data/serve/metrics/native.json b/tests/integration/http-client/data/serve/metrics/native.json
index 4aea8048614d2..76935bd2f32aa 100644
--- a/tests/integration/http-client/data/serve/metrics/native.json
+++ b/tests/integration/http-client/data/serve/metrics/native.json
@@ -1 +1 @@
-{ "metric" : { "name" : "a_metric", "kind" : "absolute" , "counter" : { "value" : 1 } } }
+{ "metric": { "name": "a_metric", "kind": "absolute", "counter": { "value": 1 } } }
diff --git a/tests/integration/http-client/data/serve/traces/native.json b/tests/integration/http-client/data/serve/traces/native.json
index cc755b92f3bea..0d970b94d3e4f 100644
--- a/tests/integration/http-client/data/serve/traces/native.json
+++ b/tests/integration/http-client/data/serve/traces/native.json
@@ -1 +1 @@
-{ "trace" : { "name" : "a_trace", "foo" : 42 } }
+{ "trace": { "name": "a_trace", "foo": 42 } }
diff --git a/tests/integration/humio/config/compose.yaml b/tests/integration/humio/config/compose.yaml
index bc1045d98445d..0fb6c2cb5ddbe 100644
--- a/tests/integration/humio/config/compose.yaml
+++ b/tests/integration/humio/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3'
+version: "3"
 
 services:
   humio:
diff --git a/tests/integration/humio/config/test.yaml b/tests/integration/humio/config/test.yaml
index a8cdebeba3b19..9d068364bf917 100644
--- a/tests/integration/humio/config/test.yaml
+++ b/tests/integration/humio/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- humio-integration-tests
+  - humio-integration-tests
 
-test_filter: '::humio::'
+test_filter: "::humio::"
 
 runner:
   env:
@@ -13,6 +13,6 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sinks/humio/**"
-- "src/sinks/util/**"
-- "tests/integration/humio/**"
+  - "src/sinks/humio/**"
+  - "src/sinks/util/**"
+  - "tests/integration/humio/**"
diff --git a/tests/integration/influxdb/config/compose.yaml b/tests/integration/influxdb/config/compose.yaml
index b5c31c006ab06..09049db7c6a31 100644
--- a/tests/integration/influxdb/config/compose.yaml
+++ b/tests/integration/influxdb/config/compose.yaml
@@ -1,24 +1,24 @@
-version: '3'
+version: "3"
 
 services:
   influxdb-v1:
     image: docker.io/influxdb:${CONFIG_VERSION}
     environment:
-    - INFLUXDB_REPORTING_DISABLED=true
+      - INFLUXDB_REPORTING_DISABLED=true
   influxdb-v1-tls:
     image: docker.io/influxdb:${CONFIG_VERSION}
     environment:
-    - INFLUXDB_REPORTING_DISABLED=true
-    - INFLUXDB_HTTP_HTTPS_ENABLED=true
-    - INFLUXDB_HTTP_HTTPS_CERTIFICATE=/etc/ssl/intermediate_server/certs/influxdb-v1-tls-chain.cert.pem
-    - INFLUXDB_HTTP_HTTPS_PRIVATE_KEY=/etc/ssl/intermediate_server/private/influxdb-v1-tls.key.pem
+      - INFLUXDB_REPORTING_DISABLED=true
+      - INFLUXDB_HTTP_HTTPS_ENABLED=true
+      - INFLUXDB_HTTP_HTTPS_CERTIFICATE=/etc/ssl/intermediate_server/certs/influxdb-v1-tls-chain.cert.pem
+      - INFLUXDB_HTTP_HTTPS_PRIVATE_KEY=/etc/ssl/intermediate_server/private/influxdb-v1-tls.key.pem
     volumes:
-    - ../../../data/ca:/etc/ssl:ro
+      - ../../../data/ca:/etc/ssl:ro
   influxdb-v2:
     image: docker.io/influxdb:2.0
     command: influxd --reporting-disabled
     environment:
-    - INFLUXDB_REPORTING_DISABLED=true
+      - INFLUXDB_REPORTING_DISABLED=true
 
 networks:
   default:
diff --git a/tests/integration/influxdb/config/test.yaml b/tests/integration/influxdb/config/test.yaml
index 35bf2f72691bf..d6965c383f24e 100644
--- a/tests/integration/influxdb/config/test.yaml
+++ b/tests/integration/influxdb/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- influxdb-integration-tests
+  - influxdb-integration-tests
 
-test_filter: '::influxdb::'
+test_filter: "::influxdb::"
 
 env:
   INFLUXDB_V1_HTTPS_ADDRESS: https://influxdb-v1-tls:8086
@@ -9,12 +9,12 @@ env:
   INFLUXDB_V2_ADDRESS: http://influxdb-v2:8086
 
 matrix:
-  version: ['1.8']
+  version: ["1.8"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/influxdb.rs"
-- "src/sinks/influxdb/**"
-- "src/sinks/util/**"
-- "tests/integration/influxdb/**"
+  - "src/internal_events/influxdb.rs"
+  - "src/sinks/influxdb/**"
+  - "src/sinks/util/**"
+  - "tests/integration/influxdb/**"
diff --git a/tests/integration/kafka/config/compose.yaml b/tests/integration/kafka/config/compose.yaml
index 81a35dd64ec94..66c16b7fc5f3a 100644
--- a/tests/integration/kafka/config/compose.yaml
+++ b/tests/integration/kafka/config/compose.yaml
@@ -1,39 +1,39 @@
-version: '3'
+version: "3"
 
 services:
   zookeeper:
     image: docker.io/confluentinc/cp-zookeeper:${CONFIG_VERSION}
     ports:
-    - 2181:2181
+      - 2181:2181
     environment:
-    - ZOOKEEPER_CLIENT_PORT=2181
+      - ZOOKEEPER_CLIENT_PORT=2181
   kafka:
     image: docker.io/confluentinc/cp-kafka:7.6.1
     depends_on:
-    - zookeeper
+      - zookeeper
     environment:
-    - KAFKA_BROKER_ID=1
-    - KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181
-    - ZOOKEEPER_SASL_ENABLED=false
-    - KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR=1
-    - KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS=0
-    - KAFKA_LISTENERS=PLAINTEXT://:9091,SSL://:9092,SASL_PLAINTEXT://:9093
-    - KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://kafka:9091,SSL://kafka:9092,SASL_PLAINTEXT://kafka:9093
-    - KAFKA_SSL_KEYSTORE_TYPE=PKCS12
-    - KAFKA_SSL_KEY_CREDENTIALS=kafka.pass
-    - KAFKA_SSL_KEYSTORE_CREDENTIALS=kafka.pass
-    - KAFKA_SSL_KEYSTORE_FILENAME=kafka.p12
-    - KAFKA_SSL_CLIENT_AUTH=none
-    - KAFKA_OPTS=-Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conf
-    - KAFKA_SASL_ENABLED_MECHANISMS=PLAIN
+      - KAFKA_BROKER_ID=1
+      - KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181
+      - ZOOKEEPER_SASL_ENABLED=false
+      - KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR=1
+      - KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS=0
+      - KAFKA_LISTENERS=PLAINTEXT://:9091,SSL://:9092,SASL_PLAINTEXT://:9093
+      - KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://kafka:9091,SSL://kafka:9092,SASL_PLAINTEXT://kafka:9093
+      - KAFKA_SSL_KEYSTORE_TYPE=PKCS12
+      - KAFKA_SSL_KEY_CREDENTIALS=kafka.pass
+      - KAFKA_SSL_KEYSTORE_CREDENTIALS=kafka.pass
+      - KAFKA_SSL_KEYSTORE_FILENAME=kafka.p12
+      - KAFKA_SSL_CLIENT_AUTH=none
+      - KAFKA_OPTS=-Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conf
+      - KAFKA_SASL_ENABLED_MECHANISMS=PLAIN
     ports:
-    - 9091:9091
-    - 9092:9092
-    - 9093:9093
+      - 9091:9091
+      - 9092:9092
+      - 9093:9093
     volumes:
-    - ../../../data/ca/intermediate_server/private/kafka.pass:/etc/kafka/secrets/kafka.pass:ro
-    - ../../../data/ca/intermediate_server/private/kafka.p12:/etc/kafka/secrets/kafka.p12:ro
-    - ../../shared/data/kafka_server_jaas.conf:/etc/kafka/kafka_server_jaas.conf
+      - ../../../data/ca/intermediate_server/private/kafka.pass:/etc/kafka/secrets/kafka.pass:ro
+      - ../../../data/ca/intermediate_server/private/kafka.p12:/etc/kafka/secrets/kafka.p12:ro
+      - ../../shared/data/kafka_server_jaas.conf:/etc/kafka/kafka_server_jaas.conf
 
 networks:
   default:
diff --git a/tests/integration/kafka/config/test.yaml b/tests/integration/kafka/config/test.yaml
index 9619b4d7ea0f1..7f91f693b25dd 100644
--- a/tests/integration/kafka/config/test.yaml
+++ b/tests/integration/kafka/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- kafka-integration-tests
+  - kafka-integration-tests
 
-test_filter: '::kafka::'
+test_filter: "::kafka::"
 
 env:
   KAFKA_HOST: kafka
@@ -12,10 +12,10 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/kafka.rs"
-- "src/sinks/kafka/**"
-- "src/sinks/util/**"
-- "src/sources/kafka.rs"
-- "src/sources/util/**"
-- "src/kafka.rs"
-- "tests/integration/kafka/**"
+  - "src/internal_events/kafka.rs"
+  - "src/sinks/kafka/**"
+  - "src/sinks/util/**"
+  - "src/sources/kafka.rs"
+  - "src/sources/util/**"
+  - "src/kafka.rs"
+  - "tests/integration/kafka/**"
diff --git a/tests/integration/logstash/config/compose.yaml b/tests/integration/logstash/config/compose.yaml
index af024d0855453..212ce4e1155be 100644
--- a/tests/integration/logstash/config/compose.yaml
+++ b/tests/integration/logstash/config/compose.yaml
@@ -1,17 +1,17 @@
-version: '3'
+version: "3"
 
 services:
   beats-heartbeat:
     image: docker.elastic.co/beats/heartbeat:${CONFIG_VERSION}
     command: -environment=container -strict.perms=false
     volumes:
-    - ../data/heartbeat.yml:/usr/share/heartbeat/heartbeat.yml:ro
+      - ../data/heartbeat.yml:/usr/share/heartbeat/heartbeat.yml:ro
   logstash:
     image: docker.elastic.co/logstash/logstash:7.13.1
     volumes:
-    - /dev/null:/usr/share/logstash/pipeline/logstash.yml
-    - ../../shared/data/host.docker.internal.crt:/tmp/logstash.crt
-    - ../data/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
+      - /dev/null:/usr/share/logstash/pipeline/logstash.yml
+      - ../../shared/data/host.docker.internal.crt:/tmp/logstash.crt
+      - ../data/logstash.conf:/usr/share/logstash/pipeline/logstash.conf
 
 networks:
   default:
diff --git a/tests/integration/logstash/config/test.yaml b/tests/integration/logstash/config/test.yaml
index e0f26afbec7f7..490293912fbae 100644
--- a/tests/integration/logstash/config/test.yaml
+++ b/tests/integration/logstash/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- logstash-integration-tests
+  - logstash-integration-tests
 
-test_filter: '::logstash::integration_tests::'
+test_filter: "::logstash::integration_tests::"
 
 env:
   HEARTBEAT_ADDRESS: 0.0.0.0:8080
@@ -13,6 +13,6 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sources/logstash.rs"
-- "src/sources/util/**"
-- "tests/integration/logstash/**"
+  - "src/sources/logstash.rs"
+  - "src/sources/util/**"
+  - "tests/integration/logstash/**"
diff --git a/tests/integration/logstash/data/heartbeat.yml b/tests/integration/logstash/data/heartbeat.yml
index ee2a9c1bca24d..154f8cb971737 100644
--- a/tests/integration/logstash/data/heartbeat.yml
+++ b/tests/integration/logstash/data/heartbeat.yml
@@ -1,8 +1,8 @@
 heartbeat.monitors:
-- type: http
-  schedule: '@every 1s'
-  urls:
-    - https://google.com
+  - type: http
+    schedule: "@every 1s"
+    urls:
+      - https://google.com
 
 output.logstash:
-  hosts: ['runner:8080']
+  hosts: ["runner:8080"]
diff --git a/tests/integration/loki/config/compose.yaml b/tests/integration/loki/config/compose.yaml
index 4350e809f8961..187c1c274bf71 100644
--- a/tests/integration/loki/config/compose.yaml
+++ b/tests/integration/loki/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3'
+version: "3"
 
 services:
   loki:
diff --git a/tests/integration/loki/config/test.yaml b/tests/integration/loki/config/test.yaml
index 9a86d9ce6c29d..3d3c0a9c9902f 100644
--- a/tests/integration/loki/config/test.yaml
+++ b/tests/integration/loki/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- loki-integration-tests
+  - loki-integration-tests
 
-test_filter: '::loki::'
+test_filter: "::loki::"
 
 env:
   LOKI_ADDRESS: http://loki:3100
@@ -12,7 +12,7 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/loki.rs"
-- "src/sinks/loki/**"
-- "src/sinks/util/**"
-- "tests/integration/loki/**"
+  - "src/internal_events/loki.rs"
+  - "src/sinks/loki/**"
+  - "src/sinks/util/**"
+  - "tests/integration/loki/**"
diff --git a/tests/integration/mongodb/config/compose.yaml b/tests/integration/mongodb/config/compose.yaml
index f7cd8b6517471..f06682b462763 100644
--- a/tests/integration/mongodb/config/compose.yaml
+++ b/tests/integration/mongodb/config/compose.yaml
@@ -1,35 +1,35 @@
-version: '3'
+version: "3"
 
 services:
   mongodb-primary:
     image: docker.io/bitnamilegacy/mongodb:${CONFIG_VERSION}
     environment:
-    - MONGODB_ADVERTISED_HOSTNAME=mongodb-primary
-    - MONGODB_REPLICA_SET_MODE=primary
-    - MONGODB_ROOT_PASSWORD=toor
-    - MONGODB_REPLICA_SET_KEY=vector
+      - MONGODB_ADVERTISED_HOSTNAME=mongodb-primary
+      - MONGODB_REPLICA_SET_MODE=primary
+      - MONGODB_ROOT_PASSWORD=toor
+      - MONGODB_REPLICA_SET_KEY=vector
   mongodb-secondary:
     image: docker.io/bitnamilegacy/mongodb:${CONFIG_VERSION}
     depends_on:
-    - mongodb-primary
+      - mongodb-primary
     environment:
-    - MONGODB_ADVERTISED_HOSTNAME=mongodb-secondary
-    - MONGODB_REPLICA_SET_MODE=secondary
-    - MONGODB_INITIAL_PRIMARY_HOST=mongodb-primary
-    - MONGODB_INITIAL_PRIMARY_PORT_NUMBER=27017
-    - MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD=toor
-    - MONGODB_REPLICA_SET_KEY=vector
+      - MONGODB_ADVERTISED_HOSTNAME=mongodb-secondary
+      - MONGODB_REPLICA_SET_MODE=secondary
+      - MONGODB_INITIAL_PRIMARY_HOST=mongodb-primary
+      - MONGODB_INITIAL_PRIMARY_PORT_NUMBER=27017
+      - MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD=toor
+      - MONGODB_REPLICA_SET_KEY=vector
   mongodb-arbiter:
     image: docker.io/bitnamilegacy/mongodb:${CONFIG_VERSION}
     depends_on:
-    - mongodb-primary
+      - mongodb-primary
     environment:
-    - MONGODB_ADVERTISED_HOSTNAME=mongodb-arbiter
-    - MONGODB_REPLICA_SET_MODE=arbiter
-    - MONGODB_INITIAL_PRIMARY_HOST=mongodb-primary
-    - MONGODB_INITIAL_PRIMARY_PORT_NUMBER=27017
-    - MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD=toor
-    - MONGODB_REPLICA_SET_KEY=vector
+      - MONGODB_ADVERTISED_HOSTNAME=mongodb-arbiter
+      - MONGODB_REPLICA_SET_MODE=arbiter
+      - MONGODB_INITIAL_PRIMARY_HOST=mongodb-primary
+      - MONGODB_INITIAL_PRIMARY_PORT_NUMBER=27017
+      - MONGODB_INITIAL_PRIMARY_ROOT_PASSWORD=toor
+      - MONGODB_REPLICA_SET_KEY=vector
 
 networks:
   default:
diff --git a/tests/integration/mongodb/config/test.yaml b/tests/integration/mongodb/config/test.yaml
index 10da02aca38dc..3668030a20fb5 100644
--- a/tests/integration/mongodb/config/test.yaml
+++ b/tests/integration/mongodb/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- mongodb_metrics-integration-tests
+  - mongodb_metrics-integration-tests
 
-test_filter: '::mongodb_metrics::'
+test_filter: "::mongodb_metrics::"
 
 env:
   PRIMARY_MONGODB_ADDRESS: mongodb://root:toor@mongodb-primary
@@ -13,7 +13,7 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/mongodb_metrics.rs"
-- "src/sources/mongodb_metrics/**"
-- "src/sources/util/**"
-- "tests/integration/mongodb/**"
+  - "src/internal_events/mongodb_metrics.rs"
+  - "src/sources/mongodb_metrics/**"
+  - "src/sources/util/**"
+  - "tests/integration/mongodb/**"
diff --git a/tests/integration/mqtt/config/compose.yaml b/tests/integration/mqtt/config/compose.yaml
index cc238cadf050c..9ce016da98cb1 100644
--- a/tests/integration/mqtt/config/compose.yaml
+++ b/tests/integration/mqtt/config/compose.yaml
@@ -1,10 +1,10 @@
-version: '3'
+version: "3"
 
 services:
   emqx:
     image: docker.io/emqx:${CONFIG_VERSION}
     ports:
-    - 1883:1883
+      - 1883:1883
 
 networks:
   default:
diff --git a/tests/integration/mqtt/config/test.yaml b/tests/integration/mqtt/config/test.yaml
index ec0c637e094d1..1119ca931faf4 100644
--- a/tests/integration/mqtt/config/test.yaml
+++ b/tests/integration/mqtt/config/test.yaml
@@ -1,13 +1,13 @@
 features:
-- mqtt-integration-tests
+  - mqtt-integration-tests
 
-test_filter: '::mqtt::'
+test_filter: "::mqtt::"
 
 matrix:
-  version: ['5.0.15']
+  version: ["5.0.15"]
 
 paths:
-- "src/internal_events/mqtt.rs"
-- "src/sinks/mqtt/**"
-- "src/sinks/util/**"
-- "src/sources/mqtt/**"
+  - "src/internal_events/mqtt.rs"
+  - "src/sinks/mqtt/**"
+  - "src/sinks/util/**"
+  - "src/sources/mqtt/**"
diff --git a/tests/integration/nats/config/compose.yaml b/tests/integration/nats/config/compose.yaml
index f77020b57afee..a556ffd61f351 100644
--- a/tests/integration/nats/config/compose.yaml
+++ b/tests/integration/nats/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3'
+version: "3"
 
 services:
   nats:
@@ -6,50 +6,50 @@ services:
   nats-userpass:
     image: docker.io/library/nats:${CONFIG_VERSION}
     command:
-    - --user
-    - natsuser
-    - --pass
-    - natspass
+      - --user
+      - natsuser
+      - --pass
+      - natspass
   nats-token:
     image: docker.io/library/nats:${CONFIG_VERSION}
     command:
-    - --auth
-    - secret
+      - --auth
+      - secret
   nats-nkey:
     image: docker.io/library/nats:${CONFIG_VERSION}
     command:
-    - --config
-    - /usr/share/nats/config/nats-nkey.conf
+      - --config
+      - /usr/share/nats/config/nats-nkey.conf
     volumes:
-    - ../data:/usr/share/nats/config
+      - ../data:/usr/share/nats/config
   nats-tls:
     image: docker.io/library/nats:${CONFIG_VERSION}
     command:
-    - --config
-    - /usr/share/nats/config/nats-tls.conf
+      - --config
+      - /usr/share/nats/config/nats-tls.conf
     volumes:
-    - ../data:/usr/share/nats/config
+      - ../data:/usr/share/nats/config
   nats-tls-client-cert:
     image: docker.io/library/nats:${CONFIG_VERSION}
     command:
-    - --config
-    - /usr/share/nats/config/nats-tls-client-cert.conf
+      - --config
+      - /usr/share/nats/config/nats-tls-client-cert.conf
     volumes:
-    - ../data:/usr/share/nats/config
+      - ../data:/usr/share/nats/config
   nats-jwt:
     image: docker.io/library/nats:${CONFIG_VERSION}
     command:
-    - --config
-    - /usr/share/nats/config/nats-jwt.conf
+      - --config
+      - /usr/share/nats/config/nats-jwt.conf
     volumes:
-    - ../data:/usr/share/nats/config
+      - ../data:/usr/share/nats/config
   nats-jetstream-test:
     image: docker.io/library/nats:${CONFIG_VERSION}
     command:
-    - --config
-    - /usr/share/nats/config/nats-jetstream.conf
+      - --config
+      - /usr/share/nats/config/nats-jetstream.conf
     volumes:
-    - ../data:/usr/share/nats/config
+      - ../data:/usr/share/nats/config
 
 networks:
   default:
diff --git a/tests/integration/nginx/config/compose.yaml b/tests/integration/nginx/config/compose.yaml
index 3caf63a002f11..4b0f50d0d92ea 100644
--- a/tests/integration/nginx/config/compose.yaml
+++ b/tests/integration/nginx/config/compose.yaml
@@ -1,25 +1,25 @@
-version: '3'
+version: "3"
 
 services:
   squid:
     image: docker.io/ubuntu/squid:latest
     depends_on:
-    - nginx-proxy
+      - nginx-proxy
     networks:
-    - default
-    - proxy
+      - default
+      - proxy
   nginx:
     image: docker.io/nginx:${CONFIG_VERSION}
     volumes:
-    - ../data/:/etc/nginx:ro
+      - ../data/:/etc/nginx:ro
     networks:
-    - default
+      - default
   nginx-proxy:
     image: docker.io/nginx:${CONFIG_VERSION}
     volumes:
-    - ../data/:/etc/nginx:ro
+      - ../data/:/etc/nginx:ro
     networks:
-    - proxy
+      - proxy
 
 networks:
   default:
diff --git a/tests/integration/nginx/config/test.yaml b/tests/integration/nginx/config/test.yaml
index 8d9014b657787..e23372f596139 100644
--- a/tests/integration/nginx/config/test.yaml
+++ b/tests/integration/nginx/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- nginx-integration-tests
+  - nginx-integration-tests
 
-test_filter: '::nginx_metrics::'
+test_filter: "::nginx_metrics::"
 
 runner:
   env:
@@ -15,7 +15,7 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/nginx_metrics.rs"
-- "src/sources/nginx_metrics/**"
-- "src/sources/util/**"
-- "tests/integration/nginx/**"
+  - "src/internal_events/nginx_metrics.rs"
+  - "src/sources/nginx_metrics/**"
+  - "src/sources/util/**"
+  - "tests/integration/nginx/**"
diff --git a/tests/integration/opentelemetry/config/compose.yaml b/tests/integration/opentelemetry/config/compose.yaml
index d8f0c95d20fbc..f65495b9bc2ae 100644
--- a/tests/integration/opentelemetry/config/compose.yaml
+++ b/tests/integration/opentelemetry/config/compose.yaml
@@ -1,10 +1,10 @@
-version: '3'
+version: "3"
 
 services:
   opentelemetry-collector:
     image: docker.io/otel/opentelemetry-collector-contrib:${CONFIG_VERSION}
     volumes:
-    - ../data/config.yaml:/etc/otelcol-contrib/config.yaml
+      - ../data/config.yaml:/etc/otelcol-contrib/config.yaml
 
 networks:
   default:
diff --git a/tests/integration/opentelemetry/config/test.yaml b/tests/integration/opentelemetry/config/test.yaml
index 91a2968fdfae0..0a3af636f56b5 100644
--- a/tests/integration/opentelemetry/config/test.yaml
+++ b/tests/integration/opentelemetry/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- opentelemetry-integration-tests
+  - opentelemetry-integration-tests
 
-test_filter: '::opentelemetry::'
+test_filter: "::opentelemetry::"
 
 runner:
   env:
@@ -14,6 +14,6 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sources/opentelemetry/**"
-- "src/sources/util/**"
-- "tests/integration/opentelemetry/**"
+  - "src/sources/opentelemetry/**"
+  - "src/sources/util/**"
+  - "tests/integration/opentelemetry/**"
diff --git a/tests/integration/opentelemetry/data/config.yaml b/tests/integration/opentelemetry/data/config.yaml
index 66c8fe34e6112..ee0fe7fa36126 100644
--- a/tests/integration/opentelemetry/data/config.yaml
+++ b/tests/integration/opentelemetry/data/config.yaml
@@ -25,10 +25,10 @@ service:
   pipelines:
     logs:
       receivers: [otlp]
-      exporters: [otlp,otlphttp]
+      exporters: [otlp, otlphttp]
     traces:
       receivers: [otlp]
-      exporters: [otlp,otlphttp]
+      exporters: [otlp, otlphttp]
     metrics:
       receivers: [otlp]
-      exporters: [otlp,otlphttp]
+      exporters: [otlp, otlphttp]
diff --git a/tests/integration/postgres/config/compose.yaml b/tests/integration/postgres/config/compose.yaml
index 017e497c81811..40970c5f3da28 100644
--- a/tests/integration/postgres/config/compose.yaml
+++ b/tests/integration/postgres/config/compose.yaml
@@ -1,16 +1,16 @@
-version: '3'
+version: "3"
 
 services:
   postgres:
     image: docker.io/postgres:${CONFIG_VERSION}
     command: /postgres-init.sh
     environment:
-    - POSTGRES_USER=vector
-    - POSTGRES_PASSWORD=vector
+      - POSTGRES_USER=vector
+      - POSTGRES_PASSWORD=vector
     volumes:
-    - socket:/var/run/postgresql
-    - ../data/postgres-init.sh:/postgres-init.sh:ro
-    - ../../../data/ca:/certs:ro
+      - socket:/var/run/postgresql
+      - ../data/postgres-init.sh:/postgres-init.sh:ro
+      - ../../../data/ca:/certs:ro
 
 volumes:
   # Use external volume 'postgres_socket' that's shared with the test runner
diff --git a/tests/integration/postgres/config/test.yaml b/tests/integration/postgres/config/test.yaml
index 85c012a11fa5f..905d4f53ccda5 100644
--- a/tests/integration/postgres/config/test.yaml
+++ b/tests/integration/postgres/config/test.yaml
@@ -1,6 +1,6 @@
 features:
-- postgresql_metrics-integration-tests
-- postgres_sink-integration-tests
+  - postgresql_metrics-integration-tests
+  - postgres_sink-integration-tests
 
 test_filter: ::postgres
 
@@ -13,13 +13,13 @@ runner:
     postgres_socket: /pg_socket
 
 matrix:
-  version: ['13.1']
+  version: ["13.1"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/postgresql_metrics.rs"
-- "src/sinks/postgres/**"
-- "src/sources/postgresql_metrics.rs"
-- "src/sources/util/**"
-- "tests/integration/postgres/**"
+  - "src/internal_events/postgresql_metrics.rs"
+  - "src/sinks/postgres/**"
+  - "src/sources/postgresql_metrics.rs"
+  - "src/sources/util/**"
+  - "tests/integration/postgres/**"
diff --git a/tests/integration/prometheus/config/compose.yaml b/tests/integration/prometheus/config/compose.yaml
index a945f730ce834..3ff987c6d5189 100644
--- a/tests/integration/prometheus/config/compose.yaml
+++ b/tests/integration/prometheus/config/compose.yaml
@@ -1,26 +1,26 @@
-version: '3'
+version: "3"
 
 services:
   influxdb-v1:
     image: docker.io/influxdb:${CONFIG_INFLUXDB}
     environment:
-    - INFLUXDB_REPORTING_DISABLED=true
+      - INFLUXDB_REPORTING_DISABLED=true
   influxdb-v1-tls:
     image: docker.io/influxdb:${CONFIG_INFLUXDB}
     environment:
-    - INFLUXDB_REPORTING_DISABLED=true
-    - INFLUXDB_HTTP_HTTPS_ENABLED=true
-    - INFLUXDB_HTTP_BIND_ADDRESS=:8087
-    - INFLUXDB_BIND_ADDRESS=:8089
-    - INFLUXDB_HTTP_HTTPS_CERTIFICATE=/etc/ssl/intermediate_server/certs/influxdb-v1-tls-chain.cert.pem
-    - INFLUXDB_HTTP_HTTPS_PRIVATE_KEY=/etc/ssl/intermediate_server/private/influxdb-v1-tls.key.pem
+      - INFLUXDB_REPORTING_DISABLED=true
+      - INFLUXDB_HTTP_HTTPS_ENABLED=true
+      - INFLUXDB_HTTP_BIND_ADDRESS=:8087
+      - INFLUXDB_BIND_ADDRESS=:8089
+      - INFLUXDB_HTTP_HTTPS_CERTIFICATE=/etc/ssl/intermediate_server/certs/influxdb-v1-tls-chain.cert.pem
+      - INFLUXDB_HTTP_HTTPS_PRIVATE_KEY=/etc/ssl/intermediate_server/private/influxdb-v1-tls.key.pem
     volumes:
-    - ../../../data/ca:/etc/ssl:ro
+      - ../../../data/ca:/etc/ssl:ro
   prometheus:
     image: docker.io/prom/prometheus:${CONFIG_PROMETHEUS}
     command: --config.file=/etc/vector/prometheus.yaml
     volumes:
-    - ../data/prometheus.yaml:/etc/vector/prometheus.yaml:ro
+      - ../data/prometheus.yaml:/etc/vector/prometheus.yaml:ro
 
 networks:
   default:
diff --git a/tests/integration/prometheus/config/test.yaml b/tests/integration/prometheus/config/test.yaml
index 455338053e2ff..ac79ea17c3d8e 100644
--- a/tests/integration/prometheus/config/test.yaml
+++ b/tests/integration/prometheus/config/test.yaml
@@ -1,21 +1,21 @@
-test_filter: '::prometheus::remote_write::'
+test_filter: "::prometheus::remote_write::"
 
 features:
-- prometheus-integration-tests
+  - prometheus-integration-tests
 
 env:
   REMOTE_WRITE_SOURCE_RECEIVE_ADDRESS: runner:9102
 
 matrix:
-  prometheus: ['v2.33.4']
-  influxdb: ['1.8']
+  prometheus: ["v2.33.4"]
+  influxdb: ["1.8"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/prometheus.rs"
-- "src/sources/prometheus/**"
-- "src/sources/util/**"
-- "src/sinks/prometheus/**"
-- "src/sinks/util/**"
-- "tests/integration/prometheus/**"
+  - "src/internal_events/prometheus.rs"
+  - "src/sources/prometheus/**"
+  - "src/sources/util/**"
+  - "src/sinks/prometheus/**"
+  - "src/sinks/util/**"
+  - "tests/integration/prometheus/**"
diff --git a/tests/integration/prometheus/data/prometheus.yaml b/tests/integration/prometheus/data/prometheus.yaml
index 5e9a6ac09a312..79ce0d180acaa 100644
--- a/tests/integration/prometheus/data/prometheus.yaml
+++ b/tests/integration/prometheus/data/prometheus.yaml
@@ -3,12 +3,12 @@ global:
 
 scrape_configs:
   # sinks::prometheus::exporter::integration_tests
-  - job_name: 'integration-test-1'
+  - job_name: "integration-test-1"
     static_configs:
-    - targets: ['127.0.0.1:9101']
+      - targets: ["127.0.0.1:9101"]
 
 remote_write:
   # sources::prometheus::remote_write::integration_tests
-  - url: 'http://runner:9102'
+  - url: "http://runner:9102"
     remote_timeout: 1s
-    name: 'integration-test-2'
+    name: "integration-test-2"
diff --git a/tests/integration/pulsar/config/compose.yaml b/tests/integration/pulsar/config/compose.yaml
index cca9c9de8d713..5d6c4e86249f9 100644
--- a/tests/integration/pulsar/config/compose.yaml
+++ b/tests/integration/pulsar/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3'
+version: "3"
 
 services:
   pulsar:
diff --git a/tests/integration/pulsar/config/test.yaml b/tests/integration/pulsar/config/test.yaml
index a273fb4e9f163..51dbb1100c9da 100644
--- a/tests/integration/pulsar/config/test.yaml
+++ b/tests/integration/pulsar/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- pulsar-integration-tests
+  - pulsar-integration-tests
 
-test_filter: '::pulsar::integration_tests::'
+test_filter: "::pulsar::integration_tests::"
 
 env:
   PULSAR_HOST: pulsar
@@ -14,7 +14,7 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/pulsar.rs"
-- "src/sinks/pulsar/**"
-- "src/sinks/util/**"
-- "tests/integration/pulsar/**"
+  - "src/internal_events/pulsar.rs"
+  - "src/sinks/pulsar/**"
+  - "src/sinks/util/**"
+  - "tests/integration/pulsar/**"
diff --git a/tests/integration/redis/config/compose.yaml b/tests/integration/redis/config/compose.yaml
index 4f0a909a6e455..845c99eff0a62 100644
--- a/tests/integration/redis/config/compose.yaml
+++ b/tests/integration/redis/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3'
+version: "3"
 
 services:
   redis-primary:
diff --git a/tests/integration/redis/config/test.yaml b/tests/integration/redis/config/test.yaml
index fdfc54e0446ec..6129d66a052fb 100644
--- a/tests/integration/redis/config/test.yaml
+++ b/tests/integration/redis/config/test.yaml
@@ -1,5 +1,5 @@
 features:
-- redis-integration-tests
+  - redis-integration-tests
 
 test_filter: "::redis::"
 
@@ -13,9 +13,9 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/redis.rs"
-- "src/sources/redis/**"
-- "src/sources/util/**"
-- "src/sinks/redis.rs"
-- "src/sinks/util/**"
-- "tests/integration/redis/**"
+  - "src/internal_events/redis.rs"
+  - "src/sources/redis/**"
+  - "src/sources/util/**"
+  - "src/sinks/redis.rs"
+  - "src/sinks/util/**"
+  - "tests/integration/redis/**"
diff --git a/tests/integration/shutdown/config/compose.yaml b/tests/integration/shutdown/config/compose.yaml
index 81a35dd64ec94..66c16b7fc5f3a 100644
--- a/tests/integration/shutdown/config/compose.yaml
+++ b/tests/integration/shutdown/config/compose.yaml
@@ -1,39 +1,39 @@
-version: '3'
+version: "3"
 
 services:
   zookeeper:
     image: docker.io/confluentinc/cp-zookeeper:${CONFIG_VERSION}
     ports:
-    - 2181:2181
+      - 2181:2181
     environment:
-    - ZOOKEEPER_CLIENT_PORT=2181
+      - ZOOKEEPER_CLIENT_PORT=2181
   kafka:
     image: docker.io/confluentinc/cp-kafka:7.6.1
     depends_on:
-    - zookeeper
+      - zookeeper
     environment:
-    - KAFKA_BROKER_ID=1
-    - KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181
-    - ZOOKEEPER_SASL_ENABLED=false
-    - KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR=1
-    - KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS=0
-    - KAFKA_LISTENERS=PLAINTEXT://:9091,SSL://:9092,SASL_PLAINTEXT://:9093
-    - KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://kafka:9091,SSL://kafka:9092,SASL_PLAINTEXT://kafka:9093
-    - KAFKA_SSL_KEYSTORE_TYPE=PKCS12
-    - KAFKA_SSL_KEY_CREDENTIALS=kafka.pass
-    - KAFKA_SSL_KEYSTORE_CREDENTIALS=kafka.pass
-    - KAFKA_SSL_KEYSTORE_FILENAME=kafka.p12
-    - KAFKA_SSL_CLIENT_AUTH=none
-    - KAFKA_OPTS=-Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conf
-    - KAFKA_SASL_ENABLED_MECHANISMS=PLAIN
+      - KAFKA_BROKER_ID=1
+      - KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181
+      - ZOOKEEPER_SASL_ENABLED=false
+      - KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR=1
+      - KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS=0
+      - KAFKA_LISTENERS=PLAINTEXT://:9091,SSL://:9092,SASL_PLAINTEXT://:9093
+      - KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://kafka:9091,SSL://kafka:9092,SASL_PLAINTEXT://kafka:9093
+      - KAFKA_SSL_KEYSTORE_TYPE=PKCS12
+      - KAFKA_SSL_KEY_CREDENTIALS=kafka.pass
+      - KAFKA_SSL_KEYSTORE_CREDENTIALS=kafka.pass
+      - KAFKA_SSL_KEYSTORE_FILENAME=kafka.p12
+      - KAFKA_SSL_CLIENT_AUTH=none
+      - KAFKA_OPTS=-Djava.security.auth.login.config=/etc/kafka/kafka_server_jaas.conf
+      - KAFKA_SASL_ENABLED_MECHANISMS=PLAIN
     ports:
-    - 9091:9091
-    - 9092:9092
-    - 9093:9093
+      - 9091:9091
+      - 9092:9092
+      - 9093:9093
     volumes:
-    - ../../../data/ca/intermediate_server/private/kafka.pass:/etc/kafka/secrets/kafka.pass:ro
-    - ../../../data/ca/intermediate_server/private/kafka.p12:/etc/kafka/secrets/kafka.p12:ro
-    - ../../shared/data/kafka_server_jaas.conf:/etc/kafka/kafka_server_jaas.conf
+      - ../../../data/ca/intermediate_server/private/kafka.pass:/etc/kafka/secrets/kafka.pass:ro
+      - ../../../data/ca/intermediate_server/private/kafka.p12:/etc/kafka/secrets/kafka.p12:ro
+      - ../../shared/data/kafka_server_jaas.conf:/etc/kafka/kafka_server_jaas.conf
 
 networks:
   default:
diff --git a/tests/integration/shutdown/config/test.yaml b/tests/integration/shutdown/config/test.yaml
index c32f2e010940a..0086db0d6f175 100644
--- a/tests/integration/shutdown/config/test.yaml
+++ b/tests/integration/shutdown/config/test.yaml
@@ -1,9 +1,9 @@
 args:
-- --test-threads
-- '4'
+  - --test-threads
+  - "4"
 
 features:
-- shutdown-tests
+  - shutdown-tests
 
 test: "integration"
 
diff --git a/tests/integration/splunk/config/compose.yaml b/tests/integration/splunk/config/compose.yaml
index a252674d2bffa..4cff3cab1ca0d 100644
--- a/tests/integration/splunk/config/compose.yaml
+++ b/tests/integration/splunk/config/compose.yaml
@@ -1,18 +1,18 @@
-version: '3'
+version: "3"
 
 services:
   splunk-hec:
     image: docker.io/splunk/splunk:${CONFIG_VERSION}
     environment:
-    - SPLUNK_START_ARGS=--accept-license
-    - SPLUNK_PASSWORD=password
-    - SPLUNK_HEC_TOKEN=abcd1234
+      - SPLUNK_START_ARGS=--accept-license
+      - SPLUNK_PASSWORD=password
+      - SPLUNK_HEC_TOKEN=abcd1234
     volumes:
-    - ../data/splunk/default.yml:/tmp/defaults/default.yml
+      - ../data/splunk/default.yml:/tmp/defaults/default.yml
     ports:
-    - 8000:8000
-    - 8088:8088
-    - 8089:8089
+      - 8000:8000
+      - 8088:8088
+      - 8089:8089
 
 networks:
   default:
diff --git a/tests/integration/splunk/config/test.yaml b/tests/integration/splunk/config/test.yaml
index 71a5c7994fe4a..2e745fab67352 100644
--- a/tests/integration/splunk/config/test.yaml
+++ b/tests/integration/splunk/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- splunk-integration-tests
+  - splunk-integration-tests
 
-test_filter: '::splunk_hec::'
+test_filter: "::splunk_hec::"
 
 env:
   SPLUNK_API_ADDRESS: https://splunk-hec:8089
@@ -13,9 +13,9 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/internal_events/splunk_hec.rs"
-- "src/sources/splunk_hec/**"
-- "src/sources/util/**"
-- "src/sinks/splunk_hec/**"
-- "src/sinks/util/**"
-- "tests/integration/splunk/**"
+  - "src/internal_events/splunk_hec.rs"
+  - "src/sources/splunk_hec/**"
+  - "src/sources/util/**"
+  - "src/sinks/splunk_hec/**"
+  - "src/sinks/util/**"
+  - "tests/integration/splunk/**"
diff --git a/tests/integration/webhdfs/config/compose.yaml b/tests/integration/webhdfs/config/compose.yaml
index f3b5a51519513..17fd3d9eb69b5 100644
--- a/tests/integration/webhdfs/config/compose.yaml
+++ b/tests/integration/webhdfs/config/compose.yaml
@@ -1,4 +1,4 @@
-version: '3'
+version: "3"
 
 services:
   namenode:
diff --git a/tests/integration/webhdfs/config/test.yaml b/tests/integration/webhdfs/config/test.yaml
index f1bd9f88b2ff9..029f12a587b76 100644
--- a/tests/integration/webhdfs/config/test.yaml
+++ b/tests/integration/webhdfs/config/test.yaml
@@ -1,17 +1,17 @@
-test_filter: '::webhdfs::'
+test_filter: "::webhdfs::"
 
 features:
-- webhdfs-integration-tests
+  - webhdfs-integration-tests
 
 env:
   WEBHDFS_ENDPOINT: http://namenode.local:9870
 
 matrix:
-  hadoop: ['2.0.0-hadoop3.2.1-java8']
+  hadoop: ["2.0.0-hadoop3.2.1-java8"]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sinks/webhdfs/**"
-- "src/sinks/util/**"
-- "tests/integration/webhdfs/**"
+  - "src/sinks/webhdfs/**"
+  - "src/sinks/util/**"
+  - "tests/integration/webhdfs/**"
diff --git a/tests/integration/windows-event-log/config/test.yaml b/tests/integration/windows-event-log/config/test.yaml
index ed0555b2e6695..6c3c619c54111 100644
--- a/tests/integration/windows-event-log/config/test.yaml
+++ b/tests/integration/windows-event-log/config/test.yaml
@@ -1,7 +1,7 @@
 features:
-- windows-event-log-integration-tests
+  - windows-event-log-integration-tests
 
-test_filter: '::windows_event_log::integration_tests::'
+test_filter: "::windows_event_log::integration_tests::"
 
 runner:
   env: {}
@@ -12,6 +12,6 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
-- "src/sources/windows_event_log/**"
-- "src/internal_events/windows_event_log.rs"
-- "tests/integration/windows-event-log/**"
+  - "src/sources/windows_event_log/**"
+  - "src/internal_events/windows_event_log.rs"
+  - "tests/integration/windows-event-log/**"
diff --git a/tests/namespacing/ignore-invalid/sinks/es_cluster.json b/tests/namespacing/ignore-invalid/sinks/es_cluster.json
index 6dd5e392cf253..c72ff984f709a 100644
--- a/tests/namespacing/ignore-invalid/sinks/es_cluster.json
+++ b/tests/namespacing/ignore-invalid/sinks/es_cluster.json
@@ -1,8 +1,6 @@
 {
-  "inputs": [
-    "apache_sample"
-  ],
+  "inputs": ["apache_sample"],
   "type": "elasticsearch",
   "endpoint": "http://79.12.221.222:9200",
-  "bulk": {"index": "vector-%Y-%m-%d"}
+  "bulk": { "index": "vector-%Y-%m-%d" }
 }
diff --git a/tests/namespacing/success/sinks/es_cluster.json b/tests/namespacing/success/sinks/es_cluster.json
index 6dd5e392cf253..c72ff984f709a 100644
--- a/tests/namespacing/success/sinks/es_cluster.json
+++ b/tests/namespacing/success/sinks/es_cluster.json
@@ -1,8 +1,6 @@
 {
-  "inputs": [
-    "apache_sample"
-  ],
+  "inputs": ["apache_sample"],
   "type": "elasticsearch",
   "endpoint": "http://79.12.221.222:9200",
-  "bulk": {"index": "vector-%Y-%m-%d"}
+  "bulk": { "index": "vector-%Y-%m-%d" }
 }
diff --git a/vdev/src/commands/check/fmt.rs b/vdev/src/commands/check/fmt.rs
index b01f6622218a2..1547d7b015808 100644
--- a/vdev/src/commands/check/fmt.rs
+++ b/vdev/src/commands/check/fmt.rs
@@ -1,6 +1,6 @@
 use anyhow::Result;
 
-use crate::app;
+use crate::{app, commands::fmt::PRETTIER_EXTENSIONS, utils::git::git_ls_files};
 
 /// Check that all files are formatted properly
 #[derive(clap::Args, Debug)]
@@ -13,6 +13,21 @@ impl Cli {
         app::exec("scripts/check-style.sh", ["--all"], true)?;
 
         info!("Checking Rust formatting...");
-        app::exec("cargo", ["fmt", "--", "--check"], true)
+        app::exec("cargo", ["fmt", "--", "--check"], true)?;
+
+        for ext in PRETTIER_EXTENSIONS {
+            let files = git_ls_files(Some(ext))?;
+            if files.is_empty() {
+                continue;
+            }
+            info!("Checking prettier formatting for {ext} files...");
+            let args: Vec<&str> = ["--ignore-path", ".prettierignore", "--check"]
+                .into_iter()
+                .chain(files.iter().map(String::as_str))
+                .collect();
+            app::exec("prettier", &args, true)?;
+        }
+
+        Ok(())
     }
 }
diff --git a/vdev/src/commands/fmt.rs b/vdev/src/commands/fmt.rs
index d53c6758ca09d..f1f7353b970d6 100644
--- a/vdev/src/commands/fmt.rs
+++ b/vdev/src/commands/fmt.rs
@@ -1,6 +1,9 @@
 use anyhow::Result;
 
-use crate::app;
+use crate::{app, utils::git::git_ls_files};
+
+pub(crate) const PRETTIER_EXTENSIONS: &[&str] =
+    &["*.yml", "*.yaml", "*.js", "*.ts", "*.tsx", "*.json"];
 
 /// Apply format changes across the repository
 #[derive(clap::Args, Debug)]
@@ -13,6 +16,21 @@ impl Cli {
         app::exec("scripts/check-style.sh", ["--fix"], true)?;
 
         info!("Formatting Rust code...");
-        app::exec("cargo", ["fmt", "--all"], true)
+        app::exec("cargo", ["fmt", "--all"], true)?;
+
+        for ext in PRETTIER_EXTENSIONS {
+            let files = git_ls_files(Some(ext))?;
+            if files.is_empty() {
+                continue;
+            }
+            info!("Formatting {ext} files with prettier...");
+            let args: Vec<&str> = ["--ignore-path", ".prettierignore", "--write"]
+                .into_iter()
+                .chain(files.iter().map(String::as_str))
+                .collect();
+            app::exec("prettier", &args, true)?;
+        }
+
+        Ok(())
     }
 }
diff --git a/website/.htmltest.external.yml b/website/.htmltest.external.yml
index 3508294079c6f..3df01b8f3309d 100644
--- a/website/.htmltest.external.yml
+++ b/website/.htmltest.external.yml
@@ -4,11 +4,11 @@ CheckExternal: true
 IgnoreAltMissing: true
 IgnoreEmptyHref: true
 IgnoreURLs:
-# We have to ignore this due to rate limiting
-- "github.com"
-- "packages.timber.io"
-- "localhost"
-# Somehow this link allows shows up as broken, so we'll exclude it
-- "https://www.microsoft.com/en-us/windows"
-# Somehow these links always come up as 5xx even though they work fine in the browser
-- "maxmind.com"
+  # We have to ignore this due to rate limiting
+  - "github.com"
+  - "packages.timber.io"
+  - "localhost"
+  # Somehow this link allows shows up as broken, so we'll exclude it
+  - "https://www.microsoft.com/en-us/windows"
+  # Somehow these links always come up as 5xx even though they work fine in the browser
+  - "maxmind.com"
diff --git a/website/.prettierrc.json b/website/.prettierrc.json
deleted file mode 100644
index 7b17711cfff7a..0000000000000
--- a/website/.prettierrc.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "plugins": ["prettier-plugin-go-template"],
-  "overrides": [
-    {
-      "files": ["*.html"],
-      "options": {
-        "parser": "go-template"
-      }
-    }
-  ],
-  "tabWidth": 2,
-  "useTabs": false,
-  "semi": false,
-  "singleQuote": true,
-  "trailingComma": "none",
-  "printWidth": 120
-}
diff --git a/website/algolia.json b/website/algolia.json
index d0c7622b530bf..1a88269b7d9e4 100644
--- a/website/algolia.json
+++ b/website/algolia.json
@@ -3,47 +3,24 @@
   "minWordSizefor2Typos": 8,
   "hitsPerPage": 10,
   "maxValuesPerFacet": 100,
-  "searchableAttributes": [
-    "title",
-    "content",
-    "unordered(hierarchy)",
-    "unordered(tags)"
-  ],
+  "searchableAttributes": ["title", "content", "unordered(hierarchy)", "unordered(tags)"],
   "numericAttributesToIndex": null,
   "attributesToRetrieve": null,
   "unretrievableAttributes": null,
   "optionalWords": null,
   "attributesForFaceting": null,
-  "attributesToSnippet": [
-    "title:10",
-    "content:10"
-  ],
+  "attributesToSnippet": ["title:10", "content:10"],
   "attributesToHighlight": null,
   "paginationLimitedTo": 1000,
   "attributeForDistinct": null,
   "exactOnSingleWordQuery": "attribute",
-  "ranking": [
-    "typo",
-    "geo",
-    "words",
-    "filters",
-    "proximity",
-    "attribute",
-    "exact",
-    "custom"
-  ],
-  "customRanking": [
-    "desc(level)",
-    "desc(ranking)"
-  ],
+  "ranking": ["typo", "geo", "words", "filters", "proximity", "attribute", "exact", "custom"],
+  "customRanking": ["desc(level)", "desc(ranking)"],
   "separatorsToIndex": "",
   "removeWordsIfNoResults": "none",
   "queryType": "prefixLast",
   "highlightPreTag": "<em>",
   "highlightPostTag": "</em>",
   "snippetEllipsisText": "…",
-  "alternativesAsExact": [
-    "ignorePlurals",
-    "singleWordSynonym"
-  ]
+  "alternativesAsExact": ["ignorePlurals", "singleWordSynonym"]
 }
diff --git a/website/assets/js/below.js b/website/assets/js/below.js
index f61004ef2a746..0123d5eb2c36c 100644
--- a/website/assets/js/below.js
+++ b/website/assets/js/below.js
@@ -1,16 +1,16 @@
-import tocbot from 'tocbot';
+import tocbot from "tocbot";
 
 // Table of contents for documentation pages
 const tableOfContents = () => {
-  if (document.getElementById('toc')) {
+  if (document.getElementById("toc")) {
     tocbot.init({
-      tocSelector: '#toc',
-      contentSelector: '#page-content',
-      headingSelector: 'h2,h3,h4,h5',
+      tocSelector: "#toc",
+      contentSelector: "#page-content",
+      headingSelector: "h2,h3,h4,h5",
       scrollSmoothDuration: 400
     });
   }
-}
+};
 
 const showCodeFilename = () => {
   var els = document.getElementsByClassName("highlight");
@@ -21,9 +21,9 @@ const showCodeFilename = () => {
       els[i].parentNode.insertBefore(newNode, els[i]);
     }
   }
-}
+};
 
-document.addEventListener('DOMContentLoaded', () => {
+document.addEventListener("DOMContentLoaded", () => {
   // search.start();
 
   tableOfContents();
diff --git a/website/assets/js/home.tsx b/website/assets/js/home.tsx
index fb92927ac4fe8..e6271eb538d16 100644
--- a/website/assets/js/home.tsx
+++ b/website/assets/js/home.tsx
@@ -28,15 +28,12 @@ interface IGlobeProps {
 
 const markers: GeoJSON.Point[] = markerData.map((m) => ({
   type: "Point",
-  coordinates: [m.coordinates[0], m.coordinates[1]],
+  coordinates: [m.coordinates[0], m.coordinates[1]]
 }));
 
 const topo: unknown = countryData;
 const topology = topo as Topology;
-const geojson = feature(
-  topology,
-  topology.objects.land
-) as GeoJSON.FeatureCollection;
+const geojson = feature(topology, topology.objects.land) as GeoJSON.FeatureCollection;
 const countries = geojson.features;
 
 export const Globe: React.FC<IGlobeProps> = animated(
@@ -66,30 +63,20 @@ export const Globe: React.FC<IGlobeProps> = animated(
     return (
       <div>
         <svg width={size} height={size} ref={svgRef} /* onClick={onClick} */>
-          <circle
-            cx={size / 2}
-            cy={size / 2}
-            r={size / 2}
-            className="globe"
-          />
+          <circle cx={size / 2} cy={size / 2} r={size / 2} className="globe" />
           <g>
             {countries.map((d, i) => (
               <path key={`path-${i}`} d={pathgen(d) || ""} className="land" />
             ))}
             {markers.map((m, i) => {
-              const coordinates: [number, number] = [
-                m.coordinates[0],
-                m.coordinates[1],
-              ];
+              const coordinates: [number, number] = [m.coordinates[0], m.coordinates[1]];
               const position = projection(coordinates);
               const x = position ? position[0] : undefined;
               const y = position ? position[1] : undefined;
-              const invertedCoordinates =
-                projection.invert && projection.invert(center);
+              const invertedCoordinates = projection.invert && projection.invert(center);
 
               // hide the marker if rotated out of view
-              const hideMarker =
-                geoDistance(coordinates, invertedCoordinates || [0, 0]) > 1.4;
+              const hideMarker = geoDistance(coordinates, invertedCoordinates || [0, 0]) > 1.4;
 
               return (
                 <circle
@@ -112,15 +99,12 @@ export const Globe: React.FC<IGlobeProps> = animated(
   }
 );
 
-export const RotatingGlobe: React.FC<{ size: number; duration?: number }> = ({
-  size = 500,
-  duration = 50000,
-}) => {
+export const RotatingGlobe: React.FC<{ size: number; duration?: number }> = ({ size = 500, duration = 50000 }) => {
   // globe positioning state
   const [orientation, setOrientation] = React.useState({
     lat: 0,
     long: 0,
-    degrees: 0,
+    degrees: 0
   });
 
   // set up spring animation
@@ -129,8 +113,8 @@ export const RotatingGlobe: React.FC<{ size: number; duration?: number }> = ({
     long: orientation.long,
     rotation: orientation.degrees,
     config: {
-      duration,
-    },
+      duration
+    }
   });
 
   // globe click handler
@@ -146,7 +130,7 @@ export const RotatingGlobe: React.FC<{ size: number; duration?: number }> = ({
     setOrientation({
       lat: Math.floor(Math.random() * size),
       long: Math.floor(Math.random() * size),
-      degrees: orientation.degrees + 360,
+      degrees: orientation.degrees + 360
     });
   }, duration);
 
@@ -162,7 +146,7 @@ export const RotatingGlobe: React.FC<{ size: number; duration?: number }> = ({
 };
 
 // Main page Vector diagram
-function Diagram({className, height, width}) {
+function Diagram({ className, height, width }) {
   const [_, updateState] = useState();
   const defaultXPosition = 7;
   const defaultTextLength = 60;
@@ -183,7 +167,12 @@ function Diagram({className, height, width}) {
   }
 
   return (
-    <svg className={classnames(className, 'diagram')} viewBox={`0 0 683 294`} version="1.1" xmlns="http://www.w3.org/2000/svg">
+    <svg
+      className={classnames(className, "diagram")}
+      viewBox={`0 0 683 294`}
+      version="1.1"
+      xmlns="http://www.w3.org/2000/svg"
+    >
       <title>Vector Diagram</title>
       <desc>A lightweight and ultra-fast tool for building observability pipelines</desc>
       <defs>
@@ -202,118 +191,323 @@ function Diagram({className, height, width}) {
       </defs>
       <g id="Components" stroke="none" strokeWidth="1" fill="none" fillRule="evenodd">
         <g id="Group-2">
-          <g id="Dividers" className="fade-in" transform="translate(192.000000, 0.000000)" fill="url(#diagram-gradient-1)" fillRule="nonzero">
+          <g
+            id="Dividers"
+            className="fade-in"
+            transform="translate(192.000000, 0.000000)"
+            fill="url(#diagram-gradient-1)"
+            fillRule="nonzero"
+          >
             <polygon id="Line-3" points="0 0 0 293.5 2 293.5 2 0"></polygon>
             <polygon id="Line-3" points="300 0 300 293.5 302 293.5 302 0"></polygon>
           </g>
-          <g id="Sink-Arrows" className="fade-in" transform="translate(466.000000, 104.000000)" fill="#000000" fillRule="nonzero">
-            <path id="Line-2" d="M122.274956,56.2259684 L136.274956,63.2259684 L122.274956,70.2259684 L122.274,64.225 L120,64.2259684 L120,62.2259684 L122.274,62.225 L122.274956,56.2259684 Z M7,62.2259684 L7,64.2259684 L0,64.2259684 L0,62.2259684 L7,62.2259684 Z M17,62.2259684 L17,64.2259684 L10,64.2259684 L10,62.2259684 L17,62.2259684 Z M27,62.2259684 L27,64.2259684 L20,64.2259684 L20,62.2259684 L27,62.2259684 Z M37,62.2259684 L37,64.2259684 L30,64.2259684 L30,62.2259684 L37,62.2259684 Z M47,62.2259684 L47,64.2259684 L40,64.2259684 L40,62.2259684 L47,62.2259684 Z M57,62.2259684 L57,64.2259684 L50,64.2259684 L50,62.2259684 L57,62.2259684 Z M67,62.2259684 L67,64.2259684 L60,64.2259684 L60,62.2259684 L67,62.2259684 Z M77,62.2259684 L77,64.2259684 L70,64.2259684 L70,62.2259684 L77,62.2259684 Z M87,62.2259684 L87,64.2259684 L80,64.2259684 L80,62.2259684 L87,62.2259684 Z M97,62.2259684 L97,64.2259684 L90,64.2259684 L90,62.2259684 L97,62.2259684 Z M107,62.2259684 L107,64.2259684 L100,64.2259684 L100,62.2259684 L107,62.2259684 Z M117,62.2259684 L117,64.2259684 L110,64.2259684 L110,62.2259684 L117,62.2259684 Z"></path>
-            <path id="Line-2" d="M39,116.225968 L53,123.225968 L39,130.225968 L39,116.225968 Z M7,122.225968 L7,124.225968 L0,124.225968 L0,122.225968 L7,122.225968 Z M17,122.225968 L17,124.225968 L10,124.225968 L10,122.225968 L17,122.225968 Z M27,122.225968 L27,124.225968 L20,124.225968 L20,122.225968 L27,122.225968 Z M37,122.225968 L37,124.225968 L30,124.225968 L30,122.225968 L37,122.225968 Z"></path>
-            <path id="Line-2" d="M39,-6.5 L53,0.5 L39,7.5 L39,-6.5 Z M14,-0.5 L14,1.5 L0,1.5 L0,-0.5 L14,-0.5 Z M38,-0.5 L38,1.5 L24,1.5 L24,-0.5 L38,-0.5 Z"></path>
+          <g
+            id="Sink-Arrows"
+            className="fade-in"
+            transform="translate(466.000000, 104.000000)"
+            fill="#000000"
+            fillRule="nonzero"
+          >
+            <path
+              id="Line-2"
+              d="M122.274956,56.2259684 L136.274956,63.2259684 L122.274956,70.2259684 L122.274,64.225 L120,64.2259684 L120,62.2259684 L122.274,62.225 L122.274956,56.2259684 Z M7,62.2259684 L7,64.2259684 L0,64.2259684 L0,62.2259684 L7,62.2259684 Z M17,62.2259684 L17,64.2259684 L10,64.2259684 L10,62.2259684 L17,62.2259684 Z M27,62.2259684 L27,64.2259684 L20,64.2259684 L20,62.2259684 L27,62.2259684 Z M37,62.2259684 L37,64.2259684 L30,64.2259684 L30,62.2259684 L37,62.2259684 Z M47,62.2259684 L47,64.2259684 L40,64.2259684 L40,62.2259684 L47,62.2259684 Z M57,62.2259684 L57,64.2259684 L50,64.2259684 L50,62.2259684 L57,62.2259684 Z M67,62.2259684 L67,64.2259684 L60,64.2259684 L60,62.2259684 L67,62.2259684 Z M77,62.2259684 L77,64.2259684 L70,64.2259684 L70,62.2259684 L77,62.2259684 Z M87,62.2259684 L87,64.2259684 L80,64.2259684 L80,62.2259684 L87,62.2259684 Z M97,62.2259684 L97,64.2259684 L90,64.2259684 L90,62.2259684 L97,62.2259684 Z M107,62.2259684 L107,64.2259684 L100,64.2259684 L100,62.2259684 L107,62.2259684 Z M117,62.2259684 L117,64.2259684 L110,64.2259684 L110,62.2259684 L117,62.2259684 Z"
+            ></path>
+            <path
+              id="Line-2"
+              d="M39,116.225968 L53,123.225968 L39,130.225968 L39,116.225968 Z M7,122.225968 L7,124.225968 L0,124.225968 L0,122.225968 L7,122.225968 Z M17,122.225968 L17,124.225968 L10,124.225968 L10,122.225968 L17,122.225968 Z M27,122.225968 L27,124.225968 L20,124.225968 L20,122.225968 L27,122.225968 Z M37,122.225968 L37,124.225968 L30,124.225968 L30,122.225968 L37,122.225968 Z"
+            ></path>
+            <path
+              id="Line-2"
+              d="M39,-6.5 L53,0.5 L39,7.5 L39,-6.5 Z M14,-0.5 L14,1.5 L0,1.5 L0,-0.5 L14,-0.5 Z M38,-0.5 L38,1.5 L24,1.5 L24,-0.5 L38,-0.5 Z"
+            ></path>
           </g>
-          <g id="Source-Arrows" className="fade-in" transform="translate(86.500000, 101.638384)" fill="#000000" fillRule="nonzero">
-            <path id="Line-4" d="M133.155668,-6.64242161 L147.221371,0.224600628 L133.288331,7.35694982 L133.231,1.357 L79.0095209,1.87104747 L78.9905689,-0.128862732 L133.212,-0.642 L133.155668,-6.64242161 Z"></path>
-            <path id="Line-5" d="M133.326364,-7.03026802 L147,0.587584848 L132.701536,6.95578182 L132.965891,1.03234055 C108.504239,1.65538762 90.3526539,11.2783109 78.3993935,29.9305268 L78.3993935,29.9305268 L69.7273462,43.4895749 L69.6187869,43.6451529 L69.5458669,43.724737 L69.4168931,43.8314804 L69.3240426,43.815818 L67.1087866,47.0978826 L63.3331136,52.764216 C52.470948,69.1254278 31.2128344,73.4282409 -0.23475072,65.833672 L-0.23475072,65.833672 L-1.20680632,65.5989213 L-0.737304886,63.6548101 L0.23475072,63.8895608 C30.9549174,71.3084586 51.3634704,67.1776035 61.6668864,51.6580122 C64.6807471,47.1183638 66.6584223,44.1678077 67.7614023,42.5579921 L67.7614023,42.5579921 L68.607827,41.3458454 C68.6566703,41.2787491 68.6992179,41.2215209 68.7363717,41.1730296 L68.7363717,41.1730296 L68.8539133,41.0277005 L68.995713,40.888649 L69.03146,40.861551 L77.0927923,28.268647 C89.4433616,9.38586562 108.133644,-0.370070055 133.054629,-0.970462358 L133.326364,-7.03026802 Z"></path>
-            <path id="Line-6" d="M133.099945,-6.86262491 L147,0.333795697 L132.90283,7.13598737 L132.986229,1.19576402 C112.502595,2.15785305 96.5785037,8.52317621 85.1610844,20.2781533 C71.2435841,34.6071267 63.6740952,56.9688315 62.4992556,87.4001939 L62.4992556,87.4001939 L62.4606781,88.3994495 L60.4621669,88.3222945 L60.5007444,87.3230389 C61.6930285,56.4398177 69.419375,33.6147256 83.7264219,18.8846887 C95.544694,6.71700753 111.991765,0.157433767 133.014439,-0.807695954 L133.099945,-6.86262491 Z"></path>
+          <g
+            id="Source-Arrows"
+            className="fade-in"
+            transform="translate(86.500000, 101.638384)"
+            fill="#000000"
+            fillRule="nonzero"
+          >
+            <path
+              id="Line-4"
+              d="M133.155668,-6.64242161 L147.221371,0.224600628 L133.288331,7.35694982 L133.231,1.357 L79.0095209,1.87104747 L78.9905689,-0.128862732 L133.212,-0.642 L133.155668,-6.64242161 Z"
+            ></path>
+            <path
+              id="Line-5"
+              d="M133.326364,-7.03026802 L147,0.587584848 L132.701536,6.95578182 L132.965891,1.03234055 C108.504239,1.65538762 90.3526539,11.2783109 78.3993935,29.9305268 L78.3993935,29.9305268 L69.7273462,43.4895749 L69.6187869,43.6451529 L69.5458669,43.724737 L69.4168931,43.8314804 L69.3240426,43.815818 L67.1087866,47.0978826 L63.3331136,52.764216 C52.470948,69.1254278 31.2128344,73.4282409 -0.23475072,65.833672 L-0.23475072,65.833672 L-1.20680632,65.5989213 L-0.737304886,63.6548101 L0.23475072,63.8895608 C30.9549174,71.3084586 51.3634704,67.1776035 61.6668864,51.6580122 C64.6807471,47.1183638 66.6584223,44.1678077 67.7614023,42.5579921 L67.7614023,42.5579921 L68.607827,41.3458454 C68.6566703,41.2787491 68.6992179,41.2215209 68.7363717,41.1730296 L68.7363717,41.1730296 L68.8539133,41.0277005 L68.995713,40.888649 L69.03146,40.861551 L77.0927923,28.268647 C89.4433616,9.38586562 108.133644,-0.370070055 133.054629,-0.970462358 L133.326364,-7.03026802 Z"
+            ></path>
+            <path
+              id="Line-6"
+              d="M133.099945,-6.86262491 L147,0.333795697 L132.90283,7.13598737 L132.986229,1.19576402 C112.502595,2.15785305 96.5785037,8.52317621 85.1610844,20.2781533 C71.2435841,34.6071267 63.6740952,56.9688315 62.4992556,87.4001939 L62.4992556,87.4001939 L62.4606781,88.3994495 L60.4621669,88.3222945 L60.5007444,87.3230389 C61.6930285,56.4398177 69.419375,33.6147256 83.7264219,18.8846887 C95.544694,6.71700753 111.991765,0.157433767 133.014439,-0.807695954 L133.099945,-6.86262491 Z"
+            ></path>
           </g>
           <g id="Sinks" transform="translate(527.000000, 5.000000)">
             <a href="/docs/reference/configuration/sinks/prometheus_exporter">
               <g id="Sink-3" transform="translate(0.000000, 184.000000)">
                 <circle id="Oval-Copy" fill="#000000" cx="37.5" cy="37.5" r="37.5"></circle>
-                <path d="M16.2259484,20 C18.123312,20 19.5799758,20.3335638 20.5959834,21.0007013 C21.6119911,21.6678388 22.1199872,22.7603367 22.1199872,24.2782276 C22.1199872,25.8083596 21.6058706,26.9130983 20.5776219,27.5924769 C19.5493732,28.2718555 18.0804686,28.6115397 16.1708639,28.6115397 L15.2711508,28.6115397 L15.2711508,32.8714058 L12.406758,32.8714058 L12.406758,20.3305069 C13.0310519,20.2080963 13.692059,20.1224102 14.3897992,20.073446 C15.0875394,20.0244817 15.699583,20 16.2259484,20 Z M16.4095633,22.4420784 C16.2014653,22.4420784 15.9964307,22.4481989 15.7944533,22.4604399 C15.5924759,22.472681 15.4180435,22.4849218 15.2711508,22.4971629 L15.2711508,26.1694613 L16.1708639,26.1694613 C17.1623894,26.1694613 17.9090826,26.0348117 18.4109659,25.7655084 C18.9128492,25.4962052 19.1637871,24.9943295 19.1637871,24.2598661 C19.1637871,23.9048755 19.0995225,23.6110946 18.9709914,23.3785145 C18.8424603,23.1459344 18.6588472,22.9592611 18.4201466,22.818489 C18.181446,22.6777169 17.8907253,22.5797899 17.5479758,22.5247051 C17.2052262,22.4696204 16.8257592,22.4420784 16.4095633,22.4420784 Z M29.8685368,25.636978 C29.6237157,25.5757727 29.3360552,25.5115081 29.0055467,25.4441823 C28.6750382,25.3768565 28.3200529,25.3431941 27.9405802,25.3431941 C27.7692054,25.3431941 27.5641708,25.3584952 27.3254702,25.3890979 C27.0867696,25.4197005 26.9062167,25.4533629 26.7838062,25.4900861 L26.7838062,32.8714058 L24.0479439,32.8714058 L24.0479439,23.7273828 C24.5375861,23.5560081 25.1159673,23.3938165 25.7831049,23.2408033 C26.4502424,23.0877901 27.1938754,23.0112847 28.0140261,23.0112847 C28.1609188,23.0112847 28.3384115,23.0204653 28.5465094,23.0388269 C28.7546074,23.0571885 28.9627022,23.0816702 29.1708001,23.1122729 C29.3788981,23.1428755 29.5869929,23.1795981 29.7950909,23.2224418 C30.0031888,23.2652855 30.1806814,23.3173092 30.3275741,23.3785145 L29.8685368,25.636978 Z M40.6467325,28.0239719 C40.6467325,28.7829174 40.5365647,29.4775869 40.3162257,30.1080013 C40.0958867,30.7384156 39.777624,31.277014 39.3614281,31.7238126 C38.9452322,32.1706111 38.4464167,32.5164157 37.8649665,32.7612369 C37.2835164,33.006058 36.6316899,33.1284667 35.9094676,33.1284667 C35.1994864,33.1284667 34.5537804,33.006058 33.9723303,32.7612369 C33.3908801,32.5164157 32.8920646,32.1706111 32.4758687,31.7238126 C32.0596728,31.277014 31.7352897,30.7384156 31.5027096,30.1080013 C31.2701295,29.4775869 31.1538412,28.7829174 31.1538412,28.0239719 C31.1538412,27.2650265 31.2731898,26.5734172 31.5118903,25.9491234 C31.7505909,25.3248295 32.0810945,24.7923516 32.5034109,24.3516736 C32.9257273,23.9109956 33.4276031,23.5682511 34.0090532,23.32343 C34.5905034,23.0786089 35.2239685,22.9562002 35.9094676,22.9562002 C36.6072078,22.9562002 37.2467934,23.0786089 37.8282435,23.32343 C38.4096937,23.5682511 38.9085092,23.9109956 39.3247051,24.3516736 C39.740901,24.7923516 40.0652841,25.3248295 40.2978642,25.9491234 C40.5304443,26.5734172 40.6467325,27.2650265 40.6467325,28.0239719 Z M37.8557858,28.0239719 C37.8557858,27.1793391 37.6874738,26.5152718 37.3508448,26.0317501 C37.0142157,25.5482284 36.5337615,25.3064712 35.9094676,25.3064712 C35.2851738,25.3064712 34.8016593,25.5482284 34.4589098,26.0317501 C34.1161602,26.5152718 33.944788,27.1793391 33.944788,28.0239719 C33.944788,28.8686048 34.1161602,29.5387925 34.4589098,30.0345553 C34.8016593,30.5303181 35.2851738,30.7781957 35.9094676,30.7781957 C36.5337615,30.7781957 37.0142157,30.5303181 37.3508448,30.0345553 C37.6874738,29.5387925 37.8557858,28.8686048 37.8557858,28.0239719 Z M48.0647753,27.7485496 C48.0647753,26.8671936 47.9515472,26.2429091 47.7250877,25.8756774 C47.4986281,25.5084457 47.1099804,25.3248326 46.5591329,25.3248326 C46.3877581,25.3248326 46.2102655,25.3340133 46.0266497,25.3523749 C45.8430338,25.3707365 45.6655412,25.392158 45.4941664,25.4166401 L45.4941664,32.8714058 L42.7583041,32.8714058 L42.7583041,23.5437679 C42.9908842,23.4825627 43.2632436,23.4182981 43.5753905,23.3509723 C43.8875374,23.2836465 44.218041,23.2224421 44.5669111,23.1673573 C44.9157812,23.1122726 45.2738267,23.0694295 45.6410583,23.0388269 C46.00829,23.0082243 46.3693957,22.9929232 46.7243864,22.9929232 C47.4221265,22.9929232 47.9882669,23.0816695 48.4228244,23.2591648 C48.8573818,23.4366601 49.2154273,23.6478152 49.4969716,23.8926363 C49.8886854,23.611092 50.3385375,23.3907563 50.8465413,23.2316226 C51.3545451,23.0724888 51.8227585,22.9929232 52.2511954,22.9929232 C53.0223819,22.9929232 53.6558471,23.1000308 54.1516098,23.3142493 C54.6473726,23.5284678 55.0421407,23.8314293 55.335926,24.2231431 C55.6297114,24.6148569 55.8316858,25.0800101 55.9418553,25.6186165 C56.0520248,26.157223 56.1071087,26.7570257 56.1071087,27.4180427 L56.1071087,32.8714058 L53.3712464,32.8714058 L53.3712464,27.7485496 C53.3712464,26.8671936 53.2580183,26.2429091 53.0315588,25.8756774 C52.8050993,25.5084457 52.4164516,25.3248326 51.8656041,25.3248326 C51.7187114,25.3248326 51.5136768,25.3615553 51.2504941,25.4350016 C50.9873114,25.5084479 50.7700359,25.6002545 50.5986611,25.710424 C50.6843485,25.9919683 50.7394325,26.2888094 50.7639146,26.6009563 C50.7883967,26.9131033 50.8006376,27.246667 50.8006376,27.6016576 L50.8006376,32.8714058 L48.0647753,32.8714058 L48.0647753,27.7485496 Z M57.759643,26.1510998 L63.0844756,26.1510998 L63.0844756,28.6299012 L57.759643,28.6299012 L57.759643,26.1510998 Z M8,46.9873127 C8,46.1304388 8.13158938,45.3806854 8.39477208,44.73803 C8.65795477,44.0953745 9.00375941,43.5598364 9.43219637,43.1313994 C9.86063332,42.7029625 10.3533284,42.3785794 10.9102965,42.1582404 C11.4672645,41.9379014 12.0395253,41.8277335 12.627096,41.8277335 C13.9980942,41.8277335 15.0814114,42.2469834 15.87708,43.0854957 C16.6727486,43.924008 17.070577,45.1572759 17.070577,46.7853363 C17.070577,46.94447 17.0644565,47.1189025 17.0522155,47.3086388 C17.0399744,47.4983752 17.0277336,47.6666872 17.0154925,47.8135799 L10.8093083,47.8135799 C10.8705135,48.3766684 11.1336923,48.8234603 11.5988524,49.1539688 C12.0640125,49.4844773 12.688297,49.649729 13.4717246,49.649729 C13.9736079,49.649729 14.466303,49.6038258 14.9498247,49.5120179 C15.4333464,49.4202099 15.8281145,49.3069819 16.1341409,49.1723303 L16.5013707,51.3940708 C16.3544781,51.4675171 16.1586241,51.5409623 15.913803,51.6144087 C15.6689819,51.687855 15.3966225,51.7521196 15.0967166,51.8072043 C14.7968107,51.8622891 14.4754878,51.9081924 14.1327383,51.9449155 C13.7899887,51.9816387 13.4472443,52 13.1044947,52 C12.2353798,52 11.4795059,51.8714708 10.8368505,51.6144087 C10.1941951,51.3573465 9.66171713,51.0054214 9.2394007,50.5586229 C8.81708428,50.1118244 8.50494204,49.5824066 8.30296462,48.9703538 C8.1009872,48.3583011 8,47.697294 8,46.9873127 Z M14.4265222,45.9407077 C14.4142811,45.7081276 14.3744983,45.4816715 14.3071725,45.2613325 C14.2398467,45.0409935 14.1357992,44.8451395 13.9950271,44.6737647 C13.854255,44.50239 13.6767623,44.3616199 13.4625438,44.2514504 C13.2483254,44.1412809 12.9820864,44.086197 12.6638189,44.086197 C12.3577925,44.086197 12.0946138,44.1382207 11.8742748,44.2422697 C11.6539358,44.3463187 11.4703227,44.4840285 11.32343,44.6554033 C11.1765374,44.826778 11.0633093,45.0256922 10.9837424,45.2521517 C10.9041756,45.4786113 10.8460314,45.7081276 10.8093083,45.9407077 L14.4265222,45.9407077 Z M19.0903411,39.679439 L21.8262034,39.2387631 L21.8262034,42.0847944 L25.1129104,42.0847944 L25.1129104,44.3616194 L21.8262034,44.3616194 L21.8262034,47.7584954 C21.8262034,48.333825 21.9271906,48.7928577 22.129168,49.1356073 C22.3311454,49.4783568 22.7381544,49.649729 23.3502072,49.649729 C23.6439925,49.649729 23.9469541,49.6221871 24.2591011,49.5671023 C24.571248,49.5120176 24.8558483,49.4355121 25.1129104,49.3375837 L25.4985018,51.4675167 C25.1679932,51.6021683 24.8007671,51.7184566 24.3968122,51.8163851 C23.9928574,51.9143135 23.4971021,51.963277 22.9095314,51.963277 C22.162827,51.963277 21.544663,51.8622898 21.0550207,51.6603124 C20.5653785,51.458335 20.1736706,51.1767949 19.8798852,50.8156838 C19.5860999,50.4545726 19.3810653,50.0169614 19.2647753,49.5028371 C19.1484852,48.9887128 19.0903411,48.4195091 19.0903411,47.7952184 L19.0903411,39.679439 Z M27.3346509,51.7429391 L27.3346509,37.9350972 L30.0705132,37.4944214 L30.0705132,42.1215174 C30.2541291,42.0603121 30.4897659,42.002168 30.7774307,41.9470832 C31.0650955,41.8919984 31.3435753,41.8644565 31.6128785,41.8644565 C32.3963061,41.8644565 33.0481326,41.9715641 33.5683774,42.1857826 C34.0886223,42.4000011 34.504812,42.7029627 34.8169589,43.0946764 C35.1291058,43.4863902 35.3494415,43.9515434 35.4779726,44.4901498 C35.6065037,45.0287563 35.6707682,45.628559 35.6707682,46.289576 L35.6707682,51.7429391 L32.934906,51.7429391 L32.934906,46.6200829 C32.934906,45.7387269 32.8216779,45.1144424 32.5952184,44.7472107 C32.3687588,44.379979 31.949509,44.196366 31.3374562,44.196366 C31.0926351,44.196366 30.8631187,44.2177875 30.6489002,44.2606312 C30.4346817,44.3034749 30.241888,44.3493781 30.0705132,44.3983424 L30.0705132,51.7429391 L27.3346509,51.7429391 Z M37.6905324,46.9873127 C37.6905324,46.1304388 37.8221217,45.3806854 38.0853044,44.73803 C38.3484871,44.0953745 38.6942918,43.5598364 39.1227287,43.1313994 C39.5511657,42.7029625 40.0438608,42.3785794 40.6008288,42.1582404 C41.1577969,41.9379014 41.7300576,41.8277335 42.3176283,41.8277335 C43.6886266,41.8277335 44.7719437,42.2469834 45.5676124,43.0854957 C46.363281,43.924008 46.7611093,45.1572759 46.7611093,46.7853363 C46.7611093,46.94447 46.7549889,47.1189025 46.7427478,47.3086388 C46.7305068,47.4983752 46.7182659,47.6666872 46.7060249,47.8135799 L40.4998406,47.8135799 C40.5610459,48.3766684 40.8242246,48.8234603 41.2893848,49.1539688 C41.7545449,49.4844773 42.3788294,49.649729 43.1622569,49.649729 C43.6641402,49.649729 44.1568353,49.6038258 44.640357,49.5120179 C45.1238787,49.4202099 45.5186469,49.3069819 45.8246733,49.1723303 L46.1919031,51.3940708 C46.0450104,51.4675171 45.8491565,51.5409623 45.6043354,51.6144087 C45.3595142,51.687855 45.0871548,51.7521196 44.787249,51.8072043 C44.4873431,51.8622891 44.1660202,51.9081924 43.8232706,51.9449155 C43.4805211,51.9816387 43.1377767,52 42.7950271,52 C41.9259121,52 41.1700383,51.8714708 40.5273828,51.6144087 C39.8847274,51.3573465 39.3522495,51.0054214 38.9299331,50.5586229 C38.5076166,50.1118244 38.1954744,49.5824066 37.993497,48.9703538 C37.7915196,48.3583011 37.6905324,47.697294 37.6905324,46.9873127 Z M44.1170545,45.9407077 C44.1048135,45.7081276 44.0650306,45.4816715 43.9977048,45.2613325 C43.930379,45.0409935 43.8263316,44.8451395 43.6855595,44.6737647 C43.5447873,44.50239 43.3672947,44.3616199 43.1530762,44.2514504 C42.9388577,44.1412809 42.6726187,44.086197 42.3543513,44.086197 C42.0483249,44.086197 41.7851461,44.1382207 41.5648071,44.2422697 C41.3444681,44.3463187 41.1608551,44.4840285 41.0139624,44.6554033 C40.8670697,44.826778 40.7538416,45.0256922 40.6742748,45.2521517 C40.5947079,45.4786113 40.5365638,45.7081276 40.4998406,45.9407077 L44.1170545,45.9407077 Z M57.1169908,51.4124323 C56.6518306,51.5470839 56.0520279,51.6725528 55.3175646,51.7888428 C54.5831012,51.9051329 53.8119263,51.963277 53.0040166,51.963277 C52.1838658,51.963277 51.5014372,51.8531092 50.9567102,51.6327702 C50.4119833,51.4124312 49.9804925,51.1033491 49.6622251,50.7055148 C49.3439576,50.3076805 49.1175015,49.8333467 48.9828499,49.2824992 C48.8481982,48.7316517 48.7808734,48.1257285 48.7808734,47.4647115 L48.7808734,42.0847944 L51.5167357,42.0847944 L51.5167357,47.1342047 C51.5167357,48.0155607 51.633024,48.652086 51.8656041,49.0437998 C52.0981841,49.4355136 52.5327351,49.6313675 53.16927,49.6313675 C53.3651269,49.6313675 53.5732217,49.6221869 53.7935607,49.6038253 C54.0138997,49.5854637 54.2097537,49.5640422 54.3811285,49.5395601 L54.3811285,42.0847944 L57.1169908,42.0847944 L57.1169908,51.4124323 Z M62.4601849,49.7782595 C62.9620682,49.7782595 63.3170535,49.729296 63.5251514,49.6313675 C63.7332494,49.5334391 63.8372968,49.3437056 63.8372968,49.0621613 C63.8372968,48.8418223 63.7026472,48.6490286 63.433344,48.4837743 C63.1640407,48.3185201 62.7539715,48.1318468 62.203124,47.9237488 C61.7746871,47.7646151 61.3860394,47.5993633 61.0371693,47.4279885 C60.6882992,47.2566137 60.391458,47.0515791 60.1466369,46.8128785 C59.9018158,46.574178 59.7120823,46.2895777 59.5774307,45.9590692 C59.4427791,45.6285607 59.3754543,45.2307323 59.3754543,44.7655722 C59.3754543,43.8597341 59.7120782,43.1436431 60.3853363,42.6172777 C61.0585944,42.0909123 61.9827802,41.8277335 63.1579216,41.8277335 C63.7454923,41.8277335 64.3085724,41.8797572 64.8471788,41.9838062 C65.3857853,42.0878552 65.8142158,42.2010832 66.1324833,42.3234938 L65.6550845,44.4534268 C65.336817,44.3432573 64.9910124,44.2453304 64.6176602,44.159643 C64.244308,44.0739556 63.8250581,44.0311125 63.359898,44.0311125 C62.5030241,44.0311125 62.0745936,44.2698095 62.0745936,44.7472107 C62.0745936,44.8573802 62.0929549,44.9553072 62.129678,45.0409946 C62.1664012,45.126682 62.2398464,45.2093079 62.3500159,45.2888747 C62.4601854,45.3684416 62.6101361,45.4541277 62.7998725,45.5459356 C62.9896089,45.6377435 63.2313661,45.7387307 63.5251514,45.8489002 C64.1249632,46.0692392 64.6207185,46.2865147 65.0124323,46.5007332 C65.404146,46.7149517 65.7132281,46.9475282 65.9396876,47.1984699 C66.1661471,47.4494115 66.3252785,47.7278914 66.4170864,48.0339178 C66.5088943,48.3399442 66.5547976,48.6949294 66.5547976,49.0988843 C66.5547976,50.0536866 66.1967521,50.7758981 65.4806503,51.2655403 C64.7645485,51.7551826 63.7516164,52 62.4418234,52 C61.5849495,52 60.8719187,51.9265548 60.3027096,51.7796621 C59.7335005,51.6327694 59.3387324,51.5103607 59.1183934,51.4124323 L59.5774307,49.1906917 C60.0425908,49.3743076 60.5199848,49.5181378 61.009627,49.6221868 C61.4992693,49.7262358 61.9827837,49.7782595 62.4601849,49.7782595 Z" id="Prom-etheus" fill="#FFFFFF" fillRule="nonzero"></path>
+                <path
+                  d="M16.2259484,20 C18.123312,20 19.5799758,20.3335638 20.5959834,21.0007013 C21.6119911,21.6678388 22.1199872,22.7603367 22.1199872,24.2782276 C22.1199872,25.8083596 21.6058706,26.9130983 20.5776219,27.5924769 C19.5493732,28.2718555 18.0804686,28.6115397 16.1708639,28.6115397 L15.2711508,28.6115397 L15.2711508,32.8714058 L12.406758,32.8714058 L12.406758,20.3305069 C13.0310519,20.2080963 13.692059,20.1224102 14.3897992,20.073446 C15.0875394,20.0244817 15.699583,20 16.2259484,20 Z M16.4095633,22.4420784 C16.2014653,22.4420784 15.9964307,22.4481989 15.7944533,22.4604399 C15.5924759,22.472681 15.4180435,22.4849218 15.2711508,22.4971629 L15.2711508,26.1694613 L16.1708639,26.1694613 C17.1623894,26.1694613 17.9090826,26.0348117 18.4109659,25.7655084 C18.9128492,25.4962052 19.1637871,24.9943295 19.1637871,24.2598661 C19.1637871,23.9048755 19.0995225,23.6110946 18.9709914,23.3785145 C18.8424603,23.1459344 18.6588472,22.9592611 18.4201466,22.818489 C18.181446,22.6777169 17.8907253,22.5797899 17.5479758,22.5247051 C17.2052262,22.4696204 16.8257592,22.4420784 16.4095633,22.4420784 Z M29.8685368,25.636978 C29.6237157,25.5757727 29.3360552,25.5115081 29.0055467,25.4441823 C28.6750382,25.3768565 28.3200529,25.3431941 27.9405802,25.3431941 C27.7692054,25.3431941 27.5641708,25.3584952 27.3254702,25.3890979 C27.0867696,25.4197005 26.9062167,25.4533629 26.7838062,25.4900861 L26.7838062,32.8714058 L24.0479439,32.8714058 L24.0479439,23.7273828 C24.5375861,23.5560081 25.1159673,23.3938165 25.7831049,23.2408033 C26.4502424,23.0877901 27.1938754,23.0112847 28.0140261,23.0112847 C28.1609188,23.0112847 28.3384115,23.0204653 28.5465094,23.0388269 C28.7546074,23.0571885 28.9627022,23.0816702 29.1708001,23.1122729 C29.3788981,23.1428755 29.5869929,23.1795981 29.7950909,23.2224418 C30.0031888,23.2652855 30.1806814,23.3173092 30.3275741,23.3785145 L29.8685368,25.636978 Z M40.6467325,28.0239719 C40.6467325,28.7829174 40.5365647,29.4775869 40.3162257,30.1080013 C40.0958867,30.7384156 39.777624,31.277014 39.3614281,31.7238126 C38.9452322,32.1706111 38.4464167,32.5164157 37.8649665,32.7612369 C37.2835164,33.006058 36.6316899,33.1284667 35.9094676,33.1284667 C35.1994864,33.1284667 34.5537804,33.006058 33.9723303,32.7612369 C33.3908801,32.5164157 32.8920646,32.1706111 32.4758687,31.7238126 C32.0596728,31.277014 31.7352897,30.7384156 31.5027096,30.1080013 C31.2701295,29.4775869 31.1538412,28.7829174 31.1538412,28.0239719 C31.1538412,27.2650265 31.2731898,26.5734172 31.5118903,25.9491234 C31.7505909,25.3248295 32.0810945,24.7923516 32.5034109,24.3516736 C32.9257273,23.9109956 33.4276031,23.5682511 34.0090532,23.32343 C34.5905034,23.0786089 35.2239685,22.9562002 35.9094676,22.9562002 C36.6072078,22.9562002 37.2467934,23.0786089 37.8282435,23.32343 C38.4096937,23.5682511 38.9085092,23.9109956 39.3247051,24.3516736 C39.740901,24.7923516 40.0652841,25.3248295 40.2978642,25.9491234 C40.5304443,26.5734172 40.6467325,27.2650265 40.6467325,28.0239719 Z M37.8557858,28.0239719 C37.8557858,27.1793391 37.6874738,26.5152718 37.3508448,26.0317501 C37.0142157,25.5482284 36.5337615,25.3064712 35.9094676,25.3064712 C35.2851738,25.3064712 34.8016593,25.5482284 34.4589098,26.0317501 C34.1161602,26.5152718 33.944788,27.1793391 33.944788,28.0239719 C33.944788,28.8686048 34.1161602,29.5387925 34.4589098,30.0345553 C34.8016593,30.5303181 35.2851738,30.7781957 35.9094676,30.7781957 C36.5337615,30.7781957 37.0142157,30.5303181 37.3508448,30.0345553 C37.6874738,29.5387925 37.8557858,28.8686048 37.8557858,28.0239719 Z M48.0647753,27.7485496 C48.0647753,26.8671936 47.9515472,26.2429091 47.7250877,25.8756774 C47.4986281,25.5084457 47.1099804,25.3248326 46.5591329,25.3248326 C46.3877581,25.3248326 46.2102655,25.3340133 46.0266497,25.3523749 C45.8430338,25.3707365 45.6655412,25.392158 45.4941664,25.4166401 L45.4941664,32.8714058 L42.7583041,32.8714058 L42.7583041,23.5437679 C42.9908842,23.4825627 43.2632436,23.4182981 43.5753905,23.3509723 C43.8875374,23.2836465 44.218041,23.2224421 44.5669111,23.1673573 C44.9157812,23.1122726 45.2738267,23.0694295 45.6410583,23.0388269 C46.00829,23.0082243 46.3693957,22.9929232 46.7243864,22.9929232 C47.4221265,22.9929232 47.9882669,23.0816695 48.4228244,23.2591648 C48.8573818,23.4366601 49.2154273,23.6478152 49.4969716,23.8926363 C49.8886854,23.611092 50.3385375,23.3907563 50.8465413,23.2316226 C51.3545451,23.0724888 51.8227585,22.9929232 52.2511954,22.9929232 C53.0223819,22.9929232 53.6558471,23.1000308 54.1516098,23.3142493 C54.6473726,23.5284678 55.0421407,23.8314293 55.335926,24.2231431 C55.6297114,24.6148569 55.8316858,25.0800101 55.9418553,25.6186165 C56.0520248,26.157223 56.1071087,26.7570257 56.1071087,27.4180427 L56.1071087,32.8714058 L53.3712464,32.8714058 L53.3712464,27.7485496 C53.3712464,26.8671936 53.2580183,26.2429091 53.0315588,25.8756774 C52.8050993,25.5084457 52.4164516,25.3248326 51.8656041,25.3248326 C51.7187114,25.3248326 51.5136768,25.3615553 51.2504941,25.4350016 C50.9873114,25.5084479 50.7700359,25.6002545 50.5986611,25.710424 C50.6843485,25.9919683 50.7394325,26.2888094 50.7639146,26.6009563 C50.7883967,26.9131033 50.8006376,27.246667 50.8006376,27.6016576 L50.8006376,32.8714058 L48.0647753,32.8714058 L48.0647753,27.7485496 Z M57.759643,26.1510998 L63.0844756,26.1510998 L63.0844756,28.6299012 L57.759643,28.6299012 L57.759643,26.1510998 Z M8,46.9873127 C8,46.1304388 8.13158938,45.3806854 8.39477208,44.73803 C8.65795477,44.0953745 9.00375941,43.5598364 9.43219637,43.1313994 C9.86063332,42.7029625 10.3533284,42.3785794 10.9102965,42.1582404 C11.4672645,41.9379014 12.0395253,41.8277335 12.627096,41.8277335 C13.9980942,41.8277335 15.0814114,42.2469834 15.87708,43.0854957 C16.6727486,43.924008 17.070577,45.1572759 17.070577,46.7853363 C17.070577,46.94447 17.0644565,47.1189025 17.0522155,47.3086388 C17.0399744,47.4983752 17.0277336,47.6666872 17.0154925,47.8135799 L10.8093083,47.8135799 C10.8705135,48.3766684 11.1336923,48.8234603 11.5988524,49.1539688 C12.0640125,49.4844773 12.688297,49.649729 13.4717246,49.649729 C13.9736079,49.649729 14.466303,49.6038258 14.9498247,49.5120179 C15.4333464,49.4202099 15.8281145,49.3069819 16.1341409,49.1723303 L16.5013707,51.3940708 C16.3544781,51.4675171 16.1586241,51.5409623 15.913803,51.6144087 C15.6689819,51.687855 15.3966225,51.7521196 15.0967166,51.8072043 C14.7968107,51.8622891 14.4754878,51.9081924 14.1327383,51.9449155 C13.7899887,51.9816387 13.4472443,52 13.1044947,52 C12.2353798,52 11.4795059,51.8714708 10.8368505,51.6144087 C10.1941951,51.3573465 9.66171713,51.0054214 9.2394007,50.5586229 C8.81708428,50.1118244 8.50494204,49.5824066 8.30296462,48.9703538 C8.1009872,48.3583011 8,47.697294 8,46.9873127 Z M14.4265222,45.9407077 C14.4142811,45.7081276 14.3744983,45.4816715 14.3071725,45.2613325 C14.2398467,45.0409935 14.1357992,44.8451395 13.9950271,44.6737647 C13.854255,44.50239 13.6767623,44.3616199 13.4625438,44.2514504 C13.2483254,44.1412809 12.9820864,44.086197 12.6638189,44.086197 C12.3577925,44.086197 12.0946138,44.1382207 11.8742748,44.2422697 C11.6539358,44.3463187 11.4703227,44.4840285 11.32343,44.6554033 C11.1765374,44.826778 11.0633093,45.0256922 10.9837424,45.2521517 C10.9041756,45.4786113 10.8460314,45.7081276 10.8093083,45.9407077 L14.4265222,45.9407077 Z M19.0903411,39.679439 L21.8262034,39.2387631 L21.8262034,42.0847944 L25.1129104,42.0847944 L25.1129104,44.3616194 L21.8262034,44.3616194 L21.8262034,47.7584954 C21.8262034,48.333825 21.9271906,48.7928577 22.129168,49.1356073 C22.3311454,49.4783568 22.7381544,49.649729 23.3502072,49.649729 C23.6439925,49.649729 23.9469541,49.6221871 24.2591011,49.5671023 C24.571248,49.5120176 24.8558483,49.4355121 25.1129104,49.3375837 L25.4985018,51.4675167 C25.1679932,51.6021683 24.8007671,51.7184566 24.3968122,51.8163851 C23.9928574,51.9143135 23.4971021,51.963277 22.9095314,51.963277 C22.162827,51.963277 21.544663,51.8622898 21.0550207,51.6603124 C20.5653785,51.458335 20.1736706,51.1767949 19.8798852,50.8156838 C19.5860999,50.4545726 19.3810653,50.0169614 19.2647753,49.5028371 C19.1484852,48.9887128 19.0903411,48.4195091 19.0903411,47.7952184 L19.0903411,39.679439 Z M27.3346509,51.7429391 L27.3346509,37.9350972 L30.0705132,37.4944214 L30.0705132,42.1215174 C30.2541291,42.0603121 30.4897659,42.002168 30.7774307,41.9470832 C31.0650955,41.8919984 31.3435753,41.8644565 31.6128785,41.8644565 C32.3963061,41.8644565 33.0481326,41.9715641 33.5683774,42.1857826 C34.0886223,42.4000011 34.504812,42.7029627 34.8169589,43.0946764 C35.1291058,43.4863902 35.3494415,43.9515434 35.4779726,44.4901498 C35.6065037,45.0287563 35.6707682,45.628559 35.6707682,46.289576 L35.6707682,51.7429391 L32.934906,51.7429391 L32.934906,46.6200829 C32.934906,45.7387269 32.8216779,45.1144424 32.5952184,44.7472107 C32.3687588,44.379979 31.949509,44.196366 31.3374562,44.196366 C31.0926351,44.196366 30.8631187,44.2177875 30.6489002,44.2606312 C30.4346817,44.3034749 30.241888,44.3493781 30.0705132,44.3983424 L30.0705132,51.7429391 L27.3346509,51.7429391 Z M37.6905324,46.9873127 C37.6905324,46.1304388 37.8221217,45.3806854 38.0853044,44.73803 C38.3484871,44.0953745 38.6942918,43.5598364 39.1227287,43.1313994 C39.5511657,42.7029625 40.0438608,42.3785794 40.6008288,42.1582404 C41.1577969,41.9379014 41.7300576,41.8277335 42.3176283,41.8277335 C43.6886266,41.8277335 44.7719437,42.2469834 45.5676124,43.0854957 C46.363281,43.924008 46.7611093,45.1572759 46.7611093,46.7853363 C46.7611093,46.94447 46.7549889,47.1189025 46.7427478,47.3086388 C46.7305068,47.4983752 46.7182659,47.6666872 46.7060249,47.8135799 L40.4998406,47.8135799 C40.5610459,48.3766684 40.8242246,48.8234603 41.2893848,49.1539688 C41.7545449,49.4844773 42.3788294,49.649729 43.1622569,49.649729 C43.6641402,49.649729 44.1568353,49.6038258 44.640357,49.5120179 C45.1238787,49.4202099 45.5186469,49.3069819 45.8246733,49.1723303 L46.1919031,51.3940708 C46.0450104,51.4675171 45.8491565,51.5409623 45.6043354,51.6144087 C45.3595142,51.687855 45.0871548,51.7521196 44.787249,51.8072043 C44.4873431,51.8622891 44.1660202,51.9081924 43.8232706,51.9449155 C43.4805211,51.9816387 43.1377767,52 42.7950271,52 C41.9259121,52 41.1700383,51.8714708 40.5273828,51.6144087 C39.8847274,51.3573465 39.3522495,51.0054214 38.9299331,50.5586229 C38.5076166,50.1118244 38.1954744,49.5824066 37.993497,48.9703538 C37.7915196,48.3583011 37.6905324,47.697294 37.6905324,46.9873127 Z M44.1170545,45.9407077 C44.1048135,45.7081276 44.0650306,45.4816715 43.9977048,45.2613325 C43.930379,45.0409935 43.8263316,44.8451395 43.6855595,44.6737647 C43.5447873,44.50239 43.3672947,44.3616199 43.1530762,44.2514504 C42.9388577,44.1412809 42.6726187,44.086197 42.3543513,44.086197 C42.0483249,44.086197 41.7851461,44.1382207 41.5648071,44.2422697 C41.3444681,44.3463187 41.1608551,44.4840285 41.0139624,44.6554033 C40.8670697,44.826778 40.7538416,45.0256922 40.6742748,45.2521517 C40.5947079,45.4786113 40.5365638,45.7081276 40.4998406,45.9407077 L44.1170545,45.9407077 Z M57.1169908,51.4124323 C56.6518306,51.5470839 56.0520279,51.6725528 55.3175646,51.7888428 C54.5831012,51.9051329 53.8119263,51.963277 53.0040166,51.963277 C52.1838658,51.963277 51.5014372,51.8531092 50.9567102,51.6327702 C50.4119833,51.4124312 49.9804925,51.1033491 49.6622251,50.7055148 C49.3439576,50.3076805 49.1175015,49.8333467 48.9828499,49.2824992 C48.8481982,48.7316517 48.7808734,48.1257285 48.7808734,47.4647115 L48.7808734,42.0847944 L51.5167357,42.0847944 L51.5167357,47.1342047 C51.5167357,48.0155607 51.633024,48.652086 51.8656041,49.0437998 C52.0981841,49.4355136 52.5327351,49.6313675 53.16927,49.6313675 C53.3651269,49.6313675 53.5732217,49.6221869 53.7935607,49.6038253 C54.0138997,49.5854637 54.2097537,49.5640422 54.3811285,49.5395601 L54.3811285,42.0847944 L57.1169908,42.0847944 L57.1169908,51.4124323 Z M62.4601849,49.7782595 C62.9620682,49.7782595 63.3170535,49.729296 63.5251514,49.6313675 C63.7332494,49.5334391 63.8372968,49.3437056 63.8372968,49.0621613 C63.8372968,48.8418223 63.7026472,48.6490286 63.433344,48.4837743 C63.1640407,48.3185201 62.7539715,48.1318468 62.203124,47.9237488 C61.7746871,47.7646151 61.3860394,47.5993633 61.0371693,47.4279885 C60.6882992,47.2566137 60.391458,47.0515791 60.1466369,46.8128785 C59.9018158,46.574178 59.7120823,46.2895777 59.5774307,45.9590692 C59.4427791,45.6285607 59.3754543,45.2307323 59.3754543,44.7655722 C59.3754543,43.8597341 59.7120782,43.1436431 60.3853363,42.6172777 C61.0585944,42.0909123 61.9827802,41.8277335 63.1579216,41.8277335 C63.7454923,41.8277335 64.3085724,41.8797572 64.8471788,41.9838062 C65.3857853,42.0878552 65.8142158,42.2010832 66.1324833,42.3234938 L65.6550845,44.4534268 C65.336817,44.3432573 64.9910124,44.2453304 64.6176602,44.159643 C64.244308,44.0739556 63.8250581,44.0311125 63.359898,44.0311125 C62.5030241,44.0311125 62.0745936,44.2698095 62.0745936,44.7472107 C62.0745936,44.8573802 62.0929549,44.9553072 62.129678,45.0409946 C62.1664012,45.126682 62.2398464,45.2093079 62.3500159,45.2888747 C62.4601854,45.3684416 62.6101361,45.4541277 62.7998725,45.5459356 C62.9896089,45.6377435 63.2313661,45.7387307 63.5251514,45.8489002 C64.1249632,46.0692392 64.6207185,46.2865147 65.0124323,46.5007332 C65.404146,46.7149517 65.7132281,46.9475282 65.9396876,47.1984699 C66.1661471,47.4494115 66.3252785,47.7278914 66.4170864,48.0339178 C66.5088943,48.3399442 66.5547976,48.6949294 66.5547976,49.0988843 C66.5547976,50.0536866 66.1967521,50.7758981 65.4806503,51.2655403 C64.7645485,51.7551826 63.7516164,52 62.4418234,52 C61.5849495,52 60.8719187,51.9265548 60.3027096,51.7796621 C59.7335005,51.6327694 59.3387324,51.5103607 59.1183934,51.4124323 L59.5774307,49.1906917 C60.0425908,49.3743076 60.5199848,49.5181378 61.009627,49.6221868 C61.4992693,49.7262358 61.9827837,49.7782595 62.4601849,49.7782595 Z"
+                  id="Prom-etheus"
+                  fill="#FFFFFF"
+                  fillRule="nonzero"
+                ></path>
               </g>
             </a>
             <a href="/docs/reference/configuration/sinks/elasticsearch">
               <g id="Sink-2" transform="translate(81.000000, 124.000000)">
                 <circle id="Oval-Copy" fill="#000000" cx="37.5" cy="37.5" r="37.5"></circle>
-                <path d="M11,33.8509704 L11,21.4814827 L19.3534203,21.4814827 L19.3534203,23.8197264 L13.7844734,23.8197264 L13.7844734,26.247216 L18.7286987,26.247216 L18.7286987,28.5319122 L13.7844734,28.5319122 L13.7844734,31.5127267 L19.7639516,31.5127267 L19.7639516,33.8509704 L11,33.8509704 Z M25.3864461,34.0294623 C24.6129774,34.0175628 23.9852872,33.9342674 23.5033567,33.7795737 C23.0214262,33.6248799 22.6406473,33.407717 22.3610086,33.1280783 C22.0813699,32.8484396 21.8909805,32.5093084 21.7898346,32.1106745 C21.6886886,31.7120406 21.6381164,31.2628406 21.6381164,30.7630608 L21.6381164,20.4283805 L24.2976456,20 L24.2976456,30.2275851 C24.2976456,30.4655755 24.3154946,30.6797636 24.3511931,30.8701559 C24.3868917,31.0605482 24.4553129,31.2211893 24.5564588,31.352084 C24.6576047,31.4829787 24.8033716,31.5900728 24.9937639,31.6733694 C25.1841562,31.756666 25.439992,31.8102131 25.761279,31.8340121 L25.3864461,34.0294623 Z M31.1338848,31.9946548 C31.3956742,31.9946548 31.6455604,31.9887051 31.8835507,31.9768056 C32.1215411,31.9649061 32.3119306,31.9470571 32.4547248,31.923258 L32.4547248,29.9062997 C32.3476291,29.8825007 32.186988,29.858702 31.9727967,29.834903 C31.7586054,29.8111039 31.5622662,29.7992046 31.3837735,29.7992046 C31.1338836,29.7992046 30.8988716,29.8140788 30.6787305,29.8438276 C30.4585894,29.8735763 30.2652251,29.9300982 30.0986319,30.0133948 C29.9320386,30.0966915 29.8011459,30.2097352 29.7059497,30.3525294 C29.6107536,30.4953237 29.5631562,30.6738138 29.5631562,30.8880051 C29.5631562,31.3044882 29.7029735,31.5930472 29.9826122,31.7536907 C30.2622508,31.9143342 30.6460046,31.9946548 31.1338848,31.9946548 Z M30.9196946,24.2124085 C31.7050628,24.2124085 32.3595265,24.3016536 32.8831053,24.4801464 C33.4066841,24.6586391 33.8261359,24.9144749 34.1414731,25.2476615 C34.4568104,25.580848 34.679923,25.9854256 34.8108177,26.4614063 C34.9417124,26.937387 35.0071588,27.4669077 35.0071588,28.0499841 L35.0071588,33.5832326 C34.6263742,33.6665292 34.0968535,33.7646988 33.418581,33.8777442 C32.7403084,33.9907896 31.9192539,34.0473115 30.9553929,34.0473115 C30.3485175,34.0473115 29.798173,33.9937645 29.304343,33.8866688 C28.810513,33.7795731 28.3851116,33.6040579 28.028126,33.3601177 C27.6711404,33.1161776 27.3974556,32.7978702 27.2070633,32.4051861 C27.016671,32.012502 26.9214763,31.5305787 26.9214763,30.9594018 C26.9214763,30.412024 27.0315452,29.9479497 27.2516863,29.5671651 C27.4718274,29.1863805 27.766336,28.8829474 28.1352211,28.6568565 C28.5041062,28.4307657 28.9265328,28.2671497 29.4025135,28.1660038 C29.8784943,28.0648579 30.3723169,28.0142857 30.8839962,28.0142857 C31.2290822,28.0142857 31.5354902,28.0291599 31.8032294,28.0589087 C32.0709686,28.0886575 32.2881315,28.1273303 32.4547248,28.1749284 L32.4547248,27.9250398 C32.4547248,27.4728581 32.3178824,27.1099282 32.0441934,26.8362393 C31.7705045,26.5625503 31.2945309,26.4257079 30.6162584,26.4257079 C30.1640766,26.4257079 29.7178514,26.4584311 29.2775692,26.5238785 C28.837287,26.5893258 28.4565081,26.6815457 28.1352211,26.8005409 L27.7960865,24.6586382 C27.9507803,24.6110402 28.1441446,24.560468 28.3761852,24.5069201 C28.6082258,24.4533723 28.8610868,24.4057749 29.1347757,24.3641266 C29.4084646,24.3224783 29.6970236,24.2867803 30.0004613,24.2570315 C30.3038991,24.2272827 30.6103071,24.2124085 30.9196946,24.2124085 Z M40.1120267,31.9411072 C40.599907,31.9411072 40.9449879,31.8935099 41.1472797,31.7983137 C41.3495715,31.7031176 41.4507159,31.5186778 41.4507159,31.2449889 C41.4507159,31.0307975 41.3198231,30.8433829 41.0580337,30.6827394 C40.7962443,30.5220959 40.3976164,30.340631 39.8621381,30.1383392 C39.4456549,29.9836454 39.0678509,29.8230043 38.7287146,29.6564111 C38.3895783,29.4898178 38.1010193,29.2905039 37.863029,29.0584633 C37.6250386,28.8264226 37.4405988,28.549763 37.3097041,28.228476 C37.1788094,27.907189 37.113363,27.5204604 37.113363,27.0682787 C37.113363,26.1877143 37.4405949,25.4916029 38.0950684,24.9799236 C38.7495419,24.4682443 39.6479421,24.2124085 40.7902959,24.2124085 C41.3614728,24.2124085 41.9088424,24.2629807 42.4324213,24.3641266 C42.9560001,24.4652725 43.372477,24.5753414 43.6818645,24.6943366 L43.2177856,26.7648425 C42.9083981,26.6577468 42.5722417,26.5625521 42.2093064,26.4792555 C41.8463711,26.3959589 41.4388187,26.3543112 40.986637,26.3543112 C40.1536707,26.3543112 39.7371938,26.5863483 39.7371938,27.0504295 C39.7371938,27.1575252 39.7550428,27.2527199 39.7907413,27.3360165 C39.8264399,27.4193132 39.8978359,27.4996337 40.0049316,27.5769806 C40.1120273,27.6543275 40.2577942,27.7376228 40.4422367,27.8268692 C40.6266793,27.9161156 40.8616912,28.0142852 41.1472797,28.1213808 C41.7303561,28.3355722 42.2122794,28.5467855 42.593064,28.755027 C42.9738485,28.9632686 43.2743069,29.1893561 43.494448,29.4332962 C43.7145891,29.6772363 43.8692805,29.9479463 43.9585269,30.2454343 C44.0477733,30.5429223 44.0923958,30.8880031 44.0923958,31.2806872 C44.0923958,32.2088497 43.7443401,32.9109108 43.0482183,33.3868915 C42.3520964,33.8628722 41.367426,34.1008591 40.0941775,34.1008591 C39.2612112,34.1008591 38.5680747,34.029463 38.0147471,33.8866688 C37.4614194,33.7438746 37.0776657,33.6248812 36.8634744,33.529685 L37.3097041,31.3699332 C37.7618858,31.548426 38.2259601,31.6882432 38.7019408,31.7893891 C39.1779216,31.890535 39.6479455,31.9411072 40.1120267,31.9411072 Z M45.9844098,22.1240535 L48.6439389,21.6956729 L48.6439389,24.4622972 L51.8389437,24.4622972 L51.8389437,26.6755966 L48.6439389,26.6755966 L48.6439389,29.9776965 C48.6439389,30.5369738 48.7421085,30.9831991 48.9384505,31.3163856 C49.1347926,31.6495721 49.5304456,31.8161629 50.1254216,31.8161629 C50.41101,31.8161629 50.7055187,31.7893894 51.0089564,31.7358416 C51.3123941,31.6822937 51.5890538,31.6079228 51.8389437,31.5127267 L52.2137766,33.5832326 C51.8924896,33.7141273 51.5355094,33.827171 51.1428253,33.9223672 C50.7501412,34.0175633 50.2682179,34.0651607 49.697041,34.0651607 C48.9711704,34.0651607 48.3702537,33.9669911 47.894273,33.7706491 C47.4182922,33.574307 47.0375134,33.3006222 46.7519249,32.9495864 C46.4663365,32.5985506 46.2670225,32.1731492 46.1539771,31.6733694 C46.0409317,31.1735896 45.9844098,30.6202673 45.9844098,30.0133948 L45.9844098,22.1240535 Z M56.6582246,33.8509704 L53.9986955,33.8509704 L53.9986955,24.4622972 L56.6582246,24.4622972 L56.6582246,33.8509704 Z M56.9081133,21.7492205 C56.9081133,22.2371008 56.750447,22.6208545 56.4351098,22.9004932 C56.1197725,23.1801318 55.7479181,23.3199491 55.3195355,23.3199491 C54.8911528,23.3199491 54.5192984,23.1801318 54.2039612,22.9004932 C53.8886239,22.6208545 53.7309577,22.2371008 53.7309577,21.7492205 C53.7309577,21.2613402 53.8886239,20.8775865 54.2039612,20.5979478 C54.5192984,20.3183091 54.8911528,20.1784919 55.3195355,20.1784919 C55.7479181,20.1784919 56.1197725,20.3183091 56.4351098,20.5979478 C56.750447,20.8775865 56.9081133,21.2613402 56.9081133,21.7492205 Z M58.7108813,29.1566338 C58.7108813,28.4783612 58.8209502,27.8387717 59.0410913,27.237846 C59.2612324,26.6369203 59.5795398,26.1133494 59.9960229,25.6671174 C60.4125061,25.2208855 60.918228,24.8668801 61.5132039,24.6050907 C62.1081799,24.3433013 62.7864423,24.2124085 63.5480115,24.2124085 C64.0477912,24.2124085 64.5059158,24.2570311 64.922399,24.3462774 C65.3388821,24.4355238 65.7434597,24.5634417 66.1361438,24.730035 L65.582819,26.8540885 C65.3329291,26.7588923 65.0592442,26.6755969 64.7617563,26.6041998 C64.4642683,26.5328027 64.1310868,26.4971047 63.7622017,26.4971047 C62.9768335,26.4971047 62.390791,26.7410411 62.0040566,27.2289214 C61.6173223,27.7168017 61.423958,28.359366 61.423958,29.1566338 C61.423958,30.0014996 61.6054229,30.6559633 61.9683583,31.1200445 C62.3312936,31.5841258 62.9649334,31.8161629 63.8692969,31.8161629 C64.1905839,31.8161629 64.5356647,31.7864146 64.9045498,31.726917 C65.2734349,31.6674194 65.6125661,31.5722246 65.9219535,31.4413299 L66.2967865,33.618931 C65.987399,33.7498257 65.6006705,33.8628694 65.1365892,33.9580655 C64.672508,34.0532617 64.1608364,34.1008591 63.601559,34.1008591 C62.7447937,34.1008591 62.0070346,33.9729411 61.3882596,33.7171015 C60.7694847,33.4612618 60.2607879,33.1132061 59.862154,32.672924 C59.4635201,32.2326418 59.1719863,31.7120456 58.9875437,31.1111199 C58.8031012,30.5101943 58.7108813,29.8587054 58.7108813,29.1566338 Z M14.2753261,50.8402482 C14.7632064,50.8402482 15.1082872,50.7926508 15.3105791,50.6974547 C15.5128709,50.6022585 15.6140153,50.4178187 15.6140153,50.1441298 C15.6140153,49.9299385 15.4831225,49.7425239 15.2213331,49.5818804 C14.9595437,49.4212369 14.5609158,49.2397719 14.0254375,49.0374801 C13.6089543,48.8827864 13.2311503,48.7221453 12.892014,48.555552 C12.5528777,48.3889588 12.2643187,48.1896448 12.0263283,47.9576042 C11.788338,47.7255636 11.6038982,47.4489039 11.4730035,47.1276169 C11.3421088,46.8063299 11.2766624,46.4196014 11.2766624,45.9674197 C11.2766624,45.0868553 11.6038943,44.3907439 12.2583678,43.8790646 C12.9128413,43.3673853 13.8112415,43.1115495 14.9535953,43.1115495 C15.5247722,43.1115495 16.0721418,43.1621217 16.5957206,43.2632676 C17.1192995,43.3644135 17.5357764,43.4744824 17.8451639,43.5934776 L17.381085,45.6639835 C17.0716975,45.5568878 16.7355411,45.4616931 16.3726058,45.3783964 C16.0096705,45.2950998 15.6021181,45.2534521 15.1499364,45.2534521 C14.3169701,45.2534521 13.9004932,45.4854892 13.9004932,45.9495705 C13.9004932,46.0566661 13.9183422,46.1518609 13.9540407,46.2351575 C13.9897393,46.3184541 14.0611353,46.3987747 14.168231,46.4761215 C14.2753267,46.5534684 14.4210936,46.6367638 14.6055361,46.7260102 C14.7899787,46.8152566 15.0249906,46.9134261 15.3105791,47.0205218 C15.8936555,47.2347131 16.3755788,47.4459264 16.7563633,47.654168 C17.1371479,47.8624096 17.4376063,48.088497 17.6577474,48.3324372 C17.8778885,48.5763773 18.0325799,48.8470873 18.1218263,49.1445752 C18.2110727,49.4420632 18.2556952,49.7871441 18.2556952,50.1798282 C18.2556952,51.1079906 17.9076395,51.8100517 17.2115177,52.2860325 C16.5153958,52.7620132 15.5307254,53 14.2574769,53 C13.4245106,53 12.7313741,52.928604 12.1780465,52.7858097 C11.6247188,52.6430155 11.2409651,52.5240221 11.0267738,52.428826 L11.4730035,50.2690741 C11.9251852,50.4475669 12.3892595,50.5873842 12.8652402,50.6885301 C13.341221,50.789676 13.8112449,50.8402482 14.2753261,50.8402482 Z M19.7907254,48.1271715 C19.7907254,47.2942052 19.9186433,46.5653706 20.174483,45.9406459 C20.4303226,45.3159212 20.766479,44.795325 21.1829621,44.3788419 C21.5994453,43.9623587 22.0783937,43.6470262 22.6198218,43.4328349 C23.1612499,43.2186435 23.7175441,43.1115495 24.288721,43.1115495 C25.6214671,43.1115495 26.6745587,43.5191019 27.4480274,44.3342189 C28.2214961,45.1493359 28.6082246,46.3481944 28.6082246,47.9308304 C28.6082246,48.0855242 28.602275,48.2550898 28.5903754,48.4395323 C28.5784759,48.6239748 28.5665766,48.7875908 28.5546771,48.930385 L22.5216513,48.930385 C22.5811489,49.4777628 22.8369847,49.9120888 23.2891664,50.2333758 C23.7413481,50.5546628 24.3482145,50.7153038 25.1097836,50.7153038 C25.5976639,50.7153038 26.0766123,50.6706813 26.5466433,50.5814349 C27.0166743,50.4921885 27.400428,50.3821196 27.697916,50.2512249 L28.0548998,52.4109768 C27.9121056,52.4823739 27.7217161,52.5537699 27.4837257,52.625167 C27.2457354,52.6965641 26.980975,52.7590357 26.6894368,52.8125835 C26.3978986,52.8661314 26.085541,52.9107539 25.7523544,52.9464524 C25.4191679,52.982151 25.0859864,53 24.7527999,53 C23.9079341,53 23.1731498,52.8750569 22.5484251,52.625167 C21.9237003,52.3752771 21.406079,52.0331711 20.9955457,51.5988387 C20.5850123,51.1645063 20.2815791,50.6498598 20.085237,50.0548839 C19.888895,49.4599079 19.7907254,48.8173436 19.7907254,48.1271715 Z M26.0379415,47.1097677 C26.0260419,46.8836769 25.9873691,46.6635391 25.9219217,46.4493478 C25.8564744,46.2351564 25.75533,46.044767 25.6184855,45.8781737 C25.4816411,45.7115805 25.3091006,45.574738 25.1008591,45.4676424 C24.8926175,45.3605467 24.6338068,45.3069997 24.3244193,45.3069997 C24.0269314,45.3069997 23.7710956,45.3575719 23.5569042,45.4587178 C23.3427129,45.5598637 23.1642228,45.6937313 23.0214286,45.8603245 C22.8786343,46.0269178 22.7685655,46.2202821 22.6912186,46.4404232 C22.6138717,46.6605643 22.5573498,46.8836769 22.5216513,47.1097677 L26.0379415,47.1097677 Z M34.2485682,50.8937957 C34.5103577,50.8937957 34.7602438,50.8878461 34.9982342,50.8759465 C35.2362245,50.864047 35.426614,50.846198 35.5694082,50.822399 L35.5694082,48.8054407 C35.4623125,48.7816416 35.3016714,48.7578429 35.0874801,48.7340439 C34.8732888,48.7102449 34.6769497,48.6983455 34.4984569,48.6983455 C34.248567,48.6983455 34.013555,48.7132197 33.7934139,48.7429685 C33.5732728,48.7727173 33.3799086,48.8292392 33.2133153,48.9125358 C33.046722,48.9958324 32.9158293,49.1088762 32.8206332,49.2516704 C32.725437,49.3944646 32.6778396,49.5729547 32.6778396,49.787146 C32.6778396,50.2036292 32.8176569,50.4921882 33.0972956,50.6528317 C33.3769343,50.8134752 33.760688,50.8937957 34.2485682,50.8937957 Z M34.034378,43.1115495 C34.8197462,43.1115495 35.4742099,43.2007945 35.9977887,43.3792873 C36.5213676,43.5577801 36.9408193,43.8136159 37.2561565,44.1468024 C37.5714938,44.4799889 37.7946064,44.8845665 37.9255011,45.3605472 C38.0563958,45.836528 38.1218422,46.3660486 38.1218422,46.949125 L38.1218422,52.4823735 C37.7410576,52.5656702 37.211537,52.6638397 36.5332644,52.7768851 C35.8549918,52.8899306 35.0339374,52.9464524 34.0700764,52.9464524 C33.4632009,52.9464524 32.9128564,52.8929054 32.4190264,52.7858097 C31.9251964,52.6787141 31.499795,52.5031988 31.1428094,52.2592587 C30.7858239,52.0153185 30.512139,51.6970112 30.3217467,51.3043271 C30.1313544,50.911643 30.0361597,50.4297197 30.0361597,49.8585428 C30.0361597,49.3111649 30.1462286,48.8470907 30.3663697,48.4663061 C30.5865108,48.0855215 30.8810195,47.7820883 31.2499045,47.5559975 C31.6187896,47.3299066 32.0412162,47.1662907 32.5171969,47.0651448 C32.9931777,46.9639989 33.4870003,46.9134267 33.9986796,46.9134267 C34.3437656,46.9134267 34.6501737,46.9283008 34.9179128,46.9580496 C35.185652,46.9877984 35.4028149,47.0264713 35.5694082,47.0740694 L35.5694082,46.8241807 C35.5694082,46.371999 35.4325658,46.0090691 35.1588769,45.7353802 C34.8851879,45.4616913 34.4092143,45.3248489 33.7309418,45.3248489 C33.2787601,45.3248489 32.8325348,45.3575721 32.3922526,45.4230194 C31.9519704,45.4884668 31.5711916,45.5806866 31.2499045,45.6996818 L30.91077,43.5577792 C31.0654637,43.5101811 31.258828,43.4596089 31.4908686,43.4060611 C31.7229092,43.3525133 31.9757702,43.3049159 32.2494591,43.2632676 C32.523148,43.2216193 32.811707,43.1859212 33.1151448,43.1561724 C33.4185825,43.1264237 33.7249905,43.1115495 34.034378,43.1115495 Z M46.1896755,45.717531 C45.9516851,45.6580334 45.6720506,45.5955619 45.3507636,45.5301145 C45.0294766,45.4646672 44.6843957,45.431944 44.3155107,45.431944 C44.1489174,45.431944 43.9496035,45.4468182 43.7175628,45.476567 C43.4855222,45.5063158 43.310007,45.539039 43.1910118,45.5747375 L43.1910118,52.7501114 L40.5314827,52.7501114 L40.5314827,43.8612154 C41.0074634,43.6946221 41.5697072,43.5369559 42.218231,43.3882119 C42.8667548,43.2394679 43.5896397,43.165097 44.3869074,43.165097 C44.5297016,43.165097 44.7022421,43.1740215 44.9045339,43.1918708 C45.1068257,43.2097201 45.3091145,43.2335188 45.5114063,43.2632676 C45.7136981,43.2930164 45.9159869,43.3287144 46.1182787,43.3703627 C46.3205705,43.412011 46.493111,43.4625832 46.6359052,43.5220808 L46.1896755,45.717531 Z M47.4391187,48.0557747 C47.4391187,47.3775022 47.5491876,46.7379126 47.7693287,46.136987 C47.9894698,45.5360613 48.3077771,45.0124903 48.7242603,44.5662584 C49.1407434,44.1200264 49.6464654,43.766021 50.2414413,43.5042316 C50.8364172,43.2424422 51.5146796,43.1115495 52.2762488,43.1115495 C52.7760286,43.1115495 53.2341532,43.156172 53.6506363,43.2454184 C54.0671195,43.3346648 54.4716971,43.4625827 54.8643812,43.6291759 L54.3110563,45.7532294 C54.0611664,45.6580332 53.7874816,45.5747379 53.4899936,45.5033408 C53.1925057,45.4319436 52.8593241,45.3962456 52.4904391,45.3962456 C51.7050708,45.3962456 51.1190283,45.6401821 50.732294,46.1280624 C50.3455596,46.6159426 50.1521954,47.258507 50.1521954,48.0557747 C50.1521954,48.9006406 50.3336603,49.5551043 50.6965956,50.0191855 C51.0595309,50.4832667 51.6931708,50.7153038 52.5975342,50.7153038 C52.9188212,50.7153038 53.2639021,50.6855555 53.6327871,50.6260579 C54.0016722,50.5665603 54.3408034,50.4713656 54.6501909,50.3404709 L55.0250239,52.5180719 C54.7156364,52.6489666 54.3289078,52.7620103 53.8648266,52.8572065 C53.4007454,52.9524026 52.8890737,53 52.3297964,53 C51.473031,53 50.7352719,52.8720821 50.116497,52.6162424 C49.497722,52.3604028 48.9890252,52.0123471 48.5903913,51.5720649 C48.1917575,51.1317827 47.9002236,50.6111866 47.7157811,50.0102609 C47.5313386,49.4093352 47.4391187,48.7578463 47.4391187,48.0557747 Z M56.8099427,52.7501114 L56.8099427,39.3275215 L59.4694718,38.8991409 L59.4694718,43.3971365 C59.6479646,43.3376389 59.8770269,43.281117 60.1566656,43.2275692 C60.4363043,43.1740214 60.7070143,43.1472479 60.9688037,43.1472479 C61.7303729,43.1472479 62.3640127,43.2513671 62.8697423,43.4596087 C63.3754718,43.6678502 63.7800494,43.9623589 64.0834871,44.3431435 C64.3869248,44.7239281 64.601113,45.176103 64.7260579,45.6996818 C64.8510029,46.2232607 64.9134744,46.8063283 64.9134744,47.4489023 L64.9134744,52.7501114 L62.2539453,52.7501114 L62.2539453,47.7701877 C62.2539453,46.9134224 62.1438764,46.306556 61.9237353,45.9495705 C61.7035942,45.5925849 61.2960418,45.4140948 60.7010659,45.4140948 C60.4630755,45.4140948 60.2399629,45.4349187 60.0317213,45.476567 C59.8234797,45.5182153 59.6360651,45.5628378 59.4694718,45.6104359 L59.4694718,52.7501114 L56.8099427,52.7501114 Z" id="Elasticsearch" fill="#FFFFFF" fillRule="nonzero"></path>
+                <path
+                  d="M11,33.8509704 L11,21.4814827 L19.3534203,21.4814827 L19.3534203,23.8197264 L13.7844734,23.8197264 L13.7844734,26.247216 L18.7286987,26.247216 L18.7286987,28.5319122 L13.7844734,28.5319122 L13.7844734,31.5127267 L19.7639516,31.5127267 L19.7639516,33.8509704 L11,33.8509704 Z M25.3864461,34.0294623 C24.6129774,34.0175628 23.9852872,33.9342674 23.5033567,33.7795737 C23.0214262,33.6248799 22.6406473,33.407717 22.3610086,33.1280783 C22.0813699,32.8484396 21.8909805,32.5093084 21.7898346,32.1106745 C21.6886886,31.7120406 21.6381164,31.2628406 21.6381164,30.7630608 L21.6381164,20.4283805 L24.2976456,20 L24.2976456,30.2275851 C24.2976456,30.4655755 24.3154946,30.6797636 24.3511931,30.8701559 C24.3868917,31.0605482 24.4553129,31.2211893 24.5564588,31.352084 C24.6576047,31.4829787 24.8033716,31.5900728 24.9937639,31.6733694 C25.1841562,31.756666 25.439992,31.8102131 25.761279,31.8340121 L25.3864461,34.0294623 Z M31.1338848,31.9946548 C31.3956742,31.9946548 31.6455604,31.9887051 31.8835507,31.9768056 C32.1215411,31.9649061 32.3119306,31.9470571 32.4547248,31.923258 L32.4547248,29.9062997 C32.3476291,29.8825007 32.186988,29.858702 31.9727967,29.834903 C31.7586054,29.8111039 31.5622662,29.7992046 31.3837735,29.7992046 C31.1338836,29.7992046 30.8988716,29.8140788 30.6787305,29.8438276 C30.4585894,29.8735763 30.2652251,29.9300982 30.0986319,30.0133948 C29.9320386,30.0966915 29.8011459,30.2097352 29.7059497,30.3525294 C29.6107536,30.4953237 29.5631562,30.6738138 29.5631562,30.8880051 C29.5631562,31.3044882 29.7029735,31.5930472 29.9826122,31.7536907 C30.2622508,31.9143342 30.6460046,31.9946548 31.1338848,31.9946548 Z M30.9196946,24.2124085 C31.7050628,24.2124085 32.3595265,24.3016536 32.8831053,24.4801464 C33.4066841,24.6586391 33.8261359,24.9144749 34.1414731,25.2476615 C34.4568104,25.580848 34.679923,25.9854256 34.8108177,26.4614063 C34.9417124,26.937387 35.0071588,27.4669077 35.0071588,28.0499841 L35.0071588,33.5832326 C34.6263742,33.6665292 34.0968535,33.7646988 33.418581,33.8777442 C32.7403084,33.9907896 31.9192539,34.0473115 30.9553929,34.0473115 C30.3485175,34.0473115 29.798173,33.9937645 29.304343,33.8866688 C28.810513,33.7795731 28.3851116,33.6040579 28.028126,33.3601177 C27.6711404,33.1161776 27.3974556,32.7978702 27.2070633,32.4051861 C27.016671,32.012502 26.9214763,31.5305787 26.9214763,30.9594018 C26.9214763,30.412024 27.0315452,29.9479497 27.2516863,29.5671651 C27.4718274,29.1863805 27.766336,28.8829474 28.1352211,28.6568565 C28.5041062,28.4307657 28.9265328,28.2671497 29.4025135,28.1660038 C29.8784943,28.0648579 30.3723169,28.0142857 30.8839962,28.0142857 C31.2290822,28.0142857 31.5354902,28.0291599 31.8032294,28.0589087 C32.0709686,28.0886575 32.2881315,28.1273303 32.4547248,28.1749284 L32.4547248,27.9250398 C32.4547248,27.4728581 32.3178824,27.1099282 32.0441934,26.8362393 C31.7705045,26.5625503 31.2945309,26.4257079 30.6162584,26.4257079 C30.1640766,26.4257079 29.7178514,26.4584311 29.2775692,26.5238785 C28.837287,26.5893258 28.4565081,26.6815457 28.1352211,26.8005409 L27.7960865,24.6586382 C27.9507803,24.6110402 28.1441446,24.560468 28.3761852,24.5069201 C28.6082258,24.4533723 28.8610868,24.4057749 29.1347757,24.3641266 C29.4084646,24.3224783 29.6970236,24.2867803 30.0004613,24.2570315 C30.3038991,24.2272827 30.6103071,24.2124085 30.9196946,24.2124085 Z M40.1120267,31.9411072 C40.599907,31.9411072 40.9449879,31.8935099 41.1472797,31.7983137 C41.3495715,31.7031176 41.4507159,31.5186778 41.4507159,31.2449889 C41.4507159,31.0307975 41.3198231,30.8433829 41.0580337,30.6827394 C40.7962443,30.5220959 40.3976164,30.340631 39.8621381,30.1383392 C39.4456549,29.9836454 39.0678509,29.8230043 38.7287146,29.6564111 C38.3895783,29.4898178 38.1010193,29.2905039 37.863029,29.0584633 C37.6250386,28.8264226 37.4405988,28.549763 37.3097041,28.228476 C37.1788094,27.907189 37.113363,27.5204604 37.113363,27.0682787 C37.113363,26.1877143 37.4405949,25.4916029 38.0950684,24.9799236 C38.7495419,24.4682443 39.6479421,24.2124085 40.7902959,24.2124085 C41.3614728,24.2124085 41.9088424,24.2629807 42.4324213,24.3641266 C42.9560001,24.4652725 43.372477,24.5753414 43.6818645,24.6943366 L43.2177856,26.7648425 C42.9083981,26.6577468 42.5722417,26.5625521 42.2093064,26.4792555 C41.8463711,26.3959589 41.4388187,26.3543112 40.986637,26.3543112 C40.1536707,26.3543112 39.7371938,26.5863483 39.7371938,27.0504295 C39.7371938,27.1575252 39.7550428,27.2527199 39.7907413,27.3360165 C39.8264399,27.4193132 39.8978359,27.4996337 40.0049316,27.5769806 C40.1120273,27.6543275 40.2577942,27.7376228 40.4422367,27.8268692 C40.6266793,27.9161156 40.8616912,28.0142852 41.1472797,28.1213808 C41.7303561,28.3355722 42.2122794,28.5467855 42.593064,28.755027 C42.9738485,28.9632686 43.2743069,29.1893561 43.494448,29.4332962 C43.7145891,29.6772363 43.8692805,29.9479463 43.9585269,30.2454343 C44.0477733,30.5429223 44.0923958,30.8880031 44.0923958,31.2806872 C44.0923958,32.2088497 43.7443401,32.9109108 43.0482183,33.3868915 C42.3520964,33.8628722 41.367426,34.1008591 40.0941775,34.1008591 C39.2612112,34.1008591 38.5680747,34.029463 38.0147471,33.8866688 C37.4614194,33.7438746 37.0776657,33.6248812 36.8634744,33.529685 L37.3097041,31.3699332 C37.7618858,31.548426 38.2259601,31.6882432 38.7019408,31.7893891 C39.1779216,31.890535 39.6479455,31.9411072 40.1120267,31.9411072 Z M45.9844098,22.1240535 L48.6439389,21.6956729 L48.6439389,24.4622972 L51.8389437,24.4622972 L51.8389437,26.6755966 L48.6439389,26.6755966 L48.6439389,29.9776965 C48.6439389,30.5369738 48.7421085,30.9831991 48.9384505,31.3163856 C49.1347926,31.6495721 49.5304456,31.8161629 50.1254216,31.8161629 C50.41101,31.8161629 50.7055187,31.7893894 51.0089564,31.7358416 C51.3123941,31.6822937 51.5890538,31.6079228 51.8389437,31.5127267 L52.2137766,33.5832326 C51.8924896,33.7141273 51.5355094,33.827171 51.1428253,33.9223672 C50.7501412,34.0175633 50.2682179,34.0651607 49.697041,34.0651607 C48.9711704,34.0651607 48.3702537,33.9669911 47.894273,33.7706491 C47.4182922,33.574307 47.0375134,33.3006222 46.7519249,32.9495864 C46.4663365,32.5985506 46.2670225,32.1731492 46.1539771,31.6733694 C46.0409317,31.1735896 45.9844098,30.6202673 45.9844098,30.0133948 L45.9844098,22.1240535 Z M56.6582246,33.8509704 L53.9986955,33.8509704 L53.9986955,24.4622972 L56.6582246,24.4622972 L56.6582246,33.8509704 Z M56.9081133,21.7492205 C56.9081133,22.2371008 56.750447,22.6208545 56.4351098,22.9004932 C56.1197725,23.1801318 55.7479181,23.3199491 55.3195355,23.3199491 C54.8911528,23.3199491 54.5192984,23.1801318 54.2039612,22.9004932 C53.8886239,22.6208545 53.7309577,22.2371008 53.7309577,21.7492205 C53.7309577,21.2613402 53.8886239,20.8775865 54.2039612,20.5979478 C54.5192984,20.3183091 54.8911528,20.1784919 55.3195355,20.1784919 C55.7479181,20.1784919 56.1197725,20.3183091 56.4351098,20.5979478 C56.750447,20.8775865 56.9081133,21.2613402 56.9081133,21.7492205 Z M58.7108813,29.1566338 C58.7108813,28.4783612 58.8209502,27.8387717 59.0410913,27.237846 C59.2612324,26.6369203 59.5795398,26.1133494 59.9960229,25.6671174 C60.4125061,25.2208855 60.918228,24.8668801 61.5132039,24.6050907 C62.1081799,24.3433013 62.7864423,24.2124085 63.5480115,24.2124085 C64.0477912,24.2124085 64.5059158,24.2570311 64.922399,24.3462774 C65.3388821,24.4355238 65.7434597,24.5634417 66.1361438,24.730035 L65.582819,26.8540885 C65.3329291,26.7588923 65.0592442,26.6755969 64.7617563,26.6041998 C64.4642683,26.5328027 64.1310868,26.4971047 63.7622017,26.4971047 C62.9768335,26.4971047 62.390791,26.7410411 62.0040566,27.2289214 C61.6173223,27.7168017 61.423958,28.359366 61.423958,29.1566338 C61.423958,30.0014996 61.6054229,30.6559633 61.9683583,31.1200445 C62.3312936,31.5841258 62.9649334,31.8161629 63.8692969,31.8161629 C64.1905839,31.8161629 64.5356647,31.7864146 64.9045498,31.726917 C65.2734349,31.6674194 65.6125661,31.5722246 65.9219535,31.4413299 L66.2967865,33.618931 C65.987399,33.7498257 65.6006705,33.8628694 65.1365892,33.9580655 C64.672508,34.0532617 64.1608364,34.1008591 63.601559,34.1008591 C62.7447937,34.1008591 62.0070346,33.9729411 61.3882596,33.7171015 C60.7694847,33.4612618 60.2607879,33.1132061 59.862154,32.672924 C59.4635201,32.2326418 59.1719863,31.7120456 58.9875437,31.1111199 C58.8031012,30.5101943 58.7108813,29.8587054 58.7108813,29.1566338 Z M14.2753261,50.8402482 C14.7632064,50.8402482 15.1082872,50.7926508 15.3105791,50.6974547 C15.5128709,50.6022585 15.6140153,50.4178187 15.6140153,50.1441298 C15.6140153,49.9299385 15.4831225,49.7425239 15.2213331,49.5818804 C14.9595437,49.4212369 14.5609158,49.2397719 14.0254375,49.0374801 C13.6089543,48.8827864 13.2311503,48.7221453 12.892014,48.555552 C12.5528777,48.3889588 12.2643187,48.1896448 12.0263283,47.9576042 C11.788338,47.7255636 11.6038982,47.4489039 11.4730035,47.1276169 C11.3421088,46.8063299 11.2766624,46.4196014 11.2766624,45.9674197 C11.2766624,45.0868553 11.6038943,44.3907439 12.2583678,43.8790646 C12.9128413,43.3673853 13.8112415,43.1115495 14.9535953,43.1115495 C15.5247722,43.1115495 16.0721418,43.1621217 16.5957206,43.2632676 C17.1192995,43.3644135 17.5357764,43.4744824 17.8451639,43.5934776 L17.381085,45.6639835 C17.0716975,45.5568878 16.7355411,45.4616931 16.3726058,45.3783964 C16.0096705,45.2950998 15.6021181,45.2534521 15.1499364,45.2534521 C14.3169701,45.2534521 13.9004932,45.4854892 13.9004932,45.9495705 C13.9004932,46.0566661 13.9183422,46.1518609 13.9540407,46.2351575 C13.9897393,46.3184541 14.0611353,46.3987747 14.168231,46.4761215 C14.2753267,46.5534684 14.4210936,46.6367638 14.6055361,46.7260102 C14.7899787,46.8152566 15.0249906,46.9134261 15.3105791,47.0205218 C15.8936555,47.2347131 16.3755788,47.4459264 16.7563633,47.654168 C17.1371479,47.8624096 17.4376063,48.088497 17.6577474,48.3324372 C17.8778885,48.5763773 18.0325799,48.8470873 18.1218263,49.1445752 C18.2110727,49.4420632 18.2556952,49.7871441 18.2556952,50.1798282 C18.2556952,51.1079906 17.9076395,51.8100517 17.2115177,52.2860325 C16.5153958,52.7620132 15.5307254,53 14.2574769,53 C13.4245106,53 12.7313741,52.928604 12.1780465,52.7858097 C11.6247188,52.6430155 11.2409651,52.5240221 11.0267738,52.428826 L11.4730035,50.2690741 C11.9251852,50.4475669 12.3892595,50.5873842 12.8652402,50.6885301 C13.341221,50.789676 13.8112449,50.8402482 14.2753261,50.8402482 Z M19.7907254,48.1271715 C19.7907254,47.2942052 19.9186433,46.5653706 20.174483,45.9406459 C20.4303226,45.3159212 20.766479,44.795325 21.1829621,44.3788419 C21.5994453,43.9623587 22.0783937,43.6470262 22.6198218,43.4328349 C23.1612499,43.2186435 23.7175441,43.1115495 24.288721,43.1115495 C25.6214671,43.1115495 26.6745587,43.5191019 27.4480274,44.3342189 C28.2214961,45.1493359 28.6082246,46.3481944 28.6082246,47.9308304 C28.6082246,48.0855242 28.602275,48.2550898 28.5903754,48.4395323 C28.5784759,48.6239748 28.5665766,48.7875908 28.5546771,48.930385 L22.5216513,48.930385 C22.5811489,49.4777628 22.8369847,49.9120888 23.2891664,50.2333758 C23.7413481,50.5546628 24.3482145,50.7153038 25.1097836,50.7153038 C25.5976639,50.7153038 26.0766123,50.6706813 26.5466433,50.5814349 C27.0166743,50.4921885 27.400428,50.3821196 27.697916,50.2512249 L28.0548998,52.4109768 C27.9121056,52.4823739 27.7217161,52.5537699 27.4837257,52.625167 C27.2457354,52.6965641 26.980975,52.7590357 26.6894368,52.8125835 C26.3978986,52.8661314 26.085541,52.9107539 25.7523544,52.9464524 C25.4191679,52.982151 25.0859864,53 24.7527999,53 C23.9079341,53 23.1731498,52.8750569 22.5484251,52.625167 C21.9237003,52.3752771 21.406079,52.0331711 20.9955457,51.5988387 C20.5850123,51.1645063 20.2815791,50.6498598 20.085237,50.0548839 C19.888895,49.4599079 19.7907254,48.8173436 19.7907254,48.1271715 Z M26.0379415,47.1097677 C26.0260419,46.8836769 25.9873691,46.6635391 25.9219217,46.4493478 C25.8564744,46.2351564 25.75533,46.044767 25.6184855,45.8781737 C25.4816411,45.7115805 25.3091006,45.574738 25.1008591,45.4676424 C24.8926175,45.3605467 24.6338068,45.3069997 24.3244193,45.3069997 C24.0269314,45.3069997 23.7710956,45.3575719 23.5569042,45.4587178 C23.3427129,45.5598637 23.1642228,45.6937313 23.0214286,45.8603245 C22.8786343,46.0269178 22.7685655,46.2202821 22.6912186,46.4404232 C22.6138717,46.6605643 22.5573498,46.8836769 22.5216513,47.1097677 L26.0379415,47.1097677 Z M34.2485682,50.8937957 C34.5103577,50.8937957 34.7602438,50.8878461 34.9982342,50.8759465 C35.2362245,50.864047 35.426614,50.846198 35.5694082,50.822399 L35.5694082,48.8054407 C35.4623125,48.7816416 35.3016714,48.7578429 35.0874801,48.7340439 C34.8732888,48.7102449 34.6769497,48.6983455 34.4984569,48.6983455 C34.248567,48.6983455 34.013555,48.7132197 33.7934139,48.7429685 C33.5732728,48.7727173 33.3799086,48.8292392 33.2133153,48.9125358 C33.046722,48.9958324 32.9158293,49.1088762 32.8206332,49.2516704 C32.725437,49.3944646 32.6778396,49.5729547 32.6778396,49.787146 C32.6778396,50.2036292 32.8176569,50.4921882 33.0972956,50.6528317 C33.3769343,50.8134752 33.760688,50.8937957 34.2485682,50.8937957 Z M34.034378,43.1115495 C34.8197462,43.1115495 35.4742099,43.2007945 35.9977887,43.3792873 C36.5213676,43.5577801 36.9408193,43.8136159 37.2561565,44.1468024 C37.5714938,44.4799889 37.7946064,44.8845665 37.9255011,45.3605472 C38.0563958,45.836528 38.1218422,46.3660486 38.1218422,46.949125 L38.1218422,52.4823735 C37.7410576,52.5656702 37.211537,52.6638397 36.5332644,52.7768851 C35.8549918,52.8899306 35.0339374,52.9464524 34.0700764,52.9464524 C33.4632009,52.9464524 32.9128564,52.8929054 32.4190264,52.7858097 C31.9251964,52.6787141 31.499795,52.5031988 31.1428094,52.2592587 C30.7858239,52.0153185 30.512139,51.6970112 30.3217467,51.3043271 C30.1313544,50.911643 30.0361597,50.4297197 30.0361597,49.8585428 C30.0361597,49.3111649 30.1462286,48.8470907 30.3663697,48.4663061 C30.5865108,48.0855215 30.8810195,47.7820883 31.2499045,47.5559975 C31.6187896,47.3299066 32.0412162,47.1662907 32.5171969,47.0651448 C32.9931777,46.9639989 33.4870003,46.9134267 33.9986796,46.9134267 C34.3437656,46.9134267 34.6501737,46.9283008 34.9179128,46.9580496 C35.185652,46.9877984 35.4028149,47.0264713 35.5694082,47.0740694 L35.5694082,46.8241807 C35.5694082,46.371999 35.4325658,46.0090691 35.1588769,45.7353802 C34.8851879,45.4616913 34.4092143,45.3248489 33.7309418,45.3248489 C33.2787601,45.3248489 32.8325348,45.3575721 32.3922526,45.4230194 C31.9519704,45.4884668 31.5711916,45.5806866 31.2499045,45.6996818 L30.91077,43.5577792 C31.0654637,43.5101811 31.258828,43.4596089 31.4908686,43.4060611 C31.7229092,43.3525133 31.9757702,43.3049159 32.2494591,43.2632676 C32.523148,43.2216193 32.811707,43.1859212 33.1151448,43.1561724 C33.4185825,43.1264237 33.7249905,43.1115495 34.034378,43.1115495 Z M46.1896755,45.717531 C45.9516851,45.6580334 45.6720506,45.5955619 45.3507636,45.5301145 C45.0294766,45.4646672 44.6843957,45.431944 44.3155107,45.431944 C44.1489174,45.431944 43.9496035,45.4468182 43.7175628,45.476567 C43.4855222,45.5063158 43.310007,45.539039 43.1910118,45.5747375 L43.1910118,52.7501114 L40.5314827,52.7501114 L40.5314827,43.8612154 C41.0074634,43.6946221 41.5697072,43.5369559 42.218231,43.3882119 C42.8667548,43.2394679 43.5896397,43.165097 44.3869074,43.165097 C44.5297016,43.165097 44.7022421,43.1740215 44.9045339,43.1918708 C45.1068257,43.2097201 45.3091145,43.2335188 45.5114063,43.2632676 C45.7136981,43.2930164 45.9159869,43.3287144 46.1182787,43.3703627 C46.3205705,43.412011 46.493111,43.4625832 46.6359052,43.5220808 L46.1896755,45.717531 Z M47.4391187,48.0557747 C47.4391187,47.3775022 47.5491876,46.7379126 47.7693287,46.136987 C47.9894698,45.5360613 48.3077771,45.0124903 48.7242603,44.5662584 C49.1407434,44.1200264 49.6464654,43.766021 50.2414413,43.5042316 C50.8364172,43.2424422 51.5146796,43.1115495 52.2762488,43.1115495 C52.7760286,43.1115495 53.2341532,43.156172 53.6506363,43.2454184 C54.0671195,43.3346648 54.4716971,43.4625827 54.8643812,43.6291759 L54.3110563,45.7532294 C54.0611664,45.6580332 53.7874816,45.5747379 53.4899936,45.5033408 C53.1925057,45.4319436 52.8593241,45.3962456 52.4904391,45.3962456 C51.7050708,45.3962456 51.1190283,45.6401821 50.732294,46.1280624 C50.3455596,46.6159426 50.1521954,47.258507 50.1521954,48.0557747 C50.1521954,48.9006406 50.3336603,49.5551043 50.6965956,50.0191855 C51.0595309,50.4832667 51.6931708,50.7153038 52.5975342,50.7153038 C52.9188212,50.7153038 53.2639021,50.6855555 53.6327871,50.6260579 C54.0016722,50.5665603 54.3408034,50.4713656 54.6501909,50.3404709 L55.0250239,52.5180719 C54.7156364,52.6489666 54.3289078,52.7620103 53.8648266,52.8572065 C53.4007454,52.9524026 52.8890737,53 52.3297964,53 C51.473031,53 50.7352719,52.8720821 50.116497,52.6162424 C49.497722,52.3604028 48.9890252,52.0123471 48.5903913,51.5720649 C48.1917575,51.1317827 47.9002236,50.6111866 47.7157811,50.0102609 C47.5313386,49.4093352 47.4391187,48.7578463 47.4391187,48.0557747 Z M56.8099427,52.7501114 L56.8099427,39.3275215 L59.4694718,38.8991409 L59.4694718,43.3971365 C59.6479646,43.3376389 59.8770269,43.281117 60.1566656,43.2275692 C60.4363043,43.1740214 60.7070143,43.1472479 60.9688037,43.1472479 C61.7303729,43.1472479 62.3640127,43.2513671 62.8697423,43.4596087 C63.3754718,43.6678502 63.7800494,43.9623589 64.0834871,44.3431435 C64.3869248,44.7239281 64.601113,45.176103 64.7260579,45.6996818 C64.8510029,46.2232607 64.9134744,46.8063283 64.9134744,47.4489023 L64.9134744,52.7501114 L62.2539453,52.7501114 L62.2539453,47.7701877 C62.2539453,46.9134224 62.1438764,46.306556 61.9237353,45.9495705 C61.7035942,45.5925849 61.2960418,45.4140948 60.7010659,45.4140948 C60.4630755,45.4140948 60.2399629,45.4349187 60.0317213,45.476567 C59.8234797,45.5182153 59.6360651,45.5628378 59.4694718,45.6104359 L59.4694718,52.7501114 L56.8099427,52.7501114 Z"
+                  id="Elasticsearch"
+                  fill="#FFFFFF"
+                  fillRule="nonzero"
+                ></path>
               </g>
             </a>
             <a href="/docs/reference/configuration/sinks/aws_s3">
               <g id="Sink-1" transform="translate(1.000000, 58.000000)">
                 <circle id="Oval-Copy-2" fill="#000000" cx="37.5" cy="37.5" r="37.5"></circle>
-                <path d="M25.8375,45.7875 C26.6625041,45.7875 27.3437473,45.7187507 27.88125,45.58125 C28.4187527,45.4437493 28.8499984,45.2562512 29.175,45.01875 C29.5000016,44.7812488 29.7249994,44.5000016 29.85,44.175 C29.9750006,43.8499984 30.0375,43.487502 30.0375,43.0875 C30.0375,42.2374957 29.6375,41.5312528 28.8375,40.96875 C28.037496,40.4062472 26.6625097,39.8000033 24.7125,39.15 C23.8624957,38.8499985 23.0125042,38.5062519 22.1625,38.11875 C21.3124958,37.7312481 20.5500034,37.2437529 19.875,36.65625 C19.1999966,36.0687471 18.6500021,35.3562542 18.225,34.51875 C17.7999979,33.6812458 17.5875,32.6625 17.5875,31.4625 C17.5875,30.262494 17.8124977,29.1812548 18.2625,28.21875 C18.7125022,27.2562452 19.3499959,26.4375034 20.175,25.7625 C21.0000041,25.0874966 21.9999941,24.5687518 23.175,24.20625 C24.3500059,23.8437482 25.6749926,23.6625 27.15,23.6625 C28.9000087,23.6625 30.4124936,23.8499981 31.6875,24.225 C32.9625064,24.6000019 34.0124959,25.0124978 34.8375,25.4625 L33.15,30.075 C32.4249964,29.6999981 31.6187544,29.3687514 30.73125,29.08125 C29.8437456,28.7937486 28.7750063,28.65 27.525,28.65 C26.124993,28.65 25.1187531,28.8437481 24.50625,29.23125 C23.8937469,29.6187519 23.5875,30.212496 23.5875,31.0125 C23.5875,31.4875024 23.6999989,31.8874984 23.925,32.2125 C24.1500011,32.5375016 24.4687479,32.8312487 24.88125,33.09375 C25.2937521,33.3562513 25.7687473,33.5937489 26.30625,33.80625 C26.8437527,34.0187511 27.4374967,34.2374989 28.0875,34.4625 C29.4375068,34.9625025 30.612495,35.4562476 31.6125,35.94375 C32.612505,36.4312524 33.4437467,36.9999968 34.10625,37.65 C34.7687533,38.3000033 35.2624984,39.0624956 35.5875,39.9375 C35.9125016,40.8125044 36.075,41.8749938 36.075,43.125 C36.075,45.5500121 35.2250085,47.4312433 33.525,48.76875 C31.8249915,50.1062567 29.2625171,50.775 25.8375,50.775 C24.6874942,50.775 23.6500046,50.7062507 22.725,50.56875 C21.7999954,50.4312493 20.9812536,50.262501 20.26875,50.0625 C19.5562464,49.862499 18.9437526,49.6500011 18.43125,49.425 C17.9187474,49.1999989 17.4875017,48.987501 17.1375,48.7875 L18.7875,44.1375 C19.5625039,44.5625021 20.5187443,44.9437483 21.65625,45.28125 C22.7937557,45.6187517 24.1874917,45.7875 25.8375,45.7875 Z M46.125,50.8125 C45.4499966,50.8125 44.7375038,50.7687504 43.9875,50.68125 C43.2374962,50.5937496 42.5125035,50.4750008 41.8125,50.325 C41.1124965,50.1749993 40.4750029,50.0125009 39.9,49.8375 C39.3249971,49.6625 38.8750016,49.5000007 38.55,49.35 L39.6375,44.7 C40.2875032,44.9750014 41.1187449,45.2687484 42.13125,45.58125 C43.1437551,45.8937516 44.3999925,46.05 45.9,46.05 C47.6250086,46.05 48.887496,45.7250033 49.6875,45.075 C50.487504,44.4249967 50.8875,43.5500055 50.8875,42.45 C50.8875,41.7749966 50.7437514,41.2062523 50.45625,40.74375 C50.1687486,40.2812477 49.7750025,39.9062514 49.275,39.61875 C48.7749975,39.3312486 48.1812534,39.1312506 47.49375,39.01875 C46.8062466,38.9062494 46.0750039,38.85 45.3,38.85 L43.125,38.85 L43.125,34.35 L45.6,34.35 C46.1500027,34.35 46.6812474,34.3000005 47.19375,34.2 C47.7062526,34.0999995 48.162498,33.9312512 48.5625,33.69375 C48.962502,33.4562488 49.2812488,33.1312521 49.51875,32.71875 C49.7562512,32.3062479 49.875,31.7875031 49.875,31.1625 C49.875,30.6874976 49.775001,30.2750017 49.575,29.925 C49.374999,29.5749983 49.1187516,29.2875011 48.80625,29.0625 C48.4937484,28.8374989 48.1312521,28.6687506 47.71875,28.55625 C47.3062479,28.4437494 46.8875021,28.3875 46.4625,28.3875 C45.3874946,28.3875 44.3937546,28.5499984 43.48125,28.875 C42.5687454,29.2000016 41.7375038,29.5999976 40.9875,30.075 L39,25.9875 C39.400002,25.7374988 39.8687473,25.4750014 40.40625,25.2 C40.9437527,24.9249986 41.5374968,24.6750011 42.1875,24.45 C42.8375032,24.2249989 43.5312463,24.0375007 44.26875,23.8875 C45.0062537,23.7374992 45.7874959,23.6625 46.6125,23.6625 C48.1375076,23.6625 49.4562444,23.8437482 50.56875,24.20625 C51.6812556,24.5687518 52.5999964,25.0812467 53.325,25.74375 C54.05,26.4062533 54.5874982,27.1812456 54.9375,28.06875 C55.2875017,28.9562544 55.4625,29.9249948 55.4625,30.975 C55.4625,32.0000051 55.1750029,32.9937452 54.6,33.95625 C54.0249971,34.9187548 53.2500049,35.6499975 52.275,36.15 C53.6250067,36.7000028 54.6687463,37.5187446 55.40625,38.60625 C56.1437537,39.6937554 56.5125,40.9999924 56.5125,42.525 C56.5125,43.725006 56.312502,44.8312449 55.9125,45.84375 C55.512498,46.8562551 54.8875042,47.7312463 54.0375,48.46875 C53.1874957,49.2062537 52.1062566,49.7812479 50.79375,50.19375 C49.4812434,50.6062521 47.925009,50.8125 46.125,50.8125 Z" id="S3" fill="#FFFFFF" fillRule="nonzero"></path>
+                <path
+                  d="M25.8375,45.7875 C26.6625041,45.7875 27.3437473,45.7187507 27.88125,45.58125 C28.4187527,45.4437493 28.8499984,45.2562512 29.175,45.01875 C29.5000016,44.7812488 29.7249994,44.5000016 29.85,44.175 C29.9750006,43.8499984 30.0375,43.487502 30.0375,43.0875 C30.0375,42.2374957 29.6375,41.5312528 28.8375,40.96875 C28.037496,40.4062472 26.6625097,39.8000033 24.7125,39.15 C23.8624957,38.8499985 23.0125042,38.5062519 22.1625,38.11875 C21.3124958,37.7312481 20.5500034,37.2437529 19.875,36.65625 C19.1999966,36.0687471 18.6500021,35.3562542 18.225,34.51875 C17.7999979,33.6812458 17.5875,32.6625 17.5875,31.4625 C17.5875,30.262494 17.8124977,29.1812548 18.2625,28.21875 C18.7125022,27.2562452 19.3499959,26.4375034 20.175,25.7625 C21.0000041,25.0874966 21.9999941,24.5687518 23.175,24.20625 C24.3500059,23.8437482 25.6749926,23.6625 27.15,23.6625 C28.9000087,23.6625 30.4124936,23.8499981 31.6875,24.225 C32.9625064,24.6000019 34.0124959,25.0124978 34.8375,25.4625 L33.15,30.075 C32.4249964,29.6999981 31.6187544,29.3687514 30.73125,29.08125 C29.8437456,28.7937486 28.7750063,28.65 27.525,28.65 C26.124993,28.65 25.1187531,28.8437481 24.50625,29.23125 C23.8937469,29.6187519 23.5875,30.212496 23.5875,31.0125 C23.5875,31.4875024 23.6999989,31.8874984 23.925,32.2125 C24.1500011,32.5375016 24.4687479,32.8312487 24.88125,33.09375 C25.2937521,33.3562513 25.7687473,33.5937489 26.30625,33.80625 C26.8437527,34.0187511 27.4374967,34.2374989 28.0875,34.4625 C29.4375068,34.9625025 30.612495,35.4562476 31.6125,35.94375 C32.612505,36.4312524 33.4437467,36.9999968 34.10625,37.65 C34.7687533,38.3000033 35.2624984,39.0624956 35.5875,39.9375 C35.9125016,40.8125044 36.075,41.8749938 36.075,43.125 C36.075,45.5500121 35.2250085,47.4312433 33.525,48.76875 C31.8249915,50.1062567 29.2625171,50.775 25.8375,50.775 C24.6874942,50.775 23.6500046,50.7062507 22.725,50.56875 C21.7999954,50.4312493 20.9812536,50.262501 20.26875,50.0625 C19.5562464,49.862499 18.9437526,49.6500011 18.43125,49.425 C17.9187474,49.1999989 17.4875017,48.987501 17.1375,48.7875 L18.7875,44.1375 C19.5625039,44.5625021 20.5187443,44.9437483 21.65625,45.28125 C22.7937557,45.6187517 24.1874917,45.7875 25.8375,45.7875 Z M46.125,50.8125 C45.4499966,50.8125 44.7375038,50.7687504 43.9875,50.68125 C43.2374962,50.5937496 42.5125035,50.4750008 41.8125,50.325 C41.1124965,50.1749993 40.4750029,50.0125009 39.9,49.8375 C39.3249971,49.6625 38.8750016,49.5000007 38.55,49.35 L39.6375,44.7 C40.2875032,44.9750014 41.1187449,45.2687484 42.13125,45.58125 C43.1437551,45.8937516 44.3999925,46.05 45.9,46.05 C47.6250086,46.05 48.887496,45.7250033 49.6875,45.075 C50.487504,44.4249967 50.8875,43.5500055 50.8875,42.45 C50.8875,41.7749966 50.7437514,41.2062523 50.45625,40.74375 C50.1687486,40.2812477 49.7750025,39.9062514 49.275,39.61875 C48.7749975,39.3312486 48.1812534,39.1312506 47.49375,39.01875 C46.8062466,38.9062494 46.0750039,38.85 45.3,38.85 L43.125,38.85 L43.125,34.35 L45.6,34.35 C46.1500027,34.35 46.6812474,34.3000005 47.19375,34.2 C47.7062526,34.0999995 48.162498,33.9312512 48.5625,33.69375 C48.962502,33.4562488 49.2812488,33.1312521 49.51875,32.71875 C49.7562512,32.3062479 49.875,31.7875031 49.875,31.1625 C49.875,30.6874976 49.775001,30.2750017 49.575,29.925 C49.374999,29.5749983 49.1187516,29.2875011 48.80625,29.0625 C48.4937484,28.8374989 48.1312521,28.6687506 47.71875,28.55625 C47.3062479,28.4437494 46.8875021,28.3875 46.4625,28.3875 C45.3874946,28.3875 44.3937546,28.5499984 43.48125,28.875 C42.5687454,29.2000016 41.7375038,29.5999976 40.9875,30.075 L39,25.9875 C39.400002,25.7374988 39.8687473,25.4750014 40.40625,25.2 C40.9437527,24.9249986 41.5374968,24.6750011 42.1875,24.45 C42.8375032,24.2249989 43.5312463,24.0375007 44.26875,23.8875 C45.0062537,23.7374992 45.7874959,23.6625 46.6125,23.6625 C48.1375076,23.6625 49.4562444,23.8437482 50.56875,24.20625 C51.6812556,24.5687518 52.5999964,25.0812467 53.325,25.74375 C54.05,26.4062533 54.5874982,27.1812456 54.9375,28.06875 C55.2875017,28.9562544 55.4625,29.9249948 55.4625,30.975 C55.4625,32.0000051 55.1750029,32.9937452 54.6,33.95625 C54.0249971,34.9187548 53.2500049,35.6499975 52.275,36.15 C53.6250067,36.7000028 54.6687463,37.5187446 55.40625,38.60625 C56.1437537,39.6937554 56.5125,40.9999924 56.5125,42.525 C56.5125,43.725006 56.312502,44.8312449 55.9125,45.84375 C55.512498,46.8562551 54.8875042,47.7312463 54.0375,48.46875 C53.1874957,49.2062537 52.1062566,49.7812479 50.79375,50.19375 C49.4812434,50.6062521 47.925009,50.8125 46.125,50.8125 Z"
+                  id="S3"
+                  fill="#FFFFFF"
+                  fillRule="nonzero"
+                ></path>
               </g>
             </a>
             <a href="/docs/reference/configuration/sinks">
-              <path className="fade-in" d="M17.154,15.382 C17.6380024,15.382 18.0376651,15.3416671 18.353,15.261 C18.6683349,15.1803329 18.9213324,15.070334 19.112,14.931 C19.3026676,14.791666 19.4346663,14.6266676 19.508,14.436 C19.5813337,14.2453324 19.618,14.0326678 19.618,13.798 C19.618,13.2993308 19.3833357,12.8850016 18.914,12.555 C18.4446643,12.2249983 17.6380057,11.8693352 16.494,11.488 C15.9953308,11.3119991 15.4966692,11.1103345 14.998,10.883 C14.4993308,10.6556655 14.052002,10.3696684 13.656,10.025 C13.259998,9.68033161 12.9373346,9.26233579 12.688,8.771 C12.4386654,8.27966421 12.314,7.68200352 12.314,6.978 C12.314,6.27399648 12.4459987,5.63966949 12.71,5.075 C12.9740013,4.51033051 13.3479976,4.03000198 13.832,3.634 C14.3160024,3.23799802 14.9026632,2.93366773 15.592,2.721 C16.2813368,2.50833227 17.0586623,2.402 17.924,2.402 C18.9506718,2.402 19.8379963,2.5119989 20.586,2.732 C21.3340037,2.9520011 21.9499976,3.19399868 22.434,3.458 L21.444,6.164 C21.0186645,5.9439989 20.5456693,5.74966751 20.025,5.581 C19.5043307,5.41233249 18.877337,5.328 18.144,5.328 C17.3226626,5.328 16.7323351,5.44166553 16.373,5.669 C16.0136649,5.89633447 15.834,6.24466432 15.834,6.714 C15.834,6.99266806 15.8999993,7.22733238 16.032,7.418 C16.1640007,7.60866762 16.3509988,7.78099923 16.593,7.935 C16.8350012,8.08900077 17.1136651,8.22833271 17.429,8.353 C17.7443349,8.47766729 18.0926648,8.60599934 18.474,8.738 C19.266004,9.0313348 19.9553304,9.32099857 20.542,9.607 C21.1286696,9.89300143 21.6163314,10.2266648 22.005,10.608 C22.3936686,10.9893352 22.6833324,11.4366641 22.874,11.95 C23.0646676,12.4633359 23.16,13.086663 23.16,13.82 C23.16,15.2426738 22.6613383,16.3463294 21.664,17.131 C20.6666617,17.9156706 19.1633434,18.308 17.154,18.308 C16.47933,18.308 15.8706694,18.2676671 15.328,18.187 C14.7853306,18.1063329 14.3050021,18.0073339 13.887,17.89 C13.4689979,17.7726661 13.1096682,17.6480007 12.809,17.516 C12.5083318,17.3839993 12.2553344,17.2593339 12.05,17.142 L13.018,14.414 C13.4726689,14.6633346 14.0336633,14.886999 14.701,15.085 C15.3683367,15.283001 16.1859952,15.382 17.154,15.382 Z M28.858,18 L25.58,18 L25.58,6.428 L28.858,6.428 L28.858,18 Z M29.166,3.084 C29.166,3.68533634 28.9716686,4.15833161 28.583,4.503 C28.1943314,4.84766839 27.7360026,5.02 27.208,5.02 C26.6799974,5.02 26.2216686,4.84766839 25.833,4.503 C25.4443314,4.15833161 25.25,3.68533634 25.25,3.084 C25.25,2.48266366 25.4443314,2.00966839 25.833,1.665 C26.2216686,1.32033161 26.6799974,1.148 27.208,1.148 C27.7360026,1.148 28.1943314,1.32033161 28.583,1.665 C28.9716686,2.00966839 29.166,2.48266366 29.166,3.084 Z M31.938,6.824 C32.4953361,6.66266586 33.2139956,6.51233403 34.094,6.373 C34.9740044,6.23366597 35.8979952,6.164 36.866,6.164 C37.8486716,6.164 38.6663301,6.29233205 39.319,6.549 C39.9716699,6.80566795 40.4886648,7.16866432 40.87,7.638 C41.2513352,8.10733568 41.5226659,8.66466344 41.684,9.31 C41.8453341,9.95533656 41.926,10.673996 41.926,11.466 L41.926,18 L38.648,18 L38.648,11.862 C38.648,10.8059947 38.5086681,10.0580022 38.23,9.618 C37.9513319,9.1779978 37.4306705,8.958 36.668,8.958 C36.4333322,8.958 36.1840013,8.96899989 35.92,8.991 C35.6559987,9.01300011 35.4213344,9.03866652 35.216,9.068 L35.216,18 L31.938,18 L31.938,6.824 Z M48.174,10.608 C48.4966683,10.2559982 48.8303316,9.88933524 49.175,9.508 C49.5196684,9.12666476 49.8533317,8.74900187 50.176,8.375 C50.4986683,8.00099813 50.8029986,7.64533502 51.089,7.308 C51.3750014,6.97066498 51.6206656,6.67733458 51.826,6.428 L55.72,6.428 C54.9426628,7.32267114 54.1836704,8.17699593 53.443,8.991 C52.7023296,9.80500407 51.8920044,10.6446623 51.012,11.51 C51.4520022,11.906002 51.9066643,12.3789972 52.376,12.929 C52.8453357,13.4790027 53.2999978,14.0473304 53.74,14.634 C54.1800022,15.2206696 54.5833315,15.8073304 54.95,16.394 C55.3166685,16.9806696 55.6246654,17.5159976 55.874,18 L52.112,18 C51.8773322,17.6186648 51.6096682,17.1970023 51.309,16.735 C51.0083318,16.2729977 50.689335,15.8110023 50.352,15.349 C50.014665,14.8869977 49.6590019,14.4433355 49.285,14.018 C48.9109981,13.5926645 48.5406685,13.2333348 48.174,12.94 L48.174,18 L44.896,18 L44.896,1.456 L48.174,0.928 L48.174,10.608 Z M60.956,15.646 C61.5573363,15.646 61.9826654,15.5873339 62.232,15.47 C62.4813346,15.3526661 62.606,15.125335 62.606,14.788 C62.606,14.5239987 62.4446683,14.293001 62.122,14.095 C61.7993317,13.896999 61.3080033,13.6733346 60.648,13.424 C60.1346641,13.2333324 59.6690021,13.0353344 59.251,12.83 C58.8329979,12.6246656 58.4773348,12.3790014 58.184,12.093 C57.8906652,11.8069986 57.6633341,11.466002 57.502,11.07 C57.3406659,10.673998 57.26,10.1973361 57.26,9.64 C57.26,8.55466124 57.6633293,7.69666982 58.47,7.066 C59.2766707,6.43533018 60.383993,6.12 61.792,6.12 C62.4960035,6.12 63.1706634,6.18233271 63.816,6.307 C64.4613366,6.43166729 64.9746648,6.5673326 65.356,6.714 L64.784,9.266 C64.4026648,9.13399934 63.9883356,9.01666718 63.541,8.914 C63.0936644,8.81133282 62.5913361,8.76 62.034,8.76 C61.0073282,8.76 60.494,9.04599714 60.494,9.618 C60.494,9.75000066 60.5159998,9.86733282 60.56,9.97 C60.6040002,10.0726672 60.6919993,10.1716662 60.824,10.267 C60.9560007,10.3623338 61.1356655,10.4649994 61.363,10.575 C61.5903345,10.6850005 61.8799982,10.8059993 62.232,10.938 C62.9506703,11.2020013 63.5446643,11.462332 64.014,11.719 C64.4833357,11.9756679 64.8536653,12.2543318 65.125,12.555 C65.3963347,12.8556682 65.5869995,13.1893315 65.697,13.556 C65.8070006,13.9226685 65.862,14.3479976 65.862,14.832 C65.862,15.9760057 65.4330043,16.8413304 64.575,17.428 C63.7169957,18.0146696 62.5033412,18.308 60.934,18.308 C59.9073282,18.308 59.0530034,18.2200009 58.371,18.044 C57.6889966,17.8679991 57.2160013,17.7213339 56.952,17.604 L57.502,14.942 C58.0593361,15.1620011 58.6313304,15.3343327 59.218,15.459 C59.8046696,15.5836673 60.3839971,15.646 60.956,15.646 Z" fill="#000000" fillRule="nonzero"></path>
+              <path
+                className="fade-in"
+                d="M17.154,15.382 C17.6380024,15.382 18.0376651,15.3416671 18.353,15.261 C18.6683349,15.1803329 18.9213324,15.070334 19.112,14.931 C19.3026676,14.791666 19.4346663,14.6266676 19.508,14.436 C19.5813337,14.2453324 19.618,14.0326678 19.618,13.798 C19.618,13.2993308 19.3833357,12.8850016 18.914,12.555 C18.4446643,12.2249983 17.6380057,11.8693352 16.494,11.488 C15.9953308,11.3119991 15.4966692,11.1103345 14.998,10.883 C14.4993308,10.6556655 14.052002,10.3696684 13.656,10.025 C13.259998,9.68033161 12.9373346,9.26233579 12.688,8.771 C12.4386654,8.27966421 12.314,7.68200352 12.314,6.978 C12.314,6.27399648 12.4459987,5.63966949 12.71,5.075 C12.9740013,4.51033051 13.3479976,4.03000198 13.832,3.634 C14.3160024,3.23799802 14.9026632,2.93366773 15.592,2.721 C16.2813368,2.50833227 17.0586623,2.402 17.924,2.402 C18.9506718,2.402 19.8379963,2.5119989 20.586,2.732 C21.3340037,2.9520011 21.9499976,3.19399868 22.434,3.458 L21.444,6.164 C21.0186645,5.9439989 20.5456693,5.74966751 20.025,5.581 C19.5043307,5.41233249 18.877337,5.328 18.144,5.328 C17.3226626,5.328 16.7323351,5.44166553 16.373,5.669 C16.0136649,5.89633447 15.834,6.24466432 15.834,6.714 C15.834,6.99266806 15.8999993,7.22733238 16.032,7.418 C16.1640007,7.60866762 16.3509988,7.78099923 16.593,7.935 C16.8350012,8.08900077 17.1136651,8.22833271 17.429,8.353 C17.7443349,8.47766729 18.0926648,8.60599934 18.474,8.738 C19.266004,9.0313348 19.9553304,9.32099857 20.542,9.607 C21.1286696,9.89300143 21.6163314,10.2266648 22.005,10.608 C22.3936686,10.9893352 22.6833324,11.4366641 22.874,11.95 C23.0646676,12.4633359 23.16,13.086663 23.16,13.82 C23.16,15.2426738 22.6613383,16.3463294 21.664,17.131 C20.6666617,17.9156706 19.1633434,18.308 17.154,18.308 C16.47933,18.308 15.8706694,18.2676671 15.328,18.187 C14.7853306,18.1063329 14.3050021,18.0073339 13.887,17.89 C13.4689979,17.7726661 13.1096682,17.6480007 12.809,17.516 C12.5083318,17.3839993 12.2553344,17.2593339 12.05,17.142 L13.018,14.414 C13.4726689,14.6633346 14.0336633,14.886999 14.701,15.085 C15.3683367,15.283001 16.1859952,15.382 17.154,15.382 Z M28.858,18 L25.58,18 L25.58,6.428 L28.858,6.428 L28.858,18 Z M29.166,3.084 C29.166,3.68533634 28.9716686,4.15833161 28.583,4.503 C28.1943314,4.84766839 27.7360026,5.02 27.208,5.02 C26.6799974,5.02 26.2216686,4.84766839 25.833,4.503 C25.4443314,4.15833161 25.25,3.68533634 25.25,3.084 C25.25,2.48266366 25.4443314,2.00966839 25.833,1.665 C26.2216686,1.32033161 26.6799974,1.148 27.208,1.148 C27.7360026,1.148 28.1943314,1.32033161 28.583,1.665 C28.9716686,2.00966839 29.166,2.48266366 29.166,3.084 Z M31.938,6.824 C32.4953361,6.66266586 33.2139956,6.51233403 34.094,6.373 C34.9740044,6.23366597 35.8979952,6.164 36.866,6.164 C37.8486716,6.164 38.6663301,6.29233205 39.319,6.549 C39.9716699,6.80566795 40.4886648,7.16866432 40.87,7.638 C41.2513352,8.10733568 41.5226659,8.66466344 41.684,9.31 C41.8453341,9.95533656 41.926,10.673996 41.926,11.466 L41.926,18 L38.648,18 L38.648,11.862 C38.648,10.8059947 38.5086681,10.0580022 38.23,9.618 C37.9513319,9.1779978 37.4306705,8.958 36.668,8.958 C36.4333322,8.958 36.1840013,8.96899989 35.92,8.991 C35.6559987,9.01300011 35.4213344,9.03866652 35.216,9.068 L35.216,18 L31.938,18 L31.938,6.824 Z M48.174,10.608 C48.4966683,10.2559982 48.8303316,9.88933524 49.175,9.508 C49.5196684,9.12666476 49.8533317,8.74900187 50.176,8.375 C50.4986683,8.00099813 50.8029986,7.64533502 51.089,7.308 C51.3750014,6.97066498 51.6206656,6.67733458 51.826,6.428 L55.72,6.428 C54.9426628,7.32267114 54.1836704,8.17699593 53.443,8.991 C52.7023296,9.80500407 51.8920044,10.6446623 51.012,11.51 C51.4520022,11.906002 51.9066643,12.3789972 52.376,12.929 C52.8453357,13.4790027 53.2999978,14.0473304 53.74,14.634 C54.1800022,15.2206696 54.5833315,15.8073304 54.95,16.394 C55.3166685,16.9806696 55.6246654,17.5159976 55.874,18 L52.112,18 C51.8773322,17.6186648 51.6096682,17.1970023 51.309,16.735 C51.0083318,16.2729977 50.689335,15.8110023 50.352,15.349 C50.014665,14.8869977 49.6590019,14.4433355 49.285,14.018 C48.9109981,13.5926645 48.5406685,13.2333348 48.174,12.94 L48.174,18 L44.896,18 L44.896,1.456 L48.174,0.928 L48.174,10.608 Z M60.956,15.646 C61.5573363,15.646 61.9826654,15.5873339 62.232,15.47 C62.4813346,15.3526661 62.606,15.125335 62.606,14.788 C62.606,14.5239987 62.4446683,14.293001 62.122,14.095 C61.7993317,13.896999 61.3080033,13.6733346 60.648,13.424 C60.1346641,13.2333324 59.6690021,13.0353344 59.251,12.83 C58.8329979,12.6246656 58.4773348,12.3790014 58.184,12.093 C57.8906652,11.8069986 57.6633341,11.466002 57.502,11.07 C57.3406659,10.673998 57.26,10.1973361 57.26,9.64 C57.26,8.55466124 57.6633293,7.69666982 58.47,7.066 C59.2766707,6.43533018 60.383993,6.12 61.792,6.12 C62.4960035,6.12 63.1706634,6.18233271 63.816,6.307 C64.4613366,6.43166729 64.9746648,6.5673326 65.356,6.714 L64.784,9.266 C64.4026648,9.13399934 63.9883356,9.01666718 63.541,8.914 C63.0936644,8.81133282 62.5913361,8.76 62.034,8.76 C61.0073282,8.76 60.494,9.04599714 60.494,9.618 C60.494,9.75000066 60.5159998,9.86733282 60.56,9.97 C60.6040002,10.0726672 60.6919993,10.1716662 60.824,10.267 C60.9560007,10.3623338 61.1356655,10.4649994 61.363,10.575 C61.5903345,10.6850005 61.8799982,10.8059993 62.232,10.938 C62.9506703,11.2020013 63.5446643,11.462332 64.014,11.719 C64.4833357,11.9756679 64.8536653,12.2543318 65.125,12.555 C65.3963347,12.8556682 65.5869995,13.1893315 65.697,13.556 C65.8070006,13.9226685 65.862,14.3479976 65.862,14.832 C65.862,15.9760057 65.4330043,16.8413304 64.575,17.428 C63.7169957,18.0146696 62.5033412,18.308 60.934,18.308 C59.9073282,18.308 59.0530034,18.2200009 58.371,18.044 C57.6889966,17.8679991 57.2160013,17.7213339 56.952,17.604 L57.502,14.942 C58.0593361,15.1620011 58.6313304,15.3343327 59.218,15.459 C59.8046696,15.5836673 60.3839971,15.646 60.956,15.646 Z"
+                fill="#000000"
+                fillRule="nonzero"
+              ></path>
             </a>
           </g>
           <g id="Sources" transform="translate(0.000000, 7.000000)">
             <a href="/docs/reference/configuration/sources/statsd">
               <g id="Source-3" transform="translate(82.000000, 182.000000)">
                 <circle id="Oval-Copy-2" fill="#000000" cx="37.5" cy="37.5" r="37.5"></circle>
-                <path d="M10.683,43.501 C11.1450023,43.501 11.5264985,43.4625004 11.8275,43.3855 C12.1285015,43.3084996 12.3699991,43.2035007 12.552,43.0705 C12.7340009,42.9374993 12.8599996,42.7800009 12.93,42.598 C13.0000004,42.4159991 13.035,42.2130011 13.035,41.989 C13.035,41.5129976 12.811,41.1175016 12.363,40.8025 C11.9149978,40.4874984 11.1450055,40.1480018 10.053,39.784 C9.57699762,39.6159992 9.10100238,39.4235011 8.625,39.2065 C8.14899762,38.9894989 7.72200189,38.7165016 7.344,38.3875 C6.96599811,38.0584984 6.65800119,37.6595023 6.42,37.1905 C6.18199881,36.7214977 6.063,36.1510034 6.063,35.479 C6.063,34.8069966 6.18899874,34.2015027 6.441,33.6625 C6.69300126,33.1234973 7.04999769,32.6650019 7.512,32.287 C7.97400231,31.9089981 8.53399671,31.618501 9.192,31.4155 C9.85000329,31.212499 10.5919959,31.111 11.418,31.111 C12.3980049,31.111 13.2449964,31.2159989 13.959,31.426 C14.6730036,31.6360011 15.2609977,31.8669987 15.723,32.119 L14.778,34.702 C14.371998,34.4919989 13.9205025,34.3065008 13.4235,34.1455 C12.9264975,33.9844992 12.3280035,33.904 11.628,33.904 C10.8439961,33.904 10.2805017,34.0124989 9.9375,34.2295 C9.59449829,34.4465011 9.423,34.7789978 9.423,35.227 C9.423,35.4930013 9.48599937,35.7169991 9.612,35.899 C9.73800063,36.0810009 9.91649884,36.2454993 10.1475,36.3925 C10.3785012,36.5395007 10.6444985,36.6724994 10.9455,36.7915 C11.2465015,36.9105006 11.5789982,37.0329994 11.943,37.159 C12.6990038,37.4390014 13.3569972,37.7154986 13.917,37.9885 C14.4770028,38.2615014 14.9424981,38.5799982 15.3135,38.944 C15.6845019,39.3080018 15.9609991,39.7349976 16.143,40.225 C16.3250009,40.7150025 16.416,41.3099965 16.416,42.01 C16.416,43.3680068 15.9400048,44.4214963 14.988,45.1705 C14.0359952,45.9195037 12.6010096,46.294 10.683,46.294 C10.0389968,46.294 9.45800259,46.2555004 8.94,46.1785 C8.42199741,46.1014996 7.96350199,46.0070006 7.5645,45.895 C7.165498,45.7829994 6.82250143,45.6640006 6.5355,45.538 C6.24849856,45.4119994 6.00700098,45.2930006 5.811,45.181 L6.735,42.577 C7.16900217,42.8150012 7.70449681,43.0284991 8.3415,43.2175 C8.97850318,43.4065009 9.75899538,43.501 10.683,43.501 Z M18.621,32.203 L21.75,31.699 L21.75,34.954 L25.509,34.954 L25.509,37.558 L21.75,37.558 L21.75,41.443 C21.75,42.1010033 21.8654988,42.625998 22.0965,43.018 C22.3275012,43.410002 22.7929965,43.606 23.493,43.606 C23.8290017,43.606 24.1754982,43.5745003 24.5325,43.5115 C24.8895018,43.4484997 25.2149985,43.3610006 25.509,43.249 L25.95,45.685 C25.5719981,45.8390008 25.1520023,45.9719994 24.69,46.084 C24.2279977,46.1960006 23.6610034,46.252 22.989,46.252 C22.1349957,46.252 21.4280028,46.1365012 20.868,45.9055 C20.3079972,45.6744988 19.8600017,45.3525021 19.524,44.9395 C19.1879983,44.5264979 18.9535007,44.0260029 18.8205,43.438 C18.6874993,42.8499971 18.621,42.199 18.621,41.485 L18.621,32.203 Z M31.851,43.816 C32.1590015,43.816 32.4529986,43.8090001 32.733,43.795 C33.0130014,43.7809999 33.2369992,43.7600001 33.405,43.732 L33.405,41.359 C33.2789994,41.3309999 33.0900013,41.3030001 32.838,41.275 C32.5859987,41.2469999 32.355001,41.233 32.145,41.233 C31.8509985,41.233 31.5745013,41.2504998 31.3155,41.2855 C31.0564987,41.3205002 30.829001,41.3869995 30.633,41.485 C30.436999,41.5830005 30.2830006,41.7159992 30.171,41.884 C30.0589994,42.0520008 30.003,42.2619987 30.003,42.514 C30.003,43.0040025 30.1674984,43.3434991 30.4965,43.5325 C30.8255016,43.7215009 31.2769971,43.816 31.851,43.816 Z M31.599,34.66 C32.5230046,34.66 33.2929969,34.7649989 33.909,34.975 C34.5250031,35.185001 35.0184981,35.485998 35.3895,35.878 C35.7605019,36.270002 36.0229992,36.7459972 36.177,37.306 C36.3310008,37.8660028 36.408,38.4889966 36.408,39.175 L36.408,45.685 C35.9599978,45.7830005 35.337004,45.8984993 34.539,46.0315 C33.740996,46.1645007 32.7750057,46.231 31.641,46.231 C30.9269964,46.231 30.2795029,46.1680006 29.6985,46.042 C29.1174971,45.9159994 28.6170021,45.7095014 28.197,45.4225 C27.7769979,45.1354986 27.4550011,44.7610023 27.231,44.299 C27.0069989,43.8369977 26.895,43.2700034 26.895,42.598 C26.895,41.9539968 27.0244987,41.4080022 27.2835,40.96 C27.5425013,40.5119978 27.8889978,40.1550013 28.323,39.889 C28.7570022,39.6229987 29.2539972,39.4305006 29.814,39.3115 C30.3740028,39.1924994 30.954997,39.133 31.557,39.133 C31.963002,39.133 32.3234984,39.1504998 32.6385,39.1855 C32.9535016,39.2205002 33.208999,39.2659997 33.405,39.322 L33.405,39.028 C33.405,38.4959973 33.2440016,38.0690016 32.922,37.747 C32.5999984,37.4249984 32.040004,37.264 31.242,37.264 C30.7099973,37.264 30.1850026,37.3024996 29.667,37.3795 C29.1489974,37.4565004 28.7010019,37.5649993 28.323,37.705 L27.924,35.185 C28.1060009,35.1289997 28.3334986,35.0695003 28.6065,35.0065 C28.8795014,34.9434997 29.1769984,34.8875002 29.499,34.8385 C29.8210016,34.7894998 30.1604982,34.7475002 30.5175,34.7125 C30.8745018,34.6774998 31.2349982,34.66 31.599,34.66 Z M39.138,32.203 L42.267,31.699 L42.267,34.954 L46.026,34.954 L46.026,37.558 L42.267,37.558 L42.267,41.443 C42.267,42.1010033 42.3824988,42.625998 42.6135,43.018 C42.8445012,43.410002 43.3099965,43.606 44.01,43.606 C44.3460017,43.606 44.6924982,43.5745003 45.0495,43.5115 C45.4065018,43.4484997 45.7319985,43.3610006 46.026,43.249 L46.467,45.685 C46.0889981,45.8390008 45.6690023,45.9719994 45.207,46.084 C44.7449977,46.1960006 44.1780034,46.252 43.506,46.252 C42.6519957,46.252 41.9450028,46.1365012 41.385,45.9055 C40.8249972,45.6744988 40.3770017,45.3525021 40.041,44.9395 C39.7049983,44.5264979 39.4705007,44.0260029 39.3375,43.438 C39.2044993,42.8499971 39.138,42.199 39.138,41.485 L39.138,32.203 Z M51.738,43.753 C52.3120029,43.753 52.7179988,43.6970006 52.956,43.585 C53.1940012,43.4729994 53.313,43.2560016 53.313,42.934 C53.313,42.6819987 53.1590015,42.4615009 52.851,42.2725 C52.5429985,42.0834991 52.0740031,41.8700012 51.444,41.632 C50.9539975,41.4499991 50.509502,41.261001 50.1105,41.065 C49.711498,40.868999 49.3720014,40.6345014 49.092,40.3615 C48.8119986,40.0884986 48.5950008,39.7630019 48.441,39.385 C48.2869992,39.0069981 48.21,38.5520027 48.21,38.02 C48.21,36.9839948 48.5949961,36.165003 49.365,35.563 C50.1350038,34.960997 51.1919933,34.66 52.536,34.66 C53.2080034,34.66 53.8519969,34.7194994 54.468,34.8385 C55.0840031,34.9575006 55.5739982,35.0869993 55.938,35.227 L55.392,37.663 C55.0279982,37.5369994 54.6325021,37.4250005 54.2055,37.327 C53.7784979,37.2289995 53.2990027,37.18 52.767,37.18 C51.7869951,37.18 51.297,37.4529973 51.297,37.999 C51.297,38.1250006 51.3179998,38.2369995 51.36,38.335 C51.4020002,38.4330005 51.4859994,38.5274995 51.612,38.6185 C51.7380006,38.7095005 51.9094989,38.8074995 52.1265,38.9125 C52.3435011,39.0175005 52.6199983,39.1329994 52.956,39.259 C53.6420034,39.5110013 54.2089978,39.7594988 54.657,40.0045 C55.1050022,40.2495012 55.4584987,40.5154986 55.7175,40.8025 C55.9765013,41.0895014 56.1584995,41.4079982 56.2635,41.758 C56.3685005,42.1080017 56.421,42.5139977 56.421,42.976 C56.421,44.0680055 56.0115041,44.8939972 55.1925,45.454 C54.3734959,46.0140028 53.2150075,46.294 51.717,46.294 C50.7369951,46.294 49.9215033,46.2100008 49.2705,46.042 C48.6194967,45.8739992 48.1680013,45.7340006 47.916,45.622 L48.441,43.081 C48.9730027,43.291001 49.5189972,43.4554994 50.079,43.5745 C50.6390028,43.6935006 51.1919973,43.753 51.738,43.753 Z M61.419,40.393 C61.419,41.3590048 61.6359978,42.1359971 62.07,42.724 C62.5040022,43.3120029 63.1479957,43.606 64.002,43.606 C64.2820014,43.606 64.5409988,43.5955001 64.779,43.5745 C65.0170012,43.5534999 65.2129992,43.5290001 65.367,43.501 L65.367,37.81 C65.170999,37.6839994 64.9155016,37.5790004 64.6005,37.495 C64.2854984,37.4109996 63.9670016,37.369 63.645,37.369 C62.1609926,37.369 61.419,38.3769899 61.419,40.393 Z M68.496,45.643 C68.2159986,45.7270004 67.8940018,45.8074996 67.53,45.8845 C67.1659982,45.9615004 66.784502,46.0279997 66.3855,46.084 C65.986498,46.1400003 65.5805021,46.1854998 65.1675,46.2205 C64.7544979,46.2555002 64.3590019,46.273 63.981,46.273 C63.0709954,46.273 62.2590036,46.1400013 61.545,45.874 C60.8309964,45.6079987 60.2290024,45.2265025 59.739,44.7295 C59.2489975,44.2324975 58.8745013,43.6305035 58.6155,42.9235 C58.3564987,42.2164965 58.227,41.4220044 58.227,40.54 C58.227,39.6439955 58.3389989,38.8355036 58.563,38.1145 C58.7870011,37.3934964 59.1089979,36.7810025 59.529,36.277 C59.9490021,35.7729975 60.463497,35.3880013 61.0725,35.122 C61.681503,34.8559987 62.3779961,34.723 63.162,34.723 C63.5960022,34.723 63.9844983,34.7649996 64.3275,34.849 C64.6705017,34.9330004 65.0169982,35.0519992 65.367,35.206 L65.367,30.208 L68.496,29.704 L68.496,45.643 Z" fill="#FFFFFF" fillRule="nonzero"></path>
+                <path
+                  d="M10.683,43.501 C11.1450023,43.501 11.5264985,43.4625004 11.8275,43.3855 C12.1285015,43.3084996 12.3699991,43.2035007 12.552,43.0705 C12.7340009,42.9374993 12.8599996,42.7800009 12.93,42.598 C13.0000004,42.4159991 13.035,42.2130011 13.035,41.989 C13.035,41.5129976 12.811,41.1175016 12.363,40.8025 C11.9149978,40.4874984 11.1450055,40.1480018 10.053,39.784 C9.57699762,39.6159992 9.10100238,39.4235011 8.625,39.2065 C8.14899762,38.9894989 7.72200189,38.7165016 7.344,38.3875 C6.96599811,38.0584984 6.65800119,37.6595023 6.42,37.1905 C6.18199881,36.7214977 6.063,36.1510034 6.063,35.479 C6.063,34.8069966 6.18899874,34.2015027 6.441,33.6625 C6.69300126,33.1234973 7.04999769,32.6650019 7.512,32.287 C7.97400231,31.9089981 8.53399671,31.618501 9.192,31.4155 C9.85000329,31.212499 10.5919959,31.111 11.418,31.111 C12.3980049,31.111 13.2449964,31.2159989 13.959,31.426 C14.6730036,31.6360011 15.2609977,31.8669987 15.723,32.119 L14.778,34.702 C14.371998,34.4919989 13.9205025,34.3065008 13.4235,34.1455 C12.9264975,33.9844992 12.3280035,33.904 11.628,33.904 C10.8439961,33.904 10.2805017,34.0124989 9.9375,34.2295 C9.59449829,34.4465011 9.423,34.7789978 9.423,35.227 C9.423,35.4930013 9.48599937,35.7169991 9.612,35.899 C9.73800063,36.0810009 9.91649884,36.2454993 10.1475,36.3925 C10.3785012,36.5395007 10.6444985,36.6724994 10.9455,36.7915 C11.2465015,36.9105006 11.5789982,37.0329994 11.943,37.159 C12.6990038,37.4390014 13.3569972,37.7154986 13.917,37.9885 C14.4770028,38.2615014 14.9424981,38.5799982 15.3135,38.944 C15.6845019,39.3080018 15.9609991,39.7349976 16.143,40.225 C16.3250009,40.7150025 16.416,41.3099965 16.416,42.01 C16.416,43.3680068 15.9400048,44.4214963 14.988,45.1705 C14.0359952,45.9195037 12.6010096,46.294 10.683,46.294 C10.0389968,46.294 9.45800259,46.2555004 8.94,46.1785 C8.42199741,46.1014996 7.96350199,46.0070006 7.5645,45.895 C7.165498,45.7829994 6.82250143,45.6640006 6.5355,45.538 C6.24849856,45.4119994 6.00700098,45.2930006 5.811,45.181 L6.735,42.577 C7.16900217,42.8150012 7.70449681,43.0284991 8.3415,43.2175 C8.97850318,43.4065009 9.75899538,43.501 10.683,43.501 Z M18.621,32.203 L21.75,31.699 L21.75,34.954 L25.509,34.954 L25.509,37.558 L21.75,37.558 L21.75,41.443 C21.75,42.1010033 21.8654988,42.625998 22.0965,43.018 C22.3275012,43.410002 22.7929965,43.606 23.493,43.606 C23.8290017,43.606 24.1754982,43.5745003 24.5325,43.5115 C24.8895018,43.4484997 25.2149985,43.3610006 25.509,43.249 L25.95,45.685 C25.5719981,45.8390008 25.1520023,45.9719994 24.69,46.084 C24.2279977,46.1960006 23.6610034,46.252 22.989,46.252 C22.1349957,46.252 21.4280028,46.1365012 20.868,45.9055 C20.3079972,45.6744988 19.8600017,45.3525021 19.524,44.9395 C19.1879983,44.5264979 18.9535007,44.0260029 18.8205,43.438 C18.6874993,42.8499971 18.621,42.199 18.621,41.485 L18.621,32.203 Z M31.851,43.816 C32.1590015,43.816 32.4529986,43.8090001 32.733,43.795 C33.0130014,43.7809999 33.2369992,43.7600001 33.405,43.732 L33.405,41.359 C33.2789994,41.3309999 33.0900013,41.3030001 32.838,41.275 C32.5859987,41.2469999 32.355001,41.233 32.145,41.233 C31.8509985,41.233 31.5745013,41.2504998 31.3155,41.2855 C31.0564987,41.3205002 30.829001,41.3869995 30.633,41.485 C30.436999,41.5830005 30.2830006,41.7159992 30.171,41.884 C30.0589994,42.0520008 30.003,42.2619987 30.003,42.514 C30.003,43.0040025 30.1674984,43.3434991 30.4965,43.5325 C30.8255016,43.7215009 31.2769971,43.816 31.851,43.816 Z M31.599,34.66 C32.5230046,34.66 33.2929969,34.7649989 33.909,34.975 C34.5250031,35.185001 35.0184981,35.485998 35.3895,35.878 C35.7605019,36.270002 36.0229992,36.7459972 36.177,37.306 C36.3310008,37.8660028 36.408,38.4889966 36.408,39.175 L36.408,45.685 C35.9599978,45.7830005 35.337004,45.8984993 34.539,46.0315 C33.740996,46.1645007 32.7750057,46.231 31.641,46.231 C30.9269964,46.231 30.2795029,46.1680006 29.6985,46.042 C29.1174971,45.9159994 28.6170021,45.7095014 28.197,45.4225 C27.7769979,45.1354986 27.4550011,44.7610023 27.231,44.299 C27.0069989,43.8369977 26.895,43.2700034 26.895,42.598 C26.895,41.9539968 27.0244987,41.4080022 27.2835,40.96 C27.5425013,40.5119978 27.8889978,40.1550013 28.323,39.889 C28.7570022,39.6229987 29.2539972,39.4305006 29.814,39.3115 C30.3740028,39.1924994 30.954997,39.133 31.557,39.133 C31.963002,39.133 32.3234984,39.1504998 32.6385,39.1855 C32.9535016,39.2205002 33.208999,39.2659997 33.405,39.322 L33.405,39.028 C33.405,38.4959973 33.2440016,38.0690016 32.922,37.747 C32.5999984,37.4249984 32.040004,37.264 31.242,37.264 C30.7099973,37.264 30.1850026,37.3024996 29.667,37.3795 C29.1489974,37.4565004 28.7010019,37.5649993 28.323,37.705 L27.924,35.185 C28.1060009,35.1289997 28.3334986,35.0695003 28.6065,35.0065 C28.8795014,34.9434997 29.1769984,34.8875002 29.499,34.8385 C29.8210016,34.7894998 30.1604982,34.7475002 30.5175,34.7125 C30.8745018,34.6774998 31.2349982,34.66 31.599,34.66 Z M39.138,32.203 L42.267,31.699 L42.267,34.954 L46.026,34.954 L46.026,37.558 L42.267,37.558 L42.267,41.443 C42.267,42.1010033 42.3824988,42.625998 42.6135,43.018 C42.8445012,43.410002 43.3099965,43.606 44.01,43.606 C44.3460017,43.606 44.6924982,43.5745003 45.0495,43.5115 C45.4065018,43.4484997 45.7319985,43.3610006 46.026,43.249 L46.467,45.685 C46.0889981,45.8390008 45.6690023,45.9719994 45.207,46.084 C44.7449977,46.1960006 44.1780034,46.252 43.506,46.252 C42.6519957,46.252 41.9450028,46.1365012 41.385,45.9055 C40.8249972,45.6744988 40.3770017,45.3525021 40.041,44.9395 C39.7049983,44.5264979 39.4705007,44.0260029 39.3375,43.438 C39.2044993,42.8499971 39.138,42.199 39.138,41.485 L39.138,32.203 Z M51.738,43.753 C52.3120029,43.753 52.7179988,43.6970006 52.956,43.585 C53.1940012,43.4729994 53.313,43.2560016 53.313,42.934 C53.313,42.6819987 53.1590015,42.4615009 52.851,42.2725 C52.5429985,42.0834991 52.0740031,41.8700012 51.444,41.632 C50.9539975,41.4499991 50.509502,41.261001 50.1105,41.065 C49.711498,40.868999 49.3720014,40.6345014 49.092,40.3615 C48.8119986,40.0884986 48.5950008,39.7630019 48.441,39.385 C48.2869992,39.0069981 48.21,38.5520027 48.21,38.02 C48.21,36.9839948 48.5949961,36.165003 49.365,35.563 C50.1350038,34.960997 51.1919933,34.66 52.536,34.66 C53.2080034,34.66 53.8519969,34.7194994 54.468,34.8385 C55.0840031,34.9575006 55.5739982,35.0869993 55.938,35.227 L55.392,37.663 C55.0279982,37.5369994 54.6325021,37.4250005 54.2055,37.327 C53.7784979,37.2289995 53.2990027,37.18 52.767,37.18 C51.7869951,37.18 51.297,37.4529973 51.297,37.999 C51.297,38.1250006 51.3179998,38.2369995 51.36,38.335 C51.4020002,38.4330005 51.4859994,38.5274995 51.612,38.6185 C51.7380006,38.7095005 51.9094989,38.8074995 52.1265,38.9125 C52.3435011,39.0175005 52.6199983,39.1329994 52.956,39.259 C53.6420034,39.5110013 54.2089978,39.7594988 54.657,40.0045 C55.1050022,40.2495012 55.4584987,40.5154986 55.7175,40.8025 C55.9765013,41.0895014 56.1584995,41.4079982 56.2635,41.758 C56.3685005,42.1080017 56.421,42.5139977 56.421,42.976 C56.421,44.0680055 56.0115041,44.8939972 55.1925,45.454 C54.3734959,46.0140028 53.2150075,46.294 51.717,46.294 C50.7369951,46.294 49.9215033,46.2100008 49.2705,46.042 C48.6194967,45.8739992 48.1680013,45.7340006 47.916,45.622 L48.441,43.081 C48.9730027,43.291001 49.5189972,43.4554994 50.079,43.5745 C50.6390028,43.6935006 51.1919973,43.753 51.738,43.753 Z M61.419,40.393 C61.419,41.3590048 61.6359978,42.1359971 62.07,42.724 C62.5040022,43.3120029 63.1479957,43.606 64.002,43.606 C64.2820014,43.606 64.5409988,43.5955001 64.779,43.5745 C65.0170012,43.5534999 65.2129992,43.5290001 65.367,43.501 L65.367,37.81 C65.170999,37.6839994 64.9155016,37.5790004 64.6005,37.495 C64.2854984,37.4109996 63.9670016,37.369 63.645,37.369 C62.1609926,37.369 61.419,38.3769899 61.419,40.393 Z M68.496,45.643 C68.2159986,45.7270004 67.8940018,45.8074996 67.53,45.8845 C67.1659982,45.9615004 66.784502,46.0279997 66.3855,46.084 C65.986498,46.1400003 65.5805021,46.1854998 65.1675,46.2205 C64.7544979,46.2555002 64.3590019,46.273 63.981,46.273 C63.0709954,46.273 62.2590036,46.1400013 61.545,45.874 C60.8309964,45.6079987 60.2290024,45.2265025 59.739,44.7295 C59.2489975,44.2324975 58.8745013,43.6305035 58.6155,42.9235 C58.3564987,42.2164965 58.227,41.4220044 58.227,40.54 C58.227,39.6439955 58.3389989,38.8355036 58.563,38.1145 C58.7870011,37.3934964 59.1089979,36.7810025 59.529,36.277 C59.9490021,35.7729975 60.463497,35.3880013 61.0725,35.122 C61.681503,34.8559987 62.3779961,34.723 63.162,34.723 C63.5960022,34.723 63.9844983,34.7649996 64.3275,34.849 C64.6705017,34.9330004 65.0169982,35.0519992 65.367,35.206 L65.367,30.208 L68.496,29.704 L68.496,45.643 Z"
+                  fill="#FFFFFF"
+                  fillRule="nonzero"
+                ></path>
               </g>
             </a>
             <a href="/docs/reference/configuration/sources/kafka">
               <g id="Source-2" transform="translate(0.000000, 122.000000)">
                 <circle id="Oval-Copy-2" fill="#000000" cx="37.5" cy="37.5" r="37.5"></circle>
-                <path d="M11.4141414,47 L11.4141414,40.2352092 C11.9393939,40.6661857 12.4646465,41.1625782 12.989899,41.7243867 C13.5151515,42.2861953 14.0221661,42.8710919 14.5109428,43.4790765 C14.9997194,44.0870611 15.4520202,44.6950457 15.8678451,45.3030303 C16.28367,45.9110149 16.6447811,46.4766715 16.9511785,47 L16.9511785,47 L21,47 C19.9640853,45.2299182 18.880752,43.6137566 17.75,42.1515152 C16.619248,40.6892737 15.4483726,39.4271284 14.2373737,38.3650794 C15.3900112,37.1491101 16.4879349,35.9408369 17.5311448,34.7402597 C18.5743547,33.5396825 19.6139169,32.2929293 20.6498316,31 L20.6498316,31 L16.6010101,31 C15.8277217,31.9081289 14.9924242,32.8970659 14.0951178,33.966811 C13.1978114,35.036556 12.3041526,36.0639731 11.4141414,37.049062 L11.4141414,37.049062 L11.4141414,31 L8,31 L8,47 L11.4141414,47 Z M26.9889625,47 C28.1810155,47 29.196468,46.9252874 30.0353201,46.7758621 C30.8741722,46.6264368 31.5290655,46.4966727 32,46.3865699 L32,46.3865699 L32,39.0725953 C32,38.3018754 31.9190581,37.6019359 31.7571744,36.9727768 C31.5952907,36.3436177 31.3193525,35.8088324 30.9293598,35.3684211 C30.5393672,34.9280097 30.0206034,34.5898367 29.3730684,34.353902 C28.7255335,34.1179673 27.9161148,34 26.9448124,34 C26.5621781,34 26.183223,34.0196612 25.807947,34.0589837 C25.4326711,34.0983061 25.075791,34.145493 24.7373068,34.2005445 C24.3988227,34.2555959 24.0860927,34.3185118 23.799117,34.3892922 C23.5121413,34.4600726 23.2729948,34.5269208 23.0816777,34.5898367 L23.0816777,34.5898367 L23.5011038,37.4210526 C23.8984547,37.2637629 24.3693893,37.1418633 24.9139073,37.0553539 C25.4584253,36.9688445 26.0103017,36.9255898 26.5695364,36.9255898 C27.4083885,36.9255898 27.9970567,37.1064731 28.3355408,37.4682396 C28.674025,37.830006 28.8432671,38.3097399 28.8432671,38.907441 L28.8432671,38.907441 L28.8432671,39.2377495 C28.6372333,39.1748336 28.3686534,39.1237145 28.0375276,39.084392 C27.7064018,39.0450696 27.3274467,39.0254083 26.9006623,39.0254083 C26.267844,39.0254083 25.6571008,39.0922565 25.0684327,39.2259528 C24.4797645,39.3596491 23.9573216,39.5759226 23.5011038,39.8747731 C23.0448859,40.1736237 22.6806475,40.5747126 22.4083885,41.0780399 C22.1361295,41.5813672 22,42.1947973 22,42.9183303 C22,43.6733212 22.1177336,44.3103448 22.3532009,44.8294011 C22.5886681,45.3484574 22.9271523,45.7692075 23.3686534,46.0916515 C23.8101545,46.4140956 24.3362767,46.646098 24.9470199,46.7876588 C25.5577631,46.9292196 26.2384106,47 26.9889625,47 Z M28.1728395,44 C27.4979424,44 26.9670782,43.8902439 26.5802469,43.6707317 C26.1934156,43.4512195 26,43.0569106 26,42.4878049 C26,42.195122 26.0658436,41.9512195 26.1975309,41.7560976 C26.3292181,41.5609756 26.5102881,41.4065041 26.7407407,41.2926829 C26.9711934,41.1788618 27.2386831,41.101626 27.5432099,41.0609756 C27.8477366,41.0203252 28.1728395,41 28.5185185,41 C28.7654321,41 29.037037,41.0162602 29.3333333,41.0487805 C29.6296296,41.0813008 29.8518519,41.1138211 30,41.1463415 L30,41.1463415 L30,43.902439 C29.8024691,43.9349593 29.5390947,43.9593496 29.2098765,43.9756098 C28.8806584,43.9918699 28.5349794,44 28.1728395,44 Z M38.735376,47 L38.735376,37.6752577 L43.3481894,37.6752577 L43.3481894,34.7989691 L38.735376,34.7989691 L38.735376,34.1958763 C38.735376,33.871134 38.7729805,33.5695876 38.8481894,33.2912371 C38.9233983,33.0128866 39.0487465,32.7731959 39.224234,32.5721649 C39.3997214,32.371134 39.6420613,32.2126289 39.9512535,32.0966495 C40.2604457,31.9806701 40.6406685,31.9226804 41.091922,31.9226804 C41.4261838,31.9226804 41.7896936,31.9574742 42.1824513,32.0270619 C42.5752089,32.0966495 42.9387187,32.2010309 43.2729805,32.3402062 L43.2729805,32.3402062 L44,29.5798969 C43.6824513,29.4561856 43.2311978,29.3286082 42.6462396,29.1971649 C42.0612813,29.0657216 41.4178273,29 40.7158774,29 C38.8272981,29 37.402507,29.4639175 36.4415042,30.3917526 C35.4805014,31.3195876 35,32.5721649 35,34.1494845 L35,34.1494845 L35,47 L38.735376,47 Z M48.2845691,47 L48.2845691,41.6649485 C48.6519706,41.9742268 49.0230461,42.3530928 49.3977956,42.8015464 C49.7725451,43.25 50.1289245,43.7177835 50.4669339,44.2048969 C50.8049432,44.6920103 51.1245825,45.1791237 51.4258517,45.6662371 C51.7271209,46.1533505 51.995324,46.5979381 52.2304609,47 L52.2304609,47 L56,47 C55.750167,46.4896907 55.4415498,45.9252577 55.0741483,45.306701 C54.7067468,44.6881443 54.3026052,44.0695876 53.8617234,43.4510309 C53.4208417,42.8324742 52.9652639,42.2332474 52.49499,41.6533505 C52.0247161,41.0734536 51.5691383,40.5747423 51.1282565,40.1572165 C52.01002,39.2448454 52.8219773,38.3595361 53.5641283,37.5012887 C54.3062792,36.6430412 55.0668003,35.742268 55.8456914,34.7989691 L55.8456914,34.7989691 L51.9438878,34.7989691 C51.738143,35.0618557 51.491984,35.371134 51.2054108,35.7268041 C50.9188377,36.0824742 50.6138945,36.4574742 50.2905812,36.8518041 C49.9672679,37.246134 49.6329325,37.6443299 49.2875752,38.0463918 C48.9422178,38.4484536 48.6078824,38.8350515 48.2845691,39.2061856 L48.2845691,39.2061856 L48.2845691,29 L45,29.556701 L45,47 L48.2845691,47 Z M61.9889625,47 C63.1810155,47 64.196468,46.9252874 65.0353201,46.7758621 C65.8741722,46.6264368 66.5290655,46.4966727 67,46.3865699 L67,46.3865699 L67,39.0725953 C67,38.3018754 66.9190581,37.6019359 66.7571744,36.9727768 C66.5952907,36.3436177 66.3193525,35.8088324 65.9293598,35.3684211 C65.5393672,34.9280097 65.0206034,34.5898367 64.3730684,34.353902 C63.7255335,34.1179673 62.9161148,34 61.9448124,34 C61.5621781,34 61.183223,34.0196612 60.807947,34.0589837 C60.4326711,34.0983061 60.075791,34.145493 59.7373068,34.2005445 C59.3988227,34.2555959 59.0860927,34.3185118 58.799117,34.3892922 C58.5121413,34.4600726 58.2729948,34.5269208 58.0816777,34.5898367 L58.0816777,34.5898367 L58.5011038,37.4210526 C58.8984547,37.2637629 59.3693893,37.1418633 59.9139073,37.0553539 C60.4584253,36.9688445 61.0103017,36.9255898 61.5695364,36.9255898 C62.4083885,36.9255898 62.9970567,37.1064731 63.3355408,37.4682396 C63.674025,37.830006 63.8432671,38.3097399 63.8432671,38.907441 L63.8432671,38.907441 L63.8432671,39.2377495 C63.6372333,39.1748336 63.3686534,39.1237145 63.0375276,39.084392 C62.7064018,39.0450696 62.3274467,39.0254083 61.9006623,39.0254083 C61.267844,39.0254083 60.6571008,39.0922565 60.0684327,39.2259528 C59.4797645,39.3596491 58.9573216,39.5759226 58.5011038,39.8747731 C58.0448859,40.1736237 57.6806475,40.5747126 57.4083885,41.0780399 C57.1361295,41.5813672 57,42.1947973 57,42.9183303 C57,43.6733212 57.1177336,44.3103448 57.3532009,44.8294011 C57.5886681,45.3484574 57.9271523,45.7692075 58.3686534,46.0916515 C58.8101545,46.4140956 59.3362767,46.646098 59.9470199,46.7876588 C60.5577631,46.9292196 61.2384106,47 61.9889625,47 Z M62.1728395,44 C61.4979424,44 60.9670782,43.8902439 60.5802469,43.6707317 C60.1934156,43.4512195 60,43.0569106 60,42.4878049 C60,42.195122 60.0658436,41.9512195 60.1975309,41.7560976 C60.3292181,41.5609756 60.5102881,41.4065041 60.7407407,41.2926829 C60.9711934,41.1788618 61.2386831,41.101626 61.5432099,41.0609756 C61.8477366,41.0203252 62.1728395,41 62.5185185,41 C62.7654321,41 63.037037,41.0162602 63.3333333,41.0487805 C63.6296296,41.0813008 63.8518519,41.1138211 64,41.1463415 L64,41.1463415 L64,43.902439 C63.8024691,43.9349593 63.5390947,43.9593496 63.2098765,43.9756098 C62.8806584,43.9918699 62.5349794,44 62.1728395,44 Z" id="Kafka" fill="#FFFFFF"></path>
+                <path
+                  d="M11.4141414,47 L11.4141414,40.2352092 C11.9393939,40.6661857 12.4646465,41.1625782 12.989899,41.7243867 C13.5151515,42.2861953 14.0221661,42.8710919 14.5109428,43.4790765 C14.9997194,44.0870611 15.4520202,44.6950457 15.8678451,45.3030303 C16.28367,45.9110149 16.6447811,46.4766715 16.9511785,47 L16.9511785,47 L21,47 C19.9640853,45.2299182 18.880752,43.6137566 17.75,42.1515152 C16.619248,40.6892737 15.4483726,39.4271284 14.2373737,38.3650794 C15.3900112,37.1491101 16.4879349,35.9408369 17.5311448,34.7402597 C18.5743547,33.5396825 19.6139169,32.2929293 20.6498316,31 L20.6498316,31 L16.6010101,31 C15.8277217,31.9081289 14.9924242,32.8970659 14.0951178,33.966811 C13.1978114,35.036556 12.3041526,36.0639731 11.4141414,37.049062 L11.4141414,37.049062 L11.4141414,31 L8,31 L8,47 L11.4141414,47 Z M26.9889625,47 C28.1810155,47 29.196468,46.9252874 30.0353201,46.7758621 C30.8741722,46.6264368 31.5290655,46.4966727 32,46.3865699 L32,46.3865699 L32,39.0725953 C32,38.3018754 31.9190581,37.6019359 31.7571744,36.9727768 C31.5952907,36.3436177 31.3193525,35.8088324 30.9293598,35.3684211 C30.5393672,34.9280097 30.0206034,34.5898367 29.3730684,34.353902 C28.7255335,34.1179673 27.9161148,34 26.9448124,34 C26.5621781,34 26.183223,34.0196612 25.807947,34.0589837 C25.4326711,34.0983061 25.075791,34.145493 24.7373068,34.2005445 C24.3988227,34.2555959 24.0860927,34.3185118 23.799117,34.3892922 C23.5121413,34.4600726 23.2729948,34.5269208 23.0816777,34.5898367 L23.0816777,34.5898367 L23.5011038,37.4210526 C23.8984547,37.2637629 24.3693893,37.1418633 24.9139073,37.0553539 C25.4584253,36.9688445 26.0103017,36.9255898 26.5695364,36.9255898 C27.4083885,36.9255898 27.9970567,37.1064731 28.3355408,37.4682396 C28.674025,37.830006 28.8432671,38.3097399 28.8432671,38.907441 L28.8432671,38.907441 L28.8432671,39.2377495 C28.6372333,39.1748336 28.3686534,39.1237145 28.0375276,39.084392 C27.7064018,39.0450696 27.3274467,39.0254083 26.9006623,39.0254083 C26.267844,39.0254083 25.6571008,39.0922565 25.0684327,39.2259528 C24.4797645,39.3596491 23.9573216,39.5759226 23.5011038,39.8747731 C23.0448859,40.1736237 22.6806475,40.5747126 22.4083885,41.0780399 C22.1361295,41.5813672 22,42.1947973 22,42.9183303 C22,43.6733212 22.1177336,44.3103448 22.3532009,44.8294011 C22.5886681,45.3484574 22.9271523,45.7692075 23.3686534,46.0916515 C23.8101545,46.4140956 24.3362767,46.646098 24.9470199,46.7876588 C25.5577631,46.9292196 26.2384106,47 26.9889625,47 Z M28.1728395,44 C27.4979424,44 26.9670782,43.8902439 26.5802469,43.6707317 C26.1934156,43.4512195 26,43.0569106 26,42.4878049 C26,42.195122 26.0658436,41.9512195 26.1975309,41.7560976 C26.3292181,41.5609756 26.5102881,41.4065041 26.7407407,41.2926829 C26.9711934,41.1788618 27.2386831,41.101626 27.5432099,41.0609756 C27.8477366,41.0203252 28.1728395,41 28.5185185,41 C28.7654321,41 29.037037,41.0162602 29.3333333,41.0487805 C29.6296296,41.0813008 29.8518519,41.1138211 30,41.1463415 L30,41.1463415 L30,43.902439 C29.8024691,43.9349593 29.5390947,43.9593496 29.2098765,43.9756098 C28.8806584,43.9918699 28.5349794,44 28.1728395,44 Z M38.735376,47 L38.735376,37.6752577 L43.3481894,37.6752577 L43.3481894,34.7989691 L38.735376,34.7989691 L38.735376,34.1958763 C38.735376,33.871134 38.7729805,33.5695876 38.8481894,33.2912371 C38.9233983,33.0128866 39.0487465,32.7731959 39.224234,32.5721649 C39.3997214,32.371134 39.6420613,32.2126289 39.9512535,32.0966495 C40.2604457,31.9806701 40.6406685,31.9226804 41.091922,31.9226804 C41.4261838,31.9226804 41.7896936,31.9574742 42.1824513,32.0270619 C42.5752089,32.0966495 42.9387187,32.2010309 43.2729805,32.3402062 L43.2729805,32.3402062 L44,29.5798969 C43.6824513,29.4561856 43.2311978,29.3286082 42.6462396,29.1971649 C42.0612813,29.0657216 41.4178273,29 40.7158774,29 C38.8272981,29 37.402507,29.4639175 36.4415042,30.3917526 C35.4805014,31.3195876 35,32.5721649 35,34.1494845 L35,34.1494845 L35,47 L38.735376,47 Z M48.2845691,47 L48.2845691,41.6649485 C48.6519706,41.9742268 49.0230461,42.3530928 49.3977956,42.8015464 C49.7725451,43.25 50.1289245,43.7177835 50.4669339,44.2048969 C50.8049432,44.6920103 51.1245825,45.1791237 51.4258517,45.6662371 C51.7271209,46.1533505 51.995324,46.5979381 52.2304609,47 L52.2304609,47 L56,47 C55.750167,46.4896907 55.4415498,45.9252577 55.0741483,45.306701 C54.7067468,44.6881443 54.3026052,44.0695876 53.8617234,43.4510309 C53.4208417,42.8324742 52.9652639,42.2332474 52.49499,41.6533505 C52.0247161,41.0734536 51.5691383,40.5747423 51.1282565,40.1572165 C52.01002,39.2448454 52.8219773,38.3595361 53.5641283,37.5012887 C54.3062792,36.6430412 55.0668003,35.742268 55.8456914,34.7989691 L55.8456914,34.7989691 L51.9438878,34.7989691 C51.738143,35.0618557 51.491984,35.371134 51.2054108,35.7268041 C50.9188377,36.0824742 50.6138945,36.4574742 50.2905812,36.8518041 C49.9672679,37.246134 49.6329325,37.6443299 49.2875752,38.0463918 C48.9422178,38.4484536 48.6078824,38.8350515 48.2845691,39.2061856 L48.2845691,39.2061856 L48.2845691,29 L45,29.556701 L45,47 L48.2845691,47 Z M61.9889625,47 C63.1810155,47 64.196468,46.9252874 65.0353201,46.7758621 C65.8741722,46.6264368 66.5290655,46.4966727 67,46.3865699 L67,46.3865699 L67,39.0725953 C67,38.3018754 66.9190581,37.6019359 66.7571744,36.9727768 C66.5952907,36.3436177 66.3193525,35.8088324 65.9293598,35.3684211 C65.5393672,34.9280097 65.0206034,34.5898367 64.3730684,34.353902 C63.7255335,34.1179673 62.9161148,34 61.9448124,34 C61.5621781,34 61.183223,34.0196612 60.807947,34.0589837 C60.4326711,34.0983061 60.075791,34.145493 59.7373068,34.2005445 C59.3988227,34.2555959 59.0860927,34.3185118 58.799117,34.3892922 C58.5121413,34.4600726 58.2729948,34.5269208 58.0816777,34.5898367 L58.0816777,34.5898367 L58.5011038,37.4210526 C58.8984547,37.2637629 59.3693893,37.1418633 59.9139073,37.0553539 C60.4584253,36.9688445 61.0103017,36.9255898 61.5695364,36.9255898 C62.4083885,36.9255898 62.9970567,37.1064731 63.3355408,37.4682396 C63.674025,37.830006 63.8432671,38.3097399 63.8432671,38.907441 L63.8432671,38.907441 L63.8432671,39.2377495 C63.6372333,39.1748336 63.3686534,39.1237145 63.0375276,39.084392 C62.7064018,39.0450696 62.3274467,39.0254083 61.9006623,39.0254083 C61.267844,39.0254083 60.6571008,39.0922565 60.0684327,39.2259528 C59.4797645,39.3596491 58.9573216,39.5759226 58.5011038,39.8747731 C58.0448859,40.1736237 57.6806475,40.5747126 57.4083885,41.0780399 C57.1361295,41.5813672 57,42.1947973 57,42.9183303 C57,43.6733212 57.1177336,44.3103448 57.3532009,44.8294011 C57.5886681,45.3484574 57.9271523,45.7692075 58.3686534,46.0916515 C58.8101545,46.4140956 59.3362767,46.646098 59.9470199,46.7876588 C60.5577631,46.9292196 61.2384106,47 61.9889625,47 Z M62.1728395,44 C61.4979424,44 60.9670782,43.8902439 60.5802469,43.6707317 C60.1934156,43.4512195 60,43.0569106 60,42.4878049 C60,42.195122 60.0658436,41.9512195 60.1975309,41.7560976 C60.3292181,41.5609756 60.5102881,41.4065041 60.7407407,41.2926829 C60.9711934,41.1788618 61.2386831,41.101626 61.5432099,41.0609756 C61.8477366,41.0203252 62.1728395,41 62.5185185,41 C62.7654321,41 63.037037,41.0162602 63.3333333,41.0487805 C63.6296296,41.0813008 63.8518519,41.1138211 64,41.1463415 L64,41.1463415 L64,43.902439 C63.8024691,43.9349593 63.5390947,43.9593496 63.2098765,43.9756098 C62.8806584,43.9918699 62.5349794,44 62.1728395,44 Z"
+                  id="Kafka"
+                  fill="#FFFFFF"
+                ></path>
               </g>
             </a>
             <a href="/docs/reference/configuration/sources/file">
               <g id="Source-1" transform="translate(82.000000, 56.000000)">
                 <circle id="Oval-Copy-2" fill="#000000" cx="37.5" cy="37.5" r="37.5"></circle>
-                <path d="M13.455,49 L13.455,28.21 L27.375,28.21 L27.375,32.14 L18.135,32.14 L18.135,36.49 L26.355,36.49 L26.355,40.42 L18.135,40.42 L18.135,49 L13.455,49 Z M34.845,49 L30.375,49 L30.375,33.22 L34.845,33.22 L34.845,49 Z M35.265,28.66 C35.265,29.4800041 35.0000026,30.1249976 34.47,30.595 C33.9399973,31.0650023 33.3150036,31.3 32.595,31.3 C31.8749964,31.3 31.2500026,31.0650023 30.72,30.595 C30.1899973,30.1249976 29.925,29.4800041 29.925,28.66 C29.925,27.8399959 30.1899973,27.1950023 30.72,26.725 C31.2500026,26.2549976 31.8749964,26.02 32.595,26.02 C33.3150036,26.02 33.9399973,26.2549976 34.47,26.725 C35.0000026,27.1950023 35.265,27.8399959 35.265,28.66 Z M45.345,49.3 C44.045,49.2799999 42.9900041,49.1400013 42.18,48.88 C41.369996,48.6199987 40.7300023,48.2550023 40.26,47.785 C39.7899976,47.3149976 39.4700008,46.7450033 39.3,46.075 C39.1299992,45.4049966 39.045,44.6500042 39.045,43.81 L39.045,26.44 L43.515,25.72 L43.515,42.91 C43.515,43.310002 43.545,43.6699984 43.605,43.99 C43.6650003,44.3100016 43.7799992,44.5799989 43.95,44.8 C44.1200008,45.0200011 44.3649984,45.1999993 44.685,45.34 C45.0050016,45.4800007 45.4349973,45.5699998 45.975,45.61 L45.345,49.3 Z M47.775,41.23 C47.775,39.829993 47.9899979,38.6050052 48.42,37.555 C48.8500022,36.5049947 49.4149965,35.6300035 50.115,34.93 C50.8150035,34.2299965 51.6199955,33.7000018 52.53,33.34 C53.4400046,32.9799982 54.3749952,32.8 55.335,32.8 C57.5750112,32.8 59.3449935,33.4849931 60.645,34.855 C61.9450065,36.2250068 62.595,38.2399867 62.595,40.9 C62.595,41.1600013 62.5850001,41.4449984 62.565,41.755 C62.5449999,42.0650015 62.5250001,42.3399988 62.505,42.58 L52.365,42.58 C52.4650005,43.5000046 52.8949962,44.2299973 53.655,44.77 C54.4150038,45.3100027 55.4349936,45.58 56.715,45.58 C57.5350041,45.58 58.3399961,45.5050007 59.13,45.355 C59.920004,45.2049992 60.5649975,45.0200011 61.065,44.8 L61.665,48.43 C61.4249988,48.5500006 61.105002,48.6699994 60.705,48.79 C60.304998,48.9100006 59.8600025,49.0149995 59.37,49.105 C58.8799976,49.1950004 58.3550028,49.2699997 57.795,49.33 C57.2349972,49.3900003 56.6750028,49.42 56.115,49.42 C54.6949929,49.42 53.4600053,49.2100021 52.41,48.79 C51.3599948,48.3699979 50.4900035,47.7950036 49.8,47.065 C49.1099966,46.3349963 48.6000017,45.470005 48.27,44.47 C47.9399984,43.469995 47.775,42.3900058 47.775,41.23 Z M58.275,39.52 C58.2549999,39.1399981 58.1900006,38.7700018 58.08,38.41 C57.9699994,38.0499982 57.8000011,37.7300014 57.57,37.45 C57.3399988,37.1699986 57.0500017,36.9400009 56.7,36.76 C56.3499982,36.5799991 55.9150026,36.49 55.395,36.49 C54.8949975,36.49 54.4650018,36.5749991 54.105,36.745 C53.7449982,36.9150008 53.4450012,37.1399986 53.205,37.42 C52.9649988,37.7000014 52.7800006,38.0249982 52.65,38.395 C52.5199993,38.7650019 52.4250003,39.1399981 52.365,39.52 L58.275,39.52 Z" fill="#FFFFFF" fillRule="nonzero"></path>
+                <path
+                  d="M13.455,49 L13.455,28.21 L27.375,28.21 L27.375,32.14 L18.135,32.14 L18.135,36.49 L26.355,36.49 L26.355,40.42 L18.135,40.42 L18.135,49 L13.455,49 Z M34.845,49 L30.375,49 L30.375,33.22 L34.845,33.22 L34.845,49 Z M35.265,28.66 C35.265,29.4800041 35.0000026,30.1249976 34.47,30.595 C33.9399973,31.0650023 33.3150036,31.3 32.595,31.3 C31.8749964,31.3 31.2500026,31.0650023 30.72,30.595 C30.1899973,30.1249976 29.925,29.4800041 29.925,28.66 C29.925,27.8399959 30.1899973,27.1950023 30.72,26.725 C31.2500026,26.2549976 31.8749964,26.02 32.595,26.02 C33.3150036,26.02 33.9399973,26.2549976 34.47,26.725 C35.0000026,27.1950023 35.265,27.8399959 35.265,28.66 Z M45.345,49.3 C44.045,49.2799999 42.9900041,49.1400013 42.18,48.88 C41.369996,48.6199987 40.7300023,48.2550023 40.26,47.785 C39.7899976,47.3149976 39.4700008,46.7450033 39.3,46.075 C39.1299992,45.4049966 39.045,44.6500042 39.045,43.81 L39.045,26.44 L43.515,25.72 L43.515,42.91 C43.515,43.310002 43.545,43.6699984 43.605,43.99 C43.6650003,44.3100016 43.7799992,44.5799989 43.95,44.8 C44.1200008,45.0200011 44.3649984,45.1999993 44.685,45.34 C45.0050016,45.4800007 45.4349973,45.5699998 45.975,45.61 L45.345,49.3 Z M47.775,41.23 C47.775,39.829993 47.9899979,38.6050052 48.42,37.555 C48.8500022,36.5049947 49.4149965,35.6300035 50.115,34.93 C50.8150035,34.2299965 51.6199955,33.7000018 52.53,33.34 C53.4400046,32.9799982 54.3749952,32.8 55.335,32.8 C57.5750112,32.8 59.3449935,33.4849931 60.645,34.855 C61.9450065,36.2250068 62.595,38.2399867 62.595,40.9 C62.595,41.1600013 62.5850001,41.4449984 62.565,41.755 C62.5449999,42.0650015 62.5250001,42.3399988 62.505,42.58 L52.365,42.58 C52.4650005,43.5000046 52.8949962,44.2299973 53.655,44.77 C54.4150038,45.3100027 55.4349936,45.58 56.715,45.58 C57.5350041,45.58 58.3399961,45.5050007 59.13,45.355 C59.920004,45.2049992 60.5649975,45.0200011 61.065,44.8 L61.665,48.43 C61.4249988,48.5500006 61.105002,48.6699994 60.705,48.79 C60.304998,48.9100006 59.8600025,49.0149995 59.37,49.105 C58.8799976,49.1950004 58.3550028,49.2699997 57.795,49.33 C57.2349972,49.3900003 56.6750028,49.42 56.115,49.42 C54.6949929,49.42 53.4600053,49.2100021 52.41,48.79 C51.3599948,48.3699979 50.4900035,47.7950036 49.8,47.065 C49.1099966,46.3349963 48.6000017,45.470005 48.27,44.47 C47.9399984,43.469995 47.775,42.3900058 47.775,41.23 Z M58.275,39.52 C58.2549999,39.1399981 58.1900006,38.7700018 58.08,38.41 C57.9699994,38.0499982 57.8000011,37.7300014 57.57,37.45 C57.3399988,37.1699986 57.0500017,36.9400009 56.7,36.76 C56.3499982,36.5799991 55.9150026,36.49 55.395,36.49 C54.8949975,36.49 54.4650018,36.5749991 54.105,36.745 C53.7449982,36.9150008 53.4450012,37.1399986 53.205,37.42 C52.9649988,37.7000014 52.7800006,38.0249982 52.65,38.395 C52.5199993,38.7650019 52.4250003,39.1399981 52.365,39.52 L58.275,39.52 Z"
+                  fill="#FFFFFF"
+                  fillRule="nonzero"
+                ></path>
               </g>
             </a>
             <a href="/docs/reference/configuration/sources">
-              <path className="fade-in" d="M73.344,13.382 C73.8280024,13.382 74.2276651,13.3416671 74.543,13.261 C74.8583349,13.1803329 75.1113324,13.070334 75.302,12.931 C75.4926676,12.791666 75.6246663,12.6266676 75.698,12.436 C75.7713337,12.2453324 75.808,12.0326678 75.808,11.798 C75.808,11.2993308 75.5733357,10.8850016 75.104,10.555 C74.6346643,10.2249983 73.8280057,9.86933524 72.684,9.488 C72.1853308,9.31199912 71.6866692,9.11033447 71.188,8.883 C70.6893308,8.65566553 70.242002,8.36966839 69.846,8.025 C69.449998,7.68033161 69.1273346,7.26233579 68.878,6.771 C68.6286654,6.27966421 68.504,5.68200352 68.504,4.978 C68.504,4.27399648 68.6359987,3.63966949 68.9,3.075 C69.1640013,2.51033051 69.5379976,2.03000198 70.022,1.634 C70.5060024,1.23799802 71.0926632,0.93366773 71.782,0.721 C72.4713368,0.50833227 73.2486623,0.402 74.114,0.402 C75.1406718,0.402 76.0279963,0.5119989 76.776,0.732 C77.5240037,0.9520011 78.1399976,1.19399868 78.624,1.458 L77.634,4.164 C77.2086645,3.9439989 76.7356693,3.74966751 76.215,3.581 C75.6943307,3.41233249 75.067337,3.328 74.334,3.328 C73.5126626,3.328 72.9223351,3.44166553 72.563,3.669 C72.2036649,3.89633447 72.024,4.24466432 72.024,4.714 C72.024,4.99266806 72.0899993,5.22733238 72.222,5.418 C72.3540007,5.60866762 72.5409988,5.78099923 72.783,5.935 C73.0250012,6.08900077 73.3036651,6.22833271 73.619,6.353 C73.9343349,6.47766729 74.2826648,6.60599934 74.664,6.738 C75.456004,7.0313348 76.1453304,7.32099857 76.732,7.607 C77.3186696,7.89300143 77.8063314,8.22666476 78.195,8.608 C78.5836686,8.98933524 78.8733324,9.4366641 79.064,9.95 C79.2546676,10.4633359 79.35,11.086663 79.35,11.82 C79.35,13.2426738 78.8513383,14.3463294 77.854,15.131 C76.8566617,15.9156706 75.3533434,16.308 73.344,16.308 C72.66933,16.308 72.0606694,16.2676671 71.518,16.187 C70.9753306,16.1063329 70.4950021,16.0073339 70.077,15.89 C69.6589979,15.7726661 69.2996682,15.6480007 68.999,15.516 C68.6983318,15.3839993 68.4453344,15.2593339 68.24,15.142 L69.208,12.414 C69.6626689,12.6633346 70.2236633,12.886999 70.891,13.085 C71.5583367,13.283001 72.3759952,13.382 73.344,13.382 Z M92.594,10.192 C92.594,11.1013379 92.4620013,11.9336629 92.198,12.689 C91.9339987,13.4443371 91.5526692,14.089664 91.054,14.625 C90.5553308,15.160336 89.9576702,15.5746652 89.261,15.868 C88.5643299,16.1613348 87.7833377,16.308 86.918,16.308 C86.0673291,16.308 85.2936701,16.1613348 84.597,15.868 C83.9003298,15.5746652 83.3026692,15.160336 82.804,14.625 C82.3053308,14.089664 81.9166681,13.4443371 81.638,12.689 C81.3593319,11.9336629 81.22,11.1013379 81.22,10.192 C81.22,9.28266212 81.3629986,8.45400374 81.649,7.706 C81.9350014,6.95799626 82.3309975,6.32000264 82.837,5.792 C83.3430025,5.26399736 83.9443299,4.8533348 84.641,4.56 C85.3376702,4.2666652 86.0966626,4.12 86.918,4.12 C87.7540042,4.12 88.5203298,4.2666652 89.217,4.56 C89.9136702,4.8533348 90.5113308,5.26399736 91.01,5.792 C91.5086692,6.32000264 91.8973319,6.95799626 92.176,7.706 C92.4546681,8.45400374 92.594,9.28266212 92.594,10.192 Z M89.25,10.192 C89.25,9.17999494 89.0483354,8.38433623 88.645,7.805 C88.2416646,7.22566377 87.6660037,6.936 86.918,6.936 C86.1699963,6.936 85.5906687,7.22566377 85.18,7.805 C84.7693313,8.38433623 84.564,9.17999494 84.564,10.192 C84.564,11.2040051 84.7693313,12.006997 85.18,12.601 C85.5906687,13.195003 86.1699963,13.492 86.918,13.492 C87.6660037,13.492 88.2416646,13.195003 88.645,12.601 C89.0483354,12.006997 89.25,11.2040051 89.25,10.192 Z M105.002,15.604 C104.444664,15.7653341 103.726004,15.915666 102.846,16.055 C101.965996,16.194334 101.042005,16.264 100.074,16.264 C99.0913284,16.264 98.2736699,16.1320013 97.621,15.868 C96.9683301,15.6039987 96.4513352,15.233669 96.07,14.757 C95.6886648,14.2803309 95.4173341,13.7120033 95.256,13.052 C95.0946659,12.3919967 95.014,11.666004 95.014,10.874 L95.014,4.428 L98.292,4.428 L98.292,10.478 C98.292,11.5340053 98.4313319,12.2966643 98.71,12.766 C98.9886681,13.2353357 99.5093295,13.47 100.272,13.47 C100.506668,13.47 100.755999,13.4590001 101.02,13.437 C101.284001,13.4149999 101.518666,13.3893335 101.724,13.36 L101.724,4.428 L105.002,4.428 L105.002,15.604 Z M115.056,7.332 C114.762665,7.2586663 114.418002,7.18166707 114.022,7.101 C113.625998,7.02033293 113.200669,6.98 112.746,6.98 C112.540666,6.98 112.295001,6.99833315 112.009,7.035 C111.722999,7.07166685 111.506667,7.11199978 111.36,7.156 L111.36,16 L108.082,16 L108.082,5.044 C108.66867,4.83866564 109.361663,4.64433425 110.161,4.461 C110.960337,4.27766575 111.851328,4.186 112.834,4.186 C113.010001,4.186 113.222665,4.19699989 113.472,4.219 C113.721335,4.24100011 113.970665,4.27033315 114.22,4.307 C114.469335,4.34366685 114.718665,4.38766641 114.968,4.439 C115.217335,4.49033359 115.429999,4.5526663 115.606,4.626 L115.056,7.332 Z M116.596,10.214 C116.596,9.37799582 116.731665,8.58967037 117.003,7.849 C117.274335,7.10832963 117.666664,6.46300275 118.18,5.913 C118.693336,5.36299725 119.316663,4.92666828 120.05,4.604 C120.783337,4.28133172 121.619329,4.12 122.558,4.12 C123.174003,4.12 123.738664,4.17499945 124.252,4.285 C124.765336,4.39500055 125.263998,4.55266564 125.748,4.758 L125.066,7.376 C124.757998,7.25866608 124.420669,7.15600044 124.054,7.068 C123.687331,6.97999956 123.276669,6.936 122.822,6.936 C121.853995,6.936 121.131669,7.23666366 120.655,7.838 C120.178331,8.43933634 119.94,9.23132842 119.94,10.214 C119.94,11.2553385 120.163664,12.0619971 120.611,12.634 C121.058336,13.2060029 121.839328,13.492 122.954,13.492 C123.350002,13.492 123.775331,13.4553337 124.23,13.382 C124.684669,13.3086663 125.102665,13.1913341 125.484,13.03 L125.946,15.714 C125.564665,15.8753341 125.088003,16.0146661 124.516,16.132 C123.943997,16.2493339 123.313337,16.308 122.624,16.308 C121.567995,16.308 120.65867,16.1503349 119.896,15.835 C119.13333,15.5196651 118.506336,15.0906694 118.015,14.548 C117.523664,14.0053306 117.164334,13.3636704 116.937,12.623 C116.709666,11.8823296 116.596,11.0793377 116.596,10.214 Z M127.046,10.302 C127.046,9.2753282 127.203665,8.37700385 127.519,7.607 C127.834335,6.83699615 128.248664,6.1953359 128.762,5.682 C129.275336,5.1686641 129.865663,4.78000132 130.533,4.516 C131.200337,4.25199868 131.885996,4.12 132.59,4.12 C134.232675,4.12 135.530662,4.62232831 136.484,5.627 C137.437338,6.63167169 137.914,8.10932358 137.914,10.06 C137.914,10.2506676 137.906667,10.4596655 137.892,10.687 C137.877333,10.9143345 137.862667,11.1159991 137.848,11.292 L130.412,11.292 C130.485334,11.96667 130.800664,12.501998 131.358,12.898 C131.915336,13.294002 132.663329,13.492 133.602,13.492 C134.203336,13.492 134.793664,13.4370005 135.373,13.327 C135.952336,13.2169994 136.425331,13.0813341 136.792,12.92 L137.232,15.582 C137.055999,15.6700004 136.821335,15.7579996 136.528,15.846 C136.234665,15.9340004 135.908335,16.0109997 135.549,16.077 C135.189665,16.1430003 134.804669,16.1979998 134.394,16.242 C133.983331,16.2860002 133.572669,16.308 133.162,16.308 C132.120661,16.308 131.215004,16.1540015 130.445,15.846 C129.674996,15.5379985 129.037003,15.116336 128.531,14.581 C128.024997,14.045664 127.651001,13.411337 127.409,12.678 C127.166999,11.944663 127.046,11.1526709 127.046,10.302 Z M134.746,9.048 C134.731333,8.76933194 134.683667,8.49800132 134.603,8.234 C134.522333,7.96999868 134.397668,7.73533436 134.229,7.53 C134.060332,7.32466564 133.847668,7.15600066 133.591,7.024 C133.334332,6.89199934 133.015335,6.826 132.634,6.826 C132.267332,6.826 131.952001,6.88833271 131.688,7.013 C131.423999,7.13766729 131.204001,7.30266564 131.028,7.508 C130.851999,7.71333436 130.716334,7.95166531 130.621,8.223 C130.525666,8.49433469 130.456,8.76933194 130.412,9.048 L134.746,9.048 Z M143.766,13.646 C144.367336,13.646 144.792665,13.5873339 145.042,13.47 C145.291335,13.3526661 145.416,13.125335 145.416,12.788 C145.416,12.5239987 145.254668,12.293001 144.932,12.095 C144.609332,11.896999 144.118003,11.6733346 143.458,11.424 C142.944664,11.2333324 142.479002,11.0353344 142.061,10.83 C141.642998,10.6246656 141.287335,10.3790014 140.994,10.093 C140.700665,9.80699857 140.473334,9.46600198 140.312,9.07 C140.150666,8.67399802 140.07,8.19733612 140.07,7.64 C140.07,6.55466124 140.473329,5.69666982 141.28,5.066 C142.086671,4.43533018 143.193993,4.12 144.602,4.12 C145.306004,4.12 145.980663,4.18233271 146.626,4.307 C147.271337,4.43166729 147.784665,4.5673326 148.166,4.714 L147.594,7.266 C147.212665,7.13399934 146.798336,7.01666718 146.351,6.914 C145.903664,6.81133282 145.401336,6.76 144.844,6.76 C143.817328,6.76 143.304,7.04599714 143.304,7.618 C143.304,7.75000066 143.326,7.86733282 143.37,7.97 C143.414,8.07266718 143.501999,8.17166619 143.634,8.267 C143.766001,8.36233381 143.945666,8.46499945 144.173,8.575 C144.400334,8.68500055 144.689998,8.80599934 145.042,8.938 C145.76067,9.20200132 146.354664,9.46233205 146.824,9.719 C147.293336,9.97566795 147.663665,10.2543318 147.935,10.555 C148.206335,10.8556682 148.396999,11.1893315 148.507,11.556 C148.617001,11.9226685 148.672,12.3479976 148.672,12.832 C148.672,13.9760057 148.243004,14.8413304 147.385,15.428 C146.526996,16.0146696 145.313341,16.308 143.744,16.308 C142.717328,16.308 141.863003,16.2200009 141.181,16.044 C140.498997,15.8679991 140.026001,15.7213339 139.762,15.604 L140.312,12.942 C140.869336,13.1620011 141.44133,13.3343327 142.028,13.459 C142.61467,13.5836673 143.193997,13.646 143.766,13.646 Z" fill="#000000" fillRule="nonzero"></path>
+              <path
+                className="fade-in"
+                d="M73.344,13.382 C73.8280024,13.382 74.2276651,13.3416671 74.543,13.261 C74.8583349,13.1803329 75.1113324,13.070334 75.302,12.931 C75.4926676,12.791666 75.6246663,12.6266676 75.698,12.436 C75.7713337,12.2453324 75.808,12.0326678 75.808,11.798 C75.808,11.2993308 75.5733357,10.8850016 75.104,10.555 C74.6346643,10.2249983 73.8280057,9.86933524 72.684,9.488 C72.1853308,9.31199912 71.6866692,9.11033447 71.188,8.883 C70.6893308,8.65566553 70.242002,8.36966839 69.846,8.025 C69.449998,7.68033161 69.1273346,7.26233579 68.878,6.771 C68.6286654,6.27966421 68.504,5.68200352 68.504,4.978 C68.504,4.27399648 68.6359987,3.63966949 68.9,3.075 C69.1640013,2.51033051 69.5379976,2.03000198 70.022,1.634 C70.5060024,1.23799802 71.0926632,0.93366773 71.782,0.721 C72.4713368,0.50833227 73.2486623,0.402 74.114,0.402 C75.1406718,0.402 76.0279963,0.5119989 76.776,0.732 C77.5240037,0.9520011 78.1399976,1.19399868 78.624,1.458 L77.634,4.164 C77.2086645,3.9439989 76.7356693,3.74966751 76.215,3.581 C75.6943307,3.41233249 75.067337,3.328 74.334,3.328 C73.5126626,3.328 72.9223351,3.44166553 72.563,3.669 C72.2036649,3.89633447 72.024,4.24466432 72.024,4.714 C72.024,4.99266806 72.0899993,5.22733238 72.222,5.418 C72.3540007,5.60866762 72.5409988,5.78099923 72.783,5.935 C73.0250012,6.08900077 73.3036651,6.22833271 73.619,6.353 C73.9343349,6.47766729 74.2826648,6.60599934 74.664,6.738 C75.456004,7.0313348 76.1453304,7.32099857 76.732,7.607 C77.3186696,7.89300143 77.8063314,8.22666476 78.195,8.608 C78.5836686,8.98933524 78.8733324,9.4366641 79.064,9.95 C79.2546676,10.4633359 79.35,11.086663 79.35,11.82 C79.35,13.2426738 78.8513383,14.3463294 77.854,15.131 C76.8566617,15.9156706 75.3533434,16.308 73.344,16.308 C72.66933,16.308 72.0606694,16.2676671 71.518,16.187 C70.9753306,16.1063329 70.4950021,16.0073339 70.077,15.89 C69.6589979,15.7726661 69.2996682,15.6480007 68.999,15.516 C68.6983318,15.3839993 68.4453344,15.2593339 68.24,15.142 L69.208,12.414 C69.6626689,12.6633346 70.2236633,12.886999 70.891,13.085 C71.5583367,13.283001 72.3759952,13.382 73.344,13.382 Z M92.594,10.192 C92.594,11.1013379 92.4620013,11.9336629 92.198,12.689 C91.9339987,13.4443371 91.5526692,14.089664 91.054,14.625 C90.5553308,15.160336 89.9576702,15.5746652 89.261,15.868 C88.5643299,16.1613348 87.7833377,16.308 86.918,16.308 C86.0673291,16.308 85.2936701,16.1613348 84.597,15.868 C83.9003298,15.5746652 83.3026692,15.160336 82.804,14.625 C82.3053308,14.089664 81.9166681,13.4443371 81.638,12.689 C81.3593319,11.9336629 81.22,11.1013379 81.22,10.192 C81.22,9.28266212 81.3629986,8.45400374 81.649,7.706 C81.9350014,6.95799626 82.3309975,6.32000264 82.837,5.792 C83.3430025,5.26399736 83.9443299,4.8533348 84.641,4.56 C85.3376702,4.2666652 86.0966626,4.12 86.918,4.12 C87.7540042,4.12 88.5203298,4.2666652 89.217,4.56 C89.9136702,4.8533348 90.5113308,5.26399736 91.01,5.792 C91.5086692,6.32000264 91.8973319,6.95799626 92.176,7.706 C92.4546681,8.45400374 92.594,9.28266212 92.594,10.192 Z M89.25,10.192 C89.25,9.17999494 89.0483354,8.38433623 88.645,7.805 C88.2416646,7.22566377 87.6660037,6.936 86.918,6.936 C86.1699963,6.936 85.5906687,7.22566377 85.18,7.805 C84.7693313,8.38433623 84.564,9.17999494 84.564,10.192 C84.564,11.2040051 84.7693313,12.006997 85.18,12.601 C85.5906687,13.195003 86.1699963,13.492 86.918,13.492 C87.6660037,13.492 88.2416646,13.195003 88.645,12.601 C89.0483354,12.006997 89.25,11.2040051 89.25,10.192 Z M105.002,15.604 C104.444664,15.7653341 103.726004,15.915666 102.846,16.055 C101.965996,16.194334 101.042005,16.264 100.074,16.264 C99.0913284,16.264 98.2736699,16.1320013 97.621,15.868 C96.9683301,15.6039987 96.4513352,15.233669 96.07,14.757 C95.6886648,14.2803309 95.4173341,13.7120033 95.256,13.052 C95.0946659,12.3919967 95.014,11.666004 95.014,10.874 L95.014,4.428 L98.292,4.428 L98.292,10.478 C98.292,11.5340053 98.4313319,12.2966643 98.71,12.766 C98.9886681,13.2353357 99.5093295,13.47 100.272,13.47 C100.506668,13.47 100.755999,13.4590001 101.02,13.437 C101.284001,13.4149999 101.518666,13.3893335 101.724,13.36 L101.724,4.428 L105.002,4.428 L105.002,15.604 Z M115.056,7.332 C114.762665,7.2586663 114.418002,7.18166707 114.022,7.101 C113.625998,7.02033293 113.200669,6.98 112.746,6.98 C112.540666,6.98 112.295001,6.99833315 112.009,7.035 C111.722999,7.07166685 111.506667,7.11199978 111.36,7.156 L111.36,16 L108.082,16 L108.082,5.044 C108.66867,4.83866564 109.361663,4.64433425 110.161,4.461 C110.960337,4.27766575 111.851328,4.186 112.834,4.186 C113.010001,4.186 113.222665,4.19699989 113.472,4.219 C113.721335,4.24100011 113.970665,4.27033315 114.22,4.307 C114.469335,4.34366685 114.718665,4.38766641 114.968,4.439 C115.217335,4.49033359 115.429999,4.5526663 115.606,4.626 L115.056,7.332 Z M116.596,10.214 C116.596,9.37799582 116.731665,8.58967037 117.003,7.849 C117.274335,7.10832963 117.666664,6.46300275 118.18,5.913 C118.693336,5.36299725 119.316663,4.92666828 120.05,4.604 C120.783337,4.28133172 121.619329,4.12 122.558,4.12 C123.174003,4.12 123.738664,4.17499945 124.252,4.285 C124.765336,4.39500055 125.263998,4.55266564 125.748,4.758 L125.066,7.376 C124.757998,7.25866608 124.420669,7.15600044 124.054,7.068 C123.687331,6.97999956 123.276669,6.936 122.822,6.936 C121.853995,6.936 121.131669,7.23666366 120.655,7.838 C120.178331,8.43933634 119.94,9.23132842 119.94,10.214 C119.94,11.2553385 120.163664,12.0619971 120.611,12.634 C121.058336,13.2060029 121.839328,13.492 122.954,13.492 C123.350002,13.492 123.775331,13.4553337 124.23,13.382 C124.684669,13.3086663 125.102665,13.1913341 125.484,13.03 L125.946,15.714 C125.564665,15.8753341 125.088003,16.0146661 124.516,16.132 C123.943997,16.2493339 123.313337,16.308 122.624,16.308 C121.567995,16.308 120.65867,16.1503349 119.896,15.835 C119.13333,15.5196651 118.506336,15.0906694 118.015,14.548 C117.523664,14.0053306 117.164334,13.3636704 116.937,12.623 C116.709666,11.8823296 116.596,11.0793377 116.596,10.214 Z M127.046,10.302 C127.046,9.2753282 127.203665,8.37700385 127.519,7.607 C127.834335,6.83699615 128.248664,6.1953359 128.762,5.682 C129.275336,5.1686641 129.865663,4.78000132 130.533,4.516 C131.200337,4.25199868 131.885996,4.12 132.59,4.12 C134.232675,4.12 135.530662,4.62232831 136.484,5.627 C137.437338,6.63167169 137.914,8.10932358 137.914,10.06 C137.914,10.2506676 137.906667,10.4596655 137.892,10.687 C137.877333,10.9143345 137.862667,11.1159991 137.848,11.292 L130.412,11.292 C130.485334,11.96667 130.800664,12.501998 131.358,12.898 C131.915336,13.294002 132.663329,13.492 133.602,13.492 C134.203336,13.492 134.793664,13.4370005 135.373,13.327 C135.952336,13.2169994 136.425331,13.0813341 136.792,12.92 L137.232,15.582 C137.055999,15.6700004 136.821335,15.7579996 136.528,15.846 C136.234665,15.9340004 135.908335,16.0109997 135.549,16.077 C135.189665,16.1430003 134.804669,16.1979998 134.394,16.242 C133.983331,16.2860002 133.572669,16.308 133.162,16.308 C132.120661,16.308 131.215004,16.1540015 130.445,15.846 C129.674996,15.5379985 129.037003,15.116336 128.531,14.581 C128.024997,14.045664 127.651001,13.411337 127.409,12.678 C127.166999,11.944663 127.046,11.1526709 127.046,10.302 Z M134.746,9.048 C134.731333,8.76933194 134.683667,8.49800132 134.603,8.234 C134.522333,7.96999868 134.397668,7.73533436 134.229,7.53 C134.060332,7.32466564 133.847668,7.15600066 133.591,7.024 C133.334332,6.89199934 133.015335,6.826 132.634,6.826 C132.267332,6.826 131.952001,6.88833271 131.688,7.013 C131.423999,7.13766729 131.204001,7.30266564 131.028,7.508 C130.851999,7.71333436 130.716334,7.95166531 130.621,8.223 C130.525666,8.49433469 130.456,8.76933194 130.412,9.048 L134.746,9.048 Z M143.766,13.646 C144.367336,13.646 144.792665,13.5873339 145.042,13.47 C145.291335,13.3526661 145.416,13.125335 145.416,12.788 C145.416,12.5239987 145.254668,12.293001 144.932,12.095 C144.609332,11.896999 144.118003,11.6733346 143.458,11.424 C142.944664,11.2333324 142.479002,11.0353344 142.061,10.83 C141.642998,10.6246656 141.287335,10.3790014 140.994,10.093 C140.700665,9.80699857 140.473334,9.46600198 140.312,9.07 C140.150666,8.67399802 140.07,8.19733612 140.07,7.64 C140.07,6.55466124 140.473329,5.69666982 141.28,5.066 C142.086671,4.43533018 143.193993,4.12 144.602,4.12 C145.306004,4.12 145.980663,4.18233271 146.626,4.307 C147.271337,4.43166729 147.784665,4.5673326 148.166,4.714 L147.594,7.266 C147.212665,7.13399934 146.798336,7.01666718 146.351,6.914 C145.903664,6.81133282 145.401336,6.76 144.844,6.76 C143.817328,6.76 143.304,7.04599714 143.304,7.618 C143.304,7.75000066 143.326,7.86733282 143.37,7.97 C143.414,8.07266718 143.501999,8.17166619 143.634,8.267 C143.766001,8.36233381 143.945666,8.46499945 144.173,8.575 C144.400334,8.68500055 144.689998,8.80599934 145.042,8.938 C145.76067,9.20200132 146.354664,9.46233205 146.824,9.719 C147.293336,9.97566795 147.663665,10.2543318 147.935,10.555 C148.206335,10.8556682 148.396999,11.1893315 148.507,11.556 C148.617001,11.9226685 148.672,12.3479976 148.672,12.832 C148.672,13.9760057 148.243004,14.8413304 147.385,15.428 C146.526996,16.0146696 145.313341,16.308 143.744,16.308 C142.717328,16.308 141.863003,16.2200009 141.181,16.044 C140.498997,15.8679991 140.026001,15.7213339 139.762,15.604 L140.312,12.942 C140.869336,13.1620011 141.44133,13.3343327 142.028,13.459 C142.61467,13.5836673 143.193997,13.646 143.766,13.646 Z"
+                fill="#000000"
+                fillRule="nonzero"
+              ></path>
             </a>
           </g>
           <g id="Transforms" transform="translate(223.721371, 5.000000)">
             <a href="/docs/reference/configuration/transforms/log_to_metric">
               <g id="Aggregate" transform="translate(29.278629, 194.000000)">
-                <polygon id="Fill-74" fill="#F44AF5" points="1.13686838e-13 52.3412682 99.9238736 72.9440335 199.84544 52.3412682 99.9238736 31.7363751"></polygon>
-                <polygon id="Fill-79" fill="#F44AF5" points="0.206736663 52.3379226 1.13686838e-13 21.1988549 99.7120786 0.579365079 199.84544 21.4061125 199.516959 52.2652672 99.7120786 72.9440335"></polygon>
-                <polygon id="Fill-75" fill="#F44AF5" points="5.68434189e-14 21.6857267 5.68434189e-14 52.5454054 97.3605992 72.9440335 97.3605992 42.3477482"></polygon>
-                <polygon id="Fill-76" fill="#F44AF5" points="100.776761 42.1888714 199.84544 21.6857267 199.36429 52.4408483 100.776761 72.9440335"></polygon>
-                <polygon id="Fill-77" fill="#F44AF5" points="100.776761 0.579365079 199.84544 21.2160983 199.364396 51.8376719 100.981171 31.4242294"></polygon>
-                <polygon id="Fill-78" fill="#F44AF5" points="1.13686838e-13 20.9515833 1.13686838e-13 51.8376719 99.0686799 31.3963029 98.8616119 0.579365079"></polygon>
-                <polygon id="Fill-74-Copy" fillOpacity="0.33241368" fill="#FFFFFF" points="1.70530257e-13 21.0555539 99.9238736 41.6583192 199.84544 21.0555539 99.9238736 0.450660813"></polygon>
+                <polygon
+                  id="Fill-74"
+                  fill="#F44AF5"
+                  points="1.13686838e-13 52.3412682 99.9238736 72.9440335 199.84544 52.3412682 99.9238736 31.7363751"
+                ></polygon>
+                <polygon
+                  id="Fill-79"
+                  fill="#F44AF5"
+                  points="0.206736663 52.3379226 1.13686838e-13 21.1988549 99.7120786 0.579365079 199.84544 21.4061125 199.516959 52.2652672 99.7120786 72.9440335"
+                ></polygon>
+                <polygon
+                  id="Fill-75"
+                  fill="#F44AF5"
+                  points="5.68434189e-14 21.6857267 5.68434189e-14 52.5454054 97.3605992 72.9440335 97.3605992 42.3477482"
+                ></polygon>
+                <polygon
+                  id="Fill-76"
+                  fill="#F44AF5"
+                  points="100.776761 42.1888714 199.84544 21.6857267 199.36429 52.4408483 100.776761 72.9440335"
+                ></polygon>
+                <polygon
+                  id="Fill-77"
+                  fill="#F44AF5"
+                  points="100.776761 0.579365079 199.84544 21.2160983 199.364396 51.8376719 100.981171 31.4242294"
+                ></polygon>
+                <polygon
+                  id="Fill-78"
+                  fill="#F44AF5"
+                  points="1.13686838e-13 20.9515833 1.13686838e-13 51.8376719 99.0686799 31.3963029 98.8616119 0.579365079"
+                ></polygon>
+                <polygon
+                  id="Fill-74-Copy"
+                  fillOpacity="0.33241368"
+                  fill="#FFFFFF"
+                  points="1.70530257e-13 21.0555539 99.9238736 41.6583192 199.84544 21.0555539 99.9238736 0.450660813"
+                ></polygon>
               </g>
             </a>
             <a href="/docs/reference/configuration/transforms/sample">
               <g id="Sample" transform="translate(29.278629, 134.000000)">
-                <polygon id="Fill-74" fill="#3084FF" points="1.13686838e-13 52.3412682 99.9238736 72.9440335 199.84544 52.3412682 99.9238736 31.7363751"></polygon>
-                <polygon id="Fill-79" fill="#3084FF" points="0.206736663 52.3379226 1.13686838e-13 21.1988549 99.7120786 0.579365079 199.84544 21.4061125 199.516959 52.2652672 99.7120786 72.9440335"></polygon>
-                <polygon id="Fill-75" fill="#3084FF" points="5.68434189e-14 21.6857267 5.68434189e-14 52.5454054 97.3605992 72.9440335 97.3605992 42.3477482"></polygon>
-                <polygon id="Fill-76" fill="#3084FF" points="100.776761 41.1888714 199.84544 20.6857267 199.36429 51.4408483 100.776761 71.9440335"></polygon>
-                <polygon id="Fill-77" fill="#3084FF" points="100.776761 0.579365079 199.84544 21.2160983 199.364396 51.8376719 100.981171 31.4242294"></polygon>
-                <polygon id="Fill-78" fill="#3084FF" points="1.13686838e-13 20.9515833 1.13686838e-13 51.8376719 99.0686799 31.3963029 98.8616119 0.579365079"></polygon>
-                <polygon id="Fill-74-Copy" fillOpacity="0.33241368" fill="#FFFFFF" points="1.70530257e-13 21.0555539 99.9238736 41.6583192 199.84544 21.0555539 99.9238736 0.450660813"></polygon>
+                <polygon
+                  id="Fill-74"
+                  fill="#3084FF"
+                  points="1.13686838e-13 52.3412682 99.9238736 72.9440335 199.84544 52.3412682 99.9238736 31.7363751"
+                ></polygon>
+                <polygon
+                  id="Fill-79"
+                  fill="#3084FF"
+                  points="0.206736663 52.3379226 1.13686838e-13 21.1988549 99.7120786 0.579365079 199.84544 21.4061125 199.516959 52.2652672 99.7120786 72.9440335"
+                ></polygon>
+                <polygon
+                  id="Fill-75"
+                  fill="#3084FF"
+                  points="5.68434189e-14 21.6857267 5.68434189e-14 52.5454054 97.3605992 72.9440335 97.3605992 42.3477482"
+                ></polygon>
+                <polygon
+                  id="Fill-76"
+                  fill="#3084FF"
+                  points="100.776761 41.1888714 199.84544 20.6857267 199.36429 51.4408483 100.776761 71.9440335"
+                ></polygon>
+                <polygon
+                  id="Fill-77"
+                  fill="#3084FF"
+                  points="100.776761 0.579365079 199.84544 21.2160983 199.364396 51.8376719 100.981171 31.4242294"
+                ></polygon>
+                <polygon
+                  id="Fill-78"
+                  fill="#3084FF"
+                  points="1.13686838e-13 20.9515833 1.13686838e-13 51.8376719 99.0686799 31.3963029 98.8616119 0.579365079"
+                ></polygon>
+                <polygon
+                  id="Fill-74-Copy"
+                  fillOpacity="0.33241368"
+                  fill="#FFFFFF"
+                  points="1.70530257e-13 21.0555539 99.9238736 41.6583192 199.84544 21.0555539 99.9238736 0.450660813"
+                ></polygon>
               </g>
             </a>
             <a href="/docs/reference/vrl">
               <g id="Structure" transform="translate(29.278629, 74.000000)">
-                <polygon id="Fill-74" fill="#10E7FF" points="1.13686838e-13 52.4612587 99.9238736 72.9443586 199.84544 52.4612587 99.9238736 31.9760433"></polygon>
-                <polygon id="Fill-79" fill="#10E7FF" points="0.206736663 52.4579325 1.13686838e-13 21.4997273 99.7120786 1 199.84544 21.7057811 199.516959 52.3856991 99.7120786 72.9443586"></polygon>
-                <polygon id="Fill-75" fill="#10E7FF" points="5.68434189e-14 21.9837713 5.68434189e-14 52.6642102 97.3605992 72.9443586 97.3605992 42.5257832"></polygon>
-                <polygon id="Fill-76" fill="#10E7FF" points="100.776761 42.3678292 199.84544 21.9837713 199.36429 52.5602604 100.776761 72.9443586"></polygon>
-                <polygon id="Fill-77" fill="#10E7FF" points="100.776761 1 199.84544 21.5168705 199.364396 51.9605873 100.981171 31.6657106"></polygon>
-                <polygon id="Fill-78" fill="#10E7FF" points="1.13686838e-13 21.2538919 1.13686838e-13 51.9605873 99.0686799 31.6379463 98.8616119 1"></polygon>
-                <polygon id="Fill-74-Copy" fillOpacity="0.33241368" fill="#FFFFFF" points="1.70530257e-13 21.3572587 99.9238736 41.8403586 199.84544 21.3572587 99.9238736 0.872043277"></polygon>
+                <polygon
+                  id="Fill-74"
+                  fill="#10E7FF"
+                  points="1.13686838e-13 52.4612587 99.9238736 72.9443586 199.84544 52.4612587 99.9238736 31.9760433"
+                ></polygon>
+                <polygon
+                  id="Fill-79"
+                  fill="#10E7FF"
+                  points="0.206736663 52.4579325 1.13686838e-13 21.4997273 99.7120786 1 199.84544 21.7057811 199.516959 52.3856991 99.7120786 72.9443586"
+                ></polygon>
+                <polygon
+                  id="Fill-75"
+                  fill="#10E7FF"
+                  points="5.68434189e-14 21.9837713 5.68434189e-14 52.6642102 97.3605992 72.9443586 97.3605992 42.5257832"
+                ></polygon>
+                <polygon
+                  id="Fill-76"
+                  fill="#10E7FF"
+                  points="100.776761 42.3678292 199.84544 21.9837713 199.36429 52.5602604 100.776761 72.9443586"
+                ></polygon>
+                <polygon
+                  id="Fill-77"
+                  fill="#10E7FF"
+                  points="100.776761 1 199.84544 21.5168705 199.364396 51.9605873 100.981171 31.6657106"
+                ></polygon>
+                <polygon
+                  id="Fill-78"
+                  fill="#10E7FF"
+                  points="1.13686838e-13 21.2538919 1.13686838e-13 51.9605873 99.0686799 31.6379463 98.8616119 1"
+                ></polygon>
+                <polygon
+                  id="Fill-74-Copy"
+                  fillOpacity="0.33241368"
+                  fill="#FFFFFF"
+                  points="1.70530257e-13 21.3572587 99.9238736 41.8403586 199.84544 21.3572587 99.9238736 0.872043277"
+                ></polygon>
               </g>
             </a>
-            <path className="fade-in" d="M137.912913,124.27351 L140.194163,124.27351 C139.922479,125.187572 140.600085,125.77351 141.92821,125.77351 C143.154772,125.77351 144.269485,125.17976 144.62449,124.328197 C144.924126,123.609447 144.534243,123.195385 143.275193,122.89851 L141.93672,122.58601 C140.061163,122.156322 139.499548,121.08601 140.21607,119.36726 C141.101952,117.24226 143.395877,115.843822 145.99744,115.843822 C148.481815,115.843822 149.659896,117.234447 148.893181,119.24226 L146.674431,119.24226 C146.936344,118.351635 146.355745,117.757885 145.21512,117.757885 C144.035433,117.757885 143.026198,118.30476 142.667937,119.164135 C142.378072,119.859447 142.751031,120.257885 143.954095,120.539135 L145.192964,120.828197 C147.259917,121.30476 147.829365,122.281322 147.099815,124.031322 C146.152052,126.30476 143.830133,127.695385 141.002008,127.695385 C138.314508,127.695385 137.12274,126.375072 137.912913,124.27351 Z M152.786957,116.74226 L155.060394,116.74226 L154.171256,118.875072 L155.960318,118.875072 L155.214484,120.664135 L153.425422,120.664135 L151.80999,124.539135 C151.497326,125.289135 151.697772,125.632885 152.471209,125.632885 C152.768084,125.632885 152.927591,125.625072 153.156112,125.601635 L152.433076,127.33601 C152.129028,127.390697 151.687611,127.437572 151.250111,127.437572 C149.156361,127.437572 148.611588,126.757885 149.311825,125.078197 L151.151984,120.664135 L149.808234,120.664135 L150.554068,118.875072 L151.897818,118.875072 L152.786957,116.74226 Z M154.294389,127.406322 L157.886769,118.789135 L160.089894,118.789135 L159.516677,120.164135 L159.657302,120.164135 C160.242125,119.30476 161.406331,118.64851 162.500081,118.64851 C162.812581,118.64851 163.179109,118.687572 163.34511,118.757885 L162.482026,120.828197 C162.331651,120.757885 161.829713,120.687572 161.462526,120.687572 C160.220338,120.687572 159.062626,121.421947 158.557803,122.632885 L156.567826,127.406322 L154.294389,127.406322 Z M172.644582,118.789135 L169.052201,127.406322 L166.849076,127.406322 L167.425551,126.02351 L167.284926,126.02351 C166.46179,127.02351 165.419348,127.593822 164.11466,127.593822 C162.255285,127.593822 161.594087,126.406322 162.427858,124.406322 L164.769582,118.789135 L167.043019,118.789135 L164.945564,123.820385 C164.450513,125.007885 164.735536,125.61726 165.782411,125.61726 C166.915223,125.61726 167.820978,124.906322 168.299745,123.757885 L170.371144,118.789135 L172.644582,118.789135 Z M181.283891,121.828197 L179.158891,121.828197 C179.344617,121.007885 178.983407,120.468822 178.014657,120.468822 C176.788095,120.468822 175.719535,121.382885 175.012784,123.078197 C174.296262,124.796947 174.604001,125.726635 175.822751,125.726635 C176.752439,125.726635 177.550715,125.27351 178.077594,124.421947 L180.202594,124.421947 C179.210635,126.351635 177.286535,127.593822 175.044348,127.593822 C172.356848,127.593822 171.510849,125.968822 172.715909,123.078197 C173.907941,120.218822 176.097748,118.601635 178.79306,118.601635 C181.07431,118.601635 181.913877,119.86726 181.283891,121.828197 Z M185.904144,116.74226 L188.177582,116.74226 L187.288443,118.875072 L189.077506,118.875072 L188.331672,120.664135 L186.542609,120.664135 L184.927178,124.539135 C184.614514,125.289135 184.814959,125.632885 185.588397,125.632885 C185.885272,125.632885 186.044779,125.625072 186.273299,125.601635 L185.550264,127.33601 C185.246215,127.390697 184.804799,127.437572 184.367299,127.437572 C182.273549,127.437572 181.728776,126.757885 182.429013,125.078197 L184.269172,120.664135 L182.925422,120.664135 L183.671256,118.875072 L185.015006,118.875072 L185.904144,116.74226 Z M198.800832,118.789135 L195.208451,127.406322 L193.005326,127.406322 L193.581801,126.02351 L193.441176,126.02351 C192.61804,127.02351 191.575598,127.593822 190.27091,127.593822 C188.411535,127.593822 187.750337,126.406322 188.584108,124.406322 L190.925832,118.789135 L193.199269,118.789135 L191.101814,123.820385 C190.606763,125.007885 190.891786,125.61726 191.938661,125.61726 C193.071473,125.61726 193.977228,124.906322 194.455995,123.757885 L196.527394,118.789135 L198.800832,118.789135 Z M197.489701,127.406322 L201.082082,118.789135 L203.285207,118.789135 L202.711989,120.164135 L202.852614,120.164135 C203.437438,119.30476 204.601644,118.64851 205.695394,118.64851 C206.007894,118.64851 206.374422,118.687572 206.540422,118.757885 L205.677339,120.828197 C205.526964,120.757885 205.025026,120.687572 204.657838,120.687572 C203.415651,120.687572 202.257938,121.421947 201.753116,122.632885 L199.763139,127.406322 L197.489701,127.406322 Z M210.926143,120.343822 C209.871455,120.343822 208.823117,121.078197 208.279253,122.195385 L211.951128,122.195385 C212.379763,121.05476 211.988643,120.343822 210.926143,120.343822 Z M210.848311,124.953197 L212.965499,124.953197 C211.955379,126.570385 210.036535,127.593822 207.92716,127.593822 C205.30216,127.593822 204.445752,125.937572 205.611729,123.140697 C206.780962,120.33601 209.082123,118.601635 211.644623,118.601635 C214.183685,118.601635 215.009503,120.218822 213.869582,122.953197 L213.579716,123.64851 L207.665654,123.64851 L207.6168,123.765697 C207.113916,125.046947 207.53171,125.843822 208.71921,125.843822 C209.617647,125.843822 210.368369,125.52351 210.848311,124.953197 Z" id="Structure-Label" fill="#FFFFFF" fillRule="nonzero" transform="translate(176.022165, 121.769603) rotate(-12.000000) translate(-176.022165, -121.769603) "></path>
-            <path className="fade-in" d="M138.906466,192.228116 L141.120295,191.795761 C141.019591,192.646949 141.781626,193.031151 143.0705,192.779438 C144.260812,192.546973 145.236733,191.816245 145.429437,191.003947 C145.592086,190.318337 145.13991,190.029974 143.865147,190.008865 L142.510521,189.989139 C140.613794,189.968679 139.877972,189.138723 140.266916,187.499221 C140.747792,185.4722 142.724623,183.813976 145.249299,183.320913 C147.660251,182.850061 149.051422,183.843417 148.665299,185.745327 L146.512122,186.165837 C146.607523,185.337006 145.938235,184.927584 144.83132,185.143761 C143.686497,185.367342 142.804582,186.037068 142.61011,186.856819 C142.452764,187.520072 142.885731,187.797973 144.103378,187.816022 L145.357164,187.83412 C147.447988,187.859316 148.174698,188.605768 147.778683,190.275079 C147.264216,192.443693 145.258826,194.100388 142.514284,194.63639 C139.90621,195.145739 138.514291,194.216493 138.906466,192.228116 Z M152.216708,191.042957 C153.240225,190.843067 154.165591,190.051143 154.363598,189.216487 L154.5068,188.612852 L152.791351,189.047373 C151.827738,189.299527 151.285703,189.725201 151.146037,190.313931 C151.001067,190.925018 151.450965,191.192505 152.216708,191.042957 Z M151.101698,192.817151 C149.494396,193.131053 148.594567,192.382875 148.951688,190.877514 C149.305273,189.387058 150.670339,188.296051 152.775987,187.771112 L154.828563,187.256537 L154.987676,186.585832 C155.150325,185.900222 154.741871,185.610427 153.832078,185.788107 C153.036009,185.943577 152.441651,186.315506 152.14301,186.842893 L150.111138,187.239712 C150.615846,185.691314 152.259901,184.460537 154.360007,184.050392 C156.573837,183.618037 157.580829,184.402142 157.163598,186.16088 L155.83235,191.772449 L153.694336,192.189997 L153.948917,191.116868 L153.812448,191.14352 C153.201736,191.980599 152.185868,192.605416 151.101698,192.817151 Z M158.00069,191.348978 L159.950712,183.129111 L162.088726,182.711562 L161.770499,184.052973 L161.906968,184.026321 C162.470899,183.020704 163.480683,182.269149 164.580016,182.054452 C165.755165,181.824949 166.424454,182.234371 166.53175,183.123114 L166.668219,183.096462 C167.272336,182.104317 168.378402,181.312638 169.54597,181.084615 C171.213924,180.758868 171.999791,181.621693 171.598472,183.313361 L170.260152,188.954738 L168.053904,189.385613 L169.256093,184.318061 C169.487692,183.341812 169.140129,182.947734 168.207591,183.129856 C167.312961,183.304575 166.588253,184.043098 166.381405,184.915015 L165.188055,189.945305 L163.065205,190.359892 L164.28861,185.202913 C164.495457,184.330996 164.098359,183.932378 163.234055,184.101174 C162.369752,184.26997 161.598296,185.053157 161.380841,185.969788 L160.206938,190.918103 L158.00069,191.348978 Z M179.209496,179.239997 C181.324764,178.826891 182.246419,180.15358 181.61527,182.814045 C180.985888,185.467057 179.328028,187.304626 177.235504,187.71329 C176.03761,187.947236 175.242222,187.612189 175.039662,186.820228 L174.903193,186.84688 L173.957353,190.833851 L171.751105,191.264725 L174.348188,180.317323 L176.486202,179.899775 L176.166207,181.248638 L176.302676,181.221986 C176.976795,180.209063 178.057091,179.465058 179.209496,179.239997 Z M176.876623,186.056375 C178.066935,185.82391 178.987712,184.77703 179.348369,183.256764 C179.70549,181.751403 179.210273,180.973956 178.035124,181.203459 C176.859975,181.432962 175.912917,182.49919 175.555796,184.00455 C175.198675,185.509911 175.709055,186.284398 176.876623,186.056375 Z M182.512032,186.56198 L185.206351,175.204702 L187.412599,174.773828 L184.71828,186.131105 L182.512032,186.56198 Z M192.222559,178.240803 C191.199042,178.440693 190.312604,179.281871 189.983974,180.362354 L193.54733,179.66644 C193.759958,178.587291 193.253658,178.039432 192.222559,178.240803 Z M192.968742,182.288211 L195.023358,181.886951 C194.331388,183.493242 192.651703,184.752298 190.604668,185.152078 C188.057248,185.649583 186.930889,184.362871 187.563807,181.694954 C188.198492,179.019585 190.122457,177.066083 192.609225,176.580424 C195.073248,176.099207 196.162956,177.357542 195.544182,179.96584 L195.386836,180.629093 L189.647558,181.749959 L189.621039,181.861743 C189.361426,183.077994 189.908932,183.695983 191.061337,183.470922 C191.933222,183.300645 192.604654,182.878129 192.968742,182.288211 Z" id="Sample-Label" fill="#FFFFFF" fillRule="nonzero"></path>
-            <path className="fade-in" d="M14.379204,161.590782 C10.7929992,155.128919 9,147.926538 9,140 C9,127.153085 13.3775094,116.876139 22.1211537,109.246524 L22.8746297,108.589049 L24.1895806,110.096 L23.4361047,110.753476 C15.1415768,117.991197 11,127.714251 11,140 C11,147.470383 12.6548675,154.239403 15.964406,160.322645 L20.4991214,156.694941 L23.7786292,172 L9.56687739,165.440571 L14.379204,161.590782 L14.379204,161.590782 Z" id="Line" className="fade-in" fill="url(#diagram-gradient-2)" fillRule="nonzero"></path>
-            <path className="fade-in" d="M14.3141739,225.644231 C4.76775209,211.063968 0,193.174861 0,172 C0,145.12301 7.34863133,124.202725 22.0670751,109.297369 L22.7697064,108.585815 L24.1928146,109.991077 L23.4901833,110.702631 C9.17045481,125.204209 2,145.617256 2,172 C2,192.72483 6.63088086,210.179546 15.8818472,224.386978 L20.4804629,220.698951 L23.7786292,236 L9.55889027,229.457904 L14.3141739,225.644231 L14.3141739,225.644231 Z" id="Line" className="fade-in" fill="url(#diagram-gradient-3)" fillRule="nonzero"></path>
-            <path className="fade-in" d="M145.190506,252.517035 L145.132342,249.999273 L141.407669,250.646141 L139.849604,253.444596 L137.623616,253.831186 L144.419262,242.047176 L147.027268,241.594241 L147.592809,252.099824 L145.190506,252.517035 Z M144.939735,244.161318 L142.388176,248.763668 L145.165151,248.281388 L145.071971,244.138352 L144.939735,244.161318 Z M152.87704,249.374389 C154.037786,249.172801 154.989564,248.118343 155.408358,246.620013 C155.827152,245.121682 155.392601,244.300642 154.239201,244.500954 C153.085801,244.701266 152.153905,245.75962 151.737269,247.250227 C151.316316,248.75628 151.716294,249.575977 152.87704,249.374389 Z M151.414255,254.507798 C149.261732,254.88163 148.114989,254.132837 148.401546,252.657472 L150.517337,252.29002 C150.48074,252.79607 150.990327,253.023553 151.915986,252.862792 C153.062039,252.663756 153.885999,251.99157 154.153682,251.033874 L154.594063,249.458311 L154.461826,249.481276 C153.763277,250.455013 152.777242,251.081863 151.638535,251.279623 C149.618249,251.630489 148.821809,250.203589 149.538508,247.639436 C150.276795,244.99805 152.010996,243.094909 154.068015,242.737664 C155.162643,242.547559 155.935901,242.957051 156.108138,243.8163 L156.240375,243.793334 L156.62247,242.426301 L158.694182,242.066504 L156.321734,250.554468 C155.762622,252.554816 153.860638,254.082932 151.414255,254.507798 Z M162.589107,247.687683 C163.749853,247.486095 164.70163,246.431637 165.120424,244.933307 C165.539219,243.434976 165.104667,242.613935 163.951267,242.814248 C162.797868,243.01456 161.865971,244.072914 161.449336,245.56352 C161.028383,247.069574 161.42836,247.889271 162.589107,247.687683 Z M161.126322,252.821092 C158.973799,253.194923 157.827055,252.446131 158.113613,250.970766 L160.229403,250.603314 C160.192807,251.109364 160.702394,251.336846 161.628052,251.176086 C162.774105,250.97705 163.598065,250.304864 163.865748,249.347168 L164.30613,247.771604 L164.173893,247.79457 C163.475344,248.768307 162.489309,249.395157 161.350602,249.592917 C159.330316,249.943783 158.533875,248.516883 159.250575,245.95273 C159.988862,243.311344 161.723063,241.408203 163.780081,241.050958 C164.874709,240.860853 165.647968,241.270345 165.820204,242.129594 L165.952441,242.106628 L166.334537,240.739594 L168.406248,240.379798 L166.0338,248.867762 C165.474689,250.86811 163.572705,252.396226 161.126322,252.821092 Z M168.170342,248.5261 L170.551425,240.007242 L172.623137,239.647446 L172.243199,241.006756 L172.375436,240.98379 C172.825945,240.097221 173.844779,239.30301 174.873289,239.124387 C175.167149,239.073352 175.516333,239.049451 175.680567,239.087065 L175.108503,241.133753 C174.958962,241.093588 174.478829,241.110837 174.133543,241.170803 C172.965451,241.373667 171.961762,242.238733 171.627158,243.435852 L170.308172,248.15482 L168.170342,248.5261 Z M179.98818,239.83069 C178.996403,240.002933 178.095565,240.850136 177.713401,241.967334 L181.166254,241.367673 C181.43735,240.247719 180.987303,239.657171 179.98818,239.83069 Z M180.4483,244.086361 L182.4392,243.740599 C181.676443,245.394196 179.990469,246.649647 178.006915,246.994133 C175.538493,247.422827 174.541538,246.0381 175.314364,243.273139 C176.08935,240.500456 178.052581,238.528145 180.462231,238.109658 C182.849842,237.694999 183.813511,239.048765 183.057954,241.751938 L182.865827,242.439317 L177.30453,243.405154 L177.272149,243.521004 C176.947503,244.78253 177.432576,245.447828 178.549243,245.253895 C179.39409,245.10717 180.062971,244.689718 180.4483,244.086361 Z M187.706773,243.325468 C188.867519,243.12388 189.819297,242.069422 190.238091,240.571092 C190.656885,239.072761 190.222334,238.25172 189.068934,238.452033 C187.915534,238.652345 186.983638,239.710698 186.567002,241.201305 C186.146049,242.707359 186.546027,243.527056 187.706773,243.325468 Z M186.243988,248.458877 C184.091465,248.832708 182.944722,248.083916 183.231279,246.608551 L185.34707,246.241099 C185.310473,246.747149 185.82006,246.974631 186.745719,246.813871 C187.891772,246.614835 188.715732,245.942649 188.983415,244.984953 L189.423796,243.409389 L189.291559,243.432355 C188.59301,244.406092 187.606975,245.032942 186.468269,245.230702 C184.447982,245.581568 183.651542,244.154668 184.368241,241.590515 C185.106528,238.949129 186.840729,237.045988 188.897748,236.688743 C189.992376,236.498637 190.765634,236.908129 190.937871,237.767378 L191.070108,237.744413 L191.452203,236.377379 L193.523915,236.017583 L191.151467,244.505547 C190.592355,246.505895 188.690371,248.034011 186.243988,248.458877 Z M196.647978,242.09597 C197.639755,241.923727 198.574748,241.129379 198.816526,240.264364 L198.991384,239.638772 L197.322893,240.031419 C196.385153,240.260414 195.839873,240.685793 195.669334,241.295938 C195.492317,241.929252 195.905982,242.224833 196.647978,242.09597 Z M195.469952,243.909868 C193.912495,244.180353 193.098502,243.366423 193.534567,241.806306 C193.966313,240.261635 195.34074,239.170517 197.388219,238.697354 L199.384273,238.233122 L199.578559,237.53802 C199.777163,236.827472 199.404548,236.510065 198.522969,236.66317 C197.751587,236.797137 197.159618,237.164489 196.840825,237.704851 L194.871965,238.046786 C195.45193,236.44698 197.102042,235.219803 199.137021,234.866385 C201.282198,234.49383 202.196464,235.349133 201.687003,237.171844 L200.061477,242.987528 L197.989766,243.347325 L198.300623,242.235162 L198.168386,242.258128 C197.531604,243.110912 196.520501,243.727418 195.469952,243.909868 Z M205.719005,231.974355 L207.856835,231.603076 L207.267501,233.711551 L208.949848,233.419376 L208.455498,235.188023 L206.773151,235.480198 L205.702419,239.310981 C205.495181,240.052423 205.723442,240.336112 206.450745,240.2098 C206.729912,240.161317 206.879001,240.128076 207.091179,240.069182 L206.61194,241.783766 C206.332355,241.883761 205.922692,241.998998 205.511288,242.070447 C203.542427,242.412381 202.951509,241.875693 203.415636,240.215172 L204.635321,235.851478 L203.371724,236.070928 L203.866073,234.302281 L205.129671,234.08283 L205.719005,231.974355 Z M213.767364,233.964219 C212.775587,234.136462 211.874749,234.983665 211.492586,236.100863 L214.945438,235.501202 C215.216534,234.381248 214.766488,233.7907 213.767364,233.964219 Z M214.227484,238.21989 L216.218385,237.874128 C215.455627,239.527725 213.769653,240.783176 211.786099,241.127662 C209.317677,241.556356 208.320722,240.171628 209.093549,237.406668 C209.868534,234.633985 211.831765,232.661674 214.241415,232.243187 C216.629026,231.828528 217.592695,233.182294 216.837139,235.885467 L216.645011,236.572846 L211.083715,237.538683 L211.051334,237.654533 C210.726687,238.916059 211.21176,239.581357 212.328427,239.387424 C213.173274,239.240699 213.842156,238.823247 214.227484,238.21989 Z" id="Aggregate-Label" fill="#FFFFFF" fillRule="nonzero"></path>
+            <path
+              className="fade-in"
+              d="M137.912913,124.27351 L140.194163,124.27351 C139.922479,125.187572 140.600085,125.77351 141.92821,125.77351 C143.154772,125.77351 144.269485,125.17976 144.62449,124.328197 C144.924126,123.609447 144.534243,123.195385 143.275193,122.89851 L141.93672,122.58601 C140.061163,122.156322 139.499548,121.08601 140.21607,119.36726 C141.101952,117.24226 143.395877,115.843822 145.99744,115.843822 C148.481815,115.843822 149.659896,117.234447 148.893181,119.24226 L146.674431,119.24226 C146.936344,118.351635 146.355745,117.757885 145.21512,117.757885 C144.035433,117.757885 143.026198,118.30476 142.667937,119.164135 C142.378072,119.859447 142.751031,120.257885 143.954095,120.539135 L145.192964,120.828197 C147.259917,121.30476 147.829365,122.281322 147.099815,124.031322 C146.152052,126.30476 143.830133,127.695385 141.002008,127.695385 C138.314508,127.695385 137.12274,126.375072 137.912913,124.27351 Z M152.786957,116.74226 L155.060394,116.74226 L154.171256,118.875072 L155.960318,118.875072 L155.214484,120.664135 L153.425422,120.664135 L151.80999,124.539135 C151.497326,125.289135 151.697772,125.632885 152.471209,125.632885 C152.768084,125.632885 152.927591,125.625072 153.156112,125.601635 L152.433076,127.33601 C152.129028,127.390697 151.687611,127.437572 151.250111,127.437572 C149.156361,127.437572 148.611588,126.757885 149.311825,125.078197 L151.151984,120.664135 L149.808234,120.664135 L150.554068,118.875072 L151.897818,118.875072 L152.786957,116.74226 Z M154.294389,127.406322 L157.886769,118.789135 L160.089894,118.789135 L159.516677,120.164135 L159.657302,120.164135 C160.242125,119.30476 161.406331,118.64851 162.500081,118.64851 C162.812581,118.64851 163.179109,118.687572 163.34511,118.757885 L162.482026,120.828197 C162.331651,120.757885 161.829713,120.687572 161.462526,120.687572 C160.220338,120.687572 159.062626,121.421947 158.557803,122.632885 L156.567826,127.406322 L154.294389,127.406322 Z M172.644582,118.789135 L169.052201,127.406322 L166.849076,127.406322 L167.425551,126.02351 L167.284926,126.02351 C166.46179,127.02351 165.419348,127.593822 164.11466,127.593822 C162.255285,127.593822 161.594087,126.406322 162.427858,124.406322 L164.769582,118.789135 L167.043019,118.789135 L164.945564,123.820385 C164.450513,125.007885 164.735536,125.61726 165.782411,125.61726 C166.915223,125.61726 167.820978,124.906322 168.299745,123.757885 L170.371144,118.789135 L172.644582,118.789135 Z M181.283891,121.828197 L179.158891,121.828197 C179.344617,121.007885 178.983407,120.468822 178.014657,120.468822 C176.788095,120.468822 175.719535,121.382885 175.012784,123.078197 C174.296262,124.796947 174.604001,125.726635 175.822751,125.726635 C176.752439,125.726635 177.550715,125.27351 178.077594,124.421947 L180.202594,124.421947 C179.210635,126.351635 177.286535,127.593822 175.044348,127.593822 C172.356848,127.593822 171.510849,125.968822 172.715909,123.078197 C173.907941,120.218822 176.097748,118.601635 178.79306,118.601635 C181.07431,118.601635 181.913877,119.86726 181.283891,121.828197 Z M185.904144,116.74226 L188.177582,116.74226 L187.288443,118.875072 L189.077506,118.875072 L188.331672,120.664135 L186.542609,120.664135 L184.927178,124.539135 C184.614514,125.289135 184.814959,125.632885 185.588397,125.632885 C185.885272,125.632885 186.044779,125.625072 186.273299,125.601635 L185.550264,127.33601 C185.246215,127.390697 184.804799,127.437572 184.367299,127.437572 C182.273549,127.437572 181.728776,126.757885 182.429013,125.078197 L184.269172,120.664135 L182.925422,120.664135 L183.671256,118.875072 L185.015006,118.875072 L185.904144,116.74226 Z M198.800832,118.789135 L195.208451,127.406322 L193.005326,127.406322 L193.581801,126.02351 L193.441176,126.02351 C192.61804,127.02351 191.575598,127.593822 190.27091,127.593822 C188.411535,127.593822 187.750337,126.406322 188.584108,124.406322 L190.925832,118.789135 L193.199269,118.789135 L191.101814,123.820385 C190.606763,125.007885 190.891786,125.61726 191.938661,125.61726 C193.071473,125.61726 193.977228,124.906322 194.455995,123.757885 L196.527394,118.789135 L198.800832,118.789135 Z M197.489701,127.406322 L201.082082,118.789135 L203.285207,118.789135 L202.711989,120.164135 L202.852614,120.164135 C203.437438,119.30476 204.601644,118.64851 205.695394,118.64851 C206.007894,118.64851 206.374422,118.687572 206.540422,118.757885 L205.677339,120.828197 C205.526964,120.757885 205.025026,120.687572 204.657838,120.687572 C203.415651,120.687572 202.257938,121.421947 201.753116,122.632885 L199.763139,127.406322 L197.489701,127.406322 Z M210.926143,120.343822 C209.871455,120.343822 208.823117,121.078197 208.279253,122.195385 L211.951128,122.195385 C212.379763,121.05476 211.988643,120.343822 210.926143,120.343822 Z M210.848311,124.953197 L212.965499,124.953197 C211.955379,126.570385 210.036535,127.593822 207.92716,127.593822 C205.30216,127.593822 204.445752,125.937572 205.611729,123.140697 C206.780962,120.33601 209.082123,118.601635 211.644623,118.601635 C214.183685,118.601635 215.009503,120.218822 213.869582,122.953197 L213.579716,123.64851 L207.665654,123.64851 L207.6168,123.765697 C207.113916,125.046947 207.53171,125.843822 208.71921,125.843822 C209.617647,125.843822 210.368369,125.52351 210.848311,124.953197 Z"
+              id="Structure-Label"
+              fill="#FFFFFF"
+              fillRule="nonzero"
+              transform="translate(176.022165, 121.769603) rotate(-12.000000) translate(-176.022165, -121.769603) "
+            ></path>
+            <path
+              className="fade-in"
+              d="M138.906466,192.228116 L141.120295,191.795761 C141.019591,192.646949 141.781626,193.031151 143.0705,192.779438 C144.260812,192.546973 145.236733,191.816245 145.429437,191.003947 C145.592086,190.318337 145.13991,190.029974 143.865147,190.008865 L142.510521,189.989139 C140.613794,189.968679 139.877972,189.138723 140.266916,187.499221 C140.747792,185.4722 142.724623,183.813976 145.249299,183.320913 C147.660251,182.850061 149.051422,183.843417 148.665299,185.745327 L146.512122,186.165837 C146.607523,185.337006 145.938235,184.927584 144.83132,185.143761 C143.686497,185.367342 142.804582,186.037068 142.61011,186.856819 C142.452764,187.520072 142.885731,187.797973 144.103378,187.816022 L145.357164,187.83412 C147.447988,187.859316 148.174698,188.605768 147.778683,190.275079 C147.264216,192.443693 145.258826,194.100388 142.514284,194.63639 C139.90621,195.145739 138.514291,194.216493 138.906466,192.228116 Z M152.216708,191.042957 C153.240225,190.843067 154.165591,190.051143 154.363598,189.216487 L154.5068,188.612852 L152.791351,189.047373 C151.827738,189.299527 151.285703,189.725201 151.146037,190.313931 C151.001067,190.925018 151.450965,191.192505 152.216708,191.042957 Z M151.101698,192.817151 C149.494396,193.131053 148.594567,192.382875 148.951688,190.877514 C149.305273,189.387058 150.670339,188.296051 152.775987,187.771112 L154.828563,187.256537 L154.987676,186.585832 C155.150325,185.900222 154.741871,185.610427 153.832078,185.788107 C153.036009,185.943577 152.441651,186.315506 152.14301,186.842893 L150.111138,187.239712 C150.615846,185.691314 152.259901,184.460537 154.360007,184.050392 C156.573837,183.618037 157.580829,184.402142 157.163598,186.16088 L155.83235,191.772449 L153.694336,192.189997 L153.948917,191.116868 L153.812448,191.14352 C153.201736,191.980599 152.185868,192.605416 151.101698,192.817151 Z M158.00069,191.348978 L159.950712,183.129111 L162.088726,182.711562 L161.770499,184.052973 L161.906968,184.026321 C162.470899,183.020704 163.480683,182.269149 164.580016,182.054452 C165.755165,181.824949 166.424454,182.234371 166.53175,183.123114 L166.668219,183.096462 C167.272336,182.104317 168.378402,181.312638 169.54597,181.084615 C171.213924,180.758868 171.999791,181.621693 171.598472,183.313361 L170.260152,188.954738 L168.053904,189.385613 L169.256093,184.318061 C169.487692,183.341812 169.140129,182.947734 168.207591,183.129856 C167.312961,183.304575 166.588253,184.043098 166.381405,184.915015 L165.188055,189.945305 L163.065205,190.359892 L164.28861,185.202913 C164.495457,184.330996 164.098359,183.932378 163.234055,184.101174 C162.369752,184.26997 161.598296,185.053157 161.380841,185.969788 L160.206938,190.918103 L158.00069,191.348978 Z M179.209496,179.239997 C181.324764,178.826891 182.246419,180.15358 181.61527,182.814045 C180.985888,185.467057 179.328028,187.304626 177.235504,187.71329 C176.03761,187.947236 175.242222,187.612189 175.039662,186.820228 L174.903193,186.84688 L173.957353,190.833851 L171.751105,191.264725 L174.348188,180.317323 L176.486202,179.899775 L176.166207,181.248638 L176.302676,181.221986 C176.976795,180.209063 178.057091,179.465058 179.209496,179.239997 Z M176.876623,186.056375 C178.066935,185.82391 178.987712,184.77703 179.348369,183.256764 C179.70549,181.751403 179.210273,180.973956 178.035124,181.203459 C176.859975,181.432962 175.912917,182.49919 175.555796,184.00455 C175.198675,185.509911 175.709055,186.284398 176.876623,186.056375 Z M182.512032,186.56198 L185.206351,175.204702 L187.412599,174.773828 L184.71828,186.131105 L182.512032,186.56198 Z M192.222559,178.240803 C191.199042,178.440693 190.312604,179.281871 189.983974,180.362354 L193.54733,179.66644 C193.759958,178.587291 193.253658,178.039432 192.222559,178.240803 Z M192.968742,182.288211 L195.023358,181.886951 C194.331388,183.493242 192.651703,184.752298 190.604668,185.152078 C188.057248,185.649583 186.930889,184.362871 187.563807,181.694954 C188.198492,179.019585 190.122457,177.066083 192.609225,176.580424 C195.073248,176.099207 196.162956,177.357542 195.544182,179.96584 L195.386836,180.629093 L189.647558,181.749959 L189.621039,181.861743 C189.361426,183.077994 189.908932,183.695983 191.061337,183.470922 C191.933222,183.300645 192.604654,182.878129 192.968742,182.288211 Z"
+              id="Sample-Label"
+              fill="#FFFFFF"
+              fillRule="nonzero"
+            ></path>
+            <path
+              className="fade-in"
+              d="M14.379204,161.590782 C10.7929992,155.128919 9,147.926538 9,140 C9,127.153085 13.3775094,116.876139 22.1211537,109.246524 L22.8746297,108.589049 L24.1895806,110.096 L23.4361047,110.753476 C15.1415768,117.991197 11,127.714251 11,140 C11,147.470383 12.6548675,154.239403 15.964406,160.322645 L20.4991214,156.694941 L23.7786292,172 L9.56687739,165.440571 L14.379204,161.590782 L14.379204,161.590782 Z"
+              id="Line"
+              className="fade-in"
+              fill="url(#diagram-gradient-2)"
+              fillRule="nonzero"
+            ></path>
+            <path
+              className="fade-in"
+              d="M14.3141739,225.644231 C4.76775209,211.063968 0,193.174861 0,172 C0,145.12301 7.34863133,124.202725 22.0670751,109.297369 L22.7697064,108.585815 L24.1928146,109.991077 L23.4901833,110.702631 C9.17045481,125.204209 2,145.617256 2,172 C2,192.72483 6.63088086,210.179546 15.8818472,224.386978 L20.4804629,220.698951 L23.7786292,236 L9.55889027,229.457904 L14.3141739,225.644231 L14.3141739,225.644231 Z"
+              id="Line"
+              className="fade-in"
+              fill="url(#diagram-gradient-3)"
+              fillRule="nonzero"
+            ></path>
+            <path
+              className="fade-in"
+              d="M145.190506,252.517035 L145.132342,249.999273 L141.407669,250.646141 L139.849604,253.444596 L137.623616,253.831186 L144.419262,242.047176 L147.027268,241.594241 L147.592809,252.099824 L145.190506,252.517035 Z M144.939735,244.161318 L142.388176,248.763668 L145.165151,248.281388 L145.071971,244.138352 L144.939735,244.161318 Z M152.87704,249.374389 C154.037786,249.172801 154.989564,248.118343 155.408358,246.620013 C155.827152,245.121682 155.392601,244.300642 154.239201,244.500954 C153.085801,244.701266 152.153905,245.75962 151.737269,247.250227 C151.316316,248.75628 151.716294,249.575977 152.87704,249.374389 Z M151.414255,254.507798 C149.261732,254.88163 148.114989,254.132837 148.401546,252.657472 L150.517337,252.29002 C150.48074,252.79607 150.990327,253.023553 151.915986,252.862792 C153.062039,252.663756 153.885999,251.99157 154.153682,251.033874 L154.594063,249.458311 L154.461826,249.481276 C153.763277,250.455013 152.777242,251.081863 151.638535,251.279623 C149.618249,251.630489 148.821809,250.203589 149.538508,247.639436 C150.276795,244.99805 152.010996,243.094909 154.068015,242.737664 C155.162643,242.547559 155.935901,242.957051 156.108138,243.8163 L156.240375,243.793334 L156.62247,242.426301 L158.694182,242.066504 L156.321734,250.554468 C155.762622,252.554816 153.860638,254.082932 151.414255,254.507798 Z M162.589107,247.687683 C163.749853,247.486095 164.70163,246.431637 165.120424,244.933307 C165.539219,243.434976 165.104667,242.613935 163.951267,242.814248 C162.797868,243.01456 161.865971,244.072914 161.449336,245.56352 C161.028383,247.069574 161.42836,247.889271 162.589107,247.687683 Z M161.126322,252.821092 C158.973799,253.194923 157.827055,252.446131 158.113613,250.970766 L160.229403,250.603314 C160.192807,251.109364 160.702394,251.336846 161.628052,251.176086 C162.774105,250.97705 163.598065,250.304864 163.865748,249.347168 L164.30613,247.771604 L164.173893,247.79457 C163.475344,248.768307 162.489309,249.395157 161.350602,249.592917 C159.330316,249.943783 158.533875,248.516883 159.250575,245.95273 C159.988862,243.311344 161.723063,241.408203 163.780081,241.050958 C164.874709,240.860853 165.647968,241.270345 165.820204,242.129594 L165.952441,242.106628 L166.334537,240.739594 L168.406248,240.379798 L166.0338,248.867762 C165.474689,250.86811 163.572705,252.396226 161.126322,252.821092 Z M168.170342,248.5261 L170.551425,240.007242 L172.623137,239.647446 L172.243199,241.006756 L172.375436,240.98379 C172.825945,240.097221 173.844779,239.30301 174.873289,239.124387 C175.167149,239.073352 175.516333,239.049451 175.680567,239.087065 L175.108503,241.133753 C174.958962,241.093588 174.478829,241.110837 174.133543,241.170803 C172.965451,241.373667 171.961762,242.238733 171.627158,243.435852 L170.308172,248.15482 L168.170342,248.5261 Z M179.98818,239.83069 C178.996403,240.002933 178.095565,240.850136 177.713401,241.967334 L181.166254,241.367673 C181.43735,240.247719 180.987303,239.657171 179.98818,239.83069 Z M180.4483,244.086361 L182.4392,243.740599 C181.676443,245.394196 179.990469,246.649647 178.006915,246.994133 C175.538493,247.422827 174.541538,246.0381 175.314364,243.273139 C176.08935,240.500456 178.052581,238.528145 180.462231,238.109658 C182.849842,237.694999 183.813511,239.048765 183.057954,241.751938 L182.865827,242.439317 L177.30453,243.405154 L177.272149,243.521004 C176.947503,244.78253 177.432576,245.447828 178.549243,245.253895 C179.39409,245.10717 180.062971,244.689718 180.4483,244.086361 Z M187.706773,243.325468 C188.867519,243.12388 189.819297,242.069422 190.238091,240.571092 C190.656885,239.072761 190.222334,238.25172 189.068934,238.452033 C187.915534,238.652345 186.983638,239.710698 186.567002,241.201305 C186.146049,242.707359 186.546027,243.527056 187.706773,243.325468 Z M186.243988,248.458877 C184.091465,248.832708 182.944722,248.083916 183.231279,246.608551 L185.34707,246.241099 C185.310473,246.747149 185.82006,246.974631 186.745719,246.813871 C187.891772,246.614835 188.715732,245.942649 188.983415,244.984953 L189.423796,243.409389 L189.291559,243.432355 C188.59301,244.406092 187.606975,245.032942 186.468269,245.230702 C184.447982,245.581568 183.651542,244.154668 184.368241,241.590515 C185.106528,238.949129 186.840729,237.045988 188.897748,236.688743 C189.992376,236.498637 190.765634,236.908129 190.937871,237.767378 L191.070108,237.744413 L191.452203,236.377379 L193.523915,236.017583 L191.151467,244.505547 C190.592355,246.505895 188.690371,248.034011 186.243988,248.458877 Z M196.647978,242.09597 C197.639755,241.923727 198.574748,241.129379 198.816526,240.264364 L198.991384,239.638772 L197.322893,240.031419 C196.385153,240.260414 195.839873,240.685793 195.669334,241.295938 C195.492317,241.929252 195.905982,242.224833 196.647978,242.09597 Z M195.469952,243.909868 C193.912495,244.180353 193.098502,243.366423 193.534567,241.806306 C193.966313,240.261635 195.34074,239.170517 197.388219,238.697354 L199.384273,238.233122 L199.578559,237.53802 C199.777163,236.827472 199.404548,236.510065 198.522969,236.66317 C197.751587,236.797137 197.159618,237.164489 196.840825,237.704851 L194.871965,238.046786 C195.45193,236.44698 197.102042,235.219803 199.137021,234.866385 C201.282198,234.49383 202.196464,235.349133 201.687003,237.171844 L200.061477,242.987528 L197.989766,243.347325 L198.300623,242.235162 L198.168386,242.258128 C197.531604,243.110912 196.520501,243.727418 195.469952,243.909868 Z M205.719005,231.974355 L207.856835,231.603076 L207.267501,233.711551 L208.949848,233.419376 L208.455498,235.188023 L206.773151,235.480198 L205.702419,239.310981 C205.495181,240.052423 205.723442,240.336112 206.450745,240.2098 C206.729912,240.161317 206.879001,240.128076 207.091179,240.069182 L206.61194,241.783766 C206.332355,241.883761 205.922692,241.998998 205.511288,242.070447 C203.542427,242.412381 202.951509,241.875693 203.415636,240.215172 L204.635321,235.851478 L203.371724,236.070928 L203.866073,234.302281 L205.129671,234.08283 L205.719005,231.974355 Z M213.767364,233.964219 C212.775587,234.136462 211.874749,234.983665 211.492586,236.100863 L214.945438,235.501202 C215.216534,234.381248 214.766488,233.7907 213.767364,233.964219 Z M214.227484,238.21989 L216.218385,237.874128 C215.455627,239.527725 213.769653,240.783176 211.786099,241.127662 C209.317677,241.556356 208.320722,240.171628 209.093549,237.406668 C209.868534,234.633985 211.831765,232.661674 214.241415,232.243187 C216.629026,231.828528 217.592695,233.182294 216.837139,235.885467 L216.645011,236.572846 L211.083715,237.538683 L211.051334,237.654533 C210.726687,238.916059 211.21176,239.581357 212.328427,239.387424 C213.173274,239.240699 213.842156,238.823247 214.227484,238.21989 Z"
+              id="Aggregate-Label"
+              fill="#FFFFFF"
+              fillRule="nonzero"
+            ></path>
             <a href="/docs/reference/configuration/transforms">
-              <path className="fade-in" d="M82.7326292,2.754 L82.7326292,5.68 L78.1346292,5.68 L78.1346292,18 L74.7026292,18 L74.7026292,5.68 L70.1046292,5.68 L70.1046292,2.754 L82.7326292,2.754 Z M90.1686292,9.332 C89.8752944,9.2586663 89.5306312,9.18166707 89.1346292,9.101 C88.7386272,9.02033293 88.3132982,8.98 87.8586292,8.98 C87.6532949,8.98 87.4076306,8.99833315 87.1216292,9.035 C86.8356278,9.07166685 86.6192966,9.11199978 86.4726292,9.156 L86.4726292,18 L83.1946292,18 L83.1946292,7.044 C83.7812988,6.83866564 84.4742919,6.64433425 85.2736292,6.461 C86.0729665,6.27766575 86.9639576,6.186 87.9466292,6.186 C88.1226301,6.186 88.3352946,6.19699989 88.5846292,6.219 C88.8339638,6.24100011 89.0832946,6.27033315 89.3326292,6.307 C89.5819638,6.34366685 89.8312946,6.38766641 90.0806292,6.439 C90.3299638,6.49033359 90.5426283,6.5526663 90.7186292,6.626 L90.1686292,9.332 Z M96.6806292,15.712 C97.0032975,15.712 97.3112944,15.7046667 97.6046292,15.69 C97.897964,15.6753333 98.1326283,15.6533335 98.3086292,15.624 L98.3086292,13.138 C98.1766286,13.1086665 97.9786305,13.0793335 97.7146292,13.05 C97.4506279,13.0206665 97.2086303,13.006 96.9886292,13.006 C96.6806277,13.006 96.3909639,13.0243331 96.1196292,13.061 C95.8482945,13.0976668 95.6099636,13.1673328 95.4046292,13.27 C95.1992949,13.3726672 95.0379631,13.5119991 94.9206292,13.688 C94.8032953,13.8640009 94.7446292,14.0839987 94.7446292,14.348 C94.7446292,14.8613359 94.9169608,15.216999 95.2616292,15.415 C95.6062976,15.613001 96.0792929,15.712 96.6806292,15.712 Z M96.4166292,6.12 C97.3846341,6.12 98.1912927,6.2299989 98.8366292,6.45 C99.4819658,6.6700011 99.9989606,6.98533128 100.387629,7.396 C100.776298,7.80666872 101.051295,8.3053304 101.212629,8.892 C101.373963,9.4786696 101.454629,10.1313297 101.454629,10.85 L101.454629,17.67 C100.985294,17.7726672 100.332633,17.893666 99.4966292,18.033 C98.660625,18.172334 97.6486352,18.242 96.4606292,18.242 C95.7126255,18.242 95.0342989,18.1760007 94.4256292,18.044 C93.8169595,17.9119993 93.2926314,17.6956682 92.8526292,17.395 C92.412627,17.0943318 92.0752971,16.7020024 91.8406292,16.218 C91.6059614,15.7339976 91.4886292,15.1400035 91.4886292,14.436 C91.4886292,13.76133 91.6242945,13.1893357 91.8956292,12.72 C92.1669639,12.2506643 92.5299603,11.8766681 92.9846292,11.598 C93.4392982,11.3193319 93.9599596,11.1176673 94.5466292,10.993 C95.1332988,10.8683327 95.7419594,10.806 96.3726292,10.806 C96.7979647,10.806 97.1756276,10.8243331 97.5056292,10.861 C97.8356309,10.8976668 98.1032949,10.945333 98.3086292,11.004 L98.3086292,10.696 C98.3086292,10.1386639 98.1399642,9.69133502 97.8026292,9.354 C97.4652942,9.01666498 96.8786334,8.848 96.0426292,8.848 C95.4852931,8.848 94.9352986,8.88833293 94.3926292,8.969 C93.8499598,9.04966707 93.3806312,9.1633326 92.9846292,9.31 L92.5666292,6.67 C92.7572968,6.61133304 92.9956278,6.54900033 93.2816292,6.483 C93.5676306,6.41699967 93.8792942,6.35833359 94.2166292,6.307 C94.5539642,6.25566641 94.9096273,6.21166685 95.2836292,6.175 C95.6576311,6.13833315 96.035294,6.12 96.4166292,6.12 Z M104.424629,6.824 C104.981965,6.66266586 105.700625,6.51233403 106.580629,6.373 C107.460634,6.23366597 108.384624,6.164 109.352629,6.164 C110.335301,6.164 111.152959,6.29233205 111.805629,6.549 C112.458299,6.80566795 112.975294,7.16866432 113.356629,7.638 C113.737964,8.10733568 114.009295,8.66466344 114.170629,9.31 C114.331963,9.95533656 114.412629,10.673996 114.412629,11.466 L114.412629,18 L111.134629,18 L111.134629,11.862 C111.134629,10.8059947 110.995297,10.0580022 110.716629,9.618 C110.437961,9.1779978 109.9173,8.958 109.154629,8.958 C108.919961,8.958 108.670631,8.96899989 108.406629,8.991 C108.142628,9.01300011 107.907964,9.03866652 107.702629,9.068 L107.702629,18 L104.424629,18 L104.424629,6.824 Z M120.704629,15.646 C121.305966,15.646 121.731295,15.5873339 121.980629,15.47 C122.229964,15.3526661 122.354629,15.125335 122.354629,14.788 C122.354629,14.5239987 122.193297,14.293001 121.870629,14.095 C121.547961,13.896999 121.056633,13.6733346 120.396629,13.424 C119.883293,13.2333324 119.417631,13.0353344 118.999629,12.83 C118.581627,12.6246656 118.225964,12.3790014 117.932629,12.093 C117.639294,11.8069986 117.411963,11.466002 117.250629,11.07 C117.089295,10.673998 117.008629,10.1973361 117.008629,9.64 C117.008629,8.55466124 117.411959,7.69666982 118.218629,7.066 C119.0253,6.43533018 120.132622,6.12 121.540629,6.12 C122.244633,6.12 122.919293,6.18233271 123.564629,6.307 C124.209966,6.43166729 124.723294,6.5673326 125.104629,6.714 L124.532629,9.266 C124.151294,9.13399934 123.736965,9.01666718 123.289629,8.914 C122.842294,8.81133282 122.339965,8.76 121.782629,8.76 C120.755957,8.76 120.242629,9.04599714 120.242629,9.618 C120.242629,9.75000066 120.264629,9.86733282 120.308629,9.97 C120.352629,10.0726672 120.440629,10.1716662 120.572629,10.267 C120.70463,10.3623338 120.884295,10.4649994 121.111629,10.575 C121.338964,10.6850005 121.628627,10.8059993 121.980629,10.938 C122.699299,11.2020013 123.293294,11.462332 123.762629,11.719 C124.231965,11.9756679 124.602295,12.2543318 124.873629,12.555 C125.144964,12.8556682 125.335629,13.1893315 125.445629,13.556 C125.55563,13.9226685 125.610629,14.3479976 125.610629,14.832 C125.610629,15.9760057 125.181634,16.8413304 124.323629,17.428 C123.465625,18.0146696 122.25197,18.308 120.682629,18.308 C119.655957,18.308 118.801633,18.2200009 118.119629,18.044 C117.437626,17.8679991 116.964631,17.7213339 116.700629,17.604 L117.250629,14.942 C117.807965,15.1620011 118.37996,15.3343327 118.966629,15.459 C119.553299,15.5836673 120.132626,15.646 120.704629,15.646 Z M133.068629,0.928 C133.684632,0.928 134.249293,0.99033271 134.762629,1.115 C135.275965,1.23966729 135.671961,1.36066608 135.950629,1.478 L135.312629,4.096 C135.019294,3.96399934 134.700298,3.86500033 134.355629,3.799 C134.010961,3.73299967 133.691964,3.7 133.398629,3.7 C133.002627,3.7 132.668964,3.75499945 132.397629,3.865 C132.126295,3.97500055 131.91363,4.12533238 131.759629,4.316 C131.605628,4.50666762 131.49563,4.73399868 131.429629,4.998 C131.363629,5.26200132 131.330629,5.54799846 131.330629,5.856 L131.330629,6.428 L135.378629,6.428 L135.378629,9.156 L131.330629,9.156 L131.330629,18 L128.052629,18 L128.052629,5.812 C128.052629,4.31599252 128.474292,3.1280044 129.317629,2.248 C130.160967,1.3679956 131.411288,0.928 133.068629,0.928 Z M147.984629,12.192 C147.984629,13.1013379 147.852631,13.9336629 147.588629,14.689 C147.324628,15.4443371 146.943298,16.089664 146.444629,16.625 C145.94596,17.160336 145.348299,17.5746652 144.651629,17.868 C143.954959,18.1613348 143.173967,18.308 142.308629,18.308 C141.457958,18.308 140.684299,18.1613348 139.987629,17.868 C139.290959,17.5746652 138.693298,17.160336 138.194629,16.625 C137.69596,16.089664 137.307297,15.4443371 137.028629,14.689 C136.749961,13.9336629 136.610629,13.1013379 136.610629,12.192 C136.610629,11.2826621 136.753628,10.4540037 137.039629,9.706 C137.325631,8.95799626 137.721627,8.32000264 138.227629,7.792 C138.733632,7.26399736 139.334959,6.8533348 140.031629,6.56 C140.728299,6.2666652 141.487292,6.12 142.308629,6.12 C143.144633,6.12 143.910959,6.2666652 144.607629,6.56 C145.304299,6.8533348 145.90196,7.26399736 146.400629,7.792 C146.899298,8.32000264 147.287961,8.95799626 147.566629,9.706 C147.845297,10.4540037 147.984629,11.2826621 147.984629,12.192 Z M144.640629,12.192 C144.640629,11.1799949 144.438965,10.3843362 144.035629,9.805 C143.632294,9.22566377 143.056633,8.936 142.308629,8.936 C141.560625,8.936 140.981298,9.22566377 140.570629,9.805 C140.15996,10.3843362 139.954629,11.1799949 139.954629,12.192 C139.954629,13.2040051 140.15996,14.006997 140.570629,14.601 C140.981298,15.195003 141.560625,15.492 142.308629,15.492 C143.056633,15.492 143.632294,15.195003 144.035629,14.601 C144.438965,14.006997 144.640629,13.2040051 144.640629,12.192 Z M157.488629,9.332 C157.195294,9.2586663 156.850631,9.18166707 156.454629,9.101 C156.058627,9.02033293 155.633298,8.98 155.178629,8.98 C154.973295,8.98 154.727631,8.99833315 154.441629,9.035 C154.155628,9.07166685 153.939297,9.11199978 153.792629,9.156 L153.792629,18 L150.514629,18 L150.514629,7.044 C151.101299,6.83866564 151.794292,6.64433425 152.593629,6.461 C153.392967,6.27766575 154.283958,6.186 155.266629,6.186 C155.44263,6.186 155.655295,6.19699989 155.904629,6.219 C156.153964,6.24100011 156.403295,6.27033315 156.652629,6.307 C156.901964,6.34366685 157.151295,6.38766641 157.400629,6.439 C157.649964,6.49033359 157.862628,6.5526663 158.038629,6.626 L157.488629,9.332 Z M166.156629,11.862 C166.156629,10.8059947 166.020964,10.0580022 165.749629,9.618 C165.478295,9.1779978 165.012633,8.958 164.352629,8.958 C164.147295,8.958 163.93463,8.96899989 163.714629,8.991 C163.494628,9.01300011 163.281964,9.03866652 163.076629,9.068 L163.076629,18 L159.798629,18 L159.798629,6.824 C160.077297,6.7506663 160.403627,6.67366707 160.777629,6.593 C161.151631,6.51233293 161.547627,6.43900033 161.965629,6.373 C162.383631,6.30699967 162.812627,6.25566685 163.252629,6.219 C163.692631,6.18233315 164.125294,6.164 164.550629,6.164 C165.386633,6.164 166.06496,6.27033227 166.585629,6.483 C167.106298,6.69566773 167.535294,6.9486652 167.872629,7.242 C168.341965,6.90466498 168.88096,6.64066762 169.489629,6.45 C170.098299,6.25933238 170.659293,6.164 171.172629,6.164 C172.096634,6.164 172.855626,6.29233205 173.449629,6.549 C174.043632,6.80566795 174.516627,7.16866432 174.868629,7.638 C175.220631,8.10733568 175.462629,8.66466344 175.594629,9.31 C175.72663,9.95533656 175.792629,10.673996 175.792629,11.466 L175.792629,18 L172.514629,18 L172.514629,11.862 C172.514629,10.8059947 172.378964,10.0580022 172.107629,9.618 C171.836295,9.1779978 171.370633,8.958 170.710629,8.958 C170.534628,8.958 170.288964,9.00199956 169.973629,9.09 C169.658294,9.17800044 169.397964,9.28799934 169.192629,9.42 C169.295296,9.75733502 169.361296,10.1129981 169.390629,10.487 C169.419963,10.8610019 169.434629,11.2606645 169.434629,11.686 L169.434629,18 L166.156629,18 L166.156629,11.862 Z M182.084629,15.646 C182.685966,15.646 183.111295,15.5873339 183.360629,15.47 C183.609964,15.3526661 183.734629,15.125335 183.734629,14.788 C183.734629,14.5239987 183.573297,14.293001 183.250629,14.095 C182.927961,13.896999 182.436633,13.6733346 181.776629,13.424 C181.263293,13.2333324 180.797631,13.0353344 180.379629,12.83 C179.961627,12.6246656 179.605964,12.3790014 179.312629,12.093 C179.019294,11.8069986 178.791963,11.466002 178.630629,11.07 C178.469295,10.673998 178.388629,10.1973361 178.388629,9.64 C178.388629,8.55466124 178.791959,7.69666982 179.598629,7.066 C180.4053,6.43533018 181.512622,6.12 182.920629,6.12 C183.624633,6.12 184.299293,6.18233271 184.944629,6.307 C185.589966,6.43166729 186.103294,6.5673326 186.484629,6.714 L185.912629,9.266 C185.531294,9.13399934 185.116965,9.01666718 184.669629,8.914 C184.222294,8.81133282 183.719965,8.76 183.162629,8.76 C182.135957,8.76 181.622629,9.04599714 181.622629,9.618 C181.622629,9.75000066 181.644629,9.86733282 181.688629,9.97 C181.732629,10.0726672 181.820629,10.1716662 181.952629,10.267 C182.08463,10.3623338 182.264295,10.4649994 182.491629,10.575 C182.718964,10.6850005 183.008627,10.8059993 183.360629,10.938 C184.079299,11.2020013 184.673294,11.462332 185.142629,11.719 C185.611965,11.9756679 185.982295,12.2543318 186.253629,12.555 C186.524964,12.8556682 186.715629,13.1893315 186.825629,13.556 C186.93563,13.9226685 186.990629,14.3479976 186.990629,14.832 C186.990629,15.9760057 186.561634,16.8413304 185.703629,17.428 C184.845625,18.0146696 183.63197,18.308 182.062629,18.308 C181.035957,18.308 180.181633,18.2200009 179.499629,18.044 C178.817626,17.8679991 178.344631,17.7213339 178.080629,17.604 L178.630629,14.942 C179.187965,15.1620011 179.75996,15.3343327 180.346629,15.459 C180.933299,15.5836673 181.512626,15.646 182.084629,15.646 Z" fill="#000000" fillRule="nonzero"></path>
+              <path
+                className="fade-in"
+                d="M82.7326292,2.754 L82.7326292,5.68 L78.1346292,5.68 L78.1346292,18 L74.7026292,18 L74.7026292,5.68 L70.1046292,5.68 L70.1046292,2.754 L82.7326292,2.754 Z M90.1686292,9.332 C89.8752944,9.2586663 89.5306312,9.18166707 89.1346292,9.101 C88.7386272,9.02033293 88.3132982,8.98 87.8586292,8.98 C87.6532949,8.98 87.4076306,8.99833315 87.1216292,9.035 C86.8356278,9.07166685 86.6192966,9.11199978 86.4726292,9.156 L86.4726292,18 L83.1946292,18 L83.1946292,7.044 C83.7812988,6.83866564 84.4742919,6.64433425 85.2736292,6.461 C86.0729665,6.27766575 86.9639576,6.186 87.9466292,6.186 C88.1226301,6.186 88.3352946,6.19699989 88.5846292,6.219 C88.8339638,6.24100011 89.0832946,6.27033315 89.3326292,6.307 C89.5819638,6.34366685 89.8312946,6.38766641 90.0806292,6.439 C90.3299638,6.49033359 90.5426283,6.5526663 90.7186292,6.626 L90.1686292,9.332 Z M96.6806292,15.712 C97.0032975,15.712 97.3112944,15.7046667 97.6046292,15.69 C97.897964,15.6753333 98.1326283,15.6533335 98.3086292,15.624 L98.3086292,13.138 C98.1766286,13.1086665 97.9786305,13.0793335 97.7146292,13.05 C97.4506279,13.0206665 97.2086303,13.006 96.9886292,13.006 C96.6806277,13.006 96.3909639,13.0243331 96.1196292,13.061 C95.8482945,13.0976668 95.6099636,13.1673328 95.4046292,13.27 C95.1992949,13.3726672 95.0379631,13.5119991 94.9206292,13.688 C94.8032953,13.8640009 94.7446292,14.0839987 94.7446292,14.348 C94.7446292,14.8613359 94.9169608,15.216999 95.2616292,15.415 C95.6062976,15.613001 96.0792929,15.712 96.6806292,15.712 Z M96.4166292,6.12 C97.3846341,6.12 98.1912927,6.2299989 98.8366292,6.45 C99.4819658,6.6700011 99.9989606,6.98533128 100.387629,7.396 C100.776298,7.80666872 101.051295,8.3053304 101.212629,8.892 C101.373963,9.4786696 101.454629,10.1313297 101.454629,10.85 L101.454629,17.67 C100.985294,17.7726672 100.332633,17.893666 99.4966292,18.033 C98.660625,18.172334 97.6486352,18.242 96.4606292,18.242 C95.7126255,18.242 95.0342989,18.1760007 94.4256292,18.044 C93.8169595,17.9119993 93.2926314,17.6956682 92.8526292,17.395 C92.412627,17.0943318 92.0752971,16.7020024 91.8406292,16.218 C91.6059614,15.7339976 91.4886292,15.1400035 91.4886292,14.436 C91.4886292,13.76133 91.6242945,13.1893357 91.8956292,12.72 C92.1669639,12.2506643 92.5299603,11.8766681 92.9846292,11.598 C93.4392982,11.3193319 93.9599596,11.1176673 94.5466292,10.993 C95.1332988,10.8683327 95.7419594,10.806 96.3726292,10.806 C96.7979647,10.806 97.1756276,10.8243331 97.5056292,10.861 C97.8356309,10.8976668 98.1032949,10.945333 98.3086292,11.004 L98.3086292,10.696 C98.3086292,10.1386639 98.1399642,9.69133502 97.8026292,9.354 C97.4652942,9.01666498 96.8786334,8.848 96.0426292,8.848 C95.4852931,8.848 94.9352986,8.88833293 94.3926292,8.969 C93.8499598,9.04966707 93.3806312,9.1633326 92.9846292,9.31 L92.5666292,6.67 C92.7572968,6.61133304 92.9956278,6.54900033 93.2816292,6.483 C93.5676306,6.41699967 93.8792942,6.35833359 94.2166292,6.307 C94.5539642,6.25566641 94.9096273,6.21166685 95.2836292,6.175 C95.6576311,6.13833315 96.035294,6.12 96.4166292,6.12 Z M104.424629,6.824 C104.981965,6.66266586 105.700625,6.51233403 106.580629,6.373 C107.460634,6.23366597 108.384624,6.164 109.352629,6.164 C110.335301,6.164 111.152959,6.29233205 111.805629,6.549 C112.458299,6.80566795 112.975294,7.16866432 113.356629,7.638 C113.737964,8.10733568 114.009295,8.66466344 114.170629,9.31 C114.331963,9.95533656 114.412629,10.673996 114.412629,11.466 L114.412629,18 L111.134629,18 L111.134629,11.862 C111.134629,10.8059947 110.995297,10.0580022 110.716629,9.618 C110.437961,9.1779978 109.9173,8.958 109.154629,8.958 C108.919961,8.958 108.670631,8.96899989 108.406629,8.991 C108.142628,9.01300011 107.907964,9.03866652 107.702629,9.068 L107.702629,18 L104.424629,18 L104.424629,6.824 Z M120.704629,15.646 C121.305966,15.646 121.731295,15.5873339 121.980629,15.47 C122.229964,15.3526661 122.354629,15.125335 122.354629,14.788 C122.354629,14.5239987 122.193297,14.293001 121.870629,14.095 C121.547961,13.896999 121.056633,13.6733346 120.396629,13.424 C119.883293,13.2333324 119.417631,13.0353344 118.999629,12.83 C118.581627,12.6246656 118.225964,12.3790014 117.932629,12.093 C117.639294,11.8069986 117.411963,11.466002 117.250629,11.07 C117.089295,10.673998 117.008629,10.1973361 117.008629,9.64 C117.008629,8.55466124 117.411959,7.69666982 118.218629,7.066 C119.0253,6.43533018 120.132622,6.12 121.540629,6.12 C122.244633,6.12 122.919293,6.18233271 123.564629,6.307 C124.209966,6.43166729 124.723294,6.5673326 125.104629,6.714 L124.532629,9.266 C124.151294,9.13399934 123.736965,9.01666718 123.289629,8.914 C122.842294,8.81133282 122.339965,8.76 121.782629,8.76 C120.755957,8.76 120.242629,9.04599714 120.242629,9.618 C120.242629,9.75000066 120.264629,9.86733282 120.308629,9.97 C120.352629,10.0726672 120.440629,10.1716662 120.572629,10.267 C120.70463,10.3623338 120.884295,10.4649994 121.111629,10.575 C121.338964,10.6850005 121.628627,10.8059993 121.980629,10.938 C122.699299,11.2020013 123.293294,11.462332 123.762629,11.719 C124.231965,11.9756679 124.602295,12.2543318 124.873629,12.555 C125.144964,12.8556682 125.335629,13.1893315 125.445629,13.556 C125.55563,13.9226685 125.610629,14.3479976 125.610629,14.832 C125.610629,15.9760057 125.181634,16.8413304 124.323629,17.428 C123.465625,18.0146696 122.25197,18.308 120.682629,18.308 C119.655957,18.308 118.801633,18.2200009 118.119629,18.044 C117.437626,17.8679991 116.964631,17.7213339 116.700629,17.604 L117.250629,14.942 C117.807965,15.1620011 118.37996,15.3343327 118.966629,15.459 C119.553299,15.5836673 120.132626,15.646 120.704629,15.646 Z M133.068629,0.928 C133.684632,0.928 134.249293,0.99033271 134.762629,1.115 C135.275965,1.23966729 135.671961,1.36066608 135.950629,1.478 L135.312629,4.096 C135.019294,3.96399934 134.700298,3.86500033 134.355629,3.799 C134.010961,3.73299967 133.691964,3.7 133.398629,3.7 C133.002627,3.7 132.668964,3.75499945 132.397629,3.865 C132.126295,3.97500055 131.91363,4.12533238 131.759629,4.316 C131.605628,4.50666762 131.49563,4.73399868 131.429629,4.998 C131.363629,5.26200132 131.330629,5.54799846 131.330629,5.856 L131.330629,6.428 L135.378629,6.428 L135.378629,9.156 L131.330629,9.156 L131.330629,18 L128.052629,18 L128.052629,5.812 C128.052629,4.31599252 128.474292,3.1280044 129.317629,2.248 C130.160967,1.3679956 131.411288,0.928 133.068629,0.928 Z M147.984629,12.192 C147.984629,13.1013379 147.852631,13.9336629 147.588629,14.689 C147.324628,15.4443371 146.943298,16.089664 146.444629,16.625 C145.94596,17.160336 145.348299,17.5746652 144.651629,17.868 C143.954959,18.1613348 143.173967,18.308 142.308629,18.308 C141.457958,18.308 140.684299,18.1613348 139.987629,17.868 C139.290959,17.5746652 138.693298,17.160336 138.194629,16.625 C137.69596,16.089664 137.307297,15.4443371 137.028629,14.689 C136.749961,13.9336629 136.610629,13.1013379 136.610629,12.192 C136.610629,11.2826621 136.753628,10.4540037 137.039629,9.706 C137.325631,8.95799626 137.721627,8.32000264 138.227629,7.792 C138.733632,7.26399736 139.334959,6.8533348 140.031629,6.56 C140.728299,6.2666652 141.487292,6.12 142.308629,6.12 C143.144633,6.12 143.910959,6.2666652 144.607629,6.56 C145.304299,6.8533348 145.90196,7.26399736 146.400629,7.792 C146.899298,8.32000264 147.287961,8.95799626 147.566629,9.706 C147.845297,10.4540037 147.984629,11.2826621 147.984629,12.192 Z M144.640629,12.192 C144.640629,11.1799949 144.438965,10.3843362 144.035629,9.805 C143.632294,9.22566377 143.056633,8.936 142.308629,8.936 C141.560625,8.936 140.981298,9.22566377 140.570629,9.805 C140.15996,10.3843362 139.954629,11.1799949 139.954629,12.192 C139.954629,13.2040051 140.15996,14.006997 140.570629,14.601 C140.981298,15.195003 141.560625,15.492 142.308629,15.492 C143.056633,15.492 143.632294,15.195003 144.035629,14.601 C144.438965,14.006997 144.640629,13.2040051 144.640629,12.192 Z M157.488629,9.332 C157.195294,9.2586663 156.850631,9.18166707 156.454629,9.101 C156.058627,9.02033293 155.633298,8.98 155.178629,8.98 C154.973295,8.98 154.727631,8.99833315 154.441629,9.035 C154.155628,9.07166685 153.939297,9.11199978 153.792629,9.156 L153.792629,18 L150.514629,18 L150.514629,7.044 C151.101299,6.83866564 151.794292,6.64433425 152.593629,6.461 C153.392967,6.27766575 154.283958,6.186 155.266629,6.186 C155.44263,6.186 155.655295,6.19699989 155.904629,6.219 C156.153964,6.24100011 156.403295,6.27033315 156.652629,6.307 C156.901964,6.34366685 157.151295,6.38766641 157.400629,6.439 C157.649964,6.49033359 157.862628,6.5526663 158.038629,6.626 L157.488629,9.332 Z M166.156629,11.862 C166.156629,10.8059947 166.020964,10.0580022 165.749629,9.618 C165.478295,9.1779978 165.012633,8.958 164.352629,8.958 C164.147295,8.958 163.93463,8.96899989 163.714629,8.991 C163.494628,9.01300011 163.281964,9.03866652 163.076629,9.068 L163.076629,18 L159.798629,18 L159.798629,6.824 C160.077297,6.7506663 160.403627,6.67366707 160.777629,6.593 C161.151631,6.51233293 161.547627,6.43900033 161.965629,6.373 C162.383631,6.30699967 162.812627,6.25566685 163.252629,6.219 C163.692631,6.18233315 164.125294,6.164 164.550629,6.164 C165.386633,6.164 166.06496,6.27033227 166.585629,6.483 C167.106298,6.69566773 167.535294,6.9486652 167.872629,7.242 C168.341965,6.90466498 168.88096,6.64066762 169.489629,6.45 C170.098299,6.25933238 170.659293,6.164 171.172629,6.164 C172.096634,6.164 172.855626,6.29233205 173.449629,6.549 C174.043632,6.80566795 174.516627,7.16866432 174.868629,7.638 C175.220631,8.10733568 175.462629,8.66466344 175.594629,9.31 C175.72663,9.95533656 175.792629,10.673996 175.792629,11.466 L175.792629,18 L172.514629,18 L172.514629,11.862 C172.514629,10.8059947 172.378964,10.0580022 172.107629,9.618 C171.836295,9.1779978 171.370633,8.958 170.710629,8.958 C170.534628,8.958 170.288964,9.00199956 169.973629,9.09 C169.658294,9.17800044 169.397964,9.28799934 169.192629,9.42 C169.295296,9.75733502 169.361296,10.1129981 169.390629,10.487 C169.419963,10.8610019 169.434629,11.2606645 169.434629,11.686 L169.434629,18 L166.156629,18 L166.156629,11.862 Z M182.084629,15.646 C182.685966,15.646 183.111295,15.5873339 183.360629,15.47 C183.609964,15.3526661 183.734629,15.125335 183.734629,14.788 C183.734629,14.5239987 183.573297,14.293001 183.250629,14.095 C182.927961,13.896999 182.436633,13.6733346 181.776629,13.424 C181.263293,13.2333324 180.797631,13.0353344 180.379629,12.83 C179.961627,12.6246656 179.605964,12.3790014 179.312629,12.093 C179.019294,11.8069986 178.791963,11.466002 178.630629,11.07 C178.469295,10.673998 178.388629,10.1973361 178.388629,9.64 C178.388629,8.55466124 178.791959,7.69666982 179.598629,7.066 C180.4053,6.43533018 181.512622,6.12 182.920629,6.12 C183.624633,6.12 184.299293,6.18233271 184.944629,6.307 C185.589966,6.43166729 186.103294,6.5673326 186.484629,6.714 L185.912629,9.266 C185.531294,9.13399934 185.116965,9.01666718 184.669629,8.914 C184.222294,8.81133282 183.719965,8.76 183.162629,8.76 C182.135957,8.76 181.622629,9.04599714 181.622629,9.618 C181.622629,9.75000066 181.644629,9.86733282 181.688629,9.97 C181.732629,10.0726672 181.820629,10.1716662 181.952629,10.267 C182.08463,10.3623338 182.264295,10.4649994 182.491629,10.575 C182.718964,10.6850005 183.008627,10.8059993 183.360629,10.938 C184.079299,11.2020013 184.673294,11.462332 185.142629,11.719 C185.611965,11.9756679 185.982295,12.2543318 186.253629,12.555 C186.524964,12.8556682 186.715629,13.1893315 186.825629,13.556 C186.93563,13.9226685 186.990629,14.3479976 186.990629,14.832 C186.990629,15.9760057 186.561634,16.8413304 185.703629,17.428 C184.845625,18.0146696 183.63197,18.308 182.062629,18.308 C181.035957,18.308 180.181633,18.2200009 179.499629,18.044 C178.817626,17.8679991 178.344631,17.7213339 178.080629,17.604 L178.630629,14.942 C179.187965,15.1620011 179.75996,15.3343327 180.346629,15.459 C180.933299,15.5836673 181.512626,15.646 182.084629,15.646 Z"
+                fill="#000000"
+                fillRule="nonzero"
+              ></path>
             </a>
           </g>
           <g id="Logo" transform="translate(328.000000, 38.000000)" fill="#10E7FF">
-            <polygon id="Rectangle" points="42.5439541 0 50.0495796 4.17258107e-13 32.1747297 29.4788933 28.466169 23.3786335"></polygon>
-            <polygon id="Triangle-Copy" transform="translate(17.780772, 14.661871) scale(1, -1) translate(-17.780772, -14.661871) " points="17.7807717 9.09494702e-13 35.5615434 29.3237412 26.6924774 29.3237412 17.9626561 14.98769 9.22860926 29.3237412 0 29.3237412"></polygon>
+            <polygon
+              id="Rectangle"
+              points="42.5439541 0 50.0495796 4.17258107e-13 32.1747297 29.4788933 28.466169 23.3786335"
+            ></polygon>
+            <polygon
+              id="Triangle-Copy"
+              transform="translate(17.780772, 14.661871) scale(1, -1) translate(-17.780772, -14.661871) "
+              points="17.7807717 9.09494702e-13 35.5615434 29.3237412 26.6924774 29.3237412 17.9626561 14.98769 9.22860926 29.3237412 0 29.3237412"
+            ></polygon>
           </g>
         </g>
       </g>
     </svg>
   );
-};
+}
 
 // Place the components in the DOM
 const globeRoot = createRoot(document.getElementById("globe"));
diff --git a/website/assets/js/search.tsx b/website/assets/js/search.tsx
index f322f463ed774..9fb384498f10e 100644
--- a/website/assets/js/search.tsx
+++ b/website/assets/js/search.tsx
@@ -1,13 +1,13 @@
-import { autocomplete } from '@algolia/autocomplete-js'
-import Typesense from 'typesense'
-import React, { createElement, Fragment, useEffect, useRef } from 'react'
-import { createRoot } from 'react-dom/client'
+import { autocomplete } from "@algolia/autocomplete-js";
+import Typesense from "typesense";
+import React, { createElement, Fragment, useEffect, useRef } from "react";
+import { createRoot } from "react-dom/client";
 
 // // Algolia search
 // const appId = process.env.ALGOLIA_APP_ID
-const apiKey = process.env.TYPESENSE_PUBLIC_API_KEY
-const indexName = process.env.TYPESENSE_INDEX
-const host = process.env.TYPESENSE_HOST
+const apiKey = process.env.TYPESENSE_PUBLIC_API_KEY;
+const indexName = process.env.TYPESENSE_INDEX;
+const host = process.env.TYPESENSE_HOST;
 // const searchClient = algoliasearch(appId, apiKey)
 
 let searchClient = new Typesense.Client({
@@ -15,73 +15,53 @@ let searchClient = new Typesense.Client({
   nearestNode: {
     host: `${host}.a1.typesense.net`,
     port: 443,
-    protocol: 'https',
+    protocol: "https"
   },
   nodes: [
     {
       host: `${host}-1.a1.typesense.net`,
       port: 443,
-      protocol: 'https',
+      protocol: "https"
     },
     {
       host: `${host}-2.a1.typesense.net`,
       port: 443,
-      protocol: 'https',
+      protocol: "https"
     },
     {
       host: `${host}-3.a1.typesense.net`,
       port: 443,
-      protocol: 'https',
-    },
+      protocol: "https"
+    }
   ],
-  connectionTimeoutSeconds: 2,
-})
-
+  connectionTimeoutSeconds: 2
+});
 
 const CommandIcon: React.FC = ({ children }) => {
   return (
     <svg width="15" height="15">
-      <g
-        fill="none"
-        stroke="currentColor"
-        strokeLinecap="round"
-        strokeLinejoin="round"
-        strokeWidth="1.2"
-      >
+      <g fill="none" stroke="currentColor" strokeLinecap="round" strokeLinejoin="round" strokeWidth="1.2">
         {children}
       </g>
     </svg>
-  )
-}
+  );
+};
 
 const Chevron: React.FC = () => {
   return (
-    <svg
-      className="h-3 w-3 inline"
-      fill="none"
-      viewBox="0 0 24 24"
-      stroke="currentColor"
-    >
-      <path
-        strokeLinecap="round"
-        strokeLinejoin="round"
-        strokeWidth={2}
-        d="M9 5l7 7-7 7"
-      />
+    <svg className="h-3 w-3 inline" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+      <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M9 5l7 7-7 7" />
     </svg>
-  )
-}
-
+  );
+};
 
 const Result = ({ hit, components, category }) => {
-  const hierarchy = hit.document.hierarchy.concat(hit.document.title)
-  const isRootPage = hierarchy.length < 1
+  const hierarchy = hit.document.hierarchy.concat(hit.document.title);
+  const isRootPage = hierarchy.length < 1;
 
   return (
     <a href={hit.document.itemUrl}>
-      <div className="border-r border-gray-300 py-4 pl-2 h-full leading-relaxed">
-        {category}
-      </div>
+      <div className="border-r border-gray-300 py-4 pl-2 h-full leading-relaxed">{category}</div>
       <div className="p-2 block">
         <div className="text-gray-800 text-md mb-1 font-medium leading-relaxed ">
           {!isRootPage &&
@@ -100,34 +80,30 @@ const Result = ({ hit, components, category }) => {
           {isRootPage && <components.Highlight hit={hit} attribute="title" />}
         </div>
         <p className="text-gray-600 text-sm">
-          {hit.content && (
-            <span dangerouslySetInnerHTML={{__html: hit.content}} />
-          )}
-          {!hit.content && (
-            <span style={{ wordBreak: 'break-word' }}>{hit.document.itemUrl}</span>
-          )}
+          {hit.content && <span dangerouslySetInnerHTML={{ __html: hit.content }} />}
+          {!hit.content && <span style={{ wordBreak: "break-word" }}>{hit.document.itemUrl}</span>}
         </p>
       </div>
     </a>
-  )
-}
+  );
+};
 
 const Autocomplete = (props) => {
-  const containerRef = useRef(null)
-  const panelRootRef = useRef({})
+  const containerRef = useRef(null);
+  const panelRootRef = useRef({});
 
   useEffect(() => {
     if (!containerRef.current) {
-      return undefined
+      return undefined;
     }
 
     const search = autocomplete({
       container: containerRef.current,
       renderer: { createElement, Fragment },
       render({ children, state, components }, root) {
-        const { preview } = state.context as any
+        const { preview } = state.context as any;
         if (!panelRootRef.current[root]) {
-          panelRootRef.current[root] = createRoot(root)
+          panelRootRef.current[root] = createRoot(root);
         }
         panelRootRef.current[root].render(
           <Fragment>
@@ -168,18 +144,18 @@ const Autocomplete = (props) => {
               </div>
             </div>
           </Fragment>
-        )
+        );
       },
-      ...props,
-    })
+      ...props
+    });
 
     return () => {
-      search.destroy()
-    }
-  }, [props])
+      search.destroy();
+    };
+  }, [props]);
 
-  return <div ref={containerRef} />
-}
+  return <div ref={containerRef} />;
+};
 
 const Search = () => {
   return (
@@ -190,64 +166,69 @@ const Search = () => {
       defaultActiveItemId={0}
       getSources={({ query }) => [
         {
-          sourceId: 'queryResults',
+          sourceId: "queryResults",
           async getItems() {
-            const results = (query) => searchClient.collections('vector_docs').documents().search({
-              q: query,
-              preset: 'vector_docs_search',
-              exhaustive_search: true,
-              highlight_fields: 'content',
-              highlight_full_fields: 'content'
-
-            }).then((result) => {
-              // order the hits by page group
-              // const hits = result.hits.sort((a, b) => (a.document.pageTitle < b.document.pageTitle ? -1 : 1))
-
-              // add page as category if there are duplicates
-              const hitsWithCategory = result.hits.map((h, i) => {
-                const prev = result.hits[i - 1] as any
-                const title = h.document.pageTitle
-
-                // if no previous hit is in this category
-                if (!prev) {
-                  return { ...h, category: title }
-                }
-
-                // skip if there is already one in this category
-                if (prev && prev.document.pageTitle === title) {
-                  return h
-                }
-
-                // add category if needed
-                if (prev && prev.document.pageTitle !== title) {
-                  return { ...h, category: title }
-                }
-
-                return h
-              })
-              return hitsWithCategory
-            })
-            return await results(query)
+            const results = (query) =>
+              searchClient
+                .collections("vector_docs")
+                .documents()
+                .search({
+                  q: query,
+                  preset: "vector_docs_search",
+                  exhaustive_search: true,
+                  highlight_fields: "content",
+                  highlight_full_fields: "content"
+                })
+                .then((result) => {
+                  // order the hits by page group
+                  // const hits = result.hits.sort((a, b) => (a.document.pageTitle < b.document.pageTitle ? -1 : 1))
+
+                  // add page as category if there are duplicates
+                  const hitsWithCategory = result.hits.map((h, i) => {
+                    const prev = result.hits[i - 1] as any;
+                    const title = h.document.pageTitle;
+
+                    // if no previous hit is in this category
+                    if (!prev) {
+                      return { ...h, category: title };
+                    }
+
+                    // skip if there is already one in this category
+                    if (prev && prev.document.pageTitle === title) {
+                      return h;
+                    }
+
+                    // add category if needed
+                    if (prev && prev.document.pageTitle !== title) {
+                      return { ...h, category: title };
+                    }
+
+                    return h;
+                  });
+                  return hitsWithCategory;
+                });
+            return await results(query);
           },
           getItemUrl({ item }) {
-            return item.document.itemUrl
+            return item.document.itemUrl;
           },
           templates: {
             item({ item, components }) {
-              const highlight = item.highlights.length && item.highlights.find(h => h.field === 'content' || {}).value || item.document['content']
-              item['content'] = highlight
-              return <Result hit={item} components={components} category={item.category} />
+              const highlight =
+                (item.highlights.length && item.highlights.find((h) => h.field === "content" || {}).value) ||
+                item.document["content"];
+              item["content"] = highlight;
+              return <Result hit={item} components={components} category={item.category} />;
             },
             noResults() {
-              return 'No results found.';
-            },
-          },
+              return "No results found.";
+            }
+          }
         }
       ]}
     />
-  )
-}
-
+  );
+};
 
-const searchRoot = createRoot(document.getElementById('site-search'))
-searchRoot.render(<Search />)
+const searchRoot = createRoot(document.getElementById("site-search"));
+searchRoot.render(<Search />);
diff --git a/website/babel.config.js b/website/babel.config.js
index cfe4e614d29c6..bf0e24707c871 100644
--- a/website/babel.config.js
+++ b/website/babel.config.js
@@ -1,6 +1,6 @@
-import presetEnv from '@babel/preset-env';
-import presetReact from '@babel/preset-react';
-import presetTypeScript from '@babel/preset-typescript';
+import presetEnv from "@babel/preset-env";
+import presetReact from "@babel/preset-react";
+import presetTypeScript from "@babel/preset-typescript";
 
 export default function (api) {
   api.cache(true);
@@ -9,22 +9,22 @@ export default function (api) {
     [
       presetEnv,
       {
-        "useBuiltIns": 'entry',
-        "corejs": 3
+        useBuiltIns: "entry",
+        corejs: 3
       }
     ],
     [
       presetReact,
       {
-        "flow": false,
-        "typescript": true
+        flow: false,
+        typescript: true
       }
     ],
     [
       presetTypeScript,
       {
-        "isTSX": true,
-        "allExtensions": true
+        isTSX: true,
+        allExtensions: true
       }
     ]
   ];
diff --git a/website/data/redirects.yaml b/website/data/redirects.yaml
index 4e7a94f467b56..e8ac227c4248b 100644
--- a/website/data/redirects.yaml
+++ b/website/data/redirects.yaml
@@ -1,74 +1,74 @@
 platforms:
-- docker
-- kubernetes
+  - docker
+  - kubernetes
 
 sinks:
-- aws_sqs
-- aws_cloudwatch_logs
-- aws_cloudwatch_metrics
-- aws_kinesis_firehose
-- aws_kinesis_streams
-- aws_s3
-- axiom
-- azure_monitor_logs
-- clickhouse
-- databend
-- datadog_logs
-- datadog_metrics
-- elasticsearch
-- file
-- gcp_cloud_storage
-- gcp_pubsub
-- gcp_stackdriver_logs
-- gcp_stackdriver_metrics
-- honeycomb
-- http
-- humio_logs
-- humio_metrics
-- influxdb_logs
-- influxdb_metrics
-- kafka
-- keep
-- mezmo
-- loki
-- nats
-- new_relic_logs
-- new_relic
-- papertrail
-- postgres
-- prometheus_exporter
-- prometheus_remote_write
-- pulsar
-- sematext_logs
-- sematext_metrics
-- socket
-- splunk_hec
-- statsd
+  - aws_sqs
+  - aws_cloudwatch_logs
+  - aws_cloudwatch_metrics
+  - aws_kinesis_firehose
+  - aws_kinesis_streams
+  - aws_s3
+  - axiom
+  - azure_monitor_logs
+  - clickhouse
+  - databend
+  - datadog_logs
+  - datadog_metrics
+  - elasticsearch
+  - file
+  - gcp_cloud_storage
+  - gcp_pubsub
+  - gcp_stackdriver_logs
+  - gcp_stackdriver_metrics
+  - honeycomb
+  - http
+  - humio_logs
+  - humio_metrics
+  - influxdb_logs
+  - influxdb_metrics
+  - kafka
+  - keep
+  - mezmo
+  - loki
+  - nats
+  - new_relic_logs
+  - new_relic
+  - papertrail
+  - postgres
+  - prometheus_exporter
+  - prometheus_remote_write
+  - pulsar
+  - sematext_logs
+  - sematext_metrics
+  - socket
+  - splunk_hec
+  - statsd
 
 sources:
-- apache_metrics
-- aws_ecs_metrics
-- aws_kinesis_firehose
-- aws_s3
-- datadog_logs
-- exec
-- file
-- heroku_logs
-- host_metrics
-- http
-- journald
-- kafka
-- mongodb_metrics
-- nginx_metrics
-- postgresql_metrics
-- prometheus_remote_write
-- prometheus_scrape
-- pulsar
-- socket
-- splunk_hec
-- statsd
-- stdin
-- syslog
+  - apache_metrics
+  - aws_ecs_metrics
+  - aws_kinesis_firehose
+  - aws_s3
+  - datadog_logs
+  - exec
+  - file
+  - heroku_logs
+  - host_metrics
+  - http
+  - journald
+  - kafka
+  - mongodb_metrics
+  - nginx_metrics
+  - postgresql_metrics
+  - prometheus_remote_write
+  - prometheus_scrape
+  - pulsar
+  - socket
+  - splunk_hec
+  - statsd
+  - stdin
+  - syslog
 
 # /guides/integrate/platforms/${key}/*  /docs/reference/configuration/sources/${source}
 multi:
diff --git a/website/postcss.config.js b/website/postcss.config.js
index 96e73589f6611..ccd51f20f80bc 100644
--- a/website/postcss.config.js
+++ b/website/postcss.config.js
@@ -1,7 +1,7 @@
-import postcssImport from 'postcss-import';
-import tailwindCss from 'tailwindcss';
-import autoprefixer from 'autoprefixer';
-import purgecssPlugin from '@fullhuman/postcss-purgecss';
+import postcssImport from "postcss-import";
+import tailwindCss from "tailwindcss";
+import autoprefixer from "autoprefixer";
+import purgecssPlugin from "@fullhuman/postcss-purgecss";
 
 // These are classes for things that are applied by JS, and thus missed by Hugo.
 // See assets/js/*.js for places where this happens.
@@ -40,12 +40,12 @@ const safeClasses = {
     "text-md",
     "text-sm",
     "w-2",
-    "w-3",
+    "w-3"
   ]
 };
 
 const purgecss = purgecssPlugin({
-  content: ['./hugo_stats.json'],
+  content: ["./hugo_stats.json"],
   safelist: safeClasses,
   defaultExtractor: (content) => {
     const broadMatches = content.match(/[^<>"'`\s]*[^<>"'`\s:]/g) || [];
@@ -59,6 +59,6 @@ export default {
     postcssImport,
     tailwindCss,
     autoprefixer,
-    ...(process.env.HUGO_ENVIRONMENT === 'production' ? [purgecss] : [])
+    ...(process.env.HUGO_ENVIRONMENT === "production" ? [purgecss] : [])
   ]
-}
+};
diff --git a/website/scripts/create-config-examples.js b/website/scripts/create-config-examples.js
index b9096fd4d3b1d..692340b359413 100755
--- a/website/scripts/create-config-examples.js
+++ b/website/scripts/create-config-examples.js
@@ -1,7 +1,7 @@
-import fs from 'fs';
-import chalk from 'chalk';
-import * as TOML from '@iarna/toml';
-import YAML from 'yaml';
+import fs from "fs";
+import chalk from "chalk";
+import * as TOML from "@iarna/toml";
+import YAML from "yaml";
 
 const cueJsonOutput = "data/docs.json";
 
@@ -10,56 +10,54 @@ const getExampleValue = (param, deepFilter) => {
   let value;
 
   const getArrayValue = (obj) => {
-    const enumVal = (obj.enum != null) ? [Object.keys(obj.enum)[0]] : null;
+    const enumVal = obj.enum != null ? [Object.keys(obj.enum)[0]] : null;
 
-    const examplesVal = (obj.examples != null && obj.examples.length > 0) ? [obj.examples[0]] : null;
+    const examplesVal = obj.examples != null && obj.examples.length > 0 ? [obj.examples[0]] : null;
 
     return obj.default || examplesVal || enumVal || null;
-  }
+  };
 
   const getValue = (obj) => {
-    const enumVal = (obj.enum != null) ? Object.keys(obj.enum)[0] : null;
+    const enumVal = obj.enum != null ? Object.keys(obj.enum)[0] : null;
 
-    const examplesVal = (obj.examples != null && obj.examples.length > 0) ? obj.examples[0] : null;
+    const examplesVal = obj.examples != null && obj.examples.length > 0 ? obj.examples[0] : null;
 
     return obj.default || examplesVal || enumVal || null;
-  }
+  };
 
-  Object.keys(param.type).forEach(k => {
+  Object.keys(param.type).forEach((k) => {
     const p = param.type[k];
 
-    if (['array', 'object'].includes(k)) {
+    if (["array", "object"].includes(k)) {
       const topType = k;
 
       if (p.items && p.items.type) {
         const typeInfo = p.items.type;
 
-        Object.keys(typeInfo).forEach(k => {
-          if (['array', 'object'].includes(k)) {
+        Object.keys(typeInfo).forEach((k) => {
+          if (["array", "object"].includes(k)) {
             const subType = k;
             const options = typeInfo[k].options;
 
             var subObj = {};
 
-            Object
-              .keys(options)
-              .filter(k => deepFilter(options[k]))
-              .forEach(k => {
-                Object.keys(options[k].type).forEach(key => {
+            Object.keys(options)
+              .filter((k) => deepFilter(options[k]))
+              .forEach((k) => {
+                Object.keys(options[k].type).forEach((key) => {
                   const deepTypeInfo = options[k].type[key];
 
-                  if (subType === 'array') {
+                  if (subType === "array") {
                     subObj[k] = getArrayValue(deepTypeInfo);
                   } else {
                     subObj[k] = getValue(deepTypeInfo);
                   }
-
                 });
               });
 
             value = subObj;
           } else {
-            if (topType === 'array') {
+            if (topType === "array") {
               value = getArrayValue(typeInfo[k]);
             } else {
               value = getValue(typeInfo[k]);
@@ -75,15 +73,14 @@ const getExampleValue = (param, deepFilter) => {
   });
 
   return value;
-}
+};
 
 Object.makeExampleParams = (params, filter, deepFilter) => {
   var obj = {};
 
-  Object
-    .keys(params)
-    .filter(k => filter(params[k]))
-    .forEach(k => {
+  Object.keys(params)
+    .filter((k) => filter(params[k]))
+    .forEach((k) => {
       let value = getExampleValue(params[k], deepFilter);
       if (value) {
         obj[k] = value;
@@ -91,22 +88,22 @@ Object.makeExampleParams = (params, filter, deepFilter) => {
     });
 
   return obj;
-}
+};
 
 // Convert object to TOML string
 const toToml = (obj) => {
   return TOML.stringify(obj);
-}
+};
 
 // Convert object to YAML string
 const toYaml = (obj) => {
   return `${YAML.stringify(obj)}`;
-}
+};
 
 // Convert object to JSON string (indented)
 const toJson = (obj) => {
   return JSON.stringify(obj, null, 2);
-}
+};
 
 // Set the example value for a given config parameter
 const setExampleValue = (exampleConfig, paramName, param) => {
@@ -125,7 +122,7 @@ const setExampleValue = (exampleConfig, paramName, param) => {
       exampleConfig[paramName] = p.examples[0];
     }
 
-    if (['array', 'object'].includes(k)) {
+    if (["array", "object"].includes(k)) {
       if (p.items) {
         var obj = {};
 
@@ -157,7 +154,7 @@ const setExampleValue = (exampleConfig, paramName, param) => {
       }
     }
   });
-}
+};
 
 // Assemble the "minimal" params for an example config
 const makeMinimalParams = (configuration) => {
@@ -175,7 +172,7 @@ const makeMinimalParams = (configuration) => {
   }
 
   return minimal;
-}
+};
 
 // Assemble the "advanced" params for an example config
 const makeAllParams = (configuration) => {
@@ -190,7 +187,7 @@ const makeAllParams = (configuration) => {
   }
 
   return optional;
-}
+};
 
 // Convert the use case examples (`component.examples`) into multi-format
 const makeUseCaseExamples = (component) => {
@@ -210,31 +207,31 @@ const makeUseCaseExamples = (component) => {
         exampleConfig = {
           [kindPlural]: {
             [keyName]: {
-              "type": component.type,
-              inputs: ['my-source-or-transform-id'],
+              type: component.type,
+              inputs: ["my-source-or-transform-id"],
               ...extra
             }
           }
-        }
+        };
       } else {
         exampleConfig = {
           [kindPlural]: {
             [keyName]: {
-              "type": component.type,
+              type: component.type,
               ...extra
             }
           }
-        }
+        };
       }
 
       // Strip the "log" or "metric" key in the example output
       let output;
 
       if (example.output) {
-        if (example.output['log']) {
-          output = example.output['log'];
-        } else if (example.output['metric']) {
-          output = example.output['metric'];
+        if (example.output["log"]) {
+          output = example.output["log"];
+        } else if (example.output["metric"]) {
+          output = example.output["metric"];
         } else {
           output = example.output;
         }
@@ -248,11 +245,11 @@ const makeUseCaseExamples = (component) => {
         configuration: {
           toml: toToml(exampleConfig),
           yaml: toYaml(exampleConfig),
-          json: toJson(exampleConfig),
+          json: toJson(exampleConfig)
         },
         input: example.input,
-        output: output,
-      }
+        output: output
+      };
 
       useCases.push(useCase);
     });
@@ -261,12 +258,12 @@ const makeUseCaseExamples = (component) => {
   } else {
     return null;
   }
-}
+};
 
 const main = () => {
   try {
     const debug = process.env.DEBUG === "true" || false;
-    const data = fs.readFileSync(cueJsonOutput, 'utf8');
+    const data = fs.readFileSync(cueJsonOutput, "utf8");
     const docs = JSON.parse(data);
     const components = docs.components;
 
@@ -285,13 +282,13 @@ const main = () => {
 
         const minimalParams = Object.makeExampleParams(
           configuration,
-            p => p.required || p.minimal,
-            p => p.required || p.minimal,
+          (p) => p.required || p.minimal,
+          (p) => p.required || p.minimal
         );
         const advancedParams = Object.makeExampleParams(
           configuration,
-          _ => true,
-            p => p.required || p.minimal || p.relevant_when,
+          (_) => true,
+          (p) => p.required || p.minimal || p.relevant_when
         );
         const useCaseExamples = makeUseCaseExamples(component);
 
@@ -300,13 +297,13 @@ const main = () => {
         let minimalExampleConfig, advancedExampleConfig;
 
         // Sinks and transforms are treated differently because they need an `inputs` field
-        if (['sinks', 'transforms'].includes(kind)) {
+        if (["sinks", "transforms"].includes(kind)) {
           minimalExampleConfig = {
             [kind]: {
               [keyName]: {
-                "type": componentType,
-                inputs: ['my-source-or-transform-id'],
-                ...minimalParams,
+                type: componentType,
+                inputs: ["my-source-or-transform-id"],
+                ...minimalParams
               }
             }
           };
@@ -314,9 +311,9 @@ const main = () => {
           advancedExampleConfig = {
             [kind]: {
               [keyName]: {
-                "type": componentType,
-                inputs: ['my-source-or-transform-id'],
-                ...advancedParams,
+                type: componentType,
+                inputs: ["my-source-or-transform-id"],
+                ...advancedParams
               }
             }
           };
@@ -324,8 +321,8 @@ const main = () => {
           minimalExampleConfig = {
             [kind]: {
               [keyName]: {
-                "type": componentType,
-                ...minimalParams,
+                type: componentType,
+                ...minimalParams
               }
             }
           };
@@ -333,49 +330,47 @@ const main = () => {
           advancedExampleConfig = {
             [kind]: {
               [keyName]: {
-                "type": componentType,
-                ...advancedParams,
+                type: componentType,
+                ...advancedParams
               }
             }
           };
         }
 
-        docs['components'][kind][componentType]['examples'] = useCaseExamples;
+        docs["components"][kind][componentType]["examples"] = useCaseExamples;
 
-        docs['components'][kind][componentType]['example_configs'] = {
+        docs["components"][kind][componentType]["example_configs"] = {
           minimal: {
             toml: toToml(minimalExampleConfig),
             yaml: toYaml(minimalExampleConfig),
-            json: toJson(minimalExampleConfig),
+            json: toJson(minimalExampleConfig)
           },
           advanced: {
             toml: toToml(advancedExampleConfig),
             yaml: toYaml(advancedExampleConfig),
-            json: toJson(advancedExampleConfig),
-          },
+            json: toJson(advancedExampleConfig)
+          }
         };
       }
     }
 
-
     // A debugging statement to make sure things are going basically as planned
     if (debug) {
-      console.log(docs['components']['sources']['syslog']['examples']);
+      console.log(docs["components"]["sources"]["syslog"]["examples"]);
     }
 
-
     console.log(chalk.green("Success. Finished generating examples for all components."));
     console.log(chalk.blue(`Writing generated examples as JSON to ${cueJsonOutput}...`));
 
     // Write back to the JSON file only when not in debug mode
     if (!debug) {
-      fs.writeFileSync(cueJsonOutput, JSON.stringify(docs), 'utf8');
+      fs.writeFileSync(cueJsonOutput, JSON.stringify(docs), "utf8");
     }
 
     console.log(chalk.green(`Success. Finished writing example configs to ${cueJsonOutput}.`));
   } catch (err) {
     console.error(err);
   }
-}
+};
 
 main();
diff --git a/website/scripts/typesense-index.ts b/website/scripts/typesense-index.ts
index 7b14f07d0fbdd..f800e710d1754 100644
--- a/website/scripts/typesense-index.ts
+++ b/website/scripts/typesense-index.ts
@@ -54,7 +54,7 @@ const tagHierarchy = {
   h5: 2,
   h6: 1,
   li: 1,
-  p: 1,
+  p: 1
 };
 
 function getPageUrl(file: string) {
@@ -75,7 +75,7 @@ function getItemUrl(file: string, { level, domId }: Payload[0]) {
 
 // Hash the file name to create a unique ID for the record using the same hash function as the one used in the synapse stream package.
 function hashString(fileName: string) {
-  return crypto.createHash('md5').update(fileName).digest('hex')
+  return crypto.createHash("md5").update(fileName).digest("hex");
 }
 
 async function indexHTMLFiles(
@@ -92,8 +92,8 @@ async function indexHTMLFiles(
     const $ = cheerio.load(html);
     const containers = $("#page-content");
     const pageTitle = $("meta[name='algolia:title']").attr("content") || "";
-    const pageTagsString = $("meta[name='keywords']").attr('content') || "";
-    const pageTags: string[] = (pageTagsString === "") ? [] : pageTagsString.split(",");
+    const pageTagsString = $("meta[name='keywords']").attr("content") || "";
+    const pageTags: string[] = pageTagsString === "" ? [] : pageTagsString.split(",");
 
     // @ts-ignore
     $(".algolia-no-index").each((_, d) => $(d).remove());
@@ -114,7 +114,7 @@ async function indexHTMLFiles(
           tagName: node.tagName,
           content: $(node)
             .text()
-            .replace(/[\n\t]/g, " "),
+            .replace(/[\n\t]/g, " ")
         });
       }
 
@@ -146,9 +146,10 @@ async function indexHTMLFiles(
           ranking,
           hierarchy: [],
           tags: pageTags,
-          content: "",
+          content: ""
         };
-      } else if (item.level === 1) { // h1 logic
+      } else if (item.level === 1) {
+        // h1 logic
         activeRecord.content += item.content;
       } else if (item.level < activeRecord.level) {
         algoliaRecords.push({ ...activeRecord });
@@ -164,9 +165,10 @@ async function indexHTMLFiles(
           ranking,
           hierarchy: [...activeRecord.hierarchy, activeRecord.title.trim()],
           tags: pageTags,
-          content: "",
+          content: ""
         };
-      } else { // h2-h6 logic
+      } else {
+        // h2-h6 logic
         algoliaRecords.push({ ...activeRecord });
 
         const hierarchySize = activeRecord.hierarchy.length;
@@ -184,12 +186,12 @@ async function indexHTMLFiles(
           ranking,
           hierarchy: [...activeRecord.hierarchy.slice(0, lastIndex)],
           tags: pageTags,
-          content: "",
+          content: ""
         };
       }
 
       if (activeRecord) {
-        algoliaRecords.push({ ...activeRecord })
+        algoliaRecords.push({ ...activeRecord });
       }
 
       for (const rec of algoliaRecords) {
@@ -211,9 +213,7 @@ async function indexHTMLFiles(
     }
   }
 
-  console.log(
-    chalk.green(`Success. Updated records for ${files.length} file(s).`)
-  );
+  console.log(chalk.green(`Success. Updated records for ${files.length} file(s).`));
 
   records.push(...algoliaRecords);
 }
@@ -228,56 +228,56 @@ async function buildIndex() {
       name: "Docs",
       path: `${publicPath}/docs/introduction/**/**.html`,
       displayPath: "docs/introduction",
-      ranking: 50,
+      ranking: 50
     },
     {
       name: "Docs",
       path: `${publicPath}/docs/administration/**/**.html`,
       displayPath: "docs/administration",
-      ranking: 50,
+      ranking: 50
     },
     {
       name: "Docs",
       path: `${publicPath}/docs/reference/**/**.html`,
       displayPath: "docs/reference",
-      ranking: 50,
+      ranking: 50
     },
     {
       name: "Docs",
       path: `${publicPath}/docs/setup/**/**.html`,
       displayPath: "docs/setup",
-      ranking: 50,
+      ranking: 50
     },
     {
       name: "Advanced guides",
       path: `${publicPath}/guides/advanced/**/**.html`,
       displayPath: "guides/advanced",
-      ranking: 40,
+      ranking: 40
     },
     {
       name: "Level up guides",
       path: `${publicPath}/guides/level-up/**/**.html`,
       displayPath: "guides/level-up",
-      ranking: 40,
+      ranking: 40
     },
     {
       name: "Developer guides",
       path: `${publicPath}/guides/developer/**/**.html`,
       displayPath: "guides/developer",
-      ranking: 40,
+      ranking: 40
     },
     {
       name: "Vector highlights",
       path: `${publicPath}/highlights/**/**.html`,
       displayPath: "highlights/",
-      ranking: 40,
+      ranking: 40
     },
     {
       name: "Upgrade guides",
       path: `${publicPath}/highlights/*-upgrade-guide/**.html`,
       displayPath: "highlights/",
-      ranking: 10,
-    },
+      ranking: 10
+    }
   ];
 
   // Recurse through each section and push the resulting records to `allRecords`
@@ -286,7 +286,7 @@ async function buildIndex() {
 
     // We shouldn't index upgrade guides
     if (section.name === "Vector highlights") {
-      files = files.filter((path) => !path.includes("-upgrade-guide"))
+      files = files.filter((path) => !path.includes("-upgrade-guide"));
     }
 
     console.log(chalk.blue(`Indexing ${section.displayPath}...`));
diff --git a/website/scripts/typesense-sync.ts b/website/scripts/typesense-sync.ts
index 65f867de7b98d..9590be0104fb8 100644
--- a/website/scripts/typesense-sync.ts
+++ b/website/scripts/typesense-sync.ts
@@ -1,19 +1,18 @@
 // Will be running in the CI/CD pipeline
-import process from 'node:process';
-import { typesenseSync } from 'typesense-sync';
-const configFilePath = './typesense.config.json';
+import process from "node:process";
+import { typesenseSync } from "typesense-sync";
+const configFilePath = "./typesense.config.json";
 
 const config = {
   configFilePath,
-  shouldSaveSettings: true,
+  shouldSaveSettings: true
 };
 
 typesenseSync(config)
   .then(() => {
-    console.log('Typesense sync completed');
+    console.log("Typesense sync completed");
   })
   .catch((err) => {
-    console.error('An error occurred', err);
+    console.error("An error occurred", err);
     process.exit(1);
   });
-
diff --git a/website/typesense.config.json b/website/typesense.config.json
index 89b40e66a4ef8..249a303dc895e 100644
--- a/website/typesense.config.json
+++ b/website/typesense.config.json
@@ -54,7 +54,7 @@
             "optional": true,
             "sort": false,
             "stem": false,
-              "type": "string",
+            "type": "string",
             "stem_dictionary": "",
             "store": true
           },

From b59c9a25b899223b6633776eeafe2e67fe418640 Mon Sep 17 00:00:00 2001
From: steveduan-IDME <steve.duan@id.me>
Date: Thu, 2 Apr 2026 11:32:25 -0400
Subject: [PATCH 093/326] chore(ci): Add http_server source to semantic PR
 scope list (#25078)

Co-Authored-By: Claude Code
---
 .github/workflows/semantic.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/semantic.yml b/.github/workflows/semantic.yml
index 79a36a94ec7cf..1e134a9f96007 100644
--- a/.github/workflows/semantic.yml
+++ b/.github/workflows/semantic.yml
@@ -160,6 +160,7 @@ jobs:
             heroku_logs source
             host_metrics source
             http_client source
+            http_server source
             http_scrape source
             internal_logs source
             internal_metrics source

From 1a78c93520ab25377b7162c9aa5756f29492f433 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 2 Apr 2026 13:57:21 -0400
Subject: [PATCH 094/326] fix(ci): fix Pulsar TLS integration tests with latest
 image (#25099)

* fix(ci): pin Pulsar integration test image to 4.1.3

The `apachepulsar/pulsar:latest` image moved to a version that breaks
TLS connectivity, causing `pulsar_happy_tls` and
`consumes_event_with_tls` to fail consistently in CI.

Pin to 4.1.3 to unblock the merge queue. Re-enabling `latest` is
tracked in #25096.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add PULSAR_PREFIX_advertisedAddress=pulsar

* fix(ci): revert Pulsar image pin to latest

* Revert to version: latest

* Fix test.yml format

* Delete obsolete comment

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 tests/integration/pulsar/config/compose.yaml | 4 ++++
 tests/integration/pulsar/config/test.yaml    | 4 +---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/integration/pulsar/config/compose.yaml b/tests/integration/pulsar/config/compose.yaml
index 5d6c4e86249f9..58c2b9344fcad 100644
--- a/tests/integration/pulsar/config/compose.yaml
+++ b/tests/integration/pulsar/config/compose.yaml
@@ -8,6 +8,10 @@ services:
       - 6650:6650
       - 6651:6651
     environment:
+      # Since apache/pulsar#25238, standalone mode advertises the container's FQDN
+      # (the container ID) instead of localhost. Set explicitly so TLS hostname
+      # verification matches the certificate's DNS SAN.
+      - PULSAR_PREFIX_advertisedAddress=pulsar
       - PULSAR_PREFIX_brokerServicePortTls=6651
       - PULSAR_PREFIX_tlsKeyFilePath=/etc/pulsar/certs/pulsar.key.pem
       - PULSAR_PREFIX_tlsCertificateFilePath=/etc/pulsar/certs/pulsar.cert.pem
diff --git a/tests/integration/pulsar/config/test.yaml b/tests/integration/pulsar/config/test.yaml
index 51dbb1100c9da..c136bffaaab24 100644
--- a/tests/integration/pulsar/config/test.yaml
+++ b/tests/integration/pulsar/config/test.yaml
@@ -7,9 +7,7 @@ env:
   PULSAR_HOST: pulsar
 
 matrix:
-  # TODO: re-enable `latest` once TLS tests pass with newer Pulsar images.
-  # See https://github.com/vectordotdev/vector/issues/25096
-  version: ["4.1.3"]
+  version: [latest]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch

From dedb9667511691731c30c05235c319867d96580c Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Fri, 3 Apr 2026 11:19:53 -0400
Subject: [PATCH 095/326] fix(ci): pin npm transitive deps via
 package-lock.json and npm ci (#25115)

Replace `npm install -g` (which resolves transitive dependencies live
from the npm registry without a lockfile) with `npm ci` against a
committed package-lock.json. This pins the entire dependency tree for
markdownlint-cli2, prettier, and datadog-ci, closing the supply chain
hole exposed by the axios compromise (2026-03-30).

Changes:
- Add scripts/environment/npm-tools/ with package.json and
  package-lock.json as the single source of truth for npm tool versions
- Replace maybe_install_npm_package with maybe_install_npm_tools using
  npm ci --prefix for deterministic installs from the lockfile
- Use $(npm config get prefix -g)/bin for symlinks instead of
  hardcoded /usr/local/bin to respect npm configuration
- Use sudo for symlinks only when the target dir is not writable
- Verify symlink targets point to our node_modules, not just that
  binaries exist, to prevent stale or system installs from being used
- Early return when no npm tool is requested, so hosts without npm
  are not broken
- Separate cargo and npm caches in CI for cleaner invalidation; npm
  cache keys hash all files in npm-tools/
- Bump datadog-ci to 5.11.0 to resolve critical simple-git RCE
  (GHSA-r275-fr43-pm7q)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/actions/setup/action.yml              |   18 +-
 scripts/environment/Dockerfile                |    1 +
 .../environment/npm-tools/package-lock.json   | 3378 +++++++++++++++++
 scripts/environment/npm-tools/package.json    |    9 +
 scripts/environment/prepare.sh                |   67 +-
 5 files changed, 3449 insertions(+), 24 deletions(-)
 create mode 100644 scripts/environment/npm-tools/package-lock.json
 create mode 100644 scripts/environment/npm-tools/package.json

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index fde57a4b33303..6faa185204ced 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -256,8 +256,8 @@ runs:
       with:
         skip-cache: ${{ env.VDEV_NEEDS_COMPILE == 'true' }}
 
-    - name: Cache prepare.sh binaries
-      id: cache-prepare-binaries
+    - name: Cache cargo binaries
+      id: cache-cargo-binaries
       uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: |
@@ -270,12 +270,16 @@ runs:
           ~/.cargo/bin/cargo-llvm-cov
           ~/.cargo/bin/dd-rust-license-tool
           ~/.cargo/bin/wasm-pack
-          /usr/local/bin/markdownlint-cli2
-          /usr/local/bin/prettier
-          /usr/local/bin/datadog-ci
-        key: ${{ runner.os }}-prepare-binaries-${{ hashFiles('scripts/environment/*') }}
+        key: ${{ runner.os }}-cargo-binaries-${{ hashFiles('scripts/environment/*.sh') }}
         restore-keys: |
-          ${{ runner.os }}-prepare-binaries-
+          ${{ runner.os }}-cargo-binaries-
+
+    - name: Cache npm tools
+      id: cache-npm-tools
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      with:
+        path: scripts/environment/npm-tools/node_modules
+        key: ${{ runner.os }}-npm-tools-${{ hashFiles('scripts/environment/npm-tools/*') }}
 
     - name: Run prepare.sh
       shell: bash
diff --git a/scripts/environment/Dockerfile b/scripts/environment/Dockerfile
index fa7d72075dae6..2798a296dd428 100644
--- a/scripts/environment/Dockerfile
+++ b/scripts/environment/Dockerfile
@@ -16,6 +16,7 @@ WORKDIR /git/vectordotdev/vector
 
 # Setup the env
 COPY scripts/environment/*.sh scripts/environment/
+COPY scripts/environment/npm-tools/ scripts/environment/npm-tools/
 RUN ./scripts/environment/bootstrap-ubuntu-24.04.sh
 
 # Setup the toolchain
diff --git a/scripts/environment/npm-tools/package-lock.json b/scripts/environment/npm-tools/package-lock.json
new file mode 100644
index 0000000000000..e3d4efa122515
--- /dev/null
+++ b/scripts/environment/npm-tools/package-lock.json
@@ -0,0 +1,3378 @@
+{
+  "name": "environment",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "dependencies": {
+        "@datadog/datadog-ci": "5.11.0",
+        "markdownlint-cli2": "0.22.0",
+        "prettier": "3.8.1"
+      }
+    },
+    "node_modules/@antfu/install-pkg": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@antfu/install-pkg/-/install-pkg-1.1.0.tgz",
+      "integrity": "sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==",
+      "license": "MIT",
+      "dependencies": {
+        "package-manager-detector": "^1.3.0",
+        "tinyexec": "^1.0.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/@datadog/datadog-ci": {
+      "version": "5.11.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci/-/datadog-ci-5.11.0.tgz",
+      "integrity": "sha512-4N/WsfnQVYJNxGtDIOhg4sUkZalDo8h+toSXR/GAw6XU81e1bOj3GvleL6IHUQ06KyPdurqPZKB4Za1CbCsT7g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@datadog/datadog-ci-base": "5.11.0",
+        "@datadog/datadog-ci-plugin-coverage": "5.11.0",
+        "@datadog/datadog-ci-plugin-deployment": "5.11.0",
+        "@datadog/datadog-ci-plugin-dora": "5.11.0",
+        "@datadog/datadog-ci-plugin-gate": "5.11.0",
+        "@datadog/datadog-ci-plugin-junit": "5.11.0",
+        "@datadog/datadog-ci-plugin-sarif": "5.11.0",
+        "@datadog/datadog-ci-plugin-sbom": "5.11.0",
+        "clipanion": "3.2.1",
+        "typanion": "3.14.0"
+      },
+      "bin": {
+        "datadog-ci": "dist/cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@datadog/datadog-ci-base": {
+      "version": "5.11.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-base/-/datadog-ci-base-5.11.0.tgz",
+      "integrity": "sha512-NACS6zhf2qidgpgrhQH0EJn4x20pwyRAhw75jBRPmjzheaXrpU0438e3kutyNsDGZrw8gHjuRqiccoY3QU7PSQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@antfu/install-pkg": "1.1.0",
+        "@types/datadog-metrics": "0.6.1",
+        "async-retry": "1.3.1",
+        "axios": "1.13.5",
+        "chalk": "3.0.0",
+        "clipanion": "3.2.1",
+        "datadog-metrics": "0.9.3",
+        "debug": "4.4.1",
+        "deep-extend": "0.6.0",
+        "fast-xml-parser": "5.3.7",
+        "form-data": "4.0.4",
+        "glob": "13.0.5",
+        "inquirer": "8.2.7",
+        "is-docker": "4.0.0",
+        "jest-diff": "30.2.0",
+        "js-yaml": "4.1.1",
+        "jszip": "3.10.1",
+        "proxy-agent": "6.4.0",
+        "semver": "7.6.3",
+        "simple-git": "3.33.0",
+        "terminal-link": "2.1.1",
+        "tiny-async-pool": "2.1.0",
+        "typanion": "3.14.0",
+        "upath": "2.0.1"
+      },
+      "peerDependencies": {
+        "@datadog/datadog-ci-plugin-aas": "5.11.0",
+        "@datadog/datadog-ci-plugin-cloud-run": "5.11.0",
+        "@datadog/datadog-ci-plugin-container-app": "5.11.0",
+        "@datadog/datadog-ci-plugin-coverage": "5.11.0",
+        "@datadog/datadog-ci-plugin-deployment": "5.11.0",
+        "@datadog/datadog-ci-plugin-dora": "5.11.0",
+        "@datadog/datadog-ci-plugin-gate": "5.11.0",
+        "@datadog/datadog-ci-plugin-junit": "5.11.0",
+        "@datadog/datadog-ci-plugin-lambda": "5.11.0",
+        "@datadog/datadog-ci-plugin-sarif": "5.11.0",
+        "@datadog/datadog-ci-plugin-sbom": "5.11.0",
+        "@datadog/datadog-ci-plugin-stepfunctions": "5.11.0",
+        "@datadog/datadog-ci-plugin-synthetics": "5.11.0",
+        "@datadog/datadog-ci-plugin-terraform": "5.11.0"
+      },
+      "peerDependenciesMeta": {
+        "@datadog/datadog-ci-plugin-aas": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-cloud-run": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-container-app": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-coverage": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-deployment": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-dora": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-gate": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-junit": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-lambda": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-sarif": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-sbom": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-stepfunctions": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-synthetics": {
+          "optional": true
+        },
+        "@datadog/datadog-ci-plugin-terraform": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@datadog/datadog-ci-base/node_modules/debug": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.1.tgz",
+      "integrity": "sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@datadog/datadog-ci-plugin-coverage": {
+      "version": "5.11.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-coverage/-/datadog-ci-plugin-coverage-5.11.0.tgz",
+      "integrity": "sha512-aKzkjbd/NVt+7Sd4QL0qVqUrnyMG0UF63lvNxve7suWQDoIWowAgCPa0ta+jpMYUYCGtjt74H3wL+q0W0G+D+Q==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "chalk": "3.0.0",
+        "fast-xml-parser": "5.3.7",
+        "form-data": "4.0.4",
+        "upath": "2.0.1"
+      },
+      "peerDependencies": {
+        "@datadog/datadog-ci-base": "5.11.0"
+      }
+    },
+    "node_modules/@datadog/datadog-ci-plugin-deployment": {
+      "version": "5.11.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-deployment/-/datadog-ci-plugin-deployment-5.11.0.tgz",
+      "integrity": "sha512-FF9L7alDz1XN5L3nYR7xMeZd99U6kxkT+InSyZY21ZHpcuuEngseW1aMgB0iFn3lxZ+1H4z196uCckViTEkjog==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "axios": "1.13.5",
+        "chalk": "3.0.0",
+        "simple-git": "3.33.0"
+      },
+      "peerDependencies": {
+        "@datadog/datadog-ci-base": "5.11.0"
+      }
+    },
+    "node_modules/@datadog/datadog-ci-plugin-dora": {
+      "version": "5.11.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-dora/-/datadog-ci-plugin-dora-5.11.0.tgz",
+      "integrity": "sha512-DWSyT2tW23XOYCvTEHvD/F9FRIffTN+2wZGYojaD1LM9wJew4xievziBwyD46quCF0OdsbGMLvAyR2hyrrYeZA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "chalk": "3.0.0",
+        "simple-git": "3.33.0"
+      },
+      "peerDependencies": {
+        "@datadog/datadog-ci-base": "5.11.0"
+      }
+    },
+    "node_modules/@datadog/datadog-ci-plugin-gate": {
+      "version": "5.11.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-gate/-/datadog-ci-plugin-gate-5.11.0.tgz",
+      "integrity": "sha512-WUNr6y292eH+sumAyD5rFhqlU/aJ8vN74h4EJj0SqDpnrDCzMnSDgRyb9GXhv8ZO4GOW6LTEcPmMZhyfYL3b5g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/uuid": "9.0.8",
+        "chalk": "3.0.0",
+        "uuid": "9.0.1"
+      },
+      "peerDependencies": {
+        "@datadog/datadog-ci-base": "5.11.0"
+      }
+    },
+    "node_modules/@datadog/datadog-ci-plugin-junit": {
+      "version": "5.11.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-junit/-/datadog-ci-plugin-junit-5.11.0.tgz",
+      "integrity": "sha512-I8H09jNR/LDYqiy7TOKv9Gu4+t/o0J6QH6cooKrNboULSDYijVo6w3knANsd2m3Hlcbi1QkTmNpPXIdeGR5Dig==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "chalk": "3.0.0",
+        "fast-xml-parser": "5.3.7",
+        "form-data": "4.0.4",
+        "upath": "2.0.1",
+        "uuid": "9.0.1"
+      },
+      "peerDependencies": {
+        "@datadog/datadog-ci-base": "5.11.0"
+      }
+    },
+    "node_modules/@datadog/datadog-ci-plugin-sarif": {
+      "version": "5.11.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-sarif/-/datadog-ci-plugin-sarif-5.11.0.tgz",
+      "integrity": "sha512-JZuqNzFsW9BZeStLM60f5zdEpG67kh7xqgbeJhqIcloEpDJIEmsJHH487PM0stakcqhhIfzUzvEW744LLQg5Ug==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "ajv": "8.18.0",
+        "ajv-formats": "3.0.1",
+        "chalk": "3.0.0",
+        "form-data": "4.0.4",
+        "upath": "2.0.1",
+        "uuid": "9.0.1"
+      },
+      "peerDependencies": {
+        "@datadog/datadog-ci-base": "5.11.0"
+      }
+    },
+    "node_modules/@datadog/datadog-ci-plugin-sbom": {
+      "version": "5.11.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-sbom/-/datadog-ci-plugin-sbom-5.11.0.tgz",
+      "integrity": "sha512-lHU65a1Hru7SiwhZtZ9OTd6vyPcRG2U/61imVpvLvhEMSwY2xSLTtZfxWbMi4VJxq81V2zhdifxP5BMJO1FnHw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "ajv": "8.18.0",
+        "ajv-formats": "3.0.1",
+        "axios": "1.13.5",
+        "chalk": "3.0.0",
+        "packageurl-js": "2.0.1"
+      },
+      "peerDependencies": {
+        "@datadog/datadog-ci-base": "5.11.0"
+      }
+    },
+    "node_modules/@inquirer/external-editor": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/@inquirer/external-editor/-/external-editor-1.0.3.tgz",
+      "integrity": "sha512-RWbSrDiYmO4LbejWY7ttpxczuwQyZLBUyygsA9Nsv95hpzUWwnNTVQmAq3xuh7vNwCp07UTmE5i11XAEExx4RA==",
+      "license": "MIT",
+      "dependencies": {
+        "chardet": "^2.1.1",
+        "iconv-lite": "^0.7.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@types/node": ">=18"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@jest/diff-sequences": {
+      "version": "30.0.1",
+      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.0.1.tgz",
+      "integrity": "sha512-n5H8QLDJ47QqbCNn5SuFjCRDrOLEZ0h8vAHCK5RL9Ls7Xa8AQLa/YxAc9UjFqoEDM48muwtBGjtMY5cr0PLDCw==",
+      "license": "MIT",
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/get-type": {
+      "version": "30.1.0",
+      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.1.0.tgz",
+      "integrity": "sha512-eMbZE2hUnx1WV0pmURZY9XoXPkUYjpc55mb0CrhtdWLtzMQPFvu/rZkTLZFTsdaVQa+Tr4eWAteqcUzoawq/uA==",
+      "license": "MIT",
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/schemas": {
+      "version": "30.0.5",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
+      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
+      "license": "MIT",
+      "dependencies": {
+        "@sinclair/typebox": "^0.34.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@kwsites/file-exists": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@kwsites/file-exists/-/file-exists-1.1.1.tgz",
+      "integrity": "sha512-m9/5YGR18lIwxSFDwfE3oA7bWuq9kdau6ugN4H2rJeyhFQZcG9AgSHkQtSD15a8WvTgfz9aikZMrKPHvbpqFiw==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.1.1"
+      }
+    },
+    "node_modules/@kwsites/promise-deferred": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@kwsites/promise-deferred/-/promise-deferred-1.1.1.tgz",
+      "integrity": "sha512-GaHYm+c0O9MjZRu0ongGBRbinu8gVAMd2UZjji6jVmqKtZluZnptXGWhz1E8j8D2HJ3f/yMxKAUC0b+57wncIw==",
+      "license": "MIT"
+    },
+    "node_modules/@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@sinclair/typebox": {
+      "version": "0.34.49",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.49.tgz",
+      "integrity": "sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A==",
+      "license": "MIT"
+    },
+    "node_modules/@sindresorhus/merge-streams": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@sindresorhus/merge-streams/-/merge-streams-4.0.0.tgz",
+      "integrity": "sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@tootallnate/quickjs-emscripten": {
+      "version": "0.23.0",
+      "resolved": "https://registry.npmjs.org/@tootallnate/quickjs-emscripten/-/quickjs-emscripten-0.23.0.tgz",
+      "integrity": "sha512-C5Mc6rdnsaJDjO3UpGW/CQTHtCKaYlScZTly4JIu97Jxo/odCiH0ITnDXSJPTOrEKk/ycSZ0AOgTmkDtkOsvIA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/datadog-metrics": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/@types/datadog-metrics/-/datadog-metrics-0.6.1.tgz",
+      "integrity": "sha512-p6zVpfmNcXwtcXjgpz7do/fKyfndGhU5sGJVtb5Gn5PvLDiQUAgD0mI/itf/99sBi9DRxeyhFQ9dQF6OxxQNbA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/debug": {
+      "version": "4.1.13",
+      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
+      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/ms": "*"
+      }
+    },
+    "node_modules/@types/katex": {
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@types/katex/-/katex-0.16.8.tgz",
+      "integrity": "sha512-trgaNyfU+Xh2Tc+ABIb44a5AYUpicB3uwirOioeOkNPPbmgRNtcWyDeeFRzjPZENO9Vq8gvVqfhaaXWLlevVwg==",
+      "license": "MIT"
+    },
+    "node_modules/@types/ms": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
+      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/unist": {
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-2.0.11.tgz",
+      "integrity": "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==",
+      "license": "MIT"
+    },
+    "node_modules/@types/uuid": {
+      "version": "9.0.8",
+      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-9.0.8.tgz",
+      "integrity": "sha512-jg+97EGIcY9AGHJJRaaPVgetKDsrTgbRjQ5Msgjh/DQKEFl0DtyRr/VCOyD1T2R1MNeWPK/u7JoGhlDZnKBAfA==",
+      "license": "MIT"
+    },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
+      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-formats": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
+      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ansi-escapes": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
+      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+      "license": "MIT",
+      "dependencies": {
+        "type-fest": "^0.21.3"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "license": "Python-2.0"
+    },
+    "node_modules/ast-types": {
+      "version": "0.13.4",
+      "resolved": "https://registry.npmjs.org/ast-types/-/ast-types-0.13.4.tgz",
+      "integrity": "sha512-x1FCFnFifvYDDzTaLII71vG5uvDwgtmDTEVWAxrgeiR8VjMONcCXJx7E+USjDtHlwFmt9MysbqgF9b9Vjr6w+w==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/async-retry": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/async-retry/-/async-retry-1.3.1.tgz",
+      "integrity": "sha512-aiieFW/7h3hY0Bq5d+ktDBejxuwR78vRu9hDUdR8rNhSaQ29VzPL4AoIRG7D/c7tdenwOcKvgPM6tIxB3cB6HA==",
+      "license": "MIT",
+      "dependencies": {
+        "retry": "0.12.0"
+      }
+    },
+    "node_modules/asynckit": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
+      "license": "MIT"
+    },
+    "node_modules/axios": {
+      "version": "1.13.5",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.5.tgz",
+      "integrity": "sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==",
+      "license": "MIT",
+      "dependencies": {
+        "follow-redirects": "^1.15.11",
+        "form-data": "^4.0.5",
+        "proxy-from-env": "^1.1.0"
+      }
+    },
+    "node_modules/axios/node_modules/form-data": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
+      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "license": "MIT",
+      "dependencies": {
+        "asynckit": "^0.4.0",
+        "combined-stream": "^1.0.8",
+        "es-set-tostringtag": "^2.1.0",
+        "hasown": "^2.0.2",
+        "mime-types": "^2.1.12"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/basic-ftp": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.0.tgz",
+      "integrity": "sha512-VoMINM2rqJwJgfdHq6RiUudKt2BV+FY5ZFezP/ypmwayk68+NzzAQy4XXLlqsGD4MCzq3DrmNFD/uUmBJuGoXw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/bignumber.js": {
+      "version": "9.3.1",
+      "resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-9.3.1.tgz",
+      "integrity": "sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ==",
+      "license": "MIT",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      }
+    },
+    "node_modules/bl/node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/brace-expansion": {
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
+      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/braces": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+      "license": "MIT",
+      "dependencies": {
+        "fill-range": "^7.1.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/chalk": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-3.0.0.tgz",
+      "integrity": "sha512-4D3B6Wf41KOYRFdszmDqMCGq5VV/uMAB273JILmO+3jAlh8X4qDtdtgCR3fxtbLEMzSx22QdhnDcJvu2u1fVwg==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/character-entities": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
+      "integrity": "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-entities-legacy": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-3.0.0.tgz",
+      "integrity": "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-reference-invalid": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/character-reference-invalid/-/character-reference-invalid-2.0.1.tgz",
+      "integrity": "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/chardet": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/chardet/-/chardet-2.1.1.tgz",
+      "integrity": "sha512-PsezH1rqdV9VvyNhxxOW32/d75r01NY7TQCmOqomRo15ZSOKbpTFVsfjghxo6JloQUCGnH4k1LGu0R4yCLlWQQ==",
+      "license": "MIT"
+    },
+    "node_modules/cli-cursor": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-3.1.0.tgz",
+      "integrity": "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==",
+      "license": "MIT",
+      "dependencies": {
+        "restore-cursor": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cli-spinners": {
+      "version": "2.9.2",
+      "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-2.9.2.tgz",
+      "integrity": "sha512-ywqV+5MmyL4E7ybXgKys4DugZbX0FC6LnwrhjuykIjnK9k8OQacQ7axGKnjDXWNhns0xot3bZI5h55H8yo9cJg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/cli-width": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/cli-width/-/cli-width-3.0.0.tgz",
+      "integrity": "sha512-FxqpkPPwu1HjuN93Omfm4h8uIanXofW0RxVEW3k5RKx+mJJYSthzNhp32Kzxxy3YAEZ/Dc/EWN1vZRY0+kOhbw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/clipanion": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/clipanion/-/clipanion-3.2.1.tgz",
+      "integrity": "sha512-dYFdjLb7y1ajfxQopN05mylEpK9ZX0sO1/RfMXdfmwjlIsPkbh4p7A682x++zFPLDCo1x3p82dtljHf5cW2LKA==",
+      "license": "MIT",
+      "workspaces": [
+        "website"
+      ],
+      "dependencies": {
+        "typanion": "^3.8.0"
+      },
+      "peerDependencies": {
+        "typanion": "*"
+      }
+    },
+    "node_modules/clone": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/clone/-/clone-1.0.4.tgz",
+      "integrity": "sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "license": "MIT"
+    },
+    "node_modules/combined-stream": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
+      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "license": "MIT",
+      "dependencies": {
+        "delayed-stream": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/commander": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
+      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/core-util-is": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
+      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
+      "license": "MIT"
+    },
+    "node_modules/data-uri-to-buffer": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-6.0.2.tgz",
+      "integrity": "sha512-7hvf7/GW8e86rW0ptuwS3OcBGDjIi6SZva7hCyWC0yYry2cOPmLIjXAUHI6DK2HsnwJd9ifmt57i8eV2n4YNpw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/datadog-metrics": {
+      "version": "0.9.3",
+      "resolved": "https://registry.npmjs.org/datadog-metrics/-/datadog-metrics-0.9.3.tgz",
+      "integrity": "sha512-BVsBX2t+4yA3tHs7DnB5H01cHVNiGJ/bHA8y6JppJDyXG7s2DLm6JaozPGpgsgVGd42Is1CHRG/yMDQpt877Xg==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "3.1.0",
+        "dogapi": "2.8.4"
+      }
+    },
+    "node_modules/datadog-metrics/node_modules/debug": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-3.1.0.tgz",
+      "integrity": "sha512-OX8XqP7/1a9cqkxYw2yXss15f26NKWBpDXQd0/uK/KPqdQhxbPa994hnzjcE2VqQpDslf55723cKPUOGSmMY3g==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/datadog-metrics/node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "license": "MIT"
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/decode-named-character-reference": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
+      "integrity": "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==",
+      "license": "MIT",
+      "dependencies": {
+        "character-entities": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/defaults": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/defaults/-/defaults-1.0.4.tgz",
+      "integrity": "sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==",
+      "license": "MIT",
+      "dependencies": {
+        "clone": "^1.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/degenerator": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/degenerator/-/degenerator-5.0.1.tgz",
+      "integrity": "sha512-TllpMR/t0M5sqCXfj85i4XaAzxmS5tVA16dqvdkMwGmzI+dXLXnw3J+3Vdv7VKw+ThlTMboK6i9rnZ6Nntj5CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ast-types": "^0.13.4",
+        "escodegen": "^2.1.0",
+        "esprima": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/delayed-stream": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/dequal": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
+      "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/devlop": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
+      "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
+      "license": "MIT",
+      "dependencies": {
+        "dequal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/dogapi": {
+      "version": "2.8.4",
+      "resolved": "https://registry.npmjs.org/dogapi/-/dogapi-2.8.4.tgz",
+      "integrity": "sha512-065fsvu5dB0o4+ENtLjZILvXMClDNH/yA9H6L8nsdcNiz9l0Hzpn7aQaCOPYXxqyzq4CRPOdwkFXUjDOXfRGbg==",
+      "license": "MIT",
+      "dependencies": {
+        "extend": "^3.0.2",
+        "json-bigint": "^1.0.0",
+        "lodash": "^4.17.21",
+        "minimist": "^1.2.5",
+        "rc": "^1.2.8"
+      },
+      "bin": {
+        "dogapi": "bin/dogapi"
+      }
+    },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "license": "MIT"
+    },
+    "node_modules/entities": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-set-tostringtag": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
+      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.6",
+        "has-tostringtag": "^1.0.2",
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/escape-string-regexp": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
+      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/escodegen": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/escodegen/-/escodegen-2.1.0.tgz",
+      "integrity": "sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w==",
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "esprima": "^4.0.1",
+        "estraverse": "^5.2.0",
+        "esutils": "^2.0.2"
+      },
+      "bin": {
+        "escodegen": "bin/escodegen.js",
+        "esgenerate": "bin/esgenerate.js"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "optionalDependencies": {
+        "source-map": "~0.6.1"
+      }
+    },
+    "node_modules/esprima": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
+      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
+      "license": "BSD-2-Clause",
+      "bin": {
+        "esparse": "bin/esparse.js",
+        "esvalidate": "bin/esvalidate.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/extend": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
+      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
+      "license": "MIT"
+    },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "license": "MIT"
+    },
+    "node_modules/fast-glob": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
+      "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==",
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "^2.0.2",
+        "@nodelib/fs.walk": "^1.2.3",
+        "glob-parent": "^5.1.2",
+        "merge2": "^1.3.0",
+        "micromatch": "^4.0.8"
+      },
+      "engines": {
+        "node": ">=8.6.0"
+      }
+    },
+    "node_modules/fast-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
+      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/fast-xml-parser": {
+      "version": "5.3.7",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.7.tgz",
+      "integrity": "sha512-JzVLro9NQv92pOM/jTCR6mHlJh2FGwtomH8ZQjhFj/R29P2Fnj38OgPJVtcvYw6SuKClhgYuwUZf5b3rd8u2mA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "strnum": "^2.1.2"
+      },
+      "bin": {
+        "fxparser": "src/cli/cli.js"
+      }
+    },
+    "node_modules/fastq": {
+      "version": "1.20.1",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
+      "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==",
+      "license": "ISC",
+      "dependencies": {
+        "reusify": "^1.0.4"
+      }
+    },
+    "node_modules/figures": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/figures/-/figures-3.2.0.tgz",
+      "integrity": "sha512-yaduQFRKLXYOGgEn6AZau90j3ggSOyiqXU0F9JZfeXYhNa+Jk4X+s45A2zg5jns87GAFa34BBm2kXw4XpNcbdg==",
+      "license": "MIT",
+      "dependencies": {
+        "escape-string-regexp": "^1.0.5"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/fill-range": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+      "license": "MIT",
+      "dependencies": {
+        "to-regex-range": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/follow-redirects": {
+      "version": "1.15.11",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz",
+      "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/RubenVerborgh"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=4.0"
+      },
+      "peerDependenciesMeta": {
+        "debug": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/form-data": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
+      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
+      "license": "MIT",
+      "dependencies": {
+        "asynckit": "^0.4.0",
+        "combined-stream": "^1.0.8",
+        "es-set-tostringtag": "^2.1.0",
+        "hasown": "^2.0.2",
+        "mime-types": "^2.1.12"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-east-asian-width": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.5.0.tgz",
+      "integrity": "sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/get-uri": {
+      "version": "6.0.5",
+      "resolved": "https://registry.npmjs.org/get-uri/-/get-uri-6.0.5.tgz",
+      "integrity": "sha512-b1O07XYq8eRuVzBNgJLstU6FYc1tS6wnMtF1I1D9lE8LxZSOGZ7LhxN54yPP6mGw5f2CkXY2BQUL9Fx41qvcIg==",
+      "license": "MIT",
+      "dependencies": {
+        "basic-ftp": "^5.0.2",
+        "data-uri-to-buffer": "^6.0.2",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/glob": {
+      "version": "13.0.5",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.5.tgz",
+      "integrity": "sha512-BzXxZg24Ibra1pbQ/zE7Kys4Ua1ks7Bn6pKLkVPZ9FZe4JQS6/Q7ef3LG1H+k7lUf5l4T3PLSyYyYJVYUvfgTw==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.1",
+        "minipass": "^7.1.2",
+        "path-scurry": "^2.0.0"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/globby": {
+      "version": "16.1.1",
+      "resolved": "https://registry.npmjs.org/globby/-/globby-16.1.1.tgz",
+      "integrity": "sha512-dW7vl+yiAJSp6aCekaVnVJxurRv7DCOLyXqEG3RYMYUg7AuJ2jCqPkZTA8ooqC2vtnkaMcV5WfFBMuEnTu1OQg==",
+      "license": "MIT",
+      "dependencies": {
+        "@sindresorhus/merge-streams": "^4.0.0",
+        "fast-glob": "^3.3.3",
+        "ignore": "^7.0.5",
+        "is-path-inside": "^4.0.0",
+        "slash": "^5.1.0",
+        "unicorn-magic": "^0.4.0"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-tostringtag": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
+      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
+      "license": "MIT",
+      "dependencies": {
+        "has-symbols": "^1.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
+      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/ignore": {
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/immediate": {
+      "version": "3.0.6",
+      "resolved": "https://registry.npmjs.org/immediate/-/immediate-3.0.6.tgz",
+      "integrity": "sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ==",
+      "license": "MIT"
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "license": "ISC"
+    },
+    "node_modules/inquirer": {
+      "version": "8.2.7",
+      "resolved": "https://registry.npmjs.org/inquirer/-/inquirer-8.2.7.tgz",
+      "integrity": "sha512-UjOaSel/iddGZJ5xP/Eixh6dY1XghiBw4XK13rCCIJcJfyhhoul/7KhLLUGtebEj6GDYM6Vnx/mVsjx2L/mFIA==",
+      "license": "MIT",
+      "dependencies": {
+        "@inquirer/external-editor": "^1.0.0",
+        "ansi-escapes": "^4.2.1",
+        "chalk": "^4.1.1",
+        "cli-cursor": "^3.1.0",
+        "cli-width": "^3.0.0",
+        "figures": "^3.0.0",
+        "lodash": "^4.17.21",
+        "mute-stream": "0.0.8",
+        "ora": "^5.4.1",
+        "run-async": "^2.4.0",
+        "rxjs": "^7.5.5",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0",
+        "through": "^2.3.6",
+        "wrap-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/inquirer/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/ip-address": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
+      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/is-alphabetical": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-alphabetical/-/is-alphabetical-2.0.1.tgz",
+      "integrity": "sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-alphanumerical": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-alphanumerical/-/is-alphanumerical-2.0.1.tgz",
+      "integrity": "sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw==",
+      "license": "MIT",
+      "dependencies": {
+        "is-alphabetical": "^2.0.0",
+        "is-decimal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-decimal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-decimal/-/is-decimal-2.0.1.tgz",
+      "integrity": "sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-docker": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-4.0.0.tgz",
+      "integrity": "sha512-LHE+wROyG/Y/0ZnbktRCoTix2c1RhgWaZraMZ8o1Q7zCh0VSrICJQO5oqIIISrcSBtrXv0o233w1IYwsWCjTzA==",
+      "license": "MIT",
+      "bin": {
+        "is-docker": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "license": "MIT",
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-hexadecimal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-hexadecimal/-/is-hexadecimal-2.0.1.tgz",
+      "integrity": "sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-interactive": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-interactive/-/is-interactive-1.0.0.tgz",
+      "integrity": "sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
+    "node_modules/is-path-inside": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/is-path-inside/-/is-path-inside-4.0.0.tgz",
+      "integrity": "sha512-lJJV/5dYS+RcL8uQdBDW9c9uWFLLBNRyFhnAKXw5tVqLlKZ4RMGZKv+YQ/IA3OhD+RpbJa1LLFM1FQPGyIXvOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/is-unicode-supported": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz",
+      "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/isarray": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
+      "license": "MIT"
+    },
+    "node_modules/jest-diff": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.2.0.tgz",
+      "integrity": "sha512-dQHFo3Pt4/NLlG5z4PxZ/3yZTZ1C7s9hveiOj+GCN+uT109NC2QgsoVZsVOAvbJ3RgKkvyLGXZV9+piDpWbm6A==",
+      "license": "MIT",
+      "dependencies": {
+        "@jest/diff-sequences": "30.0.1",
+        "@jest/get-type": "30.1.0",
+        "chalk": "^4.1.2",
+        "pretty-format": "30.2.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-diff/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/js-yaml": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/json-bigint": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-bigint/-/json-bigint-1.0.0.tgz",
+      "integrity": "sha512-SiPv/8VpZuWbvLSMtTDU8hEfrZWg/mH/nV/b4o0CYbSxu1UIQPLdwKOCIyLQX+VIPO5vrLX3i8qtqFyhdPSUSQ==",
+      "license": "MIT",
+      "dependencies": {
+        "bignumber.js": "^9.0.0"
+      }
+    },
+    "node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "license": "MIT"
+    },
+    "node_modules/jsonc-parser": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
+      "integrity": "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==",
+      "license": "MIT"
+    },
+    "node_modules/jsonpointer": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/jsonpointer/-/jsonpointer-5.0.1.tgz",
+      "integrity": "sha512-p/nXbhSEcu3pZRdkW1OfJhpsVtW1gd4Wa1fnQc9YLiTfAjn0312eMKimbdIQzuZl9aa9xUGaRlP9T/CJE/ditQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/jszip": {
+      "version": "3.10.1",
+      "resolved": "https://registry.npmjs.org/jszip/-/jszip-3.10.1.tgz",
+      "integrity": "sha512-xXDvecyTpGLrqFrvkrUSoxxfJI5AH7U8zxxtVclpsUtMCq4JQ290LY8AW5c7Ggnr/Y/oK+bQMbqK2qmtk3pN4g==",
+      "license": "(MIT OR GPL-3.0-or-later)",
+      "dependencies": {
+        "lie": "~3.3.0",
+        "pako": "~1.0.2",
+        "readable-stream": "~2.3.6",
+        "setimmediate": "^1.0.5"
+      }
+    },
+    "node_modules/katex": {
+      "version": "0.16.44",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.44.tgz",
+      "integrity": "sha512-EkxoDTk8ufHqHlf9QxGwcxeLkWRR3iOuYfRpfORgYfqc8s13bgb+YtRY59NK5ZpRaCwq1kqA6a5lpX8C/eLphQ==",
+      "funding": [
+        "https://opencollective.com/katex",
+        "https://github.com/sponsors/katex"
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "commander": "^8.3.0"
+      },
+      "bin": {
+        "katex": "cli.js"
+      }
+    },
+    "node_modules/lie": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/lie/-/lie-3.3.0.tgz",
+      "integrity": "sha512-UaiMJzeWRlEujzAuw5LokY1L5ecNQYZKfmyZ9L7wDHb/p5etKaxXhohBcrw0EYby+G/NA52vRSN4N39dxHAIwQ==",
+      "license": "MIT",
+      "dependencies": {
+        "immediate": "~3.0.5"
+      }
+    },
+    "node_modules/linkify-it": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.0.tgz",
+      "integrity": "sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ==",
+      "license": "MIT",
+      "dependencies": {
+        "uc.micro": "^2.0.0"
+      }
+    },
+    "node_modules/lodash": {
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
+      "license": "MIT"
+    },
+    "node_modules/log-symbols": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz",
+      "integrity": "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==",
+      "license": "MIT",
+      "dependencies": {
+        "chalk": "^4.1.0",
+        "is-unicode-supported": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/log-symbols/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/lru-cache": {
+      "version": "11.2.7",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.7.tgz",
+      "integrity": "sha512-aY/R+aEsRelme17KGQa/1ZSIpLpNYYrhcrepKTZgE+W3WM16YMCaPwOHLHsmopZHELU0Ojin1lPVxKR0MihncA==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/markdown-it": {
+      "version": "14.1.1",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.1.tgz",
+      "integrity": "sha512-BuU2qnTti9YKgK5N+IeMubp14ZUKUUw7yeJbkjtosvHiP0AZ5c8IAgEMk79D0eC8F23r4Ac/q8cAIFdm2FtyoA==",
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1",
+        "entities": "^4.4.0",
+        "linkify-it": "^5.0.0",
+        "mdurl": "^2.0.0",
+        "punycode.js": "^2.3.1",
+        "uc.micro": "^2.1.0"
+      },
+      "bin": {
+        "markdown-it": "bin/markdown-it.mjs"
+      }
+    },
+    "node_modules/markdownlint": {
+      "version": "0.40.0",
+      "resolved": "https://registry.npmjs.org/markdownlint/-/markdownlint-0.40.0.tgz",
+      "integrity": "sha512-UKybllYNheWac61Ia7T6fzuQNDZimFIpCg2w6hHjgV1Qu0w1TV0LlSgryUGzM0bkKQCBhy2FDhEELB73Kb0kAg==",
+      "license": "MIT",
+      "dependencies": {
+        "micromark": "4.0.2",
+        "micromark-core-commonmark": "2.0.3",
+        "micromark-extension-directive": "4.0.0",
+        "micromark-extension-gfm-autolink-literal": "2.1.0",
+        "micromark-extension-gfm-footnote": "2.1.0",
+        "micromark-extension-gfm-table": "2.1.1",
+        "micromark-extension-math": "3.1.0",
+        "micromark-util-types": "2.0.2",
+        "string-width": "8.1.0"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/DavidAnson"
+      }
+    },
+    "node_modules/markdownlint-cli2": {
+      "version": "0.22.0",
+      "resolved": "https://registry.npmjs.org/markdownlint-cli2/-/markdownlint-cli2-0.22.0.tgz",
+      "integrity": "sha512-mOC9BY/XGtdX3M9n3AgERd79F0+S7w18yBBTNIQ453sI87etZfp1z4eajqSMV70CYjbxKe5ktKvT2HCpvcWx9w==",
+      "license": "MIT",
+      "dependencies": {
+        "globby": "16.1.1",
+        "js-yaml": "4.1.1",
+        "jsonc-parser": "3.3.1",
+        "jsonpointer": "5.0.1",
+        "markdown-it": "14.1.1",
+        "markdownlint": "0.40.0",
+        "markdownlint-cli2-formatter-default": "0.0.6",
+        "micromatch": "4.0.8",
+        "smol-toml": "1.6.0"
+      },
+      "bin": {
+        "markdownlint-cli2": "markdownlint-cli2-bin.mjs"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/DavidAnson"
+      }
+    },
+    "node_modules/markdownlint-cli2-formatter-default": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/markdownlint-cli2-formatter-default/-/markdownlint-cli2-formatter-default-0.0.6.tgz",
+      "integrity": "sha512-VVDGKsq9sgzu378swJ0fcHfSicUnMxnL8gnLm/Q4J/xsNJ4e5bA6lvAz7PCzIl0/No0lHyaWdqVD2jotxOSFMQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/DavidAnson"
+      },
+      "peerDependencies": {
+        "markdownlint-cli2": ">=0.0.4"
+      }
+    },
+    "node_modules/markdownlint/node_modules/ansi-regex": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
+      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+      }
+    },
+    "node_modules/markdownlint/node_modules/string-width": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-8.1.0.tgz",
+      "integrity": "sha512-Kxl3KJGb/gxkaUMOjRsQ8IrXiGW75O4E3RPjFIINOVH8AMl2SQ/yWdTzWwF3FevIX9LcMAjJW+GRwAlAbTSXdg==",
+      "license": "MIT",
+      "dependencies": {
+        "get-east-asian-width": "^1.3.0",
+        "strip-ansi": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/markdownlint/node_modules/strip-ansi": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^6.2.2"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+      }
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/mdurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-2.0.0.tgz",
+      "integrity": "sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w==",
+      "license": "MIT"
+    },
+    "node_modules/merge2": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/micromark": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/micromark/-/micromark-4.0.2.tgz",
+      "integrity": "sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@types/debug": "^4.0.0",
+        "debug": "^4.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-core-commonmark": "^2.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-combine-extensions": "^2.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-encode": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-subtokenize": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-core-commonmark": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/micromark-core-commonmark/-/micromark-core-commonmark-2.0.3.tgz",
+      "integrity": "sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-factory-destination": "^2.0.0",
+        "micromark-factory-label": "^2.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-factory-title": "^2.0.0",
+        "micromark-factory-whitespace": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-classify-character": "^2.0.0",
+        "micromark-util-html-tag-name": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-subtokenize": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-extension-directive": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-directive/-/micromark-extension-directive-4.0.0.tgz",
+      "integrity": "sha512-/C2nqVmXXmiseSSuCdItCMho7ybwwop6RrrRPk0KbOHW21JKoCldC+8rFOaundDoRBUWBnJJcxeA/Kvi34WQXg==",
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-factory-whitespace": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0",
+        "parse-entities": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-autolink-literal": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-autolink-literal/-/micromark-extension-gfm-autolink-literal-2.1.0.tgz",
+      "integrity": "sha512-oOg7knzhicgQ3t4QCjCWgTmfNhvQbDDnJeVu9v81r7NltNCVmhPy1fJRX27pISafdjL+SVc4d3l48Gb6pbRypw==",
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-footnote": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-footnote/-/micromark-extension-gfm-footnote-2.1.0.tgz",
+      "integrity": "sha512-/yPhxI1ntnDNsiHtzLKYnE3vf9JZ6cAisqVDauhp4CEHxlb4uoOTxOCJ+9s51bIB8U1N1FJ1RXOKTIlD5B/gqw==",
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-core-commonmark": "^2.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-table": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-table/-/micromark-extension-gfm-table-2.1.1.tgz",
+      "integrity": "sha512-t2OU/dXXioARrC6yWfJ4hqB7rct14e8f7m0cbI5hUmDyyIlwv5vEtooptH8INkbLzOatzKuVbQmAYcbWoyz6Dg==",
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-math": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-math/-/micromark-extension-math-3.1.0.tgz",
+      "integrity": "sha512-lvEqd+fHjATVs+2v/8kg9i5Q0AP2k85H0WUOwpIVvUML8BapsMvh1XAogmQjOCsLpoKRCVQqEkQBB3NhVBcsOg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/katex": "^0.16.0",
+        "devlop": "^1.0.0",
+        "katex": "^0.16.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-factory-destination": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-destination/-/micromark-factory-destination-2.0.1.tgz",
+      "integrity": "sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-label": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-label/-/micromark-factory-label-2.0.1.tgz",
+      "integrity": "sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-space": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-space/-/micromark-factory-space-2.0.1.tgz",
+      "integrity": "sha512-zRkxjtBxxLd2Sc0d+fbnEunsTj46SWXgXciZmHq0kDYGnck/ZSGj9/wULTV95uoeYiK5hRXP2mJ98Uo4cq/LQg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-title": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-title/-/micromark-factory-title-2.0.1.tgz",
+      "integrity": "sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-whitespace": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.1.tgz",
+      "integrity": "sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-character": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.1.1.tgz",
+      "integrity": "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-chunked": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-chunked/-/micromark-util-chunked-2.0.1.tgz",
+      "integrity": "sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-classify-character": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-classify-character/-/micromark-util-classify-character-2.0.1.tgz",
+      "integrity": "sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-combine-extensions": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.1.tgz",
+      "integrity": "sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-decode-numeric-character-reference": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.2.tgz",
+      "integrity": "sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-encode": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz",
+      "integrity": "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/micromark-util-html-tag-name": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.1.tgz",
+      "integrity": "sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/micromark-util-normalize-identifier": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.1.tgz",
+      "integrity": "sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-resolve-all": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.1.tgz",
+      "integrity": "sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-sanitize-uri": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz",
+      "integrity": "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-encode": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-subtokenize": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-util-subtokenize/-/micromark-util-subtokenize-2.1.0.tgz",
+      "integrity": "sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-symbol": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz",
+      "integrity": "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/micromark-util-types": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.2.tgz",
+      "integrity": "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/micromatch": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+      "license": "MIT",
+      "dependencies": {
+        "braces": "^3.0.3",
+        "picomatch": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=8.6"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mimic-fn": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
+      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.5"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
+    "node_modules/mute-stream": {
+      "version": "0.0.8",
+      "resolved": "https://registry.npmjs.org/mute-stream/-/mute-stream-0.0.8.tgz",
+      "integrity": "sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA==",
+      "license": "ISC"
+    },
+    "node_modules/netmask": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/netmask/-/netmask-2.0.2.tgz",
+      "integrity": "sha512-dBpDMdxv9Irdq66304OLfEmQ9tbNRFnFTuZiLo+bD+r332bBmMJ8GBLXklIXXgxd3+v9+KUnZaUR5PJMa75Gsg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/onetime": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
+      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
+      "license": "MIT",
+      "dependencies": {
+        "mimic-fn": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/ora": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/ora/-/ora-5.4.1.tgz",
+      "integrity": "sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==",
+      "license": "MIT",
+      "dependencies": {
+        "bl": "^4.1.0",
+        "chalk": "^4.1.0",
+        "cli-cursor": "^3.1.0",
+        "cli-spinners": "^2.5.0",
+        "is-interactive": "^1.0.0",
+        "is-unicode-supported": "^0.1.0",
+        "log-symbols": "^4.1.0",
+        "strip-ansi": "^6.0.0",
+        "wcwidth": "^1.0.1"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/ora/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/pac-proxy-agent": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/pac-proxy-agent/-/pac-proxy-agent-7.2.0.tgz",
+      "integrity": "sha512-TEB8ESquiLMc0lV8vcd5Ql/JAKAoyzHFXaStwjkzpOpC5Yv+pIzLfHvjTSdf3vpa2bMiUQrg9i6276yn8666aA==",
+      "license": "MIT",
+      "dependencies": {
+        "@tootallnate/quickjs-emscripten": "^0.23.0",
+        "agent-base": "^7.1.2",
+        "debug": "^4.3.4",
+        "get-uri": "^6.0.1",
+        "http-proxy-agent": "^7.0.0",
+        "https-proxy-agent": "^7.0.6",
+        "pac-resolver": "^7.0.1",
+        "socks-proxy-agent": "^8.0.5"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/pac-resolver": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/pac-resolver/-/pac-resolver-7.0.1.tgz",
+      "integrity": "sha512-5NPgf87AT2STgwa2ntRMr45jTKrYBGkVU36yT0ig/n/GMAa3oPqhZfIQ2kMEimReg0+t9kZViDVZ83qfVUlckg==",
+      "license": "MIT",
+      "dependencies": {
+        "degenerator": "^5.0.0",
+        "netmask": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/package-manager-detector": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.6.0.tgz",
+      "integrity": "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==",
+      "license": "MIT"
+    },
+    "node_modules/packageurl-js": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-2.0.1.tgz",
+      "integrity": "sha512-N5ixXjzTy4QDQH0Q9YFjqIWd6zH6936Djpl2m9QNFmDv5Fum8q8BjkpAcHNMzOFE0IwQrFhJWex3AN6kS0OSwg==",
+      "license": "MIT"
+    },
+    "node_modules/pako": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
+      "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==",
+      "license": "(MIT AND Zlib)"
+    },
+    "node_modules/parse-entities": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/parse-entities/-/parse-entities-4.0.2.tgz",
+      "integrity": "sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/unist": "^2.0.0",
+        "character-entities-legacy": "^3.0.0",
+        "character-reference-invalid": "^2.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "is-alphanumerical": "^2.0.0",
+        "is-decimal": "^2.0.0",
+        "is-hexadecimal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/picomatch": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/prettier": {
+      "version": "3.8.1",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz",
+      "integrity": "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==",
+      "license": "MIT",
+      "bin": {
+        "prettier": "bin/prettier.cjs"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
+      }
+    },
+    "node_modules/pretty-format": {
+      "version": "30.2.0",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.2.0.tgz",
+      "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.0.5",
+        "ansi-styles": "^5.2.0",
+        "react-is": "^18.3.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/pretty-format/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/process-nextick-args": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
+      "license": "MIT"
+    },
+    "node_modules/proxy-agent": {
+      "version": "6.4.0",
+      "resolved": "https://registry.npmjs.org/proxy-agent/-/proxy-agent-6.4.0.tgz",
+      "integrity": "sha512-u0piLU+nCOHMgGjRbimiXmA9kM/L9EHh3zL81xCdp7m+Y2pHIsnmbdDoEDoAz5geaonNR6q6+yOPQs6n4T6sBQ==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.0.2",
+        "debug": "^4.3.4",
+        "http-proxy-agent": "^7.0.1",
+        "https-proxy-agent": "^7.0.3",
+        "lru-cache": "^7.14.1",
+        "pac-proxy-agent": "^7.0.1",
+        "proxy-from-env": "^1.1.0",
+        "socks-proxy-agent": "^8.0.2"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/proxy-agent/node_modules/lru-cache": {
+      "version": "7.18.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-7.18.3.tgz",
+      "integrity": "sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/proxy-from-env": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
+      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
+      "license": "MIT"
+    },
+    "node_modules/punycode.js": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode.js/-/punycode.js-2.3.1.tgz",
+      "integrity": "sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+      "dependencies": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "bin": {
+        "rc": "cli.js"
+      }
+    },
+    "node_modules/react-is": {
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
+      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
+      "license": "MIT"
+    },
+    "node_modules/readable-stream": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+      "license": "MIT",
+      "dependencies": {
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
+      }
+    },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/restore-cursor": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-3.1.0.tgz",
+      "integrity": "sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==",
+      "license": "MIT",
+      "dependencies": {
+        "onetime": "^5.1.0",
+        "signal-exit": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/retry": {
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
+      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/reusify": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
+      "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==",
+      "license": "MIT",
+      "engines": {
+        "iojs": ">=1.0.0",
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/run-async": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/run-async/-/run-async-2.4.1.tgz",
+      "integrity": "sha512-tvVnVv01b8c1RrA6Ep7JkStj85Guv/YrMcwqYQnwjsAS2cTmmPGBBjAjpCW7RrSodNSoE2/qg9O4bceNvUuDgQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
+    "node_modules/run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
+    "node_modules/rxjs": {
+      "version": "7.8.2",
+      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
+      "integrity": "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.1.0"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
+    "node_modules/semver": {
+      "version": "7.6.3",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz",
+      "integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/setimmediate": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/setimmediate/-/setimmediate-1.0.5.tgz",
+      "integrity": "sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA==",
+      "license": "MIT"
+    },
+    "node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "license": "ISC"
+    },
+    "node_modules/simple-git": {
+      "version": "3.33.0",
+      "resolved": "https://registry.npmjs.org/simple-git/-/simple-git-3.33.0.tgz",
+      "integrity": "sha512-D4V/tGC2sjsoNhoMybKyGoE+v8A60hRawKQ1iFRA1zwuDgGZCBJ4ByOzZ5J8joBbi4Oam0qiPH+GhzmSBwbJng==",
+      "license": "MIT",
+      "dependencies": {
+        "@kwsites/file-exists": "^1.1.1",
+        "@kwsites/promise-deferred": "^1.1.1",
+        "debug": "^4.4.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/steveukx/git-js?sponsor=1"
+      }
+    },
+    "node_modules/slash": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-5.1.0.tgz",
+      "integrity": "sha512-ZA6oR3T/pEyuqwMgAKT0/hAv8oAXckzbkmR0UkUosQ+Mc4RxGoJkRmwHgHufaenlyAgE1Mxgpdcrf75y6XcnDg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/smart-buffer": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
+      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/smol-toml": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.0.tgz",
+      "integrity": "sha512-4zemZi0HvTnYwLfrpk/CF9LOd9Lt87kAt50GnqhMpyF9U3poDAP2+iukq2bZsO/ufegbYehBkqINbsWxj4l4cw==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">= 18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/cyyynthia"
+      }
+    },
+    "node_modules/socks": {
+      "version": "2.8.7",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
+      "integrity": "sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==",
+      "license": "MIT",
+      "dependencies": {
+        "ip-address": "^10.0.1",
+        "smart-buffer": "^4.2.0"
+      },
+      "engines": {
+        "node": ">= 10.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/socks-proxy-agent": {
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
+      "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "^4.3.4",
+        "socks": "^2.8.3"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/source-map": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "license": "BSD-3-Clause",
+      "optional": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.1.0"
+      }
+    },
+    "node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/strnum": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.2.tgz",
+      "integrity": "sha512-DnR90I+jtXNSTXWdwrEy9FakW7UX+qUZg28gj5fk2vxxl7uS/3bpI4fjFYVmdK9etptYBPNkpahuQnEwhwECqA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "license": "MIT",
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/supports-hyperlinks": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/supports-hyperlinks/-/supports-hyperlinks-2.3.0.tgz",
+      "integrity": "sha512-RpsAZlpWcDwOPQA22aCH4J0t7L8JmAvsCxfOSEwm7cQs3LshN36QaTkwd70DnBOXDWGssw2eUoc8CaRWT0XunA==",
+      "license": "MIT",
+      "dependencies": {
+        "has-flag": "^4.0.0",
+        "supports-color": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/terminal-link": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/terminal-link/-/terminal-link-2.1.1.tgz",
+      "integrity": "sha512-un0FmiRUQNr5PJqy9kP7c40F5BOfpGlYTrxonDChEZB7pzZxRNp/bt+ymiy9/npwXya9KH99nJ/GXFIiUkYGFQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-escapes": "^4.2.1",
+        "supports-hyperlinks": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/through": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/through/-/through-2.3.8.tgz",
+      "integrity": "sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==",
+      "license": "MIT"
+    },
+    "node_modules/tiny-async-pool": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/tiny-async-pool/-/tiny-async-pool-2.1.0.tgz",
+      "integrity": "sha512-ltAHPh/9k0STRQqaoUX52NH4ZQYAJz24ZAEwf1Zm+HYg3l9OXTWeqWKyYsHu40wF/F0rxd2N2bk5sLvX2qlSvg==",
+      "license": "MIT"
+    },
+    "node_modules/tinyexec": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.4.tgz",
+      "integrity": "sha512-u9r3uZC0bdpGOXtlxUIdwf9pkmvhqJdrVCH9fapQtgy/OeTTMZ1nqH7agtvEfmGui6e1XxjcdrlxvxJvc3sMqw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "license": "MIT",
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/typanion": {
+      "version": "3.14.0",
+      "resolved": "https://registry.npmjs.org/typanion/-/typanion-3.14.0.tgz",
+      "integrity": "sha512-ZW/lVMRabETuYCd9O9ZvMhAh8GslSqaUjxmK/JLPCh6l73CvLBiuXswj/+7LdnWOgYsQ130FqLzFz5aGT4I3Ug==",
+      "license": "MIT",
+      "workspaces": [
+        "website"
+      ]
+    },
+    "node_modules/type-fest": {
+      "version": "0.21.3",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
+      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/uc.micro": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-2.1.0.tgz",
+      "integrity": "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A==",
+      "license": "MIT"
+    },
+    "node_modules/unicorn-magic": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.4.0.tgz",
+      "integrity": "sha512-wH590V9VNgYH9g3lH9wWjTrUoKsjLF6sGLjhR4sH1LWpLmCOH0Zf7PukhDA8BiS7KHe4oPNkcTHqYkj7SOGUOw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/upath": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/upath/-/upath-2.0.1.tgz",
+      "integrity": "sha512-1uEe95xksV1O0CYKXo8vQvN1JEbtJp7lb7C5U9HMsIp6IVwntkH/oNUzyVNQSd4S1sYk2FpSSW44FqMc8qee5w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4",
+        "yarn": "*"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
+    "node_modules/uuid": {
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
+      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
+    "node_modules/wcwidth": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/wcwidth/-/wcwidth-1.0.1.tgz",
+      "integrity": "sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==",
+      "license": "MIT",
+      "dependencies": {
+        "defaults": "^1.0.3"
+      }
+    },
+    "node_modules/wrap-ansi": {
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
+      "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    }
+  }
+}
diff --git a/scripts/environment/npm-tools/package.json b/scripts/environment/npm-tools/package.json
new file mode 100644
index 0000000000000..30d63057b7fed
--- /dev/null
+++ b/scripts/environment/npm-tools/package.json
@@ -0,0 +1,9 @@
+{
+  "private": true,
+  "description": "Pinned npm tools for CI. Run 'npm ci' to install with exact versions from package-lock.json.",
+  "dependencies": {
+    "@datadog/datadog-ci": "5.11.0",
+    "markdownlint-cli2": "0.22.0",
+    "prettier": "3.8.1"
+  }
+}
diff --git a/scripts/environment/prepare.sh b/scripts/environment/prepare.sh
index e74aba915ad5f..02e100999c8de 100755
--- a/scripts/environment/prepare.sh
+++ b/scripts/environment/prepare.sh
@@ -37,9 +37,8 @@ CARGO_HACK_VERSION="0.6.43"
 DD_RUST_LICENSE_TOOL_VERSION="1.0.6"
 CARGO_LLVM_COV_VERSION="0.8.4"
 WASM_PACK_VERSION="0.13.1"
-MARKDOWNLINT_CLI2_VERSION="0.22.0"
-PRETTIER_VERSION="3.8.1"
-DATADOG_CI_VERSION="5.9.0"
+# npm tool versions are defined in scripts/environment/npm-tools/package.json
+# and pinned (including transitive deps) in npm-tools/package-lock.json.
 VDEV_VERSION="0.3.0"
 
 ALL_MODULES=(
@@ -151,22 +150,58 @@ maybe_install_cargo_tool() {
   fi
 }
 
-# Helper for NPM packages
-# Usage: maybe_install_npm_package <tool-name> <package-name> <version> <version-check-pattern> <version-command>
-maybe_install_npm_package() {
-  local tool="$1"
-  local package="$2"
-  local version="$3"
-  local version_pattern="${4:-$version}"
-  local version_cmd="${5:---version}"  # Default to --version, can override with "version" etc.
+# Install npm tools from the committed package-lock.json so that every
+# transitive dependency version is pinned (no live registry resolution).
+# Versions are defined in npm-tools/package.json; npm ci ensures exact lockfile match.
+# Note: npm ci installs all packages in the lockfile even if only one tool
+# is requested, since it does not support selective installation.
+maybe_install_npm_tools() {
+  local npm_tools=(markdownlint-cli2 prettier datadog-ci)
+
+  # Early return when no npm tool is requested, so hosts without npm
+  # (e.g. tests/e2e/Dockerfile calling prepare.sh --modules=cargo-nextest)
+  # are not broken by the npm commands below.
+  local any_requested=false
+  for tool in "${npm_tools[@]}"; do
+    if contains_module "$tool"; then
+      any_requested=true
+      break
+    fi
+  done
+  if [[ "$any_requested" == "false" ]]; then
+    return 0
+  fi
 
-  if ! contains_module "$tool"; then
+  local npm_tools_dir="${SCRIPT_DIR}/npm-tools"
+  local npm_bin_dir
+  npm_bin_dir="$(npm config get prefix -g)/bin"
+  local need_install=false
+
+  for tool in "${npm_tools[@]}"; do
+    if contains_module "$tool"; then
+      local expected="${npm_tools_dir}/node_modules/.bin/${tool}"
+      if [[ "$(readlink "${npm_bin_dir}/${tool}" 2>/dev/null)" != "$expected" ]] || [[ ! -x "$expected" ]]; then
+        need_install=true
+        break
+      fi
+    fi
+  done
+
+  if [[ "$need_install" == "false" ]]; then
     return 0
   fi
 
-  if [[ "$("$tool" "$version_cmd" 2>/dev/null)" != "$version_pattern" ]]; then
-    sudo npm install -g "${package}@${version}"
+  npm ci --prefix "${npm_tools_dir}"
+
+  # Use sudo only when the target directory is not writable (e.g. /usr/local/bin
+  # on Linux CI runners is root-owned, but Homebrew dirs on macOS are user-owned).
+  local ln_cmd=(ln -sf)
+  if [[ ! -w "${npm_bin_dir}" ]]; then
+    ln_cmd=(sudo ln -sf)
   fi
+  for tool in "${npm_tools[@]}"; do
+    "${ln_cmd[@]}" "${npm_tools_dir}/node_modules/.bin/${tool}" "${npm_bin_dir}/${tool}"
+  done
 }
 
 # Always ensure git safe.directory is set
@@ -221,6 +256,4 @@ maybe_install_cargo_tool dd-rust-license-tool "${DD_RUST_LICENSE_TOOL_VERSION}"
 maybe_install_cargo_tool wasm-pack "${WASM_PACK_VERSION}"
 maybe_install_cargo_tool vdev "${VDEV_VERSION}"
 
-maybe_install_npm_package markdownlint-cli2 markdownlint-cli2 "${MARKDOWNLINT_CLI2_VERSION}"
-maybe_install_npm_package prettier prettier "${PRETTIER_VERSION}"
-maybe_install_npm_package datadog-ci "@datadog/datadog-ci" "${DATADOG_CI_VERSION}" "v${DATADOG_CI_VERSION}" "version"
+maybe_install_npm_tools

From 04f3b782e95f044fc7307fe4f6230dc48793800b Mon Sep 17 00:00:00 2001
From: Bruce Guenter <bruce.guenter@datadoghq.com>
Date: Fri, 3 Apr 2026 10:23:45 -0600
Subject: [PATCH 096/326] fix(buffers): Reverse performance regression in
 buffer metrics (#24995)

* fix(buffers): Reverse performance regression in buffer metrics

PR #23561 reworked the gauge metric handling for buffer metric reporting in
order to get rid of a global shared hashmap. However, in doing so, the current
occupancy calculation was moved into the hot path.

This change moves that calculation out of the hot path and into the reporting
loop, which executes on a fixed interval instead of per event array.

* Address PR feedback

* Refactor BufferUsage::install and add tests

* chore: remove changelog fragment from PR 24995

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 lib/vector-buffers/src/buffer_usage_data.rs | 329 +++++++++++++-------
 1 file changed, 215 insertions(+), 114 deletions(-)

diff --git a/lib/vector-buffers/src/buffer_usage_data.rs b/lib/vector-buffers/src/buffer_usage_data.rs
index ce7a67648db3d..b418023657bb5 100644
--- a/lib/vector-buffers/src/buffer_usage_data.rs
+++ b/lib/vector-buffers/src/buffer_usage_data.rs
@@ -20,6 +20,7 @@ use crate::{
 const ORDERING: Ordering = Ordering::Relaxed;
 
 /// Snapshot of category metrics.
+#[derive(Clone, Copy, Debug, Default)]
 struct CategorySnapshot {
     event_count: u64,
     event_byte_size: u64,
@@ -86,37 +87,52 @@ impl CategoryMetrics {
     }
 }
 
-/// `CurrentMetrics` is a wrapper around a pair of `CategoryMetrics` that are used to track a
-/// "current" value that may increment or decrement. The challenge this solves is that the
-/// increments and decrements may race and result in underflows that are hard to handle using only
-/// efficient atomic operations. By tracking the increments and decrements separately, we can ensure
-/// that the current value is always accurate even if the increments and decrements race.
-#[derive(Debug, Default)]
-struct CurrentMetrics {
-    increments: CategoryMetrics,
-    decrements: CategoryMetrics,
+/// Running totals of events that have entered and left a buffer stage.
+///
+/// Each reporting tick consumes the latest deltas from the atomic counters and
+/// folds them into these cumulative totals.  The difference
+/// (`total_entered - total_left`) gives the approximate current buffer
+/// occupancy without requiring a separate "current size" counter that would
+/// itself be subject to cross-thread races.
+#[derive(Clone, Copy, Debug, Default)]
+struct ReporterCurrentMetrics {
+    total_entered: CategorySnapshot,
+    total_left: CategorySnapshot,
 }
 
-impl CurrentMetrics {
-    fn increment(&self, event_count: u64, event_byte_size: u64) {
-        self.increments.increment(event_count, event_byte_size);
+impl ReporterCurrentMetrics {
+    fn add_received(&mut self, snapshot: CategorySnapshot) {
+        self.total_entered.event_count = self
+            .total_entered
+            .event_count
+            .saturating_add(snapshot.event_count);
+        self.total_entered.event_byte_size = self
+            .total_entered
+            .event_byte_size
+            .saturating_add(snapshot.event_byte_size);
     }
 
-    fn decrement(&self, event_count: u64, event_byte_size: u64) {
-        self.decrements.increment(event_count, event_byte_size);
+    fn add_left(&mut self, snapshot: CategorySnapshot) {
+        self.total_left.event_count = self
+            .total_left
+            .event_count
+            .saturating_add(snapshot.event_count);
+        self.total_left.event_byte_size = self
+            .total_left
+            .event_byte_size
+            .saturating_add(snapshot.event_byte_size);
     }
 
-    fn get(&self) -> CategorySnapshot {
-        let entered_total = self.increments.get();
-        let left_total = self.decrements.get();
-
+    fn current(&self) -> CategorySnapshot {
         CategorySnapshot {
-            event_count: entered_total
+            event_count: self
+                .total_entered
                 .event_count
-                .saturating_sub(left_total.event_count),
-            event_byte_size: entered_total
+                .saturating_sub(self.total_left.event_count),
+            event_byte_size: self
+                .total_entered
                 .event_byte_size
-                .saturating_sub(left_total.event_byte_size),
+                .saturating_sub(self.total_left.event_byte_size),
         }
     }
 }
@@ -161,7 +177,6 @@ impl BufferUsageHandle {
     pub fn increment_received_event_count_and_byte_size(&self, count: u64, byte_size: u64) {
         if count > 0 || byte_size > 0 {
             self.state.received.increment(count, byte_size);
-            self.state.current.increment(count, byte_size);
         }
     }
 
@@ -171,7 +186,6 @@ impl BufferUsageHandle {
     pub fn increment_sent_event_count_and_byte_size(&self, count: u64, byte_size: u64) {
         if count > 0 || byte_size > 0 {
             self.state.sent.increment(count, byte_size);
-            self.state.current.decrement(count, byte_size);
         }
     }
 
@@ -188,7 +202,6 @@ impl BufferUsageHandle {
             } else {
                 self.state.dropped.increment(count, byte_size);
             }
-            self.state.current.decrement(count, byte_size);
         }
     }
 }
@@ -201,7 +214,6 @@ struct BufferUsageData {
     dropped: CategoryMetrics,
     dropped_intentional: CategoryMetrics,
     max_size: CategoryMetrics,
-    current: CurrentMetrics,
 }
 
 impl BufferUsageData {
@@ -235,6 +247,85 @@ impl BufferUsageData {
                 .expect("should never be bigger than `usize`"),
         }
     }
+
+    fn report(&self, current_metrics: &mut ReporterCurrentMetrics, buffer_id: &str) {
+        let max_size = self.max_size.get();
+        emit(BufferCreated {
+            buffer_id: buffer_id.to_string(),
+            idx: self.idx,
+            max_size_bytes: max_size.event_byte_size,
+            max_size_events: max_size
+                .event_count
+                .try_into()
+                .expect("should never be bigger than `usize`"),
+        });
+
+        // Consume received before sent/dropped so that, in the presence of
+        // a race between producers and consumers, the computed current usage
+        // will err on the side of overcounting, which is more likely to be an
+        // accurate representation of the current usage than undercounting.
+        let received = self.received.consume();
+        current_metrics.add_received(received);
+
+        let sent = self.sent.consume();
+        current_metrics.add_left(sent);
+
+        let dropped = self.dropped.consume();
+        current_metrics.add_left(dropped);
+
+        let dropped_intentional = self.dropped_intentional.consume();
+        current_metrics.add_left(dropped_intentional);
+
+        let current = current_metrics.current();
+
+        if received.has_updates() {
+            emit(BufferEventsReceived {
+                buffer_id: buffer_id.to_string(),
+                idx: self.idx,
+                count: received.event_count,
+                byte_size: received.event_byte_size,
+                total_count: current.event_count,
+                total_byte_size: current.event_byte_size,
+            });
+        }
+
+        if sent.has_updates() {
+            emit(BufferEventsSent {
+                buffer_id: buffer_id.to_string(),
+                idx: self.idx,
+                count: sent.event_count,
+                byte_size: sent.event_byte_size,
+                total_count: current.event_count,
+                total_byte_size: current.event_byte_size,
+            });
+        }
+
+        if dropped.has_updates() {
+            emit(BufferEventsDropped {
+                buffer_id: buffer_id.to_string(),
+                idx: self.idx,
+                intentional: false,
+                reason: "corrupted_events",
+                count: dropped.event_count,
+                byte_size: dropped.event_byte_size,
+                total_count: current.event_count,
+                total_byte_size: current.event_byte_size,
+            });
+        }
+
+        if dropped_intentional.has_updates() {
+            emit(BufferEventsDropped {
+                buffer_id: buffer_id.to_string(),
+                idx: self.idx,
+                intentional: true,
+                reason: "drop_newest",
+                count: dropped_intentional.event_count,
+                byte_size: dropped_intentional.event_byte_size,
+                total_count: current.event_count,
+                total_byte_size: current.event_byte_size,
+            });
+        }
+    }
 }
 
 /// Snapshot of buffer usage metrics.
@@ -296,83 +387,29 @@ impl BufferUsage {
     pub fn install(self, buffer_id: &str) {
         let buffer_id = buffer_id.to_string();
         let span = self.span;
-        let stages = self.stages;
+        let stages: Vec<_> = self
+            .stages
+            .into_iter()
+            .map(|stage| (stage, ReporterCurrentMetrics::default()))
+            .collect();
         let task_name = format!("buffer usage reporter ({buffer_id})");
 
-        let task = async move {
-            let mut interval = interval(Duration::from_secs(2));
-            loop {
-                interval.tick().await;
-
-                for stage in &stages {
-                    let max_size = stage.max_size.get();
-                    emit(BufferCreated {
-                        buffer_id: buffer_id.clone(),
-                        idx: stage.idx,
-                        max_size_bytes: max_size.event_byte_size,
-                        max_size_events: max_size
-                            .event_count
-                            .try_into()
-                            .expect("should never be bigger than `usize`"),
-                    });
-
-                    let current = stage.current.get();
-                    let received = stage.received.consume();
-                    if received.has_updates() {
-                        emit(BufferEventsReceived {
-                            buffer_id: buffer_id.clone(),
-                            idx: stage.idx,
-                            count: received.event_count,
-                            byte_size: received.event_byte_size,
-                            total_count: current.event_count,
-                            total_byte_size: current.event_byte_size,
-                        });
-                    }
-
-                    let sent = stage.sent.consume();
-                    if sent.has_updates() {
-                        emit(BufferEventsSent {
-                            buffer_id: buffer_id.clone(),
-                            idx: stage.idx,
-                            count: sent.event_count,
-                            byte_size: sent.event_byte_size,
-                            total_count: current.event_count,
-                            total_byte_size: current.event_byte_size,
-                        });
-                    }
-
-                    let dropped = stage.dropped.consume();
-                    if dropped.has_updates() {
-                        emit(BufferEventsDropped {
-                            buffer_id: buffer_id.clone(),
-                            idx: stage.idx,
-                            intentional: false,
-                            reason: "corrupted_events",
-                            count: dropped.event_count,
-                            byte_size: dropped.event_byte_size,
-                            total_count: current.event_count,
-                            total_byte_size: current.event_byte_size,
-                        });
-                    }
-
-                    let dropped_intentional = stage.dropped_intentional.consume();
-                    if dropped_intentional.has_updates() {
-                        emit(BufferEventsDropped {
-                            buffer_id: buffer_id.clone(),
-                            idx: stage.idx,
-                            intentional: true,
-                            reason: "drop_newest",
-                            count: dropped_intentional.event_count,
-                            byte_size: dropped_intentional.event_byte_size,
-                            total_count: current.event_count,
-                            total_byte_size: current.event_byte_size,
-                        });
-                    }
-                }
-            }
-        };
+        let task = Self::report_buffer_usage(stages, buffer_id).instrument(span.or_current());
+        spawn_named(task, task_name.as_str());
+    }
 
-        spawn_named(task.instrument(span.or_current()), task_name.as_str());
+    async fn report_buffer_usage(
+        mut stages: Vec<(Arc<BufferUsageData>, ReporterCurrentMetrics)>,
+        buffer_id: String,
+    ) {
+        let mut interval = interval(Duration::from_secs(2));
+        loop {
+            interval.tick().await;
+
+            for (stage, current_metrics) in &mut stages {
+                stage.report(current_metrics, &buffer_id);
+            }
+        }
     }
 }
 
@@ -381,27 +418,91 @@ mod tests {
     use super::*;
 
     #[test]
-    fn current_usage_is_derived_from_entered_and_left_totals() {
-        let handle = BufferUsageHandle {
-            state: Arc::new(BufferUsageData::new(0)),
-        };
-
-        handle.increment_received_event_count_and_byte_size(10, 1000);
-        handle.increment_sent_event_count_and_byte_size(3, 300);
-        handle.increment_dropped_event_count_and_byte_size(2, 200, false);
+    fn reporter_current_usage_is_derived_from_entered_and_left_totals() {
+        let mut current = ReporterCurrentMetrics::default();
+        current.add_received(CategorySnapshot {
+            event_count: 10,
+            event_byte_size: 1000,
+        });
+        current.add_left(CategorySnapshot {
+            event_count: 3,
+            event_byte_size: 300,
+        });
+        current.add_left(CategorySnapshot {
+            event_count: 2,
+            event_byte_size: 200,
+        });
+
+        let current = current.current();
+        assert_eq!(current.event_count, 5);
+        assert_eq!(current.event_byte_size, 500);
+    }
 
-        let current = handle.state.current.get();
+    #[test]
+    fn reporter_current_usage_preserves_underflow_debt() {
+        let mut current = ReporterCurrentMetrics::default();
+        current.add_left(CategorySnapshot {
+            event_count: 10,
+            event_byte_size: 1000,
+        });
+        current.add_received(CategorySnapshot {
+            event_count: 15,
+            event_byte_size: 1500,
+        });
+
+        let current = current.current();
         assert_eq!(current.event_count, 5);
         assert_eq!(current.event_byte_size, 500);
     }
 
     #[test]
-    fn current_usage_saturates_at_zero() {
+    fn consume_resets_deltas_between_ticks() {
         let data = BufferUsageData::new(0);
-        data.current.decrement(10, 1000);
+        let mut metrics = ReporterCurrentMetrics::default();
+
+        data.received.increment(10, 1000);
+        data.sent.increment(3, 300);
+        data.report(&mut metrics, "test");
+        let current = metrics.current();
+        assert_eq!(current.event_count, 7);
+        assert_eq!(current.event_byte_size, 700);
+
+        // Second tick with no new activity should report the same totals.
+        data.report(&mut metrics, "test");
+        let current = metrics.current();
+        assert_eq!(current.event_count, 7);
+        assert_eq!(current.event_byte_size, 700);
+    }
+
+    #[test]
+    fn accumulates_across_multiple_ticks() {
+        let data = BufferUsageData::new(0);
+        let mut metrics = ReporterCurrentMetrics::default();
+
+        data.received.increment(10, 1000);
+        data.report(&mut metrics, "test");
+
+        data.received.increment(5, 500);
+        data.sent.increment(8, 800);
+        data.report(&mut metrics, "test");
+        let current = metrics.current();
+        assert_eq!(current.event_count, 7);
+        assert_eq!(current.event_byte_size, 700);
+    }
+
+    #[test]
+    fn drops_count_as_leaving_the_buffer() {
+        let data = BufferUsageData::new(0);
+        let mut metrics = ReporterCurrentMetrics::default();
+
+        data.received.increment(20, 2000);
+        data.sent.increment(5, 500);
+        data.dropped.increment(3, 300);
+        data.dropped_intentional.increment(2, 200);
 
-        let current = data.current.get();
-        assert_eq!(current.event_count, 0);
-        assert_eq!(current.event_byte_size, 0);
+        data.report(&mut metrics, "test");
+        let current = metrics.current();
+        assert_eq!(current.event_count, 10);
+        assert_eq!(current.event_byte_size, 1000);
     }
 }

From 51030d2aade15deae23297a1ed1994cb36c530e9 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 3 Apr 2026 12:36:36 -0400
Subject: [PATCH 097/326] fix(dev): make file source tests not flaky (#24957)

Make file source tests not flaky
---
 src/sources/file.rs | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/src/sources/file.rs b/src/sources/file.rs
index 62a95db362f10..df51a5a73788a 100644
--- a/src/sources/file.rs
+++ b/src/sources/file.rs
@@ -2462,12 +2462,23 @@ mod tests {
         inner: impl Future<Output = ()>,
     ) -> Vec<Event> {
         assert_source_compliance(&FILE_SOURCE_TAGS, async move {
-            let (tx, rx) = if acking_mode == Acks {
-                let (tx, rx) = SourceSender::new_test_finalize(EventStatus::Delivered);
-                (tx, rx.boxed())
-            } else {
-                let (tx, rx) = SourceSender::new_test();
-                (tx, rx.boxed())
+            let (tx, rx) = match acking_mode {
+                Acks => {
+                    let (tx, rx) = SourceSender::new_test_finalize(EventStatus::Delivered);
+                    (tx, rx.boxed())
+                }
+                Unfinalized => {
+                    // Use Rejected so that events are finalized but checkpoints
+                    // are NOT updated (only Delivered triggers checkpoint updates).
+                    // This avoids a race where the default Delivered status on drop
+                    // could leak checkpoint writes into the next run.
+                    let (tx, rx) = SourceSender::new_test_finalize(EventStatus::Rejected);
+                    (tx, rx.boxed())
+                }
+                NoAcks => {
+                    let (tx, rx) = SourceSender::new_test();
+                    (tx, rx.boxed())
+                }
             };
 
             let (trigger_shutdown, shutdown, shutdown_done) = ShutdownSignal::new_wired();

From 2fe515ccd2dfc23d98b84300e4fd87bee27b35fa Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Fri, 3 Apr 2026 14:13:12 -0400
Subject: [PATCH 098/326] fix(ci): use helm-charts develop branch for K8s E2E
 tests (#25118)

Instead of pulling the published chart from helm.vector.dev, clone
the helm-charts repo (develop branch) and use the local chart path.
This breaks the circular dependency between Vector and helm-charts
releases and catches chart incompatibilities before release.

- Add `helm_chart_repo()` helper with HELM_CHART_REPO env var override
- Update deploy-chart-test.sh to support local chart paths
- Clone helm-charts in CI and set HELM_CHART_REPO

Fixes: #25111

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/k8s_e2e.yml                 |  8 ++++++
 lib/k8s-e2e-tests/src/lib.rs                  |  6 ++++
 lib/k8s-e2e-tests/tests/vector-agent.rs       | 28 +++++++++----------
 lib/k8s-e2e-tests/tests/vector-aggregator.rs  |  4 +--
 .../tests/vector-dd-agent-aggregator.rs       |  2 +-
 lib/k8s-e2e-tests/tests/vector.rs             |  8 +++---
 scripts/deploy-chart-test.sh                  | 12 ++++++--
 7 files changed, 44 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index afdcc01252e20..471783ed1488c 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -197,6 +197,13 @@ jobs:
           MINIKUBE_VERSION: ${{ matrix.minikube_version }}
           CONTAINER_RUNTIME: ${{ matrix.container_runtime }}
 
+      - name: Checkout helm-charts
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: vectordotdev/helm-charts
+          ref: develop
+          path: helm-charts
+
       # TODO: This job has been quite flakey. Need to investigate further and then remove the retries.
       - name: Run tests
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
@@ -204,6 +211,7 @@ jobs:
           USE_MINIKUBE_CACHE: "true"
           SKIP_PACKAGE_DEB: "true"
           CARGO_INCREMENTAL: 0
+          HELM_CHART_REPO: ${{ github.workspace }}/helm-charts/charts/vector
         with:
           timeout_minutes: 45
           max_attempts: 3
diff --git a/lib/k8s-e2e-tests/src/lib.rs b/lib/k8s-e2e-tests/src/lib.rs
index 4d6d10f4a1875..8986b59ee03a1 100644
--- a/lib/k8s-e2e-tests/src/lib.rs
+++ b/lib/k8s-e2e-tests/src/lib.rs
@@ -20,6 +20,12 @@ pub mod metrics;
 
 pub const BUSYBOX_IMAGE: &str = "busybox:1.28";
 
+/// Returns the Helm chart repo to use for E2E tests.
+/// Set `HELM_CHART_REPO` to override the default (e.g., a local chart path).
+pub fn helm_chart_repo() -> String {
+    env::var("HELM_CHART_REPO").unwrap_or_else(|_| "https://helm.vector.dev".to_string())
+}
+
 pub fn init() {
     _ = env_logger::builder().is_test(true).try_init();
 }
diff --git a/lib/k8s-e2e-tests/tests/vector-agent.rs b/lib/k8s-e2e-tests/tests/vector-agent.rs
index 2bf56f32336c6..1a1176b8ce4a1 100644
--- a/lib/k8s-e2e-tests/tests/vector-agent.rs
+++ b/lib/k8s-e2e-tests/tests/vector-agent.rs
@@ -74,7 +74,7 @@ async fn default_agent() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![
                     &config_override_name(&override_name, true),
@@ -199,7 +199,7 @@ async fn partial_merge() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![
                     &config_override_name(&override_name, true),
@@ -351,7 +351,7 @@ async fn preexisting() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![
                     &config_override_name(&override_name, true),
@@ -453,7 +453,7 @@ async fn multiple_lines() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![
                     &config_override_name(&override_name, true),
@@ -580,7 +580,7 @@ async fn metadata_annotation() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![
                     &config_override_name(&override_name, true),
@@ -769,7 +769,7 @@ async fn pod_filtering() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![
                     &config_override_name(&override_name, true),
@@ -1012,7 +1012,7 @@ async fn custom_selectors() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![&config_override_name(&override_name, true), CONFIG],
                 ..Default::default()
@@ -1207,7 +1207,7 @@ async fn container_filtering() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![
                     &config_override_name(&override_name, true),
@@ -1416,7 +1416,7 @@ async fn glob_pattern_filtering() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![&config_override_name(&override_name, true), CONFIG],
                 ..Default::default()
@@ -1576,7 +1576,7 @@ async fn multiple_ns() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![
                     &config_override_name(&override_name, true),
@@ -1738,7 +1738,7 @@ async fn existing_config_file() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![
                     &config_override_name(&override_name, true),
@@ -1839,7 +1839,7 @@ async fn metrics_pipeline() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![
                     &config_override_name(&override_name, true),
@@ -1994,7 +1994,7 @@ async fn host_metrics() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![
                     &config_override_name(&override_name, true),
@@ -2060,7 +2060,7 @@ async fn simple_checkpoint() -> Result<(), Box<dyn std::error::Error>> {
             "test-vector",
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![HELM_VALUES_AGENT],
                 ..Default::default()
diff --git a/lib/k8s-e2e-tests/tests/vector-aggregator.rs b/lib/k8s-e2e-tests/tests/vector-aggregator.rs
index 07cb49ff4bf9d..d945fc5175051 100644
--- a/lib/k8s-e2e-tests/tests/vector-aggregator.rs
+++ b/lib/k8s-e2e-tests/tests/vector-aggregator.rs
@@ -19,7 +19,7 @@ async fn dummy_topology() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![&config_override_name(&override_name, false)],
                 ..Default::default()
@@ -54,7 +54,7 @@ async fn metrics_pipeline() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![&config_override_name(&override_name, false)],
                 ..Default::default()
diff --git a/lib/k8s-e2e-tests/tests/vector-dd-agent-aggregator.rs b/lib/k8s-e2e-tests/tests/vector-dd-agent-aggregator.rs
index 25c7dc4ce6e0a..dde302827cd82 100644
--- a/lib/k8s-e2e-tests/tests/vector-dd-agent-aggregator.rs
+++ b/lib/k8s-e2e-tests/tests/vector-dd-agent-aggregator.rs
@@ -58,7 +58,7 @@ async fn datadog_to_vector() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "vector",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![&config_override_name(&override_name, false)],
                 ..Default::default()
diff --git a/lib/k8s-e2e-tests/tests/vector.rs b/lib/k8s-e2e-tests/tests/vector.rs
index 7d74442fb1146..e38f494236786 100644
--- a/lib/k8s-e2e-tests/tests/vector.rs
+++ b/lib/k8s-e2e-tests/tests/vector.rs
@@ -77,7 +77,7 @@ async fn logs() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "aggregator",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 ..Default::default()
             },
@@ -97,7 +97,7 @@ async fn logs() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "agent",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![&helm_values_stdout_sink(&agent_override_name)],
                 ..Default::default()
@@ -198,7 +198,7 @@ async fn haproxy() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "aggregator",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![CONFIG],
                 ..Default::default()
@@ -227,7 +227,7 @@ async fn haproxy() -> Result<(), Box<dyn std::error::Error>> {
             &namespace,
             "vector",
             "agent",
-            "https://helm.vector.dev",
+            &helm_chart_repo(),
             VectorConfig {
                 custom_helm_values: vec![&helm_values_haproxy(&agent_override_name)],
                 ..Default::default()
diff --git a/scripts/deploy-chart-test.sh b/scripts/deploy-chart-test.sh
index 343b8030fc202..817161ce41c7b 100755
--- a/scripts/deploy-chart-test.sh
+++ b/scripts/deploy-chart-test.sh
@@ -61,8 +61,14 @@ up() {
   # A Vector container image to use.
   CONTAINER_IMAGE="${CONTAINER_IMAGE:?"You must assign CONTAINER_IMAGE variable with the Vector container image name"}"
 
-  $VECTOR_TEST_HELM repo add "$CUSTOM_HELM_REPO_LOCAL_NAME" "$CHART_REPO" --force-update || true
-  $VECTOR_TEST_HELM repo update
+  # Support both remote repos (https://...) and local chart paths
+  if [[ "$CHART_REPO" == http* ]]; then
+    $VECTOR_TEST_HELM repo add "$CUSTOM_HELM_REPO_LOCAL_NAME" "$CHART_REPO" --force-update || true
+    $VECTOR_TEST_HELM repo update
+    HELM_INSTALL_TARGET="$CUSTOM_HELM_REPO_LOCAL_NAME/$HELM_CHART"
+  else
+    HELM_INSTALL_TARGET="$CHART_REPO"
+  fi
 
   $VECTOR_TEST_KUBECTL create namespace "$NAMESPACE" --dry-run -o yaml | $VECTOR_TEST_KUBECTL apply -f -
 
@@ -95,7 +101,7 @@ up() {
     --namespace "$NAMESPACE" \
     "${HELM_VALUES[@]}" \
     "$RELEASE_NAME" \
-    "$CUSTOM_HELM_REPO_LOCAL_NAME/$HELM_CHART"
+    "$HELM_INSTALL_TARGET"
   { set +x; } &>/dev/null
 }
 

From b428aba5dd4f26285ce907212acae648bdb6d8df Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Fri, 3 Apr 2026 15:39:14 -0400
Subject: [PATCH 099/326] fix(dev): resolve build.rs HEAD path in worktrees
 (#25120)

* fix(dev): resolve build.rs HEAD path in worktrees

* fix(dev): preserve whitespace in git HEAD path
---
 build.rs | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/build.rs b/build.rs
index 5d6d533e86423..01cd4bea5e8ef 100644
--- a/build.rs
+++ b/build.rs
@@ -104,13 +104,30 @@ fn git_short_hash() -> std::io::Result<String> {
     })
 }
 
+#[cfg(not(feature = "nightly"))]
+fn git_path(path: &str) -> std::io::Result<String> {
+    let output_result = Command::new("git")
+        .args(["rev-parse", "--git-path", path])
+        .output();
+
+    output_result.map(|output| {
+        String::from_utf8(output.stdout)
+            .expect("valid UTF-8")
+            .trim_end_matches(['\r', '\n'])
+            .to_owned()
+    })
+}
+
 fn main() {
     // Always rerun if the build script itself changes.
     println!("cargo:rerun-if-changed=build.rs");
 
     // re-run if the HEAD has changed. This is only necessary for non-release and nightly builds.
     #[cfg(not(feature = "nightly"))]
-    println!("cargo:rerun-if-changed=.git/HEAD");
+    println!(
+        "cargo:rerun-if-changed={}",
+        git_path("HEAD").expect("git HEAD path detection failed")
+    );
 
     #[cfg(feature = "protobuf-build")]
     {

From 738c1d7758024a074f4fbe9ba9fa6d6110b316d7 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Fri, 3 Apr 2026 21:14:48 -0400
Subject: [PATCH 100/326] chore(ci): run K8s E2E suite on a weekly schedule
 (#25119)

chore(ci): run K8s E2E suite weekly instead of nightly

Reduce the schedule from Tue-Sat to once a week (Monday 01:00 UTC).
The suite also runs on PRs that touch K8s-related files and in the
merge queue, so weekly is sufficient for catching regressions.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/k8s_e2e.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index 471783ed1488c..5f9ba890ab88f 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -4,7 +4,7 @@
 #    - manual dispatch in GH UI
 #    - on a PR commit if the kubernetes_logs source was changed
 #    - in the merge queue
-#    - on a schedule at midnight UTC Tue-Sat
+#    - on a weekly schedule (Monday 01:00 UTC)
 #    - on demand by either of the following comments in a PR:
 #        - '/ci-run-k8s'
 #        - '/ci-run-all'
@@ -34,7 +34,7 @@ on:
   merge_group:
     types: [checks_requested]
   schedule:
-    - cron: "0 1 * * 2-6" # 01:00 UTC Tue-Sat
+    - cron: "0 1 * * 1" # 01:00 UTC every Monday
 
 concurrency:
   # In flight runs will be canceled through re-trigger in the merge queue, scheduled run, or if

From 703590bff3c2e49aa722c493329c753b1943c4ff Mon Sep 17 00:00:00 2001
From: Caleb Metz <135133572+cmetz100@users.noreply.github.com>
Date: Mon, 6 Apr 2026 09:25:55 -0400
Subject: [PATCH 101/326] chore(ci): Migrate smp regression workflow auth from
 static secrets to oidc (#25112)

* migrate smp regression workflow auth to oidc

Signed-off-by: Caleb Metz <caleb.metz@datadoghq.com>

* increase token duration

Signed-off-by: Caleb Metz <caleb.metz@datadoghq.com>

* fmt

Signed-off-by: Caleb Metz <caleb.metz@datadoghq.com>

---------

Signed-off-by: Caleb Metz <caleb.metz@datadoghq.com>
---
 .github/workflows/regression.yml | 39 ++++++++++++++++++++++----------
 1 file changed, 27 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 167dc0186bada..5a3e1d252b72a 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -278,13 +278,16 @@ jobs:
     needs:
       - should-run-gate
       - resolve-inputs
+    # Job level permissions for downloading SMP binary
+    permissions:
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
           aws-region: us-west-2
+          role-duration-seconds: 14400 # 4 hours
 
       - name: Download SMP binary
         run: |
@@ -303,6 +306,9 @@ jobs:
       - resolve-inputs
       - confirm-valid-credentials
       - build-baseline
+    # Job level permissions for uploading baseline image to SMP ECR
+    permissions:
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - name: "Download baseline image"
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
@@ -316,9 +322,9 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
           aws-region: us-west-2
+          role-duration-seconds: 14400 # 4 hours
 
       - name: Login to Amazon ECR
         id: login-ecr
@@ -343,6 +349,9 @@ jobs:
       - resolve-inputs
       - confirm-valid-credentials
       - build-comparison
+    # Job level permissions for uploading comparison image to SMP ECR
+    permissions:
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - name: "Download comparison image"
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
@@ -356,9 +365,9 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
           aws-region: us-west-2
+          role-duration-seconds: 14400 # 4 hours
 
       - name: Login to Amazon ECR
         id: login-ecr
@@ -387,6 +396,7 @@ jobs:
     permissions:
       contents: read # Required to checkout code
       actions: write # Required to upload artifacts
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -395,9 +405,9 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
           aws-region: us-west-2
+          role-duration-seconds: 14400 # 4 hours
 
       - name: Login to Amazon ECR
         id: login-ecr
@@ -462,15 +472,19 @@ jobs:
       - submit-job
       - should-run-gate
       - resolve-inputs
+    # Job level permissions for downloading SMP results
+    permissions:
+      contents: read # Required to checkout code
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
           aws-region: us-west-2
+          role-duration-seconds: 14400 # 4 hours
 
       - name: Download SMP binary
         run: |
@@ -503,6 +517,7 @@ jobs:
     permissions:
       contents: read # Required to checkout code
       actions: write # Required to upload artifacts
+      id-token: write # Required for GitHub OIDC token exchange
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -511,9 +526,9 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
         with:
-          aws-access-key-id: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.SINGLE_MACHINE_PERFORMANCE_BOT_SECRET_ACCESS_KEY }}
+          role-to-assume: arn:aws:iam::850406765696:role/smp-regression-oidc
           aws-region: us-west-2
+          role-duration-seconds: 14400 # 4 hours
 
       - name: Download SMP binary
         run: |

From 2d6fea2dfe7536202c83305cff5021bfadc90442 Mon Sep 17 00:00:00 2001
From: Jed Laundry <jlaundry@jlaundry.com>
Date: Tue, 7 Apr 2026 01:29:11 +1200
Subject: [PATCH 102/326] chore(ci): update check-spelling (#25124)

update check-spelling
---
 .github/workflows/spelling.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index e95e1183fc593..3b2c1f57f2d12 100644
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -90,7 +90,7 @@ jobs:
     steps:
       - name: check-spelling
         id: spelling
-        uses: check-spelling/check-spelling@c635c2f3f714eec2fcf27b643a1919b9a811ef2e # v0.0.25
+        uses: check-spelling/check-spelling@a35147f799f30f8739c33f92222c847214e82e67 # v0.0.26 (see check-spelling/check-spelling/issues/103)
         with:
           suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
           checkout: true

From 1152614bc73e74df27986d1bff7864a376025544 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 6 Apr 2026 09:32:37 -0400
Subject: [PATCH 103/326] chore(ci): collect K8s diagnostics on E2E test
 failure (#25114)

Add a diagnostic step to the K8s E2E workflow that runs on failure.
Captures pod logs, events, configs, and node resource usage to avoid
deep manual investigation when tests fail.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/k8s_e2e.yml | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index 5f9ba890ab88f..1df064c5eebc9 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -164,7 +164,7 @@ jobs:
   test-e2e-kubernetes:
     name: K8s ${{ matrix.kubernetes_version.version }} / ${{ matrix.container_runtime }} (${{ matrix.kubernetes_version.role }})
     runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    timeout-minutes: 60
     needs:
       - build-x86_64-unknown-linux-gnu
       - compute-k8s-test-plan
@@ -217,6 +217,37 @@ jobs:
           max_attempts: 3
           command: make test-e2e-kubernetes
 
+      - name: Collect K8s diagnostics on failure
+        if: ${{ !success() }}
+        run: |
+          set +e +o pipefail
+          # Best-effort diagnostics -- never fail the job
+          run_diag() { local label="$1"; shift; echo "--- $label ---"; "$@" 2>&1 || true; echo; }
+          # For commands with pipes that can't be passed as args
+          run_diag_sh() { echo "--- $1 ---"; bash -c "$2" 2>&1 || true; echo; }
+
+          run_diag "Cluster-wide pods" kubectl get pods -A -o wide
+          run_diag "Cluster-wide events" kubectl get events -A --sort-by=.metadata.creationTimestamp
+          run_diag "Nodes" kubectl get nodes -o wide
+
+          for ns in $(kubectl get namespaces -o jsonpath='{.items[*].metadata.name}' 2>/dev/null | tr ' ' '\n' | grep -E '^vector-' || true); do
+            echo "=========================================="
+            echo "=== Namespace: $ns ==="
+            echo "=========================================="
+            run_diag "Pods"             kubectl get pods -n "$ns" -o wide
+            run_diag "Pod descriptions" kubectl describe pods -n "$ns"
+            run_diag "Events"           kubectl get events -n "$ns" --sort-by=.metadata.creationTimestamp
+            run_diag "ConfigMaps"       kubectl get configmaps -n "$ns" -o yaml
+
+            for pod in $(kubectl get pods -n "$ns" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null || true); do
+              run_diag "Logs: $pod"          kubectl logs -n "$ns" "$pod" --all-containers=true --tail=100
+              run_diag "Previous logs: $pod" kubectl logs -n "$ns" "$pod" --all-containers=true --previous --tail=50
+            done
+          done
+
+          run_diag_sh "Node resources" "kubectl describe nodes | grep -A20 'Allocated resources'"
+          run_diag "Minikube logs" minikube logs --length=100
+
   final-result:
     name: K8s E2E Suite
     runs-on: ubuntu-24.04

From cab8fab16b2da5478d495cd37091b525f527d8ba Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 15:37:04 -0400
Subject: [PATCH 104/326] chore(ci): bump the artifact group across 1 directory
 with 2 updates (#24999)

chore(ci): bump the artifact group with 2 updates

Bumps the artifact group with 2 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact).


Updates `actions/upload-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)

Updates `actions/download-artifact` from 7.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/v7...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: artifact
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: artifact
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/check_generated_vrl_docs.yml     |  2 +-
 .../workflows/check_generated_vrl_docs_comment.yml |  2 +-
 .github/workflows/integration.yml                  |  4 ++--
 .github/workflows/k8s_e2e.yml                      |  2 +-
 .github/workflows/publish.yml                      | 14 +++++++-------
 .github/workflows/regression.yml                   | 10 +++++-----
 6 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/check_generated_vrl_docs.yml b/.github/workflows/check_generated_vrl_docs.yml
index 7407b28260685..e183e12578f6e 100644
--- a/.github/workflows/check_generated_vrl_docs.yml
+++ b/.github/workflows/check_generated_vrl_docs.yml
@@ -112,7 +112,7 @@ jobs:
           && steps.last-commit.outputs.is-auto != 'true'
           && github.event_name == 'pull_request'
           && steps.push.outcome != 'success'
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: vrl-docs-check-pr
           path: /tmp/docs-check/pr-number
diff --git a/.github/workflows/check_generated_vrl_docs_comment.yml b/.github/workflows/check_generated_vrl_docs_comment.yml
index 25eed42cfeb28..e455203f75a6b 100644
--- a/.github/workflows/check_generated_vrl_docs_comment.yml
+++ b/.github/workflows/check_generated_vrl_docs_comment.yml
@@ -19,7 +19,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Download PR metadata
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vrl-docs-check-pr
           run-id: ${{ github.event.workflow_run.id }}
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 64cfe8c6da004..cdbba4f19187c 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -115,7 +115,7 @@ jobs:
     timeout-minutes: 90
     steps:
       - name: Download JSON artifact from changes.yml
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         if: github.event_name == 'merge_group'
         with:
           name: int_tests_changes
@@ -179,7 +179,7 @@ jobs:
 
     steps:
       - name: Download JSON artifact from changes.yml
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         if: github.event_name == 'merge_group'
         with:
           name: e2e_tests_changes
diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index 1df064c5eebc9..6432b3a8c810e 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -185,7 +185,7 @@ jobs:
           mold: false
           cargo-cache: false
 
-      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: e2e-test-deb-package
           path: target/artifacts
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4c66ff585e173..239b7f95388f6 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -221,7 +221,7 @@ jobs:
         with:
           ref: ${{ inputs.git_ref }}
       - name: Download staged package artifacts (x86_64-unknown-linux-gnu)
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vector-${{ env.VECTOR_VERSION }}-x86_64-unknown-linux-gnu
           path: target/artifacts
@@ -272,7 +272,7 @@ jobs:
         with:
           ref: ${{ inputs.git_ref }}
       - name: Download staged package artifacts (x86_64-unknown-linux-gnu)
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vector-${{ env.VECTOR_VERSION }}-x86_64-unknown-linux-gnu
           path: target/artifacts
@@ -301,7 +301,7 @@ jobs:
         with:
           ref: ${{ inputs.git_ref }}
       - name: Download staged package artifacts (${{ matrix.target }})
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vector-${{ env.VECTOR_VERSION }}-${{ matrix.target }}
           path: target/artifacts
@@ -351,7 +351,7 @@ jobs:
         with:
           version: latest
       - name: Download all Linux package artifacts
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: vector-${{ env.VECTOR_VERSION }}-*-linux-*
           path: target/artifacts
@@ -394,7 +394,7 @@ jobs:
         with:
           vdev: true
       - name: Download all package artifacts
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: vector-${{ env.VECTOR_VERSION }}-*
           path: target/artifacts
@@ -434,7 +434,7 @@ jobs:
         with:
           vdev: true
       - name: Download all package artifacts
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: vector-${{ env.VECTOR_VERSION }}-*
           path: target/artifacts
@@ -461,7 +461,7 @@ jobs:
         with:
           ref: ${{ inputs.git_ref }}
       - name: Download all package artifacts
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: vector-${{ env.VECTOR_VERSION }}-*
           path: target/artifacts
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 5a3e1d252b72a..cc1170a8aaa21 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -311,7 +311,7 @@ jobs:
       id-token: write # Required for GitHub OIDC token exchange
     steps:
       - name: "Download baseline image"
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: baseline-image
 
@@ -354,7 +354,7 @@ jobs:
       id-token: write # Required for GitHub OIDC token exchange
     steps:
       - name: "Download comparison image"
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: comparison-image
 
@@ -491,7 +491,7 @@ jobs:
           aws s3 cp s3://smp-cli-releases/v${{ needs.resolve-inputs.outputs.smp-version }}/x86_64-unknown-linux-musl/smp ${{ runner.temp }}/bin/smp
 
       - name: Download submission metadata
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vector-submission-metadata
           path: ${{ runner.temp }}/
@@ -535,7 +535,7 @@ jobs:
           aws s3 cp s3://smp-cli-releases/v${{ needs.resolve-inputs.outputs.smp-version }}/x86_64-unknown-linux-musl/smp ${{ runner.temp }}/bin/smp
 
       - name: Download submission metadata
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: vector-submission-metadata
           path: ${{ runner.temp }}/
@@ -581,7 +581,7 @@ jobs:
     steps:
       - name: Download capture-artifacts
         continue-on-error: true
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: capture-artifacts
 

From 4b2353a35dd54b888cdee7d1ca70c8723e12873c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 15:46:52 -0400
Subject: [PATCH 105/326] chore(ci): bump nick-fields/retry from 3.0.2 to 4.0.0
 (#25102)

Bumps [nick-fields/retry](https://github.com/nick-fields/retry) from 3.0.2 to 4.0.0.
- [Release notes](https://github.com/nick-fields/retry/releases)
- [Commits](https://github.com/nick-fields/retry/compare/ce71cc2ab81d554ebbe88c79ab5975992d79ba08...ad984534de44a9489a53aefd81eb77f87c70dc60)

---
updated-dependencies:
- dependency-name: nick-fields/retry
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci-integration-review.yml | 4 ++--
 .github/workflows/integration.yml           | 4 ++--
 .github/workflows/k8s_e2e.yml               | 2 +-
 .github/workflows/publish.yml               | 2 +-
 .github/workflows/unit_mac.yml              | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci-integration-review.yml b/.github/workflows/ci-integration-review.yml
index 67fae9ea864d7..77b20b347e318 100644
--- a/.github/workflows/ci-integration-review.yml
+++ b/.github/workflows/ci-integration-review.yml
@@ -174,7 +174,7 @@ jobs:
 
       - name: Integration Tests - ${{ matrix.service }}
         if: steps.run_condition.outputs.should_run == 'true'
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         with:
           timeout_minutes: 30
           max_attempts: 3
@@ -228,7 +228,7 @@ jobs:
 
       - name: E2E Tests - ${{ matrix.service }}
         if: steps.run_condition.outputs.should_run == 'true'
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         with:
           timeout_minutes: 35
           max_attempts: 3
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index cdbba4f19187c..2c1e91c57a8e7 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -158,7 +158,7 @@ jobs:
 
       - name: Run Integration Tests for ${{ matrix.service }}
         if: steps.check.outputs.should_run == 'true'
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         with:
           timeout_minutes: 30
           max_attempts: 3
@@ -222,7 +222,7 @@ jobs:
 
       - name: Run E2E Tests for ${{ matrix.service }}
         if: steps.check.outputs.should_run == 'true'
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         with:
           timeout_minutes: 30
           max_attempts: 3
diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index 6432b3a8c810e..3b35ec0b7b9dc 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -206,7 +206,7 @@ jobs:
 
       # TODO: This job has been quite flakey. Need to investigate further and then remove the retries.
       - name: Run tests
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         env:
           USE_MINIKUBE_CACHE: "true"
           SKIP_PACKAGE_DEB: "true"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 239b7f95388f6..d5093f229017c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -363,7 +363,7 @@ jobs:
         env:
           PLATFORM: "linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6"
           REPOS: "timberio/vector,ghcr.io/vectordotdev/vector"
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         with:
           timeout_minutes: 15
           max_attempts: 3
diff --git a/.github/workflows/unit_mac.yml b/.github/workflows/unit_mac.yml
index e0d367b530959..a44a84d368953 100644
--- a/.github/workflows/unit_mac.yml
+++ b/.github/workflows/unit_mac.yml
@@ -31,7 +31,7 @@ jobs:
 
       # Some tests e.g. `reader_exits_cleanly_when_writer_done_and_in_flight_acks` are flaky.
       - name: Run tests
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
         with:
           timeout_minutes: 45
           max_attempts: 3

From 9e897388fbf772a23c48df93de923a05b2d3ecbe Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 20:05:11 +0000
Subject: [PATCH 106/326] chore(deps): bump fast-xml-parser from 5.3.7 to 5.5.9
 in /scripts/environment/npm-tools in the npm_and_yarn group across 1
 directory (#25127)

chore(deps): bump fast-xml-parser

Bumps the npm_and_yarn group with 1 update in the /scripts/environment/npm-tools directory: [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser).


Updates `fast-xml-parser` from 5.3.7 to 5.5.9
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.3.7...v5.5.9)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.5.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 .../environment/npm-tools/package-lock.json   | 192 ++++++++++--------
 scripts/environment/npm-tools/package.json    |   2 +-
 2 files changed, 113 insertions(+), 81 deletions(-)

diff --git a/scripts/environment/npm-tools/package-lock.json b/scripts/environment/npm-tools/package-lock.json
index e3d4efa122515..1047d5444f89a 100644
--- a/scripts/environment/npm-tools/package-lock.json
+++ b/scripts/environment/npm-tools/package-lock.json
@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "@datadog/datadog-ci": "5.11.0",
+        "@datadog/datadog-ci": "5.12.0",
         "markdownlint-cli2": "0.22.0",
         "prettier": "3.8.1"
       }
@@ -24,19 +24,19 @@
       }
     },
     "node_modules/@datadog/datadog-ci": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci/-/datadog-ci-5.11.0.tgz",
-      "integrity": "sha512-4N/WsfnQVYJNxGtDIOhg4sUkZalDo8h+toSXR/GAw6XU81e1bOj3GvleL6IHUQ06KyPdurqPZKB4Za1CbCsT7g==",
+      "version": "5.12.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci/-/datadog-ci-5.12.0.tgz",
+      "integrity": "sha512-8zJOgx0ouVZtspXTGdx327Yt6UiRnaQSlMc7c343a1HaKC9nIlQhnd90G1frFZhopiqA1KD8h9CWBhygxAJW7w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@datadog/datadog-ci-base": "5.11.0",
-        "@datadog/datadog-ci-plugin-coverage": "5.11.0",
-        "@datadog/datadog-ci-plugin-deployment": "5.11.0",
-        "@datadog/datadog-ci-plugin-dora": "5.11.0",
-        "@datadog/datadog-ci-plugin-gate": "5.11.0",
-        "@datadog/datadog-ci-plugin-junit": "5.11.0",
-        "@datadog/datadog-ci-plugin-sarif": "5.11.0",
-        "@datadog/datadog-ci-plugin-sbom": "5.11.0",
+        "@datadog/datadog-ci-base": "5.12.0",
+        "@datadog/datadog-ci-plugin-coverage": "5.12.0",
+        "@datadog/datadog-ci-plugin-deployment": "5.12.0",
+        "@datadog/datadog-ci-plugin-dora": "5.12.0",
+        "@datadog/datadog-ci-plugin-gate": "5.12.0",
+        "@datadog/datadog-ci-plugin-junit": "5.12.0",
+        "@datadog/datadog-ci-plugin-sarif": "5.12.0",
+        "@datadog/datadog-ci-plugin-sbom": "5.12.0",
         "clipanion": "3.2.1",
         "typanion": "3.14.0"
       },
@@ -48,23 +48,23 @@
       }
     },
     "node_modules/@datadog/datadog-ci-base": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-base/-/datadog-ci-base-5.11.0.tgz",
-      "integrity": "sha512-NACS6zhf2qidgpgrhQH0EJn4x20pwyRAhw75jBRPmjzheaXrpU0438e3kutyNsDGZrw8gHjuRqiccoY3QU7PSQ==",
+      "version": "5.12.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-base/-/datadog-ci-base-5.12.0.tgz",
+      "integrity": "sha512-ZyobD2nbzwRksWiYvcxl3ZuYE4+AX1is26qjWAs1ufhVyGBCx1cVqiDFEAILeyqkncZYIFGppjCyjUcxev+CBg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@antfu/install-pkg": "1.1.0",
         "@types/datadog-metrics": "0.6.1",
-        "async-retry": "1.3.1",
+        "async-retry": "1.3.3",
         "axios": "1.13.5",
         "chalk": "3.0.0",
         "clipanion": "3.2.1",
         "datadog-metrics": "0.9.3",
         "debug": "4.4.1",
         "deep-extend": "0.6.0",
-        "fast-xml-parser": "5.3.7",
+        "fast-xml-parser": "5.5.9",
         "form-data": "4.0.4",
-        "glob": "13.0.5",
+        "glob": "13.0.6",
         "inquirer": "8.2.7",
         "is-docker": "4.0.0",
         "jest-diff": "30.2.0",
@@ -79,17 +79,17 @@
         "upath": "2.0.1"
       },
       "peerDependencies": {
-        "@datadog/datadog-ci-plugin-aas": "5.11.0",
-        "@datadog/datadog-ci-plugin-cloud-run": "5.11.0",
-        "@datadog/datadog-ci-plugin-container-app": "5.11.0",
-        "@datadog/datadog-ci-plugin-coverage": "5.11.0",
-        "@datadog/datadog-ci-plugin-deployment": "5.11.0",
-        "@datadog/datadog-ci-plugin-dora": "5.11.0",
-        "@datadog/datadog-ci-plugin-gate": "5.11.0",
-        "@datadog/datadog-ci-plugin-junit": "5.11.0",
-        "@datadog/datadog-ci-plugin-lambda": "5.11.0",
-        "@datadog/datadog-ci-plugin-sarif": "5.11.0",
-        "@datadog/datadog-ci-plugin-sbom": "5.11.0",
+        "@datadog/datadog-ci-plugin-aas": "5.12.0",
+        "@datadog/datadog-ci-plugin-cloud-run": "5.12.0",
+        "@datadog/datadog-ci-plugin-container-app": "5.12.0",
+        "@datadog/datadog-ci-plugin-coverage": "5.12.0",
+        "@datadog/datadog-ci-plugin-deployment": "5.12.0",
+        "@datadog/datadog-ci-plugin-dora": "5.12.0",
+        "@datadog/datadog-ci-plugin-gate": "5.12.0",
+        "@datadog/datadog-ci-plugin-junit": "5.12.0",
+        "@datadog/datadog-ci-plugin-lambda": "5.12.0",
+        "@datadog/datadog-ci-plugin-sarif": "5.12.0",
+        "@datadog/datadog-ci-plugin-sbom": "5.12.0",
         "@datadog/datadog-ci-plugin-stepfunctions": "5.11.0",
         "@datadog/datadog-ci-plugin-synthetics": "5.11.0",
         "@datadog/datadog-ci-plugin-terraform": "5.11.0"
@@ -157,24 +157,24 @@
       }
     },
     "node_modules/@datadog/datadog-ci-plugin-coverage": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-coverage/-/datadog-ci-plugin-coverage-5.11.0.tgz",
-      "integrity": "sha512-aKzkjbd/NVt+7Sd4QL0qVqUrnyMG0UF63lvNxve7suWQDoIWowAgCPa0ta+jpMYUYCGtjt74H3wL+q0W0G+D+Q==",
+      "version": "5.12.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-coverage/-/datadog-ci-plugin-coverage-5.12.0.tgz",
+      "integrity": "sha512-ll4aBYF+FMOlOjAnNiPjO8iPmVB/qfBHrUOCk2EMnOaQn6Eve/FajCaSqeV2BoI9+3UXv04P6eH5nxPtpcM/cg==",
       "license": "Apache-2.0",
       "dependencies": {
         "chalk": "3.0.0",
-        "fast-xml-parser": "5.3.7",
+        "fast-xml-parser": "5.5.9",
         "form-data": "4.0.4",
         "upath": "2.0.1"
       },
       "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.11.0"
+        "@datadog/datadog-ci-base": "5.12.0"
       }
     },
     "node_modules/@datadog/datadog-ci-plugin-deployment": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-deployment/-/datadog-ci-plugin-deployment-5.11.0.tgz",
-      "integrity": "sha512-FF9L7alDz1XN5L3nYR7xMeZd99U6kxkT+InSyZY21ZHpcuuEngseW1aMgB0iFn3lxZ+1H4z196uCckViTEkjog==",
+      "version": "5.12.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-deployment/-/datadog-ci-plugin-deployment-5.12.0.tgz",
+      "integrity": "sha512-6KDwUmdxwGxYoBEYqAY0uo7ocvtTq3p3cXW4KjpDXwZyr1wWstzXQxTx7qquZzMMNvsD6JCq+HDqwdTgaHSAog==",
       "license": "Apache-2.0",
       "dependencies": {
         "axios": "1.13.5",
@@ -182,26 +182,26 @@
         "simple-git": "3.33.0"
       },
       "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.11.0"
+        "@datadog/datadog-ci-base": "5.12.0"
       }
     },
     "node_modules/@datadog/datadog-ci-plugin-dora": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-dora/-/datadog-ci-plugin-dora-5.11.0.tgz",
-      "integrity": "sha512-DWSyT2tW23XOYCvTEHvD/F9FRIffTN+2wZGYojaD1LM9wJew4xievziBwyD46quCF0OdsbGMLvAyR2hyrrYeZA==",
+      "version": "5.12.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-dora/-/datadog-ci-plugin-dora-5.12.0.tgz",
+      "integrity": "sha512-HrC6H5lLzRTv3tKiS2f5YMU/WWwgzMF2kHIJU6+pe0y/v1xUYCELV112XYldbg3dkENfpG/AwjUeO6B8rE3s+g==",
       "license": "Apache-2.0",
       "dependencies": {
         "chalk": "3.0.0",
         "simple-git": "3.33.0"
       },
       "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.11.0"
+        "@datadog/datadog-ci-base": "5.12.0"
       }
     },
     "node_modules/@datadog/datadog-ci-plugin-gate": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-gate/-/datadog-ci-plugin-gate-5.11.0.tgz",
-      "integrity": "sha512-WUNr6y292eH+sumAyD5rFhqlU/aJ8vN74h4EJj0SqDpnrDCzMnSDgRyb9GXhv8ZO4GOW6LTEcPmMZhyfYL3b5g==",
+      "version": "5.12.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-gate/-/datadog-ci-plugin-gate-5.12.0.tgz",
+      "integrity": "sha512-YNZuRigmGDGK2tK6xRsaq0PPx/4CRVZ4U6q7xabIP+jmhoG7mbI1RFUjlXSnGfeU1SXm0bVQw8F69AcZCHtNOA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@types/uuid": "9.0.8",
@@ -209,29 +209,29 @@
         "uuid": "9.0.1"
       },
       "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.11.0"
+        "@datadog/datadog-ci-base": "5.12.0"
       }
     },
     "node_modules/@datadog/datadog-ci-plugin-junit": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-junit/-/datadog-ci-plugin-junit-5.11.0.tgz",
-      "integrity": "sha512-I8H09jNR/LDYqiy7TOKv9Gu4+t/o0J6QH6cooKrNboULSDYijVo6w3knANsd2m3Hlcbi1QkTmNpPXIdeGR5Dig==",
+      "version": "5.12.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-junit/-/datadog-ci-plugin-junit-5.12.0.tgz",
+      "integrity": "sha512-XPVULYU1RUN2kFmSWGfAgU+psGFhPu+5NxnHeAQubs/wYcGwdZUEAD2+tn4F3PxpCkTduEb4FO6mLpYbjBpuqA==",
       "license": "Apache-2.0",
       "dependencies": {
         "chalk": "3.0.0",
-        "fast-xml-parser": "5.3.7",
+        "fast-xml-parser": "5.5.9",
         "form-data": "4.0.4",
         "upath": "2.0.1",
         "uuid": "9.0.1"
       },
       "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.11.0"
+        "@datadog/datadog-ci-base": "5.12.0"
       }
     },
     "node_modules/@datadog/datadog-ci-plugin-sarif": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-sarif/-/datadog-ci-plugin-sarif-5.11.0.tgz",
-      "integrity": "sha512-JZuqNzFsW9BZeStLM60f5zdEpG67kh7xqgbeJhqIcloEpDJIEmsJHH487PM0stakcqhhIfzUzvEW744LLQg5Ug==",
+      "version": "5.12.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-sarif/-/datadog-ci-plugin-sarif-5.12.0.tgz",
+      "integrity": "sha512-tmUEv6sJWsFG9vnriSu9RZSrLvYo0EfvRaHiiO3ufxBC+NvU0HZYhtTqXVT6NnsUSVv/2FBnzl0hCnPDHhyBFg==",
       "license": "Apache-2.0",
       "dependencies": {
         "ajv": "8.18.0",
@@ -242,13 +242,13 @@
         "uuid": "9.0.1"
       },
       "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.11.0"
+        "@datadog/datadog-ci-base": "5.12.0"
       }
     },
     "node_modules/@datadog/datadog-ci-plugin-sbom": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-sbom/-/datadog-ci-plugin-sbom-5.11.0.tgz",
-      "integrity": "sha512-lHU65a1Hru7SiwhZtZ9OTd6vyPcRG2U/61imVpvLvhEMSwY2xSLTtZfxWbMi4VJxq81V2zhdifxP5BMJO1FnHw==",
+      "version": "5.12.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-sbom/-/datadog-ci-plugin-sbom-5.12.0.tgz",
+      "integrity": "sha512-F0c0gfX4O+Qm1heLEhNCTl/tUPlVQvyFGYTUqJ0Z2niqT4Y3z7Oi6RSodgUSwGCKl6bwacRjTTdCrzI3V0n3nA==",
       "license": "Apache-2.0",
       "dependencies": {
         "ajv": "8.18.0",
@@ -258,7 +258,7 @@
         "packageurl-js": "2.0.1"
       },
       "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.11.0"
+        "@datadog/datadog-ci-base": "5.12.0"
       }
     },
     "node_modules/@inquirer/external-editor": {
@@ -525,12 +525,12 @@
       }
     },
     "node_modules/async-retry": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/async-retry/-/async-retry-1.3.1.tgz",
-      "integrity": "sha512-aiieFW/7h3hY0Bq5d+ktDBejxuwR78vRu9hDUdR8rNhSaQ29VzPL4AoIRG7D/c7tdenwOcKvgPM6tIxB3cB6HA==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/async-retry/-/async-retry-1.3.3.tgz",
+      "integrity": "sha512-wfr/jstw9xNi/0teMHrRW7dsz3Lt5ARhYNZ2ewpadnhaIp5mbALhOAP+EAdsC7t4Z6wqsDVv9+W6gm1Dk9mEyw==",
       "license": "MIT",
       "dependencies": {
-        "retry": "0.12.0"
+        "retry": "0.13.1"
       }
     },
     "node_modules/asynckit": {
@@ -1178,10 +1178,25 @@
       ],
       "license": "BSD-3-Clause"
     },
+    "node_modules/fast-xml-builder": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz",
+      "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "path-expression-matcher": "^1.1.3"
+      }
+    },
     "node_modules/fast-xml-parser": {
-      "version": "5.3.7",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.7.tgz",
-      "integrity": "sha512-JzVLro9NQv92pOM/jTCR6mHlJh2FGwtomH8ZQjhFj/R29P2Fnj38OgPJVtcvYw6SuKClhgYuwUZf5b3rd8u2mA==",
+      "version": "5.5.9",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.9.tgz",
+      "integrity": "sha512-jldvxr1MC6rtiZKgrFnDSvT8xuH+eJqxqOBThUVjYrxssYTo1avZLGql5l0a0BAERR01CadYzZ83kVEkbyDg+g==",
       "funding": [
         {
           "type": "github",
@@ -1190,7 +1205,9 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "strnum": "^2.1.2"
+        "fast-xml-builder": "^1.1.4",
+        "path-expression-matcher": "^1.2.0",
+        "strnum": "^2.2.2"
       },
       "bin": {
         "fxparser": "src/cli/cli.js"
@@ -1341,17 +1358,17 @@
       }
     },
     "node_modules/glob": {
-      "version": "13.0.5",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.5.tgz",
-      "integrity": "sha512-BzXxZg24Ibra1pbQ/zE7Kys4Ua1ks7Bn6pKLkVPZ9FZe4JQS6/Q7ef3LG1H+k7lUf5l4T3PLSyYyYJVYUvfgTw==",
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "minimatch": "^10.2.1",
-        "minipass": "^7.1.2",
-        "path-scurry": "^2.0.0"
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -1884,9 +1901,9 @@
       }
     },
     "node_modules/lru-cache": {
-      "version": "11.2.7",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.7.tgz",
-      "integrity": "sha512-aY/R+aEsRelme17KGQa/1ZSIpLpNYYrhcrepKTZgE+W3WM16YMCaPwOHLHsmopZHELU0Ojin1lPVxKR0MihncA==",
+      "version": "11.3.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.3.0.tgz",
+      "integrity": "sha512-sr8xPKE25m6vJVcrdn6NxtC0fVfuPowbscLypegRgOm0yXSqr5JNHCAY3hnusdJ7HRBW04j6Ip4khvHU778DuQ==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
@@ -2768,6 +2785,21 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
+    "node_modules/path-expression-matcher": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.2.1.tgz",
+      "integrity": "sha512-d7gQQmLvAKXKXE2GeP9apIGbMYKz88zWdsn/BN2HRWVQsDFdUY36WSLTY0Jvd4HWi7Fb30gQ62oAOzdgJA6fZw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/path-scurry": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
@@ -2965,9 +2997,9 @@
       }
     },
     "node_modules/retry": {
-      "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
-      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
+      "version": "0.13.1",
+      "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
+      "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
       "license": "MIT",
       "engines": {
         "node": ">= 4"
diff --git a/scripts/environment/npm-tools/package.json b/scripts/environment/npm-tools/package.json
index 30d63057b7fed..a7ec2311e71d2 100644
--- a/scripts/environment/npm-tools/package.json
+++ b/scripts/environment/npm-tools/package.json
@@ -2,7 +2,7 @@
   "private": true,
   "description": "Pinned npm tools for CI. Run 'npm ci' to install with exact versions from package-lock.json.",
   "dependencies": {
-    "@datadog/datadog-ci": "5.11.0",
+    "@datadog/datadog-ci": "5.12.0",
     "markdownlint-cli2": "0.22.0",
     "prettier": "3.8.1"
   }

From 0c5fd58228bfab0dd9f6e81a1dc651da2ea8e670 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 7 Apr 2026 12:14:58 -0400
Subject: [PATCH 107/326] chore(api top): improve dashboard column layout
 (#25135)

enhancement(vector top): improve dashboard column layout

- Move Errors column to always be last (after Memory Used when
  allocation-tracing is enabled)
- Slightly increase Kind column width (+1%) and decrease Errors (-1%)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 lib/vector-top/src/dashboard.rs | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/lib/vector-top/src/dashboard.rs b/lib/vector-top/src/dashboard.rs
index 1b73d5b89e9c8..8f54c48534f71 100644
--- a/lib/vector-top/src/dashboard.rs
+++ b/lib/vector-top/src/dashboard.rs
@@ -170,9 +170,9 @@ static HEADER: [&str; NUM_COLUMNS] = [
     columns::BYTES_IN,
     columns::EVENTS_OUT,
     columns::BYTES_OUT,
-    columns::ERRORS,
     #[cfg(feature = "allocation-tracing")]
     columns::MEMORY_USED,
+    columns::ERRORS,
 ];
 
 struct Widgets<'a> {
@@ -348,13 +348,13 @@ impl<'a> Widgets<'a> {
                     r.sent_bytes_throughput_sec,
                     self.human_metrics,
                 ),
+                #[cfg(feature = "allocation-tracing")]
+                r.allocated_bytes.human_format_bytes(),
                 if self.human_metrics {
                     r.errors.human_format()
                 } else {
                     r.errors.thousands_format()
                 },
-                #[cfg(feature = "allocation-tracing")]
-                r.allocated_bytes.human_format_bytes(),
             ];
 
             data.extend_from_slice(&formatted_metrics);
@@ -383,26 +383,26 @@ impl<'a> Widgets<'a> {
             &[
                 Constraint::Percentage(13), // ID
                 Constraint::Percentage(8),  // Output
-                Constraint::Percentage(4),  // Kind
+                Constraint::Percentage(5),  // Kind
                 Constraint::Percentage(9),  // Type
                 Constraint::Percentage(10), // Events In
                 Constraint::Percentage(12), // Bytes In
                 Constraint::Percentage(10), // Events Out
                 Constraint::Percentage(12), // Bytes Out
-                Constraint::Percentage(8),  // Errors
-                Constraint::Percentage(14), // Allocated Bytes
+                Constraint::Percentage(14), // Memory Used
+                Constraint::Percentage(7),  // Errors
             ]
         } else {
             &[
                 Constraint::Percentage(13), // ID
                 Constraint::Percentage(12), // Output
-                Constraint::Percentage(9),  // Kind
+                Constraint::Percentage(10), // Kind
                 Constraint::Percentage(6),  // Type
                 Constraint::Percentage(12), // Events In
                 Constraint::Percentage(14), // Bytes In
                 Constraint::Percentage(12), // Events Out
                 Constraint::Percentage(14), // Bytes Out
-                Constraint::Percentage(8),  // Errors
+                Constraint::Percentage(7),  // Errors
             ]
         };
         let w = Table::new(items, widths)

From 02f281d6ad2786f8bbfad9ece820b8d9f4925571 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 7 Apr 2026 15:38:29 -0400
Subject: [PATCH 108/326] enhancement(api top): show "disabled" in Memory Used
 when allocation tracing is off (#25138)

* enhancement(vector top): show "disabled" in Memory Used when allocation tracing is off

Add GetAllocationTracingStatus gRPC endpoint that reports whether
the connected Vector instance has --allocation-tracing active.
vector-top queries this on startup and shows "disabled" in the
Memory Used column when tracing is off, instead of misleading zeros.

Changes:
- proto: add GetAllocationTracingStatus RPC and messages
- service.rs: implement the endpoint using is_allocation_tracing_enabled()
- client.rs: add get_allocation_tracing_status() method
- metrics.rs: query the endpoint on startup, store result in State
- state.rs: add allocation_tracing_active field to State
- dashboard.rs: show "disabled" when allocation_tracing_active is false

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: add changelog fragment for Memory Used disabled label

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* add authors

* fix(api): guard allocation tracing RPC behind cfg feature flag

The `get_allocation_tracing_status` RPC handler unconditionally called
`is_allocation_tracing_enabled()`, which only exists behind the
`allocation-tracing` feature gate. This broke builds on feature sets
that lack it (e.g. `default-msvc`). Add cfg guards so the handler
returns `false` when the feature is absent.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 ...tor_top_disabled_memory_used.enhancement.md |  3 +++
 lib/vector-api-client/src/client.rs            | 12 ++++++++++++
 lib/vector-top/src/dashboard.rs                |  6 +++++-
 lib/vector-top/src/metrics.rs                  | 18 +++++++++++++++++-
 lib/vector-top/src/state.rs                    |  6 ++++++
 proto/vector/observability.proto               |  9 +++++++++
 src/api/grpc/service.rs                        | 13 +++++++++++++
 7 files changed, 65 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/vector_top_disabled_memory_used.enhancement.md

diff --git a/changelog.d/vector_top_disabled_memory_used.enhancement.md b/changelog.d/vector_top_disabled_memory_used.enhancement.md
new file mode 100644
index 0000000000000..e929a065019ef
--- /dev/null
+++ b/changelog.d/vector_top_disabled_memory_used.enhancement.md
@@ -0,0 +1,3 @@
+`vector top` terminal UI now shows `disabled` in the Memory Used column when the connected Vector instance was not started with `--allocation-tracing`, instead of displaying misleading zeros. A new `GetAllocationTracingStatus` gRPC endpoint is queried on connect to determine the status.
+
+authors: pront
diff --git a/lib/vector-api-client/src/client.rs b/lib/vector-api-client/src/client.rs
index d4991efef0894..fcba2702a3e2a 100644
--- a/lib/vector-api-client/src/client.rs
+++ b/lib/vector-api-client/src/client.rs
@@ -5,6 +5,7 @@ use tonic::transport::{Channel, Endpoint};
 use crate::{
     error::{Error, Result},
     proto::{
+        GetAllocationTracingStatusRequest, GetAllocationTracingStatusResponse,
         GetComponentsRequest, GetComponentsResponse, GetMetaRequest, GetMetaResponse,
         HealthRequest, HealthResponse, MetricName, StreamComponentAllocatedBytesRequest,
         StreamComponentAllocatedBytesResponse, StreamComponentMetricsRequest,
@@ -77,6 +78,17 @@ impl Client {
         Ok(response.into_inner())
     }
 
+    /// Check whether allocation tracing is active on the connected Vector instance
+    pub async fn get_allocation_tracing_status(
+        &mut self,
+    ) -> Result<GetAllocationTracingStatusResponse> {
+        let client = self.ensure_connected()?;
+        let response = client
+            .get_allocation_tracing_status(GetAllocationTracingStatusRequest {})
+            .await?;
+        Ok(response.into_inner())
+    }
+
     // ========== Streaming RPCs ==========
 
     /// Stream periodic heartbeat timestamps
diff --git a/lib/vector-top/src/dashboard.rs b/lib/vector-top/src/dashboard.rs
index 8f54c48534f71..9e6a1907dff36 100644
--- a/lib/vector-top/src/dashboard.rs
+++ b/lib/vector-top/src/dashboard.rs
@@ -349,7 +349,11 @@ impl<'a> Widgets<'a> {
                     self.human_metrics,
                 ),
                 #[cfg(feature = "allocation-tracing")]
-                r.allocated_bytes.human_format_bytes(),
+                if state.allocation_tracing_active {
+                    r.allocated_bytes.human_format_bytes()
+                } else {
+                    "disabled".to_string()
+                },
                 if self.human_metrics {
                     r.errors.human_format()
                 } else {
diff --git a/lib/vector-top/src/metrics.rs b/lib/vector-top/src/metrics.rs
index 52cf46beff244..63328a62825f0 100644
--- a/lib/vector-top/src/metrics.rs
+++ b/lib/vector-top/src/metrics.rs
@@ -569,5 +569,21 @@ pub async fn init_components(
         })
         .collect::<BTreeMap<_, _>>();
 
-    Ok(state::State::new(rows))
+    let mut state = state::State::new(rows);
+
+    #[cfg(feature = "allocation-tracing")]
+    {
+        // Allocation tracing is a compile-time + startup-time setting on the
+        // server, so querying once per connection is sufficient. On error
+        // (e.g. older server without this RPC) we default to false, matching
+        // pre-existing behavior. This is re-evaluated on every reconnect via
+        // the retry loop in `subscription()`.
+        state.allocation_tracing_active = client
+            .get_allocation_tracing_status()
+            .await
+            .map(|r| r.enabled)
+            .unwrap_or(false);
+    }
+
+    Ok(state)
 }
diff --git a/lib/vector-top/src/state.rs b/lib/vector-top/src/state.rs
index a954c804ce467..30fc05ef76c13 100644
--- a/lib/vector-top/src/state.rs
+++ b/lib/vector-top/src/state.rs
@@ -122,6 +122,10 @@ pub struct State {
     pub sort_state: SortState,
     pub filter_state: FilterState,
     pub ui: UiState,
+    /// Set to `true` once we receive the first `AllocatedBytes` event,
+    /// indicating the connected Vector instance has allocation tracing active.
+    #[cfg(feature = "allocation-tracing")]
+    pub allocation_tracing_active: bool,
 }
 
 #[derive(Debug, Clone, Copy)]
@@ -343,6 +347,8 @@ impl State {
             ui: UiState::default(),
             sort_state: SortState::default(),
             filter_state: FilterState::default(),
+            #[cfg(feature = "allocation-tracing")]
+            allocation_tracing_active: false,
         }
     }
 
diff --git a/proto/vector/observability.proto b/proto/vector/observability.proto
index 1c1d508e5d26c..9996a47908949 100644
--- a/proto/vector/observability.proto
+++ b/proto/vector/observability.proto
@@ -17,6 +17,9 @@ service ObservabilityService {
   // Get information about configured components (sources, transforms, sinks)
   rpc GetComponents(GetComponentsRequest) returns (GetComponentsResponse);
 
+  // Check whether allocation tracing is active on this instance
+  rpc GetAllocationTracingStatus(GetAllocationTracingStatusRequest) returns (GetAllocationTracingStatusResponse);
+
   // ========== Real-time Metric Streams ==========
   // All streaming RPCs send periodic updates at the specified interval
 
@@ -54,6 +57,12 @@ message GetMetaResponse {
   string hostname = 2;
 }
 
+message GetAllocationTracingStatusRequest {}
+
+message GetAllocationTracingStatusResponse {
+  bool enabled = 1;
+}
+
 // ========== Component Messages ==========
 
 message GetComponentsRequest {
diff --git a/src/api/grpc/service.rs b/src/api/grpc/service.rs
index 171f65853cc91..580ebb69b5219 100644
--- a/src/api/grpc/service.rs
+++ b/src/api/grpc/service.rs
@@ -436,6 +436,19 @@ impl observability::Service for ObservabilityService {
         Ok(Response::new(GetMetaResponse { version, hostname }))
     }
 
+    async fn get_allocation_tracing_status(
+        &self,
+        _request: Request<GetAllocationTracingStatusRequest>,
+    ) -> Result<Response<GetAllocationTracingStatusResponse>, Status> {
+        #[cfg(feature = "allocation-tracing")]
+        let enabled = crate::internal_telemetry::allocations::is_allocation_tracing_enabled();
+        #[cfg(not(feature = "allocation-tracing"))]
+        let enabled = false;
+        Ok(Response::new(GetAllocationTracingStatusResponse {
+            enabled,
+        }))
+    }
+
     async fn get_components(
         &self,
         request: Request<GetComponentsRequest>,

From 256db9c12951987ea235a0c5a4a88898d5187642 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 8 Apr 2026 11:32:50 -0400
Subject: [PATCH 109/326] fix(api top): avoid unused-mut warning on Windows
 builds (#25142)

The `allocation-tracing` feature is gated behind `unix`, so on Windows
`state` was never mutated, triggering `-D unused-mut`. Split into two
cfg branches so each path only declares what it needs.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 lib/vector-top/src/metrics.rs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/vector-top/src/metrics.rs b/lib/vector-top/src/metrics.rs
index 63328a62825f0..75aae4456fce6 100644
--- a/lib/vector-top/src/metrics.rs
+++ b/lib/vector-top/src/metrics.rs
@@ -569,8 +569,6 @@ pub async fn init_components(
         })
         .collect::<BTreeMap<_, _>>();
 
-    let mut state = state::State::new(rows);
-
     #[cfg(feature = "allocation-tracing")]
     {
         // Allocation tracing is a compile-time + startup-time setting on the
@@ -578,12 +576,15 @@ pub async fn init_components(
         // (e.g. older server without this RPC) we default to false, matching
         // pre-existing behavior. This is re-evaluated on every reconnect via
         // the retry loop in `subscription()`.
+        let mut state = state::State::new(rows);
         state.allocation_tracing_active = client
             .get_allocation_tracing_status()
             .await
             .map(|r| r.enabled)
             .unwrap_or(false);
+        Ok(state)
     }
 
-    Ok(state)
+    #[cfg(not(feature = "allocation-tracing"))]
+    Ok(state::State::new(rows))
 }

From 711b039fe7a8ddac2296dfe1e78685bb901795e6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 8 Apr 2026 13:30:51 -0400
Subject: [PATCH 110/326] chore(website deps): bump lodash from 4.17.23 to
 4.18.1 in /website (#25113)

Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 website/yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/website/yarn.lock b/website/yarn.lock
index da88eb1b5980f..055e51daa030a 100644
--- a/website/yarn.lock
+++ b/website/yarn.lock
@@ -2815,9 +2815,9 @@ lodash.uniq@^4.5.0:
   integrity sha512-xfBaXQd9ryd9dlSDvnvI0lvxfLJlYAZzXomUYzLKtUeOQvOP5piqAWuGtrhWeqaXK9hhoM/iyJc5AV+XfsX3HQ==
 
 lodash@^4.17.21:
-  version "4.17.23"
-  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.23.tgz#f113b0378386103be4f6893388c73d0bde7f2c5a"
-  integrity sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==
+  version "4.18.1"
+  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.18.1.tgz#ff2b66c1f6326d59513de2407bf881439812771c"
+  integrity sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==
 
 logform@^2.6.0, logform@^2.6.1:
   version "2.6.1"

From dcf98a7ccf54080a74626e9277ac5b2f8340ded8 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 8 Apr 2026 13:37:57 -0400
Subject: [PATCH 111/326] chore: fix spell check CI failures (#25144)

chore: fix spell check failures for gzip'd and schema'd

Replace `gzip'd` with `gzip'ed` (already in the allow list) and
`schema'd` with `schema-based` to fix the Check Spelling CI job.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 rfcs/2021-01-08-5843-encoding-decoding-format-vector.md   | 2 +-
 website/content/en/guides/aws/cloudwatch-logs-firehose.md | 2 +-
 website/cue/reference/releases/0.28.0.cue                 | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/rfcs/2021-01-08-5843-encoding-decoding-format-vector.md b/rfcs/2021-01-08-5843-encoding-decoding-format-vector.md
index 9687c50e06992..59bfd92566555 100644
--- a/rfcs/2021-01-08-5843-encoding-decoding-format-vector.md
+++ b/rfcs/2021-01-08-5843-encoding-decoding-format-vector.md
@@ -248,7 +248,7 @@ Per the data format itself - I haven't found any single conglomerate conclusion
 
 ## Drawbacks
 
-The only drawback to adopting protobuf as the encoding format is that Protobufs can be slightly slower than other schema'd data formats and we don't shed the protobuf tooling overhead.
+The only drawback to adopting protobuf as the encoding format is that Protobufs can be slightly slower than other schema-based data formats and we don't shed the protobuf tooling overhead.
 
 Drawbacks to adopting HTTP/2 are that (like literally any other transport we could pick) it alters our kubernetes deployment handling and if we don't decide to continue to maintain other transports it means needing to appropriately handle the deprecation and removal of our TCP and HTTP/1.1 implementations fairly soon afterwards.
 
diff --git a/website/content/en/guides/aws/cloudwatch-logs-firehose.md b/website/content/en/guides/aws/cloudwatch-logs-firehose.md
index 8323be561df9c..02c4e48b40146 100644
--- a/website/content/en/guides/aws/cloudwatch-logs-firehose.md
+++ b/website/content/en/guides/aws/cloudwatch-logs-firehose.md
@@ -457,7 +457,7 @@ The [`aws_kinesis_firehose`][aws_kinesis_firehose] source:
   access_key = "my secret key" # this will also be set in the Firehose config
 ```
 
-will accept this request, decode the record (which is gzip'd and then base64 encoded), to produce an event that looks like:
+will accept this request, decode the record (which is gzip'ed and then base64 encoded), to produce an event that looks like:
 
 ```json
 {
diff --git a/website/cue/reference/releases/0.28.0.cue b/website/cue/reference/releases/0.28.0.cue
index 91032cae68694..7d44ba72e215b 100644
--- a/website/cue/reference/releases/0.28.0.cue
+++ b/website/cue/reference/releases/0.28.0.cue
@@ -144,7 +144,7 @@ releases: "0.28.0": {
 			type: "feat"
 			scopes: ["vrl: stdlib"]
 			description: """
-				`encode_gzip` and `decode_gzip` functions were added to VRL to interact with gzip'd
+				`encode_gzip` and `decode_gzip` functions were added to VRL to interact with gzip'ed
 				data.
 				"""
 			contributors: ["zamazan4ik"]

From 30d9a58669556a9bc014ba0b2ea4f33f8e372d98 Mon Sep 17 00:00:00 2001
From: Jed Laundry <jlaundry@jlaundry.com>
Date: Thu, 9 Apr 2026 05:43:50 +1200
Subject: [PATCH 112/326] feat(azure_blob sink): Expand support for Azure
 authentication types (#24729)

* start by moving auth config to azure_common

* add auth to azure_blob

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* initial auth switch

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* integration test WIP

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* doc updates

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* add feature changelog

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* clippy changes

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* add account_name and blob_endpoint options

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* remove block_in_place

* add ClientCertificateCredential

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* remake certificate with required attributes

* refactor integration tests to support both connection string and oauth

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* update doc examples

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* make clippy happy

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* fix tests

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* make "client_secret_credential" explicitly configured

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* add azure_logs_ingestion to Azure integration tests

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* Err out the other TlsConfig options

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* Add warning message to connection_string

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* Simplify TlsConfig

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* add workload identity config options

* Move warning into docs::warnings

* Properly regenerate cue file

* Fix spaces

* tidy options creation

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* add UAMI type option

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* add note about breaking change

* propagate credential errors instead of panicking

* automatic Cargo lock change

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* clarify PEM cert file

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* action test fixes

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* allow sinks-azure_logs_ingestion to build without sinks-azure_blob

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* require auth when using account_name or blob_endpoint

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* add dep:base64

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>

* check-fmt changes

* space diff fix

---------

Signed-off-by: Jed Laundry <jlaundry@jlaundry.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 .github/actions/spelling/allow.txt            |   2 +
 .github/actions/spelling/expect.txt           |   1 +
 Cargo.lock                                    |   1 +
 Cargo.toml                                    |  10 +-
 ...24729_azure_blob_authentication.feature.md |   3 +
 .../24729_azure_logs_ingestion.breaking.md    |   3 +
 src/sinks/azure_blob/config.rs                |  88 ++-
 src/sinks/azure_blob/integration_tests.rs     | 174 ++++--
 src/sinks/azure_blob/test.rs                  | 320 +++++++++++
 src/sinks/azure_common/config.rs              | 534 +++++++++++++++++-
 src/sinks/azure_logs_ingestion/config.rs      | 200 +------
 src/sinks/azure_logs_ingestion/tests.rs       |  62 +-
 src/sinks/mod.rs                              |   2 +-
 tests/data/ClientCertificateAuth.pfx          | Bin 0 -> 2467 bytes
 tests/data/Makefile                           |  21 +
 .../certs/azurite-chain.cert.pem              |  98 ++++
 .../certs/azurite.cert.pem                    |  32 ++
 .../intermediate_server/csr/azurite.csr.pem   |  18 +
 tests/data/ca/intermediate_server/index.txt   |   1 +
 .../data/ca/intermediate_server/index.txt.old |   1 +
 .../ca/intermediate_server/newcerts/1009.pem  |  32 ++
 .../private/azurite.key.pem                   |  28 +
 tests/data/ca/intermediate_server/serial      |   2 +-
 tests/data/ca/intermediate_server/serial.old  |   2 +-
 tests/integration/azure/config/compose.yaml   |   8 +
 tests/integration/azure/config/test.yaml      |   3 +-
 .../components/sinks/generated/azure_blob.cue | 155 ++++-
 .../sinks/generated/azure_logs_ingestion.cue  |  83 ++-
 28 files changed, 1542 insertions(+), 342 deletions(-)
 create mode 100644 changelog.d/24729_azure_blob_authentication.feature.md
 create mode 100644 changelog.d/24729_azure_logs_ingestion.breaking.md
 create mode 100644 tests/data/ClientCertificateAuth.pfx
 create mode 100644 tests/data/ca/intermediate_server/certs/azurite-chain.cert.pem
 create mode 100644 tests/data/ca/intermediate_server/certs/azurite.cert.pem
 create mode 100644 tests/data/ca/intermediate_server/csr/azurite.csr.pem
 create mode 100644 tests/data/ca/intermediate_server/newcerts/1009.pem
 create mode 100644 tests/data/ca/intermediate_server/private/azurite.key.pem

diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index a3f2dae3ceea2..b43abdd6fba66 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -210,6 +210,7 @@ greptimedb
 GSM
 gvisor
 gws
+gzip'd
 hadoop
 Haier
 Haipad
@@ -460,6 +461,7 @@ rumqttc
 Salesforce
 Samsung
 SBT
+schema'd
 scriptblock
 Sega
 Segoe
diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index 60715b9c96c0e..ddd945006f1c4 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -379,6 +379,7 @@ mycie
 mycorp
 mydatabase
 mylabel
+mylogstorage
 mypod
 myvalue
 Namazu
diff --git a/Cargo.lock b/Cargo.lock
index 76e4c912d09ee..45f4a998276fc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1668,6 +1668,7 @@ dependencies = [
  "async-trait",
  "azure_core",
  "futures",
+ "openssl",
  "pin-project",
  "serde",
  "time",
diff --git a/Cargo.toml b/Cargo.toml
index 21c40c793a9bf..25ca1f9e0dec9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -302,7 +302,7 @@ aws-smithy-types = { version = "1.2.11", default-features = false, features = ["
 
 # Azure
 azure_core = { version = "0.30", features = ["reqwest", "hmac_openssl"], optional = true }
-azure_identity = { version = "0.30", optional = true }
+azure_identity = { version = "0.30", features = ["client_certificate"], optional = true }
 
 # Azure Storage
 azure_storage_blob = { version = "0.7", optional = true }
@@ -875,8 +875,8 @@ sinks-aws_s3 = ["dep:base64", "dep:md-5", "aws-core", "dep:aws-sdk-s3"]
 sinks-aws_sqs = ["aws-core", "dep:aws-sdk-sqs"]
 sinks-aws_sns = ["aws-core", "dep:aws-sdk-sns"]
 sinks-axiom = ["sinks-http"]
-sinks-azure_blob = ["dep:azure_core", "dep:azure_storage_blob"]
-sinks-azure_logs_ingestion = ["dep:azure_core", "dep:azure_identity"]
+sinks-azure_blob = ["dep:azure_core", "dep:azure_identity", "dep:azure_storage_blob", "dep:base64"]
+sinks-azure_logs_ingestion = ["dep:azure_core", "dep:azure_identity", "dep:azure_storage_blob", "dep:base64"]
 sinks-azure_monitor_logs = []
 sinks-blackhole = []
 sinks-chronicle = []
@@ -987,7 +987,8 @@ aws-integration-tests = [
 ]
 
 azure-integration-tests = [
-  "azure-blob-integration-tests"
+  "azure-blob-integration-tests",
+  "azure-logs-ingestion-integration-tests",
 ]
 
 aws-cloudwatch-logs-integration-tests = ["sinks-aws_cloudwatch_logs"]
@@ -1001,6 +1002,7 @@ aws-sqs-integration-tests = ["sinks-aws_sqs"]
 aws-sns-integration-tests = ["sinks-aws_sns"]
 axiom-integration-tests = ["sinks-axiom"]
 azure-blob-integration-tests = ["sinks-azure_blob"]
+azure-logs-ingestion-integration-tests = ["sinks-azure_logs_ingestion"]
 chronicle-integration-tests = ["sinks-gcp"]
 clickhouse-integration-tests = ["sinks-clickhouse"]
 databend-integration-tests = ["sinks-databend"]
diff --git a/changelog.d/24729_azure_blob_authentication.feature.md b/changelog.d/24729_azure_blob_authentication.feature.md
new file mode 100644
index 0000000000000..7b224172563b7
--- /dev/null
+++ b/changelog.d/24729_azure_blob_authentication.feature.md
@@ -0,0 +1,3 @@
+Re-introduced Azure authentication support to `azure_blob`, including Azure CLI, Managed Identity, Workload Identity, and Managed Identity-based Client Assertion authentication types.
+
+authors: jlaundry
diff --git a/changelog.d/24729_azure_logs_ingestion.breaking.md b/changelog.d/24729_azure_logs_ingestion.breaking.md
new file mode 100644
index 0000000000000..ce0230a352f38
--- /dev/null
+++ b/changelog.d/24729_azure_logs_ingestion.breaking.md
@@ -0,0 +1,3 @@
+If using the `azure_logs_ingestion` sink (added in Vector 0.54.0) with Client Secret credentials, add `azure_credential_kind = "client_secret_credential"` to your sink config (this was previously the default, and now must be explicitly configured).
+
+authors: jlaundry
diff --git a/src/sinks/azure_blob/config.rs b/src/sinks/azure_blob/config.rs
index db0521b4fa137..1311e09edd4f7 100644
--- a/src/sinks/azure_blob/config.rs
+++ b/src/sinks/azure_blob/config.rs
@@ -16,7 +16,8 @@ use crate::{
     sinks::{
         Healthcheck, VectorSink,
         azure_common::{
-            self, config::AzureBlobRetryLogic, service::AzureBlobService, sink::AzureBlobSink,
+            self, config::AzureAuthentication, config::AzureBlobRetryLogic,
+            config::AzureBlobTlsConfig, service::AzureBlobService, sink::AzureBlobSink,
         },
         util::{
             BatchConfig, BulkSizeBasedDefaultBatchSettings, Compression, ServiceBuilderExt,
@@ -41,6 +42,10 @@ impl TowerRequestConfigDefaults for AzureBlobTowerRequestConfigDefaults {
 #[derive(Clone, Debug)]
 #[serde(deny_unknown_fields)]
 pub struct AzureBlobSinkConfig {
+    #[configurable(derived)]
+    #[serde(default)]
+    pub auth: Option<AzureAuthentication>,
+
     /// The Azure Blob Storage Account connection string.
     ///
     /// Authentication with an access key or shared access signature (SAS)
@@ -55,13 +60,33 @@ pub struct AzureBlobSinkConfig {
     /// | Allowed services       | Blob               |
     /// | Allowed resource types | Container & Object |
     /// | Allowed permissions    | Read & Create      |
+    #[configurable(metadata(
+        docs::warnings = "Access keys and SAS tokens can be used to gain unauthorized access to Azure Blob Storage \
+        resources. Numerous security breaches have occurred due to leaked connection strings. It is important to keep \
+        connection strings secure and not expose them in logs, error messages, or version control systems."
+    ))]
     #[configurable(metadata(
         docs::examples = "DefaultEndpointsProtocol=https;AccountName=mylogstorage;AccountKey=storageaccountkeybase64encoded;EndpointSuffix=core.windows.net"
     ))]
     #[configurable(metadata(
         docs::examples = "BlobEndpoint=https://mylogstorage.blob.core.windows.net/;SharedAccessSignature=generatedsastoken"
     ))]
-    pub connection_string: SensitiveString,
+    #[configurable(metadata(docs::examples = "AccountName=mylogstorage"))]
+    pub connection_string: Option<SensitiveString>,
+
+    /// The Azure Blob Storage Account name.
+    ///
+    /// If provided, this will be used instead of the `connection_string`.
+    /// This is useful for authenticating with an Azure credential.
+    #[configurable(metadata(docs::examples = "mylogstorage"))]
+    pub(super) account_name: Option<String>,
+
+    /// The Azure Blob Storage endpoint.
+    ///
+    /// If provided, this will be used instead of the `connection_string`.
+    /// This is useful for authenticating with an Azure credential.
+    #[configurable(metadata(docs::examples = "https://mylogstorage.blob.core.windows.net/"))]
+    pub(super) blob_endpoint: Option<String>,
 
     /// The Azure Blob Storage Account container name.
     #[configurable(metadata(docs::examples = "my-logs"))]
@@ -138,6 +163,10 @@ pub struct AzureBlobSinkConfig {
         skip_serializing_if = "crate::serde::is_default"
     )]
     pub(super) acknowledgements: AcknowledgementsConfig,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub tls: Option<AzureBlobTlsConfig>,
 }
 
 pub fn default_blob_prefix() -> Template {
@@ -147,7 +176,10 @@ pub fn default_blob_prefix() -> Template {
 impl GenerateConfig for AzureBlobSinkConfig {
     fn generate_config() -> toml::Value {
         toml::Value::try_from(Self {
-            connection_string: String::from("DefaultEndpointsProtocol=https;AccountName=some-account-name;AccountKey=some-account-key;").into(),
+            auth: None,
+            connection_string: Some(String::from("DefaultEndpointsProtocol=https;AccountName=some-account-name;AccountKey=some-account-key;").into()),
+            account_name: None,
+            blob_endpoint: None,
             container_name: String::from("logs"),
             blob_prefix: default_blob_prefix(),
             blob_time_format: Some(String::from("%s")),
@@ -157,6 +189,7 @@ impl GenerateConfig for AzureBlobSinkConfig {
             batch: BatchConfig::default(),
             request: TowerRequestConfig::default(),
             acknowledgements: Default::default(),
+            tls: None,
         })
         .unwrap()
     }
@@ -166,11 +199,56 @@ impl GenerateConfig for AzureBlobSinkConfig {
 #[typetag::serde(name = "azure_blob")]
 impl SinkConfig for AzureBlobSinkConfig {
     async fn build(&self, cx: SinkContext) -> Result<(VectorSink, Healthcheck)> {
+        let connection_string: String = match (
+            &self.connection_string,
+            &self.account_name,
+            &self.blob_endpoint,
+        ) {
+            (Some(connstr), None, None) => connstr.inner().into(),
+            (None, Some(account_name), None) => {
+                if self.auth.is_none() {
+                    return Err(
+                        "`auth` configuration must be provided when using `account_name`".into(),
+                    );
+                }
+                format!("AccountName={}", account_name)
+            }
+            (None, None, Some(blob_endpoint)) => {
+                if self.auth.is_none() {
+                    return Err(
+                        "`auth` configuration must be provided when using `blob_endpoint`".into(),
+                    );
+                }
+                // BlobEndpoint must always end in a trailing slash
+                let blob_endpoint = if blob_endpoint.ends_with('/') {
+                    blob_endpoint.clone()
+                } else {
+                    format!("{}/", blob_endpoint)
+                };
+                format!("BlobEndpoint={}", blob_endpoint)
+            }
+            (None, None, None) => {
+                return Err("One of `connection_string`, `account_name`, or `blob_endpoint` must be provided".into());
+            }
+            (Some(_), Some(_), _) => {
+                return Err("Cannot provide both `connection_string` and `account_name`".into());
+            }
+            (Some(_), _, Some(_)) => {
+                return Err("Cannot provide both `connection_string` and `blob_endpoint`".into());
+            }
+            (_, Some(_), Some(_)) => {
+                return Err("Cannot provide both `account_name` and `blob_endpoint`".into());
+            }
+        };
+
         let client = azure_common::config::build_client(
-            self.connection_string.clone().into(),
+            self.auth.clone(),
+            connection_string.clone(),
             self.container_name.clone(),
             cx.proxy(),
-        )?;
+            self.tls.clone(),
+        )
+        .await?;
 
         let healthcheck = azure_common::config::build_healthcheck(
             self.container_name.clone(),
diff --git a/src/sinks/azure_blob/integration_tests.rs b/src/sinks/azure_blob/integration_tests.rs
index 63943312fe66d..dbe20a884ff86 100644
--- a/src/sinks/azure_blob/integration_tests.rs
+++ b/src/sinks/azure_blob/integration_tests.rs
@@ -1,6 +1,8 @@
 use std::io::{BufRead, BufReader};
+use std::sync::Arc;
 
 use azure_core::http::StatusCode;
+use azure_storage_blob::BlobContainerClient;
 
 use bytes::{Buf, BytesMut};
 use flate2::read::GzDecoder;
@@ -24,17 +26,24 @@ use crate::{
         components::{SINK_TAGS, assert_sink_compliance},
         random_events_with_stream, random_lines, random_lines_with_stream, random_string,
     },
+    tls,
 };
 
 #[tokio::test]
 async fn azure_blob_healthcheck_passed() {
     let config = AzureBlobSinkConfig::new_emulator().await;
-    let client = azure_common::config::build_client(
-        config.connection_string.clone().into(),
-        config.container_name.clone(),
-        &crate::config::ProxyConfig::default(),
-    )
-    .expect("Failed to create client");
+    let client = config.build_test_client().await;
+
+    azure_common::config::build_healthcheck(config.container_name, client)
+        .expect("Failed to build healthcheck")
+        .await
+        .expect("Failed to pass healthcheck");
+}
+
+#[tokio::test]
+async fn azure_blob_healthcheck_passed_with_oauth() {
+    let config = AzureBlobSinkConfig::new_emulator_with_oauth().await;
+    let client = config.build_test_client().await;
 
     azure_common::config::build_healthcheck(config.container_name, client)
         .expect("Failed to build healthcheck")
@@ -49,12 +58,7 @@ async fn azure_blob_healthcheck_unknown_container() {
         container_name: String::from("other-container-name"),
         ..config
     };
-    let client = azure_common::config::build_client(
-        config.connection_string.clone().into(),
-        config.container_name.clone(),
-        &crate::config::ProxyConfig::default(),
-    )
-    .expect("Failed to create client");
+    let client = config.build_test_client().await;
 
     assert_eq!(
         azure_common::config::build_healthcheck(config.container_name, client)
@@ -66,10 +70,8 @@ async fn azure_blob_healthcheck_unknown_container() {
     );
 }
 
-#[tokio::test]
-async fn azure_blob_insert_lines_into_blob() {
+async fn assert_insert_lines_into_blob(config: AzureBlobSinkConfig) {
     let blob_prefix = format!("lines/into/blob/{}", random_string(10));
-    let config = AzureBlobSinkConfig::new_emulator().await;
     let config = AzureBlobSinkConfig {
         blob_prefix: blob_prefix.clone().try_into().unwrap(),
         ..config
@@ -88,9 +90,17 @@ async fn azure_blob_insert_lines_into_blob() {
 }
 
 #[tokio::test]
-async fn azure_blob_insert_json_into_blob() {
+async fn azure_blob_insert_lines_into_blob() {
+    assert_insert_lines_into_blob(AzureBlobSinkConfig::new_emulator().await).await;
+}
+
+#[tokio::test]
+async fn azure_blob_insert_lines_into_blob_with_oauth() {
+    assert_insert_lines_into_blob(AzureBlobSinkConfig::new_emulator_with_oauth().await).await;
+}
+
+async fn assert_insert_json_into_blob(config: AzureBlobSinkConfig) {
     let blob_prefix = format!("json/into/blob/{}", random_string(10));
-    let config = AzureBlobSinkConfig::new_emulator().await;
     let config = AzureBlobSinkConfig {
         blob_prefix: blob_prefix.clone().try_into().unwrap(),
         encoding: (
@@ -117,6 +127,16 @@ async fn azure_blob_insert_json_into_blob() {
     assert_eq!(expected, blob_lines);
 }
 
+#[tokio::test]
+async fn azure_blob_insert_json_into_blob() {
+    assert_insert_json_into_blob(AzureBlobSinkConfig::new_emulator().await).await;
+}
+
+#[tokio::test]
+async fn azure_blob_insert_json_into_blob_with_oauth() {
+    assert_insert_json_into_blob(AzureBlobSinkConfig::new_emulator_with_oauth().await).await;
+}
+
 #[ignore]
 #[tokio::test]
 // This test fails to get the posted blob with "header not found content-length".
@@ -177,14 +197,12 @@ async fn azure_blob_insert_json_into_blob_gzip() {
     assert_eq!(expected, blob_lines);
 }
 
-#[tokio::test]
-async fn azure_blob_rotate_files_after_the_buffer_size_is_reached() {
+async fn assert_rotate_files_after_the_buffer_size_is_reached(mut config: AzureBlobSinkConfig) {
     let groups = 3;
     let (lines, size, input) = random_lines_with_stream_with_group_key(100, 30, groups);
     let size_per_group = (size / groups) + 10;
 
     let blob_prefix = format!("lines-rotate/into/blob/{}", random_string(10));
-    let mut config = AzureBlobSinkConfig::new_emulator().await;
     config.batch.max_bytes = Some(size_per_group);
 
     let config = AzureBlobSinkConfig {
@@ -211,52 +229,104 @@ async fn azure_blob_rotate_files_after_the_buffer_size_is_reached() {
     }
 }
 
+#[tokio::test]
+async fn azure_blob_rotate_files_after_the_buffer_size_is_reached() {
+    assert_rotate_files_after_the_buffer_size_is_reached(AzureBlobSinkConfig::new_emulator().await)
+        .await;
+}
+
+#[tokio::test]
+async fn azure_blob_rotate_files_after_the_buffer_size_is_reached_with_oauth() {
+    assert_rotate_files_after_the_buffer_size_is_reached(
+        AzureBlobSinkConfig::new_emulator_with_oauth().await,
+    )
+    .await;
+}
+
 impl AzureBlobSinkConfig {
     pub async fn new_emulator() -> AzureBlobSinkConfig {
-        let address = std::env::var("AZURE_ADDRESS").unwrap_or_else(|_| "localhost".into());
+        let address = std::env::var("AZURITE_ADDRESS").unwrap_or_else(|_| "localhost".into());
         let config = AzureBlobSinkConfig {
-            connection_string: format!("UseDevelopmentStorage=true;DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://{address}:10000/devstoreaccount1;QueueEndpoint=http://{address}:10001/devstoreaccount1;TableEndpoint=http://{address}:10002/devstoreaccount1;").into(),
-                container_name: "logs".to_string(),
-                blob_prefix: Default::default(),
-                blob_time_format: None,
-                blob_append_uuid: None,
-                encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
-                compression: Compression::None,
-                batch: Default::default(),
-                request: TowerRequestConfig::default(),
-                acknowledgements: Default::default(),
-            };
+            auth: None,
+            connection_string: Some(format!("UseDevelopmentStorage=true;DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://{address}:10000/devstoreaccount1;QueueEndpoint=http://{address}:10001/devstoreaccount1;TableEndpoint=http://{address}:10002/devstoreaccount1;").into()),
+            account_name: None,
+            blob_endpoint: None,
+            container_name: "logs".to_string(),
+            blob_prefix: Default::default(),
+            blob_time_format: None,
+            blob_append_uuid: None,
+            encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
+            compression: Compression::None,
+            batch: Default::default(),
+            request: TowerRequestConfig::default(),
+            acknowledgements: Default::default(),
+            tls: None,
+        };
 
         config.ensure_container().await;
 
         config
     }
 
-    fn to_sink(&self) -> VectorSink {
-        let client = azure_common::config::build_client(
-            self.connection_string.clone().into(),
+    pub async fn new_emulator_with_oauth() -> AzureBlobSinkConfig {
+        let address = std::env::var("AZURITE_OAUTH_ADDRESS").unwrap_or_else(|_| "localhost".into());
+        let config = AzureBlobSinkConfig {
+            auth: Some(azure_common::config::AzureAuthentication::MockCredential),
+            connection_string: Some(format!("DefaultEndpointsProtocol=https;AccountName=devstoreaccount1;BlobEndpoint=https://{address}:14430/devstoreaccount1;QueueEndpoint=https://{address}:14431/devstoreaccount1;TableEndpoint=https://{address}:14432/devstoreaccount1;").into()),
+            account_name: None,
+            blob_endpoint: None,
+            container_name: "logs".to_string(),
+            blob_prefix: Default::default(),
+            blob_time_format: None,
+            blob_append_uuid: None,
+            encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
+            compression: Compression::None,
+            batch: Default::default(),
+            request: TowerRequestConfig::default(),
+            acknowledgements: Default::default(),
+            tls: Some(azure_common::config::AzureBlobTlsConfig {
+                ca_file: Some(tls::TEST_PEM_CA_PATH.into()),
+            }),
+        };
+
+        config.ensure_container().await;
+
+        config
+    }
+
+    async fn build_test_client(&self) -> Arc<BlobContainerClient> {
+        azure_common::config::build_client(
+            self.auth.clone(),
+            self.connection_string
+                .clone()
+                .expect("failed to unwrap connection_string")
+                .inner()
+                .to_string(),
             self.container_name.clone(),
             &crate::config::ProxyConfig::default(),
+            self.tls.clone(),
         )
-        .expect("Failed to create client");
+        .await
+        .expect("Failed to create client")
+    }
 
+    async fn to_sink(&self) -> VectorSink {
+        let client = self.build_test_client().await;
         self.build_processor(client).expect("Failed to create sink")
     }
 
     async fn run_assert(&self, input: impl Stream<Item = EventArray> + Send) {
         // `to_sink` needs to be inside the assertion check
-        assert_sink_compliance(&SINK_TAGS, async move { self.to_sink().run(input).await })
-            .await
-            .expect("Running sink failed");
+        assert_sink_compliance(
+            &SINK_TAGS,
+            async move { self.to_sink().await.run(input).await },
+        )
+        .await
+        .expect("Running sink failed");
     }
 
     pub async fn list_blobs(&self, prefix: String) -> Vec<String> {
-        let client = azure_common::config::build_client(
-            self.connection_string.clone().into(),
-            self.container_name.clone(),
-            &crate::config::ProxyConfig::default(),
-        )
-        .unwrap();
+        let client = self.build_test_client().await;
 
         // Iterate pager results and collect blob names. Filter by prefix server-side.
         let mut pager = client
@@ -276,12 +346,7 @@ impl AzureBlobSinkConfig {
     }
 
     pub async fn get_blob(&self, blob: String) -> (Option<String>, Option<String>, Vec<String>) {
-        let client = azure_common::config::build_client(
-            self.connection_string.clone().into(),
-            self.container_name.clone(),
-            &crate::config::ProxyConfig::default(),
-        )
-        .unwrap();
+        let client = self.build_test_client().await;
 
         let blob_client = client.blob_client(&blob);
 
@@ -337,12 +402,7 @@ impl AzureBlobSinkConfig {
     }
 
     async fn ensure_container(&self) {
-        let client = azure_common::config::build_client(
-            self.connection_string.clone().into(),
-            self.container_name.clone(),
-            &crate::config::ProxyConfig::default(),
-        )
-        .unwrap();
+        let client = self.build_test_client().await;
         let result = client.create_container(None).await;
 
         let response = match result {
diff --git a/src/sinks/azure_blob/test.rs b/src/sinks/azure_blob/test.rs
index b7f1a9689229f..2dd6aaf69bdd4 100644
--- a/src/sinks/azure_blob/test.rs
+++ b/src/sinks/azure_blob/test.rs
@@ -14,6 +14,8 @@ use super::{config::AzureBlobSinkConfig, request_builder::AzureBlobRequestOption
 use crate::{
     codecs::{Encoder, EncodingConfigWithFraming},
     event::{Event, LogEvent},
+    sinks::azure_common::config::{AzureAuthentication, SpecificAzureCredential},
+    sinks::prelude::*,
     sinks::util::{
         Compression,
         request_builder::{EncodeResult, RequestBuilder},
@@ -22,7 +24,10 @@ use crate::{
 
 fn default_config(encoding: EncodingConfigWithFraming) -> AzureBlobSinkConfig {
     AzureBlobSinkConfig {
+        auth: Default::default(),
         connection_string: Default::default(),
+        account_name: Default::default(),
+        blob_endpoint: Default::default(),
         container_name: Default::default(),
         blob_prefix: Default::default(),
         blob_time_format: Default::default(),
@@ -32,6 +37,7 @@ fn default_config(encoding: EncodingConfigWithFraming) -> AzureBlobSinkConfig {
         batch: Default::default(),
         request: Default::default(),
         acknowledgements: Default::default(),
+        tls: Default::default(),
     }
 }
 
@@ -234,3 +240,317 @@ fn azure_blob_build_request_with_uuid() {
     assert_eq!(request.content_encoding, None);
     assert_eq!(request.content_type, "text/plain");
 }
+
+#[tokio::test]
+async fn azure_blob_build_config_with_null_auth() {
+    let config: Result<AzureBlobSinkConfig, toml::de::Error> = toml::from_str::<AzureBlobSinkConfig>(
+        r#"
+            connection_string = "AccountName=mylogstorage"
+            container_name = "my-logs"
+
+            [encoding]
+            codec = "json"
+
+            [auth]
+        "#,
+    );
+
+    match config {
+        Ok(_) => panic!("Config parsing should have failed due to invalid auth config"),
+        Err(e) => {
+            let err_str = e.to_string();
+            assert!(
+                err_str.contains("data did not match any variant of untagged enum"),
+                "Config parsing did not complain about invalid auth config: {}",
+                err_str
+            );
+        }
+    }
+}
+
+#[tokio::test]
+async fn azure_blob_build_config_with_client_id_and_secret() {
+    let config: AzureBlobSinkConfig = toml::from_str::<AzureBlobSinkConfig>(
+        r#"
+            connection_string = "AccountName=mylogstorage"
+            container_name = "my-logs"
+
+            [encoding]
+            codec = "json"
+
+            [auth]
+            azure_credential_kind = "client_secret_credential"
+            azure_tenant_id = "00000000-0000-0000-0000-000000000000"
+            azure_client_id = "mock-client-id"
+            azure_client_secret = "mock-client-secret"
+        "#,
+    )
+    .unwrap_or_else(|error| panic!("Config parsing failed: {error:?}"));
+
+    assert!(&config.auth.is_some());
+
+    match &config.auth.clone().unwrap() {
+        AzureAuthentication::Specific(SpecificAzureCredential::ClientSecretCredential {
+            azure_tenant_id,
+            azure_client_id,
+            azure_client_secret,
+        }) => {
+            assert_eq!(azure_tenant_id, "00000000-0000-0000-0000-000000000000");
+            assert_eq!(azure_client_id, "mock-client-id");
+            let secret: String = azure_client_secret.inner().into();
+            assert_eq!(secret, "mock-client-secret");
+        }
+        _ => panic!("Expected Specific(ClientSecretCredential) variant"),
+    }
+
+    let cx = SinkContext::default();
+    let _sink = config
+        .build(cx)
+        .await
+        .unwrap_or_else(|error| panic!("Failed to build sink: {error:?}"));
+}
+
+#[tokio::test]
+async fn azure_blob_build_config_with_client_certificate() {
+    let config: AzureBlobSinkConfig = toml::from_str::<AzureBlobSinkConfig>(
+        r#"
+            connection_string = "AccountName=mylogstorage"
+            container_name = "my-logs"
+
+            [encoding]
+            codec = "json"
+
+            [auth]
+            azure_credential_kind = "client_certificate_credential"
+            azure_tenant_id = "00000000-0000-0000-0000-000000000000"
+            azure_client_id = "mock-client-id"
+            certificate_path = "tests/data/ClientCertificateAuth.pfx"
+            certificate_password = "MockPassword123"
+        "#,
+    )
+    .unwrap_or_else(|error| panic!("Config parsing failed: {error:?}"));
+
+    assert!(&config.auth.is_some());
+
+    match &config.auth.clone().unwrap() {
+        AzureAuthentication::Specific(SpecificAzureCredential::ClientCertificateCredential {
+            ..
+        }) => {
+            // Expected variant
+        }
+        _ => panic!("Expected Specific(ClientCertificateCredential) variant"),
+    }
+
+    let cx = SinkContext::default();
+    let _sink = config
+        .build(cx)
+        .await
+        .unwrap_or_else(|error| panic!("Failed to build sink: {error:?}"));
+}
+
+#[tokio::test]
+async fn azure_blob_build_config_with_account_name() {
+    let config: AzureBlobSinkConfig = toml::from_str::<AzureBlobSinkConfig>(
+        r#"
+            account_name = "mylogstorage"
+            container_name = "my-logs"
+
+            [encoding]
+            codec = "json"
+
+            [auth]
+            azure_credential_kind = "client_secret_credential"
+            azure_tenant_id = "00000000-0000-0000-0000-000000000000"
+            azure_client_id = "mock-client-id"
+            azure_client_secret = "mock-client-secret"
+        "#,
+    )
+    .unwrap_or_else(|error| panic!("Config parsing failed: {error:?}"));
+
+    let cx = SinkContext::default();
+    let _ = config
+        .build(cx)
+        .await
+        .unwrap_or_else(|error| panic!("Failed to build sink: {error:?}"));
+}
+
+#[tokio::test]
+async fn azure_blob_build_config_with_account_name_with_no_auth() {
+    let config: AzureBlobSinkConfig = toml::from_str::<AzureBlobSinkConfig>(
+        r#"
+            account_name = "mylogstorage"
+            container_name = "my-logs"
+
+            [encoding]
+            codec = "json"
+        "#,
+    )
+    .unwrap_or_else(|error| panic!("Config parsing failed: {error:?}"));
+
+    let cx = SinkContext::default();
+    let sink = config.build(cx).await;
+    match sink {
+        Ok(_) => panic!("Config build should have errored due to missing `auth`"),
+        Err(e) => {
+            let err_str = e.to_string();
+            assert!(
+                err_str.contains("`auth` configuration must be provided"),
+                "Config build did not complain about missing `auth`: {}",
+                err_str
+            );
+        }
+    }
+}
+
+#[tokio::test]
+async fn azure_blob_build_config_with_blob_endpoint() {
+    let config: AzureBlobSinkConfig = toml::from_str::<AzureBlobSinkConfig>(
+        r#"
+            blob_endpoint = "https://localhost:10000/devstoreaccount1"
+            container_name = "my-logs"
+
+            [encoding]
+            codec = "json"
+
+            [auth]
+            azure_credential_kind = "client_secret_credential"
+            azure_tenant_id = "00000000-0000-0000-0000-000000000000"
+            azure_client_id = "mock-client-id"
+            azure_client_secret = "mock-client-secret"
+        "#,
+    )
+    .unwrap_or_else(|error| panic!("Config parsing failed: {error:?}"));
+
+    let cx = SinkContext::default();
+    let _ = config
+        .build(cx)
+        .await
+        .unwrap_or_else(|error| panic!("Failed to build sink: {error:?}"));
+}
+
+#[tokio::test]
+async fn azure_blob_build_config_with_blob_endpoint_with_no_auth() {
+    let config: AzureBlobSinkConfig = toml::from_str::<AzureBlobSinkConfig>(
+        r#"
+            blob_endpoint = "https://localhost:10000/devstoreaccount1"
+            container_name = "my-logs"
+
+            [encoding]
+            codec = "json"
+        "#,
+    )
+    .unwrap_or_else(|error| panic!("Config parsing failed: {error:?}"));
+
+    let cx = SinkContext::default();
+    let sink = config.build(cx).await;
+    match sink {
+        Ok(_) => panic!("Config build should have errored due to missing `auth`"),
+        Err(e) => {
+            let err_str = e.to_string();
+            assert!(
+                err_str.contains("`auth` configuration must be provided"),
+                "Config build did not complain about missing `auth`: {}",
+                err_str
+            );
+        }
+    }
+}
+
+#[tokio::test]
+async fn azure_blob_build_config_with_conflicting_connection_string_and_account_name() {
+    let config: AzureBlobSinkConfig = toml::from_str::<AzureBlobSinkConfig>(
+        r#"
+            connection_string = "AccountName=mylogstorage"
+            account_name = "mylogstorage"
+            container_name = "my-logs"
+
+            [encoding]
+            codec = "json"
+        "#,
+    )
+    .unwrap_or_else(|error| panic!("Config parsing failed: {error:?}"));
+
+    let cx = SinkContext::default();
+    let sink = config.build(cx).await;
+    match sink {
+        Ok(_) => panic!(
+            "Config build should have errored due to conflicting connection_string and account_name"
+        ),
+        Err(e) => {
+            let err_str = e.to_string();
+            assert!(
+                err_str.contains("`connection_string` and `account_name`"),
+                "Config build did not complain about conflicting connection_string and account_name: {}",
+                err_str
+            );
+        }
+    }
+}
+
+#[tokio::test]
+async fn azure_blob_build_config_with_conflicting_connection_string_and_client_id_and_secret() {
+    let config: AzureBlobSinkConfig = toml::from_str::<AzureBlobSinkConfig>(
+        r#"
+            connection_string = "AccountName=mylogstorage;AccountKey=mockkey"
+            container_name = "my-logs"
+
+            [encoding]
+            codec = "json"
+
+            [auth]
+            azure_credential_kind = "client_secret_credential"
+            azure_tenant_id = "00000000-0000-0000-0000-000000000000"
+            azure_client_id = "mock-client-id"
+            azure_client_secret = "mock-client-secret"
+        "#,
+    )
+    .unwrap_or_else(|error| panic!("Config parsing failed: {error:?}"));
+
+    assert!(&config.auth.is_some());
+
+    let cx = SinkContext::default();
+    let sink = config.build(cx).await;
+    match sink {
+        Ok(_) => {
+            panic!("Config build should have errored due to conflicting Shared Key and Client ID")
+        }
+        Err(e) => {
+            let err_str = e.to_string();
+            assert!(
+                err_str
+                    .contains("Cannot use both Shared Key and another Azure Authentication method"),
+                "Config build did not complain about conflicting Shared Key and Client ID: {}",
+                err_str
+            );
+        }
+    }
+}
+
+#[tokio::test]
+async fn azure_blob_build_config_with_custom_ca_certificate() {
+    let config: AzureBlobSinkConfig = toml::from_str::<AzureBlobSinkConfig>(
+        r#"
+            account_name = "mylogstorage"
+            container_name = "my-logs"
+
+            [encoding]
+            codec = "json"
+
+            [tls]
+            ca_file = "tests/data/ca/certs/ca.cert.pem"
+
+            [auth]
+            azure_credential_kind = "client_secret_credential"
+            azure_tenant_id = "00000000-0000-0000-0000-000000000000"
+            azure_client_id = "mock-client-id"
+            azure_client_secret = "mock-client-secret"
+        "#,
+    )
+    .unwrap_or_else(|error| panic!("Config parsing failed: {error:?}"));
+
+    let cx = SinkContext::default();
+    let _ = config
+        .build(cx)
+        .await
+        .unwrap_or_else(|error| panic!("Failed to build sink: {error:?}"));
+}
diff --git a/src/sinks/azure_common/config.rs b/src/sinks/azure_common/config.rs
index 139608d9847ab..800e0a6eb3f23 100644
--- a/src/sinks/azure_common/config.rs
+++ b/src/sinks/azure_common/config.rs
@@ -1,19 +1,36 @@
+use std::fs::File;
+use std::io::Read;
+use std::path::PathBuf;
 use std::sync::Arc;
 
+use base64::prelude::*;
+
 use azure_core::error::Error as AzureCoreError;
 
 use crate::sinks::azure_common::connection_string::{Auth, ParsedConnectionString};
 use crate::sinks::azure_common::shared_key_policy::SharedKeyAuthorizationPolicy;
-use azure_core::http::Url;
+use azure_core::http::{ClientMethodOptions, StatusCode, Url};
+
+use azure_core::credentials::{TokenCredential, TokenRequestOptions};
+use azure_core::{Error, error::ErrorKind};
+
+use azure_identity::{
+    AzureCliCredential, ClientAssertion, ClientAssertionCredential, ClientCertificateCredential,
+    ClientCertificateCredentialOptions, ClientSecretCredential, ManagedIdentityCredential,
+    ManagedIdentityCredentialOptions, UserAssignedId, WorkloadIdentityCredential,
+    WorkloadIdentityCredentialOptions,
+};
+
 use azure_storage_blob::{BlobContainerClient, BlobContainerClientOptions};
 
-use azure_core::http::StatusCode;
 use bytes::Bytes;
 use futures::FutureExt;
 use snafu::Snafu;
 use vector_lib::{
+    configurable::configurable_component,
     json_size::JsonSize,
     request_metadata::{GroupedCountByteSize, MetaDescriptive, RequestMetadata},
+    sensitive_string::SensitiveString,
     stream::DriverResponse,
 };
 
@@ -22,6 +39,374 @@ use crate::{
     sinks::{Healthcheck, util::retries::RetryLogic},
 };
 
+/// TLS configuration.
+#[configurable_component]
+#[configurable(metadata(docs::advanced))]
+#[derive(Clone, Debug, Default)]
+#[serde(deny_unknown_fields)]
+pub struct AzureBlobTlsConfig {
+    /// Absolute path to an additional CA certificate file.
+    ///
+    /// The certificate must be in PEM (X.509) format.
+    #[serde(alias = "ca_path")]
+    #[configurable(metadata(docs::examples = "/path/to/certificate_authority.crt"))]
+    #[configurable(metadata(docs::human_name = "CA File Path"))]
+    pub ca_file: Option<PathBuf>,
+}
+
+/// Azure service principal authentication.
+#[configurable_component]
+#[derive(Clone, Debug, Eq, PartialEq)]
+#[serde(deny_unknown_fields, untagged)]
+pub enum AzureAuthentication {
+    #[configurable(metadata(docs::enum_tag_description = "The kind of Azure credential to use."))]
+    Specific(SpecificAzureCredential),
+
+    /// Mock credential for testing — returns a static fake token
+    #[cfg(test)]
+    #[serde(skip)]
+    MockCredential,
+}
+
+impl Default for AzureAuthentication {
+    // This should never be actually used.
+    // This is only needed when using Default::default() (such as unit tests),
+    // as serde requires `azure_credential_kind` to be specified.
+    fn default() -> Self {
+        Self::Specific(SpecificAzureCredential::ManagedIdentity {
+            user_assigned_managed_identity_id: None,
+            user_assigned_managed_identity_id_type: None,
+        })
+    }
+}
+
+#[configurable_component]
+#[derive(Clone, Debug, Eq, PartialEq)]
+#[serde(deny_unknown_fields, rename_all = "snake_case")]
+#[derive(Default)]
+/// User Assigned Managed Identity Types.
+pub enum UserAssignedManagedIdentityIdType {
+    #[default]
+    /// Client ID
+    ClientId,
+    /// Object ID
+    ObjectId,
+    /// Resource ID
+    ResourceId,
+}
+
+/// Specific Azure credential types.
+#[configurable_component]
+#[derive(Clone, Debug, Eq, PartialEq)]
+#[serde(
+    tag = "azure_credential_kind",
+    rename_all = "snake_case",
+    deny_unknown_fields
+)]
+pub enum SpecificAzureCredential {
+    /// Use Azure CLI credentials
+    #[cfg(not(target_arch = "wasm32"))]
+    AzureCli {},
+
+    /// Use certificate credentials
+    ClientCertificateCredential {
+        /// The [Azure Tenant ID][azure_tenant_id].
+        ///
+        /// [azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_TENANT_ID:?err}"))]
+        azure_tenant_id: String,
+
+        /// The [Azure Client ID][azure_client_id].
+        ///
+        /// [azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_ID:?err}"))]
+        azure_client_id: String,
+
+        /// PKCS12 certificate with RSA private key.
+        #[configurable(metadata(docs::examples = "path/to/certificate.pfx"))]
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_CERTIFICATE_PATH:?err}"))]
+        certificate_path: PathBuf,
+
+        /// The password for the client certificate, if applicable.
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_CERTIFICATE_PASSWORD}"))]
+        certificate_password: Option<SensitiveString>,
+    },
+
+    /// Use client ID/secret credentials
+    ClientSecretCredential {
+        /// The [Azure Tenant ID][azure_tenant_id].
+        ///
+        /// [azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_TENANT_ID:?err}"))]
+        azure_tenant_id: String,
+
+        /// The [Azure Client ID][azure_client_id].
+        ///
+        /// [azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_ID:?err}"))]
+        azure_client_id: String,
+
+        /// The [Azure Client Secret][azure_client_secret].
+        ///
+        /// [azure_client_secret]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00-00~000000-0000000~0000000000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_SECRET:?err}"))]
+        azure_client_secret: SensitiveString,
+    },
+
+    /// Use Managed Identity credentials
+    ManagedIdentity {
+        /// The User Assigned Managed Identity to use.
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        user_assigned_managed_identity_id: Option<String>,
+
+        /// The type of the User Assigned Managed Identity ID provided (Client ID, Object ID,
+        /// or Resource ID). Defaults to Client ID.
+        user_assigned_managed_identity_id_type: Option<UserAssignedManagedIdentityIdType>,
+    },
+
+    /// Use Managed Identity with Client Assertion credentials
+    ManagedIdentityClientAssertion {
+        /// The User Assigned Managed Identity to use for the managed identity.
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(
+            docs::examples = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-vector/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id-vector-uami"
+        ))]
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        user_assigned_managed_identity_id: Option<String>,
+
+        /// The type of the User Assigned Managed Identity ID provided (Client ID, Object ID, or Resource ID). Defaults to Client ID.
+        user_assigned_managed_identity_id_type: Option<UserAssignedManagedIdentityIdType>,
+
+        /// The target Tenant ID to use.
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        client_assertion_tenant_id: String,
+
+        /// The target Client ID to use.
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        client_assertion_client_id: String,
+    },
+
+    /// Use Workload Identity credentials
+    WorkloadIdentity {
+        /// The [Azure Tenant ID][azure_tenant_id]. Defaults to the value of the environment variable `AZURE_TENANT_ID`.
+        ///
+        /// [azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_TENANT_ID}"))]
+        tenant_id: Option<String>,
+
+        /// The [Azure Client ID][azure_client_id]. Defaults to the value of the environment variable `AZURE_CLIENT_ID`.
+        ///
+        /// [azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_ID}"))]
+        client_id: Option<String>,
+
+        /// Path of a file containing a Kubernetes service account token. Defaults to the value of the environment variable `AZURE_FEDERATED_TOKEN_FILE`.
+        #[configurable(metadata(
+            docs::examples = "/var/run/secrets/azure/tokens/azure-identity-token"
+        ))]
+        #[configurable(metadata(docs::examples = "${AZURE_FEDERATED_TOKEN_FILE}"))]
+        token_file_path: Option<PathBuf>,
+    },
+}
+
+#[derive(Debug)]
+struct ManagedIdentityClientAssertion {
+    credential: Arc<dyn TokenCredential>,
+    scope: String,
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
+impl ClientAssertion for ManagedIdentityClientAssertion {
+    async fn secret(&self, options: Option<ClientMethodOptions<'_>>) -> azure_core::Result<String> {
+        Ok(self
+            .credential
+            .get_token(
+                &[&self.scope],
+                Some(TokenRequestOptions {
+                    method_options: options.unwrap_or_default(),
+                }),
+            )
+            .await?
+            .token
+            .secret()
+            .to_string())
+    }
+}
+
+impl AzureAuthentication {
+    /// Returns the provider for the credentials based on the authentication mechanism chosen.
+    pub async fn credential(&self) -> azure_core::Result<Arc<dyn TokenCredential>> {
+        match self {
+            Self::Specific(specific) => specific.credential().await,
+
+            #[cfg(test)]
+            Self::MockCredential => Ok(Arc::new(MockTokenCredential) as Arc<dyn TokenCredential>),
+        }
+    }
+}
+
+impl SpecificAzureCredential {
+    /// Returns the provider for the credentials based on the specific credential type.
+    pub async fn credential(&self) -> azure_core::Result<Arc<dyn TokenCredential>> {
+        let credential: Arc<dyn TokenCredential> = match self {
+            #[cfg(not(target_arch = "wasm32"))]
+            Self::AzureCli {} => AzureCliCredential::new(None)?,
+
+            // requires azure_identity feature 'client_certificate'
+            Self::ClientCertificateCredential {
+                azure_tenant_id,
+                azure_client_id,
+                certificate_path,
+                certificate_password,
+            } => {
+                let certificate_bytes: Vec<u8> = std::fs::read(certificate_path).map_err(|e| {
+                    Error::with_message(
+                        ErrorKind::Credential,
+                        format!(
+                            "Failed to read certificate file {}: {e}",
+                            certificate_path.display()
+                        ),
+                    )
+                })?;
+
+                // Note: in azure_identity 0.33.0+, this changes to SecretBytes, and the base64 encoding is no longer needed
+                let certificate_base64: azure_core::credentials::Secret =
+                    BASE64_STANDARD.encode(&certificate_bytes).into();
+
+                let mut options: ClientCertificateCredentialOptions =
+                    ClientCertificateCredentialOptions::default();
+                if let Some(password) = certificate_password {
+                    options.password = Some(password.inner().to_string().into());
+                }
+
+                ClientCertificateCredential::new(
+                    azure_tenant_id.clone(),
+                    azure_client_id.clone(),
+                    certificate_base64,
+                    Some(options),
+                )?
+            }
+
+            Self::ClientSecretCredential {
+                azure_tenant_id,
+                azure_client_id,
+                azure_client_secret,
+            } => {
+                if azure_tenant_id.is_empty() {
+                    return Err(Error::with_message(ErrorKind::Credential,
+                        "`auth.azure_tenant_id` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
+                    ));
+                }
+                if azure_client_id.is_empty() {
+                    return Err(Error::with_message(ErrorKind::Credential,
+                        "`auth.azure_client_id` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
+                    ));
+                }
+                if azure_client_secret.inner().is_empty() {
+                    return Err(Error::with_message(ErrorKind::Credential,
+                        "`auth.azure_client_secret` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
+                    ));
+                }
+
+                let secret: String = azure_client_secret.inner().into();
+                ClientSecretCredential::new(
+                    &azure_tenant_id.clone(),
+                    azure_client_id.clone(),
+                    secret.into(),
+                    None,
+                )?
+            }
+
+            Self::ManagedIdentity {
+                user_assigned_managed_identity_id,
+                user_assigned_managed_identity_id_type,
+            } => {
+                let mut options = ManagedIdentityCredentialOptions::default();
+                if let Some(id) = user_assigned_managed_identity_id {
+                    options.user_assigned_id = match user_assigned_managed_identity_id_type
+                        .as_ref()
+                        .unwrap_or(&Default::default())
+                    {
+                        UserAssignedManagedIdentityIdType::ClientId => {
+                            Some(UserAssignedId::ClientId(id.clone()))
+                        }
+                        UserAssignedManagedIdentityIdType::ObjectId => {
+                            Some(UserAssignedId::ObjectId(id.clone()))
+                        }
+                        UserAssignedManagedIdentityIdType::ResourceId => {
+                            Some(UserAssignedId::ResourceId(id.clone()))
+                        }
+                    };
+                }
+                ManagedIdentityCredential::new(Some(options))?
+            }
+
+            Self::ManagedIdentityClientAssertion {
+                user_assigned_managed_identity_id,
+                user_assigned_managed_identity_id_type,
+                client_assertion_tenant_id,
+                client_assertion_client_id,
+            } => {
+                let mut options = ManagedIdentityCredentialOptions::default();
+                if let Some(id) = user_assigned_managed_identity_id {
+                    options.user_assigned_id = match user_assigned_managed_identity_id_type
+                        .as_ref()
+                        .unwrap_or(&Default::default())
+                    {
+                        UserAssignedManagedIdentityIdType::ClientId => {
+                            Some(UserAssignedId::ClientId(id.clone()))
+                        }
+                        UserAssignedManagedIdentityIdType::ObjectId => {
+                            Some(UserAssignedId::ObjectId(id.clone()))
+                        }
+                        UserAssignedManagedIdentityIdType::ResourceId => {
+                            Some(UserAssignedId::ResourceId(id.clone()))
+                        }
+                    };
+                }
+                let msi: Arc<dyn TokenCredential> = ManagedIdentityCredential::new(Some(options))?;
+                let assertion = ManagedIdentityClientAssertion {
+                    credential: msi,
+                    // Future: make this configurable for sovereign clouds? (no way to test...)
+                    scope: "api://AzureADTokenExchange/.default".to_string(),
+                };
+
+                ClientAssertionCredential::new(
+                    client_assertion_tenant_id.clone(),
+                    client_assertion_client_id.clone(),
+                    assertion,
+                    None,
+                )?
+            }
+
+            Self::WorkloadIdentity {
+                tenant_id,
+                client_id,
+                token_file_path,
+            } => {
+                let options = WorkloadIdentityCredentialOptions {
+                    tenant_id: tenant_id.clone(),
+                    client_id: client_id.clone(),
+                    token_file_path: token_file_path.clone(),
+                    ..Default::default()
+                };
+
+                WorkloadIdentityCredential::new(Some(options))?
+            }
+        };
+        Ok(credential)
+    }
+}
+
 #[derive(Debug, Clone)]
 pub struct AzureBlobRequest {
     pub blob_data: Bytes,
@@ -126,10 +511,12 @@ pub fn build_healthcheck(
     Ok(healthcheck.boxed())
 }
 
-pub fn build_client(
+pub async fn build_client(
+    auth: Option<AzureAuthentication>,
     connection_string: String,
     container_name: String,
     proxy: &crate::config::ProxyConfig,
+    tls: Option<AzureBlobTlsConfig>,
 ) -> crate::Result<Arc<BlobContainerClient>> {
     // Parse connection string without legacy SDK
     let parsed = ParsedConnectionString::parse(&connection_string)
@@ -140,16 +527,26 @@ pub fn build_client(
         .map_err(|e| format!("Failed to build container URL: {e}"))?;
     let url = Url::parse(&container_url).map_err(|e| format!("Invalid container URL: {e}"))?;
 
+    let mut credential: Option<Arc<dyn TokenCredential>> = None;
+
     // Prepare options; attach Shared Key policy if needed
     let mut options = BlobContainerClientOptions::default();
-    match parsed.auth() {
-        Auth::Sas { .. } | Auth::None => {
-            // No extra policy; SAS is in the URL already (or anonymous)
+    match (parsed.auth(), &auth) {
+        (Auth::None, None) => {
+            warn!("No authentication method provided, requests will be anonymous.");
+        }
+        (Auth::Sas { .. }, None) => {
+            info!("Using SAS token authentication.");
         }
-        Auth::SharedKey {
-            account_name,
-            account_key,
-        } => {
+        (
+            Auth::SharedKey {
+                account_name,
+                account_key,
+            },
+            None,
+        ) => {
+            info!("Using Shared Key authentication.");
+
             let policy = SharedKeyAuthorizationPolicy::new(
                 account_name,
                 account_key,
@@ -162,6 +559,41 @@ pub fn build_client(
                 .per_call_policies
                 .push(Arc::new(policy));
         }
+        (Auth::None, Some(AzureAuthentication::Specific(..))) => {
+            info!("Using Azure Authentication method.");
+            let credential_result: Arc<dyn TokenCredential> =
+                auth.unwrap().credential().await.map_err(|e| {
+                    Error::with_message(
+                        ErrorKind::Credential,
+                        format!("Failed to configure Azure Authentication: {e}"),
+                    )
+                })?;
+            credential = Some(credential_result);
+        }
+        (Auth::Sas { .. }, Some(AzureAuthentication::Specific(..))) => {
+            return Err(Box::new(Error::with_message(
+                ErrorKind::Credential,
+                "Cannot use both SAS token and another Azure Authentication method at the same time",
+            )));
+        }
+        (Auth::SharedKey { .. }, Some(AzureAuthentication::Specific(..))) => {
+            return Err(Box::new(Error::with_message(
+                ErrorKind::Credential,
+                "Cannot use both Shared Key and another Azure Authentication method at the same time",
+            )));
+        }
+        #[cfg(test)]
+        (Auth::None, Some(AzureAuthentication::MockCredential)) => {
+            warn!("Using mock token credential authentication.");
+            credential = Some(auth.unwrap().credential().await.unwrap());
+        }
+        #[cfg(test)]
+        (_, Some(AzureAuthentication::MockCredential)) => {
+            return Err(Box::new(Error::with_message(
+                ErrorKind::Credential,
+                "Cannot use both connection string auth and mock credential at the same time",
+            )));
+        }
     }
 
     // Use reqwest v0.12 since Azure SDK only implements HttpClient for reqwest::Client v0.12
@@ -191,12 +623,90 @@ pub fn build_client(
             reqwest_builder = reqwest_builder.proxy(p);
         }
     }
+
+    if let Some(AzureBlobTlsConfig { ca_file }) = &tls
+        && let Some(ca_file) = ca_file
+    {
+        let mut buf = Vec::new();
+        File::open(ca_file)?.read_to_end(&mut buf)?;
+        let cert = reqwest_12::Certificate::from_pem(&buf)?;
+
+        warn!("Adding TLS root certificate from {}", ca_file.display());
+        reqwest_builder = reqwest_builder.add_root_certificate(cert);
+    }
+
     options.client_options.transport = Some(azure_core::http::Transport::new(std::sync::Arc::new(
         reqwest_builder
             .build()
             .map_err(|e| format!("Failed to build reqwest client: {e}"))?,
     )));
-    let client =
-        BlobContainerClient::from_url(url, None, Some(options)).map_err(|e| format!("{e}"))?;
+    let client = BlobContainerClient::from_url(url, credential, Some(options))
+        .map_err(|e| format!("{e}"))?;
     Ok(Arc::new(client))
 }
+
+#[cfg(test)]
+#[derive(Debug)]
+struct MockTokenCredential;
+
+#[cfg(test)]
+#[async_trait::async_trait]
+impl TokenCredential for MockTokenCredential {
+    async fn get_token(
+        &self,
+        scopes: &[&str],
+        _options: Option<azure_core::credentials::TokenRequestOptions<'_>>,
+    ) -> azure_core::Result<azure_core::credentials::AccessToken> {
+        let Some(scope) = scopes.first() else {
+            return Err(Error::with_message(
+                ErrorKind::Credential,
+                "no scopes were provided",
+            ));
+        };
+
+        // serde_json sometimes does and sometimes doesn't preserve order, be careful to sort
+        // the claims in alphabetical order to ensure a consistent base64 encoding for testing
+        let jwt = serde_json::json!({
+            "aud": scope.strip_suffix("/.default").unwrap_or(*scope),
+            "exp": 2147483647,
+            "iat": 0,
+            "iss": "https://sts.windows.net/",
+            "nbf": 0,
+        });
+
+        // JWTs do not include standard base64 padding.
+        // this seemed cleaner than importing a new crates just for this function
+        let jwt_base64 = format!(
+            "e30.{}.",
+            BASE64_STANDARD
+                .encode(serde_json::to_string(&jwt).unwrap())
+                .trim_end_matches("=")
+        )
+        .to_string();
+
+        warn!(
+            "Using mock token credential, JWT: {}, base64: {}",
+            serde_json::to_string(&jwt).unwrap(),
+            jwt_base64
+        );
+
+        Ok(azure_core::credentials::AccessToken::new(
+            jwt_base64,
+            azure_core::time::OffsetDateTime::now_utc() + std::time::Duration::from_secs(3600),
+        ))
+    }
+}
+
+#[cfg(test)]
+#[tokio::test]
+async fn azure_mock_token_credential_test() {
+    let credential = MockTokenCredential;
+    let access_token = credential
+        .get_token(&["https://example.com/.default"], None)
+        .await
+        .expect("valid credential should return a token");
+    assert_eq!(
+        access_token.token.secret(),
+        "e30.eyJhdWQiOiJodHRwczovL2V4YW1wbGUuY29tIiwiZXhwIjoyMTQ3NDgzNjQ3LCJpYXQiOjAsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LyIsIm5iZiI6MH0."
+    );
+}
diff --git a/src/sinks/azure_logs_ingestion/config.rs b/src/sinks/azure_logs_ingestion/config.rs
index 4e876a18a26bd..3b105d549d0c1 100644
--- a/src/sinks/azure_logs_ingestion/config.rs
+++ b/src/sinks/azure_logs_ingestion/config.rs
@@ -1,20 +1,14 @@
 use std::sync::Arc;
 
-use azure_core::credentials::{TokenCredential, TokenRequestOptions};
-use azure_core::http::ClientMethodOptions;
-use azure_core::{Error, error::ErrorKind};
-
-use azure_identity::{
-    AzureCliCredential, ClientAssertion, ClientAssertionCredential, ClientSecretCredential,
-    ManagedIdentityCredential, ManagedIdentityCredentialOptions, UserAssignedId,
-    WorkloadIdentityCredential,
-};
-use vector_lib::{configurable::configurable_component, schema, sensitive_string::SensitiveString};
+use azure_core::credentials::TokenCredential;
+
+use vector_lib::{configurable::configurable_component, schema};
 use vrl::value::Kind;
 
 use crate::{
     http::{HttpClient, get_http_scheme_from_uri},
     sinks::{
+        azure_common::config::AzureAuthentication,
         prelude::*,
         util::{RealtimeSizeBasedDefaultBatchSettings, UriSerde, http::HttpStatusRetryLogic},
     },
@@ -65,7 +59,6 @@ pub struct AzureLogsIngestionConfig {
     pub stream_name: String,
 
     #[configurable(derived)]
-    #[serde(default)]
     pub auth: AzureAuthentication,
 
     /// [Token scope][token_scope] for dedicated Azure regions.
@@ -129,191 +122,6 @@ impl Default for AzureLogsIngestionConfig {
     }
 }
 
-/// Configuration of the authentication strategy for interacting with Azure services.
-#[configurable_component]
-#[derive(Clone, Debug, Derivative, Eq, PartialEq)]
-#[derivative(Default)]
-#[serde(deny_unknown_fields, untagged)]
-pub enum AzureAuthentication {
-    /// Use client credentials
-    #[derivative(Default)]
-    ClientSecretCredential {
-        /// The [Azure Tenant ID][azure_tenant_id].
-        ///
-        /// [azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        azure_tenant_id: String,
-
-        /// The [Azure Client ID][azure_client_id].
-        ///
-        /// [azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        azure_client_id: String,
-
-        /// The [Azure Client Secret][azure_client_secret].
-        ///
-        /// [azure_client_secret]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
-        #[configurable(metadata(docs::examples = "00-00~000000-0000000~0000000000000000000"))]
-        azure_client_secret: SensitiveString,
-    },
-
-    /// Use credentials from environment variables
-    #[configurable(metadata(docs::enum_tag_description = "The kind of Azure credential to use."))]
-    Specific(SpecificAzureCredential),
-}
-
-/// Specific Azure credential types.
-#[configurable_component]
-#[derive(Clone, Debug, Eq, PartialEq)]
-#[serde(
-    tag = "azure_credential_kind",
-    rename_all = "snake_case",
-    deny_unknown_fields
-)]
-pub enum SpecificAzureCredential {
-    /// Use Azure CLI credentials
-    #[cfg(not(target_arch = "wasm32"))]
-    AzureCli {},
-
-    /// Use Managed Identity credentials
-    ManagedIdentity {
-        /// The User Assigned Managed Identity (Client ID) to use.
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        user_assigned_managed_identity_id: Option<String>,
-    },
-
-    /// Use Managed Identity with Client Assertion credentials
-    ManagedIdentityClientAssertion {
-        /// The User Assigned Managed Identity (Client ID) to use for the managed identity.
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        user_assigned_managed_identity_id: Option<String>,
-
-        /// The target Tenant ID to use.
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        client_assertion_tenant_id: String,
-
-        /// The target Client ID to use.
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        client_assertion_client_id: String,
-    },
-
-    /// Use Workload Identity credentials
-    WorkloadIdentity {},
-}
-
-#[derive(Debug)]
-struct ManagedIdentityClientAssertion {
-    credential: Arc<dyn TokenCredential>,
-    scope: String,
-}
-
-#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
-impl ClientAssertion for ManagedIdentityClientAssertion {
-    async fn secret(&self, options: Option<ClientMethodOptions<'_>>) -> azure_core::Result<String> {
-        Ok(self
-            .credential
-            .get_token(
-                &[&self.scope],
-                Some(TokenRequestOptions {
-                    method_options: options.unwrap_or_default(),
-                }),
-            )
-            .await?
-            .token
-            .secret()
-            .to_string())
-    }
-}
-
-impl AzureAuthentication {
-    /// Returns the provider for the credentials based on the authentication mechanism chosen.
-    pub async fn credential(&self) -> azure_core::Result<Arc<dyn TokenCredential>> {
-        match self {
-            Self::ClientSecretCredential {
-                azure_tenant_id,
-                azure_client_id,
-                azure_client_secret,
-            } => {
-                if azure_tenant_id.is_empty() {
-                    return Err(Error::with_message(ErrorKind::Credential,
-                        "`auth.azure_tenant_id` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
-                    ));
-                }
-                if azure_client_id.is_empty() {
-                    return Err(Error::with_message(ErrorKind::Credential,
-                        "`auth.azure_client_id` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
-                    ));
-                }
-                if azure_client_secret.inner().is_empty() {
-                    return Err(Error::with_message(ErrorKind::Credential,
-                        "`auth.azure_client_secret` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
-                    ));
-                }
-                let secret: String = azure_client_secret.inner().into();
-                let credential: Arc<dyn TokenCredential> = ClientSecretCredential::new(
-                    &azure_tenant_id.clone(),
-                    azure_client_id.clone(),
-                    secret.into(),
-                    None,
-                )?;
-                Ok(credential)
-            }
-
-            Self::Specific(specific) => specific.credential().await,
-        }
-    }
-}
-
-impl SpecificAzureCredential {
-    /// Returns the provider for the credentials based on the specific credential type.
-    pub async fn credential(&self) -> azure_core::Result<Arc<dyn TokenCredential>> {
-        let credential: Arc<dyn TokenCredential> = match self {
-            #[cfg(not(target_arch = "wasm32"))]
-            Self::AzureCli {} => AzureCliCredential::new(None)?,
-
-            Self::ManagedIdentity {
-                user_assigned_managed_identity_id,
-            } => {
-                let mut options = ManagedIdentityCredentialOptions::default();
-                if let Some(id) = user_assigned_managed_identity_id {
-                    options.user_assigned_id = Some(UserAssignedId::ClientId(id.clone()));
-                }
-                ManagedIdentityCredential::new(Some(options))?
-            }
-
-            Self::ManagedIdentityClientAssertion {
-                user_assigned_managed_identity_id,
-                client_assertion_tenant_id,
-                client_assertion_client_id,
-            } => {
-                let mut options = ManagedIdentityCredentialOptions::default();
-                if let Some(id) = user_assigned_managed_identity_id {
-                    options.user_assigned_id = Some(UserAssignedId::ClientId(id.clone()));
-                }
-                let msi: Arc<dyn TokenCredential> = ManagedIdentityCredential::new(Some(options))?;
-                let assertion = ManagedIdentityClientAssertion {
-                    credential: msi,
-                    // Future: make this configurable for sovereign clouds? (no way to test...)
-                    scope: "api://AzureADTokenExchange/.default".to_string(),
-                };
-
-                ClientAssertionCredential::new(
-                    client_assertion_tenant_id.clone(),
-                    client_assertion_client_id.clone(),
-                    assertion,
-                    None,
-                )?
-            }
-
-            Self::WorkloadIdentity {} => WorkloadIdentityCredential::new(None)?,
-        };
-        Ok(credential)
-    }
-}
-
 impl AzureLogsIngestionConfig {
     #[allow(clippy::too_many_arguments)]
     pub(super) async fn build_inner(
diff --git a/src/sinks/azure_logs_ingestion/tests.rs b/src/sinks/azure_logs_ingestion/tests.rs
index 26eda91338836..46095071bd28c 100644
--- a/src/sinks/azure_logs_ingestion/tests.rs
+++ b/src/sinks/azure_logs_ingestion/tests.rs
@@ -8,6 +8,8 @@ use vector_lib::config::log_schema;
 use azure_core::credentials::{AccessToken, TokenCredential};
 use azure_core::time::OffsetDateTime;
 
+use crate::sinks::azure_common::config::{AzureAuthentication, SpecificAzureCredential};
+
 use super::config::AzureLogsIngestionConfig;
 
 use crate::{
@@ -26,50 +28,22 @@ fn generate_config() {
 
 #[tokio::test]
 async fn basic_config_error_with_no_auth() {
-    let config: AzureLogsIngestionConfig = toml::from_str::<AzureLogsIngestionConfig>(
-        r#"
+    let config: Result<AzureLogsIngestionConfig, toml::de::Error> =
+        toml::from_str::<AzureLogsIngestionConfig>(
+            r#"
             endpoint = "https://my-dce-5kyl.eastus-1.ingest.monitor.azure.com"
             dcr_immutable_id = "dcr-00000000000000000000000000000000"
             stream_name = "Custom-UnitTest"
         "#,
-    )
-    .expect("Config parsing failed");
-
-    assert_eq!(
-        config.endpoint,
-        "https://my-dce-5kyl.eastus-1.ingest.monitor.azure.com"
-    );
-    assert_eq!(
-        config.dcr_immutable_id,
-        "dcr-00000000000000000000000000000000"
-    );
-    assert_eq!(config.stream_name, "Custom-UnitTest");
-    assert_eq!(config.token_scope, "https://monitor.azure.com/.default");
-    assert_eq!(config.timestamp_field, "TimeGenerated");
-
-    match &config.auth {
-        crate::sinks::azure_logs_ingestion::config::AzureAuthentication::ClientSecretCredential {
-            azure_tenant_id,
-            azure_client_id,
-            azure_client_secret,
-        } => {
-            assert_eq!(azure_tenant_id, "");
-            assert_eq!(azure_client_id, "");
-            let secret: String = azure_client_secret.inner().into();
-            assert_eq!(secret, "");
-        }
-        _ => panic!("Expected ClientSecretCredential variant"),
-    }
+        );
 
-    let cx = SinkContext::default();
-    let sink = config.build(cx).await;
-    match sink {
-        Ok(_) => panic!("Config build should have errored due to missing auth info"),
+    match config {
+        Ok(_) => panic!("Config parsing should have failed due to missing auth config"),
         Err(e) => {
             let err_str = e.to_string();
             assert!(
-                err_str.contains("`auth.azure_tenant_id` is blank"),
-                "Config build did not complain about azure_tenant_id being blank: {}",
+                err_str.contains("missing field `auth`"),
+                "Config parsing did not complain about missing auth field: {}",
                 err_str
             );
         }
@@ -85,6 +59,7 @@ fn basic_config_with_client_credentials() {
             stream_name = "Custom-UnitTest"
 
             [auth]
+            azure_credential_kind = "client_secret_credential"
             azure_tenant_id = "00000000-0000-0000-0000-000000000000"
             azure_client_id = "mock-client-id"
             azure_client_secret = "mock-client-secret"
@@ -105,17 +80,17 @@ fn basic_config_with_client_credentials() {
     assert_eq!(config.timestamp_field, "TimeGenerated");
 
     match &config.auth {
-        crate::sinks::azure_logs_ingestion::config::AzureAuthentication::ClientSecretCredential {
+        AzureAuthentication::Specific(SpecificAzureCredential::ClientSecretCredential {
             azure_tenant_id,
             azure_client_id,
             azure_client_secret,
-        } => {
+        }) => {
             assert_eq!(azure_tenant_id, "00000000-0000-0000-0000-000000000000");
             assert_eq!(azure_client_id, "mock-client-id");
             let secret: String = azure_client_secret.inner().into();
             assert_eq!(secret, "mock-client-secret");
         }
-        _ => panic!("Expected ClientSecretCredential variant"),
+        _ => panic!("Expected Specific(ClientSecretCredential) variant"),
     }
 }
 
@@ -146,11 +121,7 @@ fn basic_config_with_managed_identity() {
     assert_eq!(config.timestamp_field, "TimeGenerated");
 
     match &config.auth {
-        crate::sinks::azure_logs_ingestion::config::AzureAuthentication::Specific(
-            crate::sinks::azure_logs_ingestion::config::SpecificAzureCredential::ManagedIdentity {
-                ..
-            },
-        ) => {
+        AzureAuthentication::Specific(SpecificAzureCredential::ManagedIdentity { .. }) => {
             // Expected variant
         }
         _ => panic!("Expected Specific(ManagedIdentity) variant"),
@@ -182,6 +153,7 @@ async fn correct_request() {
             stream_name = "Custom-UnitTest"
 
             [auth]
+            azure_credential_kind = "client_secret_credential"
             azure_tenant_id = "00000000-0000-0000-0000-000000000000"
             azure_client_id = "mock-client-id"
             azure_client_secret = "mock-client-secret"
@@ -292,6 +264,7 @@ async fn mock_healthcheck_with_400_response() {
             stream_name = "Custom-UnitTest"
 
             [auth]
+            azure_credential_kind = "client_secret_credential"
             azure_tenant_id = "00000000-0000-0000-0000-000000000000"
             azure_client_id = "mock-client-id"
             azure_client_secret = "mock-client-secret"
@@ -361,6 +334,7 @@ async fn mock_healthcheck_with_403_response() {
             stream_name = "Custom-UnitTest"
 
             [auth]
+            azure_credential_kind = "client_secret_credential"
             azure_tenant_id = "00000000-0000-0000-0000-000000000000"
             azure_client_id = "mock-client-id"
             azure_client_secret = "mock-client-secret"
diff --git a/src/sinks/mod.rs b/src/sinks/mod.rs
index 3a9c3c049a0fa..e5584de61dd02 100644
--- a/src/sinks/mod.rs
+++ b/src/sinks/mod.rs
@@ -26,7 +26,7 @@ pub mod aws_s_s;
 pub mod axiom;
 #[cfg(feature = "sinks-azure_blob")]
 pub mod azure_blob;
-#[cfg(feature = "sinks-azure_blob")]
+#[cfg(any(feature = "sinks-azure_blob", feature = "sinks-azure_logs_ingestion",))]
 pub mod azure_common;
 #[cfg(feature = "sinks-azure_logs_ingestion")]
 pub mod azure_logs_ingestion;
diff --git a/tests/data/ClientCertificateAuth.pfx b/tests/data/ClientCertificateAuth.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..e289b55375a4ac01132352e54813ffd76405bcc0
GIT binary patch
literal 2467
zcmai$X*3iH8^_JYjO|(m*)GNs8rRtOeN7nIn_)7@zGSB`jBHaP(Y2&TlOjuK24hcl
zDceP|zPhL+GMI$>y61gQ_v8KWoaa3M|9Q^y>GwYmiU@lM1b|RPm<uaRF~d6JfD6C|
zAQNGhU?R-)R5nBrL5=@dtYjjHaw?rJv7EM|e;feH?dJgDLfN1c{uwz@VqoYU<69b?
zC0ac|Ae05g$qN17H6RSaf)Zzid1Y7wu7JP*MKDiEQdM0-qGR#$8h3E=&TLo;5rmQn
z4bS{DU?B20qr=?WgYzXKw%ZK%#X%}n&Di!S6&apr%*5k;TOMp1+n?}=?7B(zgoGN%
z+o=i!1qscJ6?y@mey3|7qmTCrU(O3OjMLKuh08QB!+#b%vebg=YstRo6UtmDo<vI(
z+?&CAJ?>g<Q_)+ymudE%^sp{{<EhQwcfMSotP8PYVUJOj3?uewcXdKN?`#Y5*9EoS
z7@mtOqoPSy<@OF)ptvyyz`?Sc&7aO6<$W+@J<}NBQAeNTY2oAIvGs4o1fHh8q;lPb
zFJJbRu}m`RuSzE&w8Srkv^xkF4*@pACD8iT>ra;t>(+DF#`Fr0R=8`-8d_*|TW-N^
zbl*q?#EcG5mTh$AF9my5!#w>BN%mvzvYCMH<M@y8%~XHYp;s)=OJd%pr>j<K=SZhC
zCU8$1@uoI-=lv*)+f79Tz{_|w&{WJ#%Ui6Nqr3b06)R-upz~4}Q&HowKqH$^UbWsM
z{``_qdJKo?C3Iy~^$(ppc^O+YHz~XBqUdfFht`S4mH00tO}dUiM0jytOZA!lOA&{C
zF-@0C{G<7zQvGvHM^xJl0WPn)rt6p(Bj^p&gS&0VQ5T)&u5U2cG?va*Z3+ni#@kz(
z$6h?~#+Y+R%~ZVHOPH&I<b<msUVmQA=5E$uck~WFG~$1ypzTkGG@pnE!=ekToZcYZ
za0-1r*X|w1je7X+;Cf@B9Az__lm8i*IFZq}QC)tikbNZb3frjFpNv~EOR&SmCBp3~
zzsR2KsFGSBp&yHPC0S0^G$vBBQ})wU0sAMO$pIS@RLvp>Ml9IEW7mY*aR|^%vM|mk
z>D$T_eLDX<GE?|IrG_(=L_hu%7-VSexwAj%YMxv$EctL9eefFvA0U-qK*2VK=68N|
zK=^e%db1!^Jtar13!A?|zCIhbRli=>7@~?mtF+1NH>3DzL7G&!OEmFHc3r%yrn8ag
zH8OA8F}bG=p>N?#M!pyvyu4cQ#Qn?L7u)AQZ+B7!Q>u$)TiA@enyp?*wo7RZbgbNr
z&9_oG>09(IIZv_)5y+kBwFf*c{#`)C3Juaoj0>HebqYigAvb>V_czdx7%&kMaVm$N
zRv;_K|5@i`2LMk^l~Yma-vGXH&|ttURI>b6fZ?ozpeNh!`Rl5i<{r?J`@ux;7!I5>
zk~oIIy(wTih5{n}gchSthP}|EWtvrAb1wwuF6w4`MtP(6ZzlOy;D-whH6j*woj-bk
z)v4+nR`TDo8;<5`qfGI)l#GY2W8vLL+qKq31G%0>Uz1m#-S<hB4A830ZewoB+=fp;
z7sm;KR|&Q?&eTeg4GcF#U)lpvR@A9pqV8^R!F@#Ap~JrWoZ|j#@stI{bNZ$ZAI^y7
zzLQ1Ly7PFM&anmR+&RFgdS!>PChsR%41Y%^EtCv>o!YV;iZjxy@}h{{#bOtDMheWo
zw(4F>xS3U(D%6LzC{1e0{q;x_u^s9p{A(?5C~05GqJXvpEEI}q(C|}I>7$HpPTa;(
zrebEj=W6qY%t~uLkEblEA|;}Cy=kE5_?bzyuZr-)^J(I+G-#qWHO=2a1)KPk4-x38
z>=FAgP}b@({qg}lYNQf-c}`5X>Fr+!zr!Jbn*O(J*30vA{65;tEAe7zed!atQ<2X3
z#17Kh&D-g=(PI1y>@p-1C(HK!inEb}_oaA>{NkD#QW%M@eom+@KXV%@A#!?&T}rD<
zd0yKg;gPnNgH3^^q=a#VR}ih@({t}!#?1yiEy;M0UXBJT9$34IMNi(SJ;TYLnr+tk
z*c(E97tZ-w>DIX5PPWM^{Zd9y^_Z4iD?Fk7*@xJ;EWY<qIe^)6>?T^6!?b!bNqx<>
zC%b<-DHuB|936ZiiCucg_3C?4^B>+chJ0pT;DP3e+L7ry8H^|a7^7h7O5T{@p4eRK
zdXJ3Kb?FhAD+sCCqY7rE5>n&Kc7x_9>@w+kq)nE)XnBIt9mRn{-n-@f!Rwo%8sAp;
z`G7ryL63GLEZ?Q$bVhwSc+|UTM%u5xBI7fmr&&j7eD#MYwMWopHu>PmHzWgMvdW7!
zTeBA{-vzd?b+Y#GBWkjPq4owL1{?ak(~%HdqsX(sVK_!hiGkb$FvLH8pi|->j?aRt
zs+J{|Z@0&nhxZgax?<FO16mWQ(k<WbUBM8x58W03LB8kEWdrW8>n>9Zo{>iq`l6pl
zESYILy?h-=+#aO1HPU*Di&}%zsdiGF+oKSstNb?mjUSkxHeCO+WGgXJK4Rzdob#%S
zo?N4OC+z_dCiFoKYwe?Ek-1%UmYwfp+*QKsb%~(F&Z`K1u8>Sg)r)PTx3td8i&(1F
zvzK4x@G5O7&%dzVRJmnWgVdFg)8wg8DMaeWaeWut0Qw&nV@ZrO%V$}4UIx81Gk@E*
z;39mM#(E!rt_h<?2QGb6X?rsdv?5E#-Q(@jF{GrVeY1Ra=r=5tbMi)fOILJ6)==cW
zc6F;vR?QEBI?wMcKYoajN!?*#rpH;}Kr4d|o+=L08^eAPt%_4C6^qCK&nvqTNgW*Z
zcu!EDR6na7!||+~bG`Xwf_^Tg{SE)5vi+XSP>Fo7t+-=p4R^`KKh%MSVeS38RG9F!
zYl0t@52PjH7ZfO3M~=Hg4Pu^`L)OV>4BM%Ed!SMfMzq&s|D?1<r~HaP-b;A(31&@n
zu6M%S*~HgCrRO_!Ju2F=uXS~GI$*Y_&C2RFjdsu%k$(*>q`Z!vw|a*UpR2qV1*M+9
zLztw&9}G=BTDO3B;VLfa6)@9bE?Qz51B!p-smP+Fe+Dc}Kt&J?NABjzJC%MW3RI`X
za2d$ig=@Blp-fOJD6XIH4G;if0ZaN8uILs-Ob3Hud6PjPmwKTu_?mrd<`jRwu)MFc
Tg&i2m^(Z6qB2fO!-%<Nto#Jgc

literal 0
HcmV?d00001

diff --git a/tests/data/Makefile b/tests/data/Makefile
index f3550bf8bf100..6d4a17ab0d54c 100644
--- a/tests/data/Makefile
+++ b/tests/data/Makefile
@@ -61,6 +61,27 @@ ca/intermediate_server/certs/localhost.cert.pem: ca/intermediate_server/csr/loca
 ca/intermediate_server/certs/localhost-chain.cert.pem: ca/intermediate_server/certs/ca-chain.cert.pem ca/intermediate_server/certs/localhost.cert.pem
 	cat ca/intermediate_server/certs/localhost.cert.pem ca/intermediate_server/certs/ca-chain.cert.pem > ca/intermediate_server/certs/localhost-chain.cert.pem
 
+ca/intermediate_server/private/azurite.key.pem:
+	openssl genrsa -out ca/intermediate_server/private/azurite.key.pem 2048
+
+ca/intermediate_server/csr/azurite.csr.pem: ca/intermediate_server/private/azurite.key.pem
+	openssl req -config ca/intermediate_server/openssl.cnf \
+		-key ca/intermediate_server/private/azurite.key.pem \
+		-subj '/CN=azurite/OU=Vector/O=Datadog/ST=New York/L=New York/C=US' \
+		-addext 'subjectAltName=DNS:azurite' \
+		-addext 'basicConstraints=critical,CA:FALSE' \
+		-addext 'extendedKeyUsage=serverAuth' \
+		-new -sha256 -out ca/intermediate_server/csr/azurite.csr.pem
+
+ca/intermediate_server/certs/azurite.cert.pem: ca/intermediate_server/csr/azurite.csr.pem
+	openssl ca -batch -config ca/intermediate_server/openssl.cnf \
+		-extensions server_cert -days 3650 -notext -md sha256 \
+		-in ca/intermediate_server/csr/azurite.csr.pem \
+		-out ca/intermediate_server/certs/azurite.cert.pem
+
+ca/intermediate_server/certs/azurite-chain.cert.pem: ca/intermediate_server/certs/ca-chain.cert.pem ca/intermediate_server/certs/azurite.cert.pem
+	cat ca/intermediate_server/certs/azurite.cert.pem ca/intermediate_server/certs/ca-chain.cert.pem > ca/intermediate_server/certs/azurite-chain.cert.pem
+
 ca/intermediate_server/private/elasticsearch-secure.key.pem:
 	openssl genrsa -out ca/intermediate_server/private/elasticsearch-secure.key.pem 2048
 
diff --git a/tests/data/ca/intermediate_server/certs/azurite-chain.cert.pem b/tests/data/ca/intermediate_server/certs/azurite-chain.cert.pem
new file mode 100644
index 0000000000000..f646a0fe3c20a
--- /dev/null
+++ b/tests/data/ca/intermediate_server/certs/azurite-chain.cert.pem
@@ -0,0 +1,98 @@
+-----BEGIN CERTIFICATE-----
+MIIFhDCCA2ygAwIBAgICEAkwDQYJKoZIhvcNAQELBQAwazELMAkGA1UEBhMCVVMx
+ETAPBgNVBAgMCE5ldyBZb3JrMRAwDgYDVQQKDAdEYXRhZG9nMQ8wDQYDVQQLDAZW
+ZWN0b3IxJjAkBgNVBAMMHVZlY3RvciBJbnRlcm1lZGlhdGUgU2VydmVyIENBMB4X
+DTI2MDMwNDIwNTI1M1oXDTM2MDMwMTIwNTI1M1owaDELMAkGA1UEBhMCVVMxETAP
+BgNVBAgMCE5ldyBZb3JrMREwDwYDVQQHDAhOZXcgWW9yazEQMA4GA1UECgwHRGF0
+YWRvZzEPMA0GA1UECwwGVmVjdG9yMRAwDgYDVQQDDAdhenVyaXRlMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvnAyCpCvDorySCNastVW9x3+31Ta4SVP
+bGW0LqD1WO42dSmUMQ2iRGsFeHvM4guXrhXloBVf35L1OyWRp/bltHlleLrr58bR
+RInmuyocDTvm4t7VU+ybnPD7MhdNsbMmo2HBn12cEY7PszxVOwcZ8j0XOHtI+ve3
+QZ4loS61BR5TxrCdnpE++gxh7KhUG1yTiKmEEt587vRIuVBWNrLFVhYQN6mc+2JJ
+63PaXXvGpGiDwPqUqi0WhIYp73XVyIqbHivI27Tiuv/n9gcHPAt2UwVbv1AqqFFn
+Vr8lMVavcDcoTrHdJ8PXN4EipgvssJF14gFFg7L0U4AOj4xu31e+iQIDAQABo4IB
+MzCCAS8wCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwMwYJYIZIAYb4QgEN
+BCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
+FgQUvRxz2qJo5NhsNm51lOVK0woSO2UwgZUGA1UdIwSBjTCBioAUPD06L8zVggN9
+mcRY8eHbNu+tDUGhbqRsMGoxEjAQBgNVBAMMCVZlY3RvciBDQTEPMA0GA1UECwwG
+VmVjdG9yMRAwDgYDVQQKDAdEYXRhZG9nMREwDwYDVQQIDAhOZXcgWW9yazERMA8G
+A1UEBwwITmV3IFlvcmsxCzAJBgNVBAYTAlVTggIQADAOBgNVHQ8BAf8EBAMCBaAw
+EwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBAFZJBzkVVJQ8
+pjs1qRrjsIgr3w1ylDJD4YTTEh96jLvQTf/PzhwG+W8ylr8a7EPzaJ9SOnLimEat
+sw8ZCZJlRNdALL7o1tDAfOUkva45IQzvpzvDjy7iLQ488Cv4or/wWBd56JqWlYyA
+OcyaCAkslI4RRoeIlKczbmhF/hTXlqe4z8q/89tHwFINOksbCj5VWYKzmYMijluw
+X6RfcTyyaPlhz/1TJERWxyYVs+RN9TLNWvgPAeNmSZvnOXJ7b0hiIwRN+Hj+0M9L
+tSfHq7Nrz8ls9+u7gyfkYtXz7KahI6CVKATIJl18X7zTLRCh/2DRyISSs+hbXlBa
+fSG/rL92F/rerzw0w6PP7cs0TnKuEnnwIBZV+q5mkg/c15mTL5vgzRCiZfE8E/bJ
+UwV+eX7s1yd67UU9LgNanYYTCNpAnb9HZwm+65Q+wEO7M3puxL2/DqbJ3IQVHDRx
+6/2raCYBszz6p4FPalRXmUqa5JogIxc5kVPHje330JwY5JKwIfe/GtT5AkeRqHx+
+KlbEBQYfIh66BPB+y60sPBUtJslPfDV+PabDHq6u9wJtZi12RbxLFBjQtCMAV3vx
+AvTfgxzbZ8rqg7mL8JB1SupkMiw8eObC/zrYGMv8O3IOoSWSRNb/KrYjYf3oVRQ5
+CDjEDNgIlI4ue4WLySdt1Fped5jCf/+P
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFtzCCA5+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwajESMBAGA1UEAwwJVmVj
+dG9yIENBMQ8wDQYDVQQLDAZWZWN0b3IxEDAOBgNVBAoMB0RhdGFkb2cxETAPBgNV
+BAgMCE5ldyBZb3JrMREwDwYDVQQHDAhOZXcgWW9yazELMAkGA1UEBhMCVVMwHhcN
+MjIwNjA3MjIyNzUzWhcNMzIwNjA0MjIyNzUzWjBrMQswCQYDVQQGEwJVUzERMA8G
+A1UECAwITmV3IFlvcmsxEDAOBgNVBAoMB0RhdGFkb2cxDzANBgNVBAsMBlZlY3Rv
+cjEmMCQGA1UEAwwdVmVjdG9yIEludGVybWVkaWF0ZSBTZXJ2ZXIgQ0EwggIiMA0G
+CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCy/mB0/ZwfgKrSZPQIFaGPtRA9xL2N
+o2SsHndZ8k2XOCV225Hb2fzNH+o2WGNSjwmGjLP/uXb47KH0cHCAyFGzSjp++8/O
+zoZaFiO0P5El02hQxmoabO3Cqu/N62EFsLfpSM828JM6YOn9p+WXUDn1+YPNoOOE
+H142p4/RjFnXNHkzR3geXU4Pfi3KXDrMi8vK42lDqXPLPs6rhreBAfQ2dsYyqhz6
+tg6FzZuXxxzEYyYtNgGh+zTji99WCBMLbCmRcDurRjdTDO7m4O3PrwbGUy0xdLeb
+HJiNGvUDCPH4bfwLiNqwVIZY38RBCAqbCnrqRhDaZIfAUev4mq3Kqh6KUeO/U7Vx
+/5J5rL5ApREKOfWPATHMprBuEU2rs3N+MPBA04HoiFlu311urCxVEA1qsZCTkoCg
+GHuDIVSU4E4hT4co95/J0to4zWgPlfPg1+cXyU8lAIMe7JdCGkG9cDe7Umw/GSbt
+ZdoCMQZ6WyyiW2Hw+7sFD3V3VzYa5YA/rjKZRduPmGWKrs+mAa5J5pM2M22rrjbd
+EpfTHWLS9s6cPN3/jxpCxn6Hv/KhIYRAcIterugag1+clvS1ajVjxBRavOxPBsf+
+hYdh7S5NTZnT98gjkc3yOuGQm7BPtXau+IYZRlWcB0dJ4/E2P69hmWQezSo9VVWh
+5/K1RkbPvqTGZQIDAQABo2YwZDAdBgNVHQ4EFgQUPD06L8zVggN9mcRY8eHbNu+t
+DUEwHwYDVR0jBBgwFoAURTWK6ARqnZkz8rktUc5PrtasIh8wEgYDVR0TAQH/BAgw
+BgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBAGqaGBuL
+2J6Na8RHx/GmSeuZFiVcWhmd/I9bVpeMSYHSZujA2nay6OGaUYs0Lq/G5OKgsuT9
+AIHnsn7VUE1zqoDfXac/K8sXlOig8if7rTb+06jgymaP1YSELg3R+pBsdkZnXVil
+izh/9FvzoyV+QQlIhojqCIybVFgxa1XFHq4QCPhDfwkg+tp9RctfwNmWgsJ63H19
+RmxN+H2xIrySvObwXnB4j6D4wvgu468QXQMEuSsnLcIQFg6Zteqe8fixbqTiOTBf
+Dk1k+EpB9VMEkIPvMdfa48vseXdBEe6Ma9zGuJC76q4q1ZapVLTvOUP5Y24khlgd
+cj5tfP7o7yc6HqymfXAcD1lzP2JQhqaRxA4I18Nrd+aHi+G1EM2c3cicuD3n6Iw9
+9oqdCwmMfS25fv5cyA5B6hRusIZ9wRopTi7at+JHl0GIt/FelaTYI7kRmAqgakQe
+oEKLpXcH8lRJW802DmXm7ka4eQzwxa7Ngyf8O+JOFtGO0+EshuLJovxiPl6IyLyG
+NJ/dHq3ad+46YVManbHdyjHxgT5PSvJFkq0Yluvf44NIyP5QRTCAvfH76bu7hXgS
+QoQj5t5ILn6meQRTR79r2iwpQTanPLTEdoZvmrE4TeUBev9BA5KpiPPA3i3ZF/oV
+0EYorXCNri7M/jylGW7AuWvNUyaVR6xgxAn6
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIFujCCA6KgAwIBAgIJAKhPL9BkNaFGMA0GCSqGSIb3DQEBCwUAMGoxEjAQBgNV
+BAMMCVZlY3RvciBDQTEPMA0GA1UECwwGVmVjdG9yMRAwDgYDVQQKDAdEYXRhZG9n
+MREwDwYDVQQIDAhOZXcgWW9yazERMA8GA1UEBwwITmV3IFlvcmsxCzAJBgNVBAYT
+AlVTMB4XDTIyMDYwNzIyMjc1MloXDTQyMDYwMjIyMjc1MlowajESMBAGA1UEAwwJ
+VmVjdG9yIENBMQ8wDQYDVQQLDAZWZWN0b3IxEDAOBgNVBAoMB0RhdGFkb2cxETAP
+BgNVBAgMCE5ldyBZb3JrMREwDwYDVQQHDAhOZXcgWW9yazELMAkGA1UEBhMCVVMw
+ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC9c1T+NXTNmqiiV36NSEJt
+7mo0cyv8Byk2ZGdC85vHBm45QDY5USoh0vgonzPpWgSMggPn1WbR0f1y+LBwXdlM
++ZyZh2RVVeUrSjJ88lLHVn4DfywpdDkwQaFj1VmOsj2I9rMMrgc5x5n1Hj7lwZ+t
+uPVSAGmgKp4iFfzLph9r/rjP1TUAnVUComfTUVS+Gd7zoGPOc14cMJXG6g2P2aAU
+P6dg5uQlTxRmagnlx7bwm3lRwv6LMtnAdnjwBDBxr933nucAnk21GgE92GejiO3Z
+OwlzIdzBI23lPcWi5pq+vCTgAArNq24W1Ha+7Jn5QewNTGKFyyYAJetZAwCUR8QS
+Ip++2GE2pNhaGqcV5u1Tbwl02eD6p2qRqjfgLxmb+aC6xfl0n9kiFGPZppjCqDEW
+sw+gX66nf+qxZVRWpJon2kWcFvhTnLqoa3T3+9+KIeamz2lW6wxMnki/Co2EA1Wa
+mmedaUUcRPCgMx9aCktRkMyH6bEY8/vfJ07juxUsszOc46T00Scmn6Vkuo9Uc3Kf
+2Q2N6Wo4jtyAiMO4gAwq5kzzpBAhNgRfLHOb83r2gAUj2Y4Vln/UUR/KR8ZbJi4i
+r1BjX16Lz3yblJXXb1lp4uZynlbHNaAevXyGlRqHddM2ykKtAX/vgJcZRGSvms11
+uce/cqzrzx60AhpLRma5CwIDAQABo2MwYTAdBgNVHQ4EFgQURTWK6ARqnZkz8rkt
+Uc5PrtasIh8wHwYDVR0jBBgwFoAURTWK6ARqnZkz8rktUc5PrtasIh8wDwYDVR0T
+AQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggIBAEf5
+TR3hq/DtSAmsYotu1lAWz/OlTpG+7AdqSOHB878X4ETN3xaQ+KWvSwvf0K70ZDTV
+tFOTh/r43cpzPifPKd1P+2ctnQEzrBtAacvyETLq1ABRK9VJOtfJ6Xk5KZXPhKdY
+t353PQgBgW8YzQ2adq2B7FtgIlX7f1DIndjcMZBbolETR6xt9QwB/UnPI7Mwt01T
++bCBhr1fWAbZ4YAMlQ0xRam4qUOTjxgfmePrmSrv4HO7cXHMsRMLiXk+BLcx959/
+K/B6xzpzn6366Eqnqlo/uDiMpo5ud2I/Snz5PduB6oLztPMEf/8RmkG5tpHXYdWr
+tM64WqNGO+ikluIrrtYvtyZS4DfsLAMfMYZcxX/Uw56gHo0i2c8I6+6JvGWdvOJ0
+FjrsKeIQoRlV77z025kI4V9jKi3XNMEsAIH+W7KNSut0X80yX7SugvQGoe0GDkXu
+0fy8hMC3uTN2LEycYFRRfoIeKPLi6OZFK0PdS2E15d8PEU3n3W4eBCPgMtmiOKLY
+d8QNBC8XLAuBoK9R8luCJpOJWUcFXjLpjcDab4V2hKTuAs+GQyDh/Xx4wF1yHX0r
+zIkyN0EkOD/SvD8X4uFaM4mdsAh+ucn4ryUV7i5PgvDM9z4InHAMAee1ebBl0U+h
++NzMWF5c5OwxD5o6/Wh1HopmzJiVNT2v9u0kHT/f
+-----END CERTIFICATE-----
diff --git a/tests/data/ca/intermediate_server/certs/azurite.cert.pem b/tests/data/ca/intermediate_server/certs/azurite.cert.pem
new file mode 100644
index 0000000000000..3e2f680ef37c0
--- /dev/null
+++ b/tests/data/ca/intermediate_server/certs/azurite.cert.pem
@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFhDCCA2ygAwIBAgICEAkwDQYJKoZIhvcNAQELBQAwazELMAkGA1UEBhMCVVMx
+ETAPBgNVBAgMCE5ldyBZb3JrMRAwDgYDVQQKDAdEYXRhZG9nMQ8wDQYDVQQLDAZW
+ZWN0b3IxJjAkBgNVBAMMHVZlY3RvciBJbnRlcm1lZGlhdGUgU2VydmVyIENBMB4X
+DTI2MDMwNDIwNTI1M1oXDTM2MDMwMTIwNTI1M1owaDELMAkGA1UEBhMCVVMxETAP
+BgNVBAgMCE5ldyBZb3JrMREwDwYDVQQHDAhOZXcgWW9yazEQMA4GA1UECgwHRGF0
+YWRvZzEPMA0GA1UECwwGVmVjdG9yMRAwDgYDVQQDDAdhenVyaXRlMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvnAyCpCvDorySCNastVW9x3+31Ta4SVP
+bGW0LqD1WO42dSmUMQ2iRGsFeHvM4guXrhXloBVf35L1OyWRp/bltHlleLrr58bR
+RInmuyocDTvm4t7VU+ybnPD7MhdNsbMmo2HBn12cEY7PszxVOwcZ8j0XOHtI+ve3
+QZ4loS61BR5TxrCdnpE++gxh7KhUG1yTiKmEEt587vRIuVBWNrLFVhYQN6mc+2JJ
+63PaXXvGpGiDwPqUqi0WhIYp73XVyIqbHivI27Tiuv/n9gcHPAt2UwVbv1AqqFFn
+Vr8lMVavcDcoTrHdJ8PXN4EipgvssJF14gFFg7L0U4AOj4xu31e+iQIDAQABo4IB
+MzCCAS8wCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwMwYJYIZIAYb4QgEN
+BCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
+FgQUvRxz2qJo5NhsNm51lOVK0woSO2UwgZUGA1UdIwSBjTCBioAUPD06L8zVggN9
+mcRY8eHbNu+tDUGhbqRsMGoxEjAQBgNVBAMMCVZlY3RvciBDQTEPMA0GA1UECwwG
+VmVjdG9yMRAwDgYDVQQKDAdEYXRhZG9nMREwDwYDVQQIDAhOZXcgWW9yazERMA8G
+A1UEBwwITmV3IFlvcmsxCzAJBgNVBAYTAlVTggIQADAOBgNVHQ8BAf8EBAMCBaAw
+EwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBAFZJBzkVVJQ8
+pjs1qRrjsIgr3w1ylDJD4YTTEh96jLvQTf/PzhwG+W8ylr8a7EPzaJ9SOnLimEat
+sw8ZCZJlRNdALL7o1tDAfOUkva45IQzvpzvDjy7iLQ488Cv4or/wWBd56JqWlYyA
+OcyaCAkslI4RRoeIlKczbmhF/hTXlqe4z8q/89tHwFINOksbCj5VWYKzmYMijluw
+X6RfcTyyaPlhz/1TJERWxyYVs+RN9TLNWvgPAeNmSZvnOXJ7b0hiIwRN+Hj+0M9L
+tSfHq7Nrz8ls9+u7gyfkYtXz7KahI6CVKATIJl18X7zTLRCh/2DRyISSs+hbXlBa
+fSG/rL92F/rerzw0w6PP7cs0TnKuEnnwIBZV+q5mkg/c15mTL5vgzRCiZfE8E/bJ
+UwV+eX7s1yd67UU9LgNanYYTCNpAnb9HZwm+65Q+wEO7M3puxL2/DqbJ3IQVHDRx
+6/2raCYBszz6p4FPalRXmUqa5JogIxc5kVPHje330JwY5JKwIfe/GtT5AkeRqHx+
+KlbEBQYfIh66BPB+y60sPBUtJslPfDV+PabDHq6u9wJtZi12RbxLFBjQtCMAV3vx
+AvTfgxzbZ8rqg7mL8JB1SupkMiw8eObC/zrYGMv8O3IOoSWSRNb/KrYjYf3oVRQ5
+CDjEDNgIlI4ue4WLySdt1Fped5jCf/+P
+-----END CERTIFICATE-----
diff --git a/tests/data/ca/intermediate_server/csr/azurite.csr.pem b/tests/data/ca/intermediate_server/csr/azurite.csr.pem
new file mode 100644
index 0000000000000..09cf2dd0bc3f7
--- /dev/null
+++ b/tests/data/ca/intermediate_server/csr/azurite.csr.pem
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIC9TCCAd0CAQAwaDEQMA4GA1UEAwwHYXp1cml0ZTEPMA0GA1UECwwGVmVjdG9y
+MRAwDgYDVQQKDAdEYXRhZG9nMREwDwYDVQQIDAhOZXcgWW9yazERMA8GA1UEBwwI
+TmV3IFlvcmsxCzAJBgNVBAYTAlVTMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAvnAyCpCvDorySCNastVW9x3+31Ta4SVPbGW0LqD1WO42dSmUMQ2iRGsF
+eHvM4guXrhXloBVf35L1OyWRp/bltHlleLrr58bRRInmuyocDTvm4t7VU+ybnPD7
+MhdNsbMmo2HBn12cEY7PszxVOwcZ8j0XOHtI+ve3QZ4loS61BR5TxrCdnpE++gxh
+7KhUG1yTiKmEEt587vRIuVBWNrLFVhYQN6mc+2JJ63PaXXvGpGiDwPqUqi0WhIYp
+73XVyIqbHivI27Tiuv/n9gcHPAt2UwVbv1AqqFFnVr8lMVavcDcoTrHdJ8PXN4Ei
+pgvssJF14gFFg7L0U4AOj4xu31e+iQIDAQABoEgwRgYJKoZIhvcNAQkOMTkwNzAS
+BgNVHREECzAJggdhenVyaXRlMAwGA1UdEwEB/wQCMAAwEwYDVR0lBAwwCgYIKwYB
+BQUHAwEwDQYJKoZIhvcNAQELBQADggEBAIbILz+IbvX9126CRLqmtlp4s1q2L+A2
+jYz+qk1G1UhImumfEcLMBfj6X/ZQ5IRIrH8BZZtW9ungXUS/9eYKUCQP52GXPPZJ
+WkS3sERjvktEP7orNrTLo7v36f9P0J9eMjN8XYhcqHmZB5OyoQ4S3ndqgE4+HV8j
+OyP9lZC1Urjrre/S7pyxxnkVftxXtVHXzB0MgoQa77U/ukqeaMYIw3qWRqGwwl44
+JnZm05mukTpYnDVmo+J2Ra1uNOJf9/SIEnawyL1ROYCINxgIcdodrpuxz+dnYT0K
+zvsbMGQ1MTacJK61Pw0EBbxERB9ZhWnApRdeuhrF5oq9uGEzD/76wTg=
+-----END CERTIFICATE REQUEST-----
diff --git a/tests/data/ca/intermediate_server/index.txt b/tests/data/ca/intermediate_server/index.txt
index 0402ad0946130..b2a0481603b78 100644
--- a/tests/data/ca/intermediate_server/index.txt
+++ b/tests/data/ca/intermediate_server/index.txt
@@ -6,3 +6,4 @@ V	320613195253Z		1005	unknown	/C=US/ST=New York/L=New York/O=Datadog/OU=Vector/C
 V	320731200837Z		1006	unknown	/C=US/ST=New York/L=New York/O=Datadog/OU=Vector/CN=dufs-https
 V	330412000039Z		1007	unknown	/C=US/ST=New York/L=New York/O=Datadog/OU=Vector/CN=rabbitmq
 V	341228053159Z		1008	unknown	/C=US/ST=New York/L=New York/O=Datadog/OU=Vector/CN=pulsar
+V	360301205253Z		1009	unknown	/C=US/ST=New York/L=New York/O=Datadog/OU=Vector/CN=azurite
diff --git a/tests/data/ca/intermediate_server/index.txt.old b/tests/data/ca/intermediate_server/index.txt.old
index ab4efe2c2f6bd..0402ad0946130 100644
--- a/tests/data/ca/intermediate_server/index.txt.old
+++ b/tests/data/ca/intermediate_server/index.txt.old
@@ -5,3 +5,4 @@ V	320613195026Z		1004	unknown	/C=US/ST=New York/L=New York/O=Datadog/OU=Vector/C
 V	320613195253Z		1005	unknown	/C=US/ST=New York/L=New York/O=Datadog/OU=Vector/CN=kafka
 V	320731200837Z		1006	unknown	/C=US/ST=New York/L=New York/O=Datadog/OU=Vector/CN=dufs-https
 V	330412000039Z		1007	unknown	/C=US/ST=New York/L=New York/O=Datadog/OU=Vector/CN=rabbitmq
+V	341228053159Z		1008	unknown	/C=US/ST=New York/L=New York/O=Datadog/OU=Vector/CN=pulsar
diff --git a/tests/data/ca/intermediate_server/newcerts/1009.pem b/tests/data/ca/intermediate_server/newcerts/1009.pem
new file mode 100644
index 0000000000000..3e2f680ef37c0
--- /dev/null
+++ b/tests/data/ca/intermediate_server/newcerts/1009.pem
@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFhDCCA2ygAwIBAgICEAkwDQYJKoZIhvcNAQELBQAwazELMAkGA1UEBhMCVVMx
+ETAPBgNVBAgMCE5ldyBZb3JrMRAwDgYDVQQKDAdEYXRhZG9nMQ8wDQYDVQQLDAZW
+ZWN0b3IxJjAkBgNVBAMMHVZlY3RvciBJbnRlcm1lZGlhdGUgU2VydmVyIENBMB4X
+DTI2MDMwNDIwNTI1M1oXDTM2MDMwMTIwNTI1M1owaDELMAkGA1UEBhMCVVMxETAP
+BgNVBAgMCE5ldyBZb3JrMREwDwYDVQQHDAhOZXcgWW9yazEQMA4GA1UECgwHRGF0
+YWRvZzEPMA0GA1UECwwGVmVjdG9yMRAwDgYDVQQDDAdhenVyaXRlMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvnAyCpCvDorySCNastVW9x3+31Ta4SVP
+bGW0LqD1WO42dSmUMQ2iRGsFeHvM4guXrhXloBVf35L1OyWRp/bltHlleLrr58bR
+RInmuyocDTvm4t7VU+ybnPD7MhdNsbMmo2HBn12cEY7PszxVOwcZ8j0XOHtI+ve3
+QZ4loS61BR5TxrCdnpE++gxh7KhUG1yTiKmEEt587vRIuVBWNrLFVhYQN6mc+2JJ
+63PaXXvGpGiDwPqUqi0WhIYp73XVyIqbHivI27Tiuv/n9gcHPAt2UwVbv1AqqFFn
+Vr8lMVavcDcoTrHdJ8PXN4EipgvssJF14gFFg7L0U4AOj4xu31e+iQIDAQABo4IB
+MzCCAS8wCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBkAwMwYJYIZIAYb4QgEN
+BCYWJE9wZW5TU0wgR2VuZXJhdGVkIFNlcnZlciBDZXJ0aWZpY2F0ZTAdBgNVHQ4E
+FgQUvRxz2qJo5NhsNm51lOVK0woSO2UwgZUGA1UdIwSBjTCBioAUPD06L8zVggN9
+mcRY8eHbNu+tDUGhbqRsMGoxEjAQBgNVBAMMCVZlY3RvciBDQTEPMA0GA1UECwwG
+VmVjdG9yMRAwDgYDVQQKDAdEYXRhZG9nMREwDwYDVQQIDAhOZXcgWW9yazERMA8G
+A1UEBwwITmV3IFlvcmsxCzAJBgNVBAYTAlVTggIQADAOBgNVHQ8BAf8EBAMCBaAw
+EwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQELBQADggIBAFZJBzkVVJQ8
+pjs1qRrjsIgr3w1ylDJD4YTTEh96jLvQTf/PzhwG+W8ylr8a7EPzaJ9SOnLimEat
+sw8ZCZJlRNdALL7o1tDAfOUkva45IQzvpzvDjy7iLQ488Cv4or/wWBd56JqWlYyA
+OcyaCAkslI4RRoeIlKczbmhF/hTXlqe4z8q/89tHwFINOksbCj5VWYKzmYMijluw
+X6RfcTyyaPlhz/1TJERWxyYVs+RN9TLNWvgPAeNmSZvnOXJ7b0hiIwRN+Hj+0M9L
+tSfHq7Nrz8ls9+u7gyfkYtXz7KahI6CVKATIJl18X7zTLRCh/2DRyISSs+hbXlBa
+fSG/rL92F/rerzw0w6PP7cs0TnKuEnnwIBZV+q5mkg/c15mTL5vgzRCiZfE8E/bJ
+UwV+eX7s1yd67UU9LgNanYYTCNpAnb9HZwm+65Q+wEO7M3puxL2/DqbJ3IQVHDRx
+6/2raCYBszz6p4FPalRXmUqa5JogIxc5kVPHje330JwY5JKwIfe/GtT5AkeRqHx+
+KlbEBQYfIh66BPB+y60sPBUtJslPfDV+PabDHq6u9wJtZi12RbxLFBjQtCMAV3vx
+AvTfgxzbZ8rqg7mL8JB1SupkMiw8eObC/zrYGMv8O3IOoSWSRNb/KrYjYf3oVRQ5
+CDjEDNgIlI4ue4WLySdt1Fped5jCf/+P
+-----END CERTIFICATE-----
diff --git a/tests/data/ca/intermediate_server/private/azurite.key.pem b/tests/data/ca/intermediate_server/private/azurite.key.pem
new file mode 100644
index 0000000000000..545d8904a3d73
--- /dev/null
+++ b/tests/data/ca/intermediate_server/private/azurite.key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC+cDIKkK8OivJI
+I1qy1Vb3Hf7fVNrhJU9sZbQuoPVY7jZ1KZQxDaJEawV4e8ziC5euFeWgFV/fkvU7
+JZGn9uW0eWV4uuvnxtFEiea7KhwNO+bi3tVT7Juc8PsyF02xsyajYcGfXZwRjs+z
+PFU7BxnyPRc4e0j697dBniWhLrUFHlPGsJ2ekT76DGHsqFQbXJOIqYQS3nzu9Ei5
+UFY2ssVWFhA3qZz7Yknrc9pde8akaIPA+pSqLRaEhinvddXIipseK8jbtOK6/+f2
+Bwc8C3ZTBVu/UCqoUWdWvyUxVq9wNyhOsd0nw9c3gSKmC+ywkXXiAUWDsvRTgA6P
+jG7fV76JAgMBAAECggEAEXeC73sjw0a1QC6V9A8jQdkrdlp3FO1yInQVma1Ds5tt
+vUNKB1HDz1itkMZyHU2I5Pu3Kv6q43u8KGeiu3Am023LA87JMmIG8a1gT0xmdERJ
+QgfEM0VhZHyp3YdLpf/TjGq78p0IYofhvwPKoXZeR9yYk6KjJ/mugkM6GlWJXuWn
+sE2ZYL4Wl6d//1/9D6xWfNVU1zCH7ScbFFvQKkBxURLpnQlgkfhr8HMrCQyV4Lps
+6n166zcQKJO4mwGrWyu75HU8vcBYv1+6WbJ1Rgke6lL3dzjIhzE7C61i3dI636Aq
+l0wZ3NVeysyrn5Xzu5vfq0D9/pt+Of1PE0FmmlRogQKBgQDhaY8OyUafMYhGnike
+7K1ho60tFHE5vgxMpoUTinLyARgW8bA9VRtQ++PW90Z1sHzXAHjb30YZcYEuKaCW
+SvIWg49/L4bORX2jY4UPZvESemJtnIXZkuuiGoYaXjIwNudorT1siCD/GYM24Uko
+ax0QbFsNRtq89QE/ibKdFLRfUQKBgQDYR7JfauKmsY6OQjB8RvFe50AnnPfiJSZ+
+rD7H7gXWlt3q9zpsU3xBK+fwI9QsvTlUNsIkFhJpu6znCzK26nLIJCqGcm0W+9Ah
+rJR+0TXyafQn1d1dTrtn7XVIL6QQEuUY9jggsAXWBejdPCeaVxplEiJa1i9x3YOp
+OQWmMTvNuQKBgCiGF6fq231nJD691Fqw5gK1sD54fFqLJh7pmOcIbt2/AJuvW6XL
+FRwcDLvqvIoP7oGgnhm5LBsK4tRvu2UJmDgf8r5ExxFyQMIM9DDuqsxNoEBgcVfK
+J/5+kjlPUeqFFFknO/G1D2mNJp/JJKPVjeYT9NKQOGbcDRtlH+1JeZvhAoGAZkOg
+Z9WWTdNu4H0Th+/TeVhG0XQ7EUcXqJWxKb+2Kv0y+ULk8QuYmQg1pyqJzI28acFq
+kr2M/0mqO6Tj2fGJTHEtWl0Ij/GJPCLqI/ywUWsf8yYAgXoUytNQvU0peiA1C1SA
+vZP9bnFk5hbncub0qA2nCOR1kpV3B7DapvZonKECgYEAjzpfOhaULZgwnkYOkoFw
+VS+tDOVNVfjDOjuV82B/0zCgCW8dv2EeTCobEkIbSl8GYMzukNZQR8r3ZAxbs1By
+Ieliad2FD/s0MtsPiGcxJN4twbDQO/SvLFtjQ+jCysgOVON6KiqpGVRcEL+6U4ZD
+NiqT36xmXpmkZ05bMxOXPLM=
+-----END PRIVATE KEY-----
diff --git a/tests/data/ca/intermediate_server/serial b/tests/data/ca/intermediate_server/serial
index 6cb3869343bf8..4e75b247d2247 100644
--- a/tests/data/ca/intermediate_server/serial
+++ b/tests/data/ca/intermediate_server/serial
@@ -1 +1 @@
-1009
+100A
diff --git a/tests/data/ca/intermediate_server/serial.old b/tests/data/ca/intermediate_server/serial.old
index 617ba1c154075..6cb3869343bf8 100644
--- a/tests/data/ca/intermediate_server/serial.old
+++ b/tests/data/ca/intermediate_server/serial.old
@@ -1 +1 @@
-1008
+1009
diff --git a/tests/integration/azure/config/compose.yaml b/tests/integration/azure/config/compose.yaml
index fe3541bf2a07c..384a65ab0e42d 100644
--- a/tests/integration/azure/config/compose.yaml
+++ b/tests/integration/azure/config/compose.yaml
@@ -7,6 +7,14 @@ services:
     volumes:
       - /var/run:/var/run
 
+  azurite:
+    image: mcr.microsoft.com/azure-storage/azurite:${CONFIG_VERSION}
+    command: azurite --blobHost 0.0.0.0 --blobPort 14430 --queuePort 14431 --tablePort 14432 --loose --oauth basic --cert /certs/azurite-chain.cert.pem --key /private/azurite.key.pem
+    volumes:
+      - /var/run:/var/run
+      - ../../../data/ca/intermediate_server/certs:/certs
+      - ../../../data/ca/intermediate_server/private/azurite.key.pem:/private/azurite.key.pem
+
 networks:
   default:
     name: ${VECTOR_NETWORK}
diff --git a/tests/integration/azure/config/test.yaml b/tests/integration/azure/config/test.yaml
index da00ceed79ad4..1b3a0e4cbe151 100644
--- a/tests/integration/azure/config/test.yaml
+++ b/tests/integration/azure/config/test.yaml
@@ -4,7 +4,8 @@ features:
 test_filter: ::azure_
 
 env:
-  AZURE_ADDRESS: local-azure-blob
+  AZURITE_ADDRESS: local-azure-blob
+  AZURITE_OAUTH_ADDRESS: azurite
   HEARTBEAT_ADDRESS: 0.0.0.0:8080
   LOGSTASH_ADDRESS: 0.0.0.0:8081
 
diff --git a/website/cue/reference/components/sinks/generated/azure_blob.cue b/website/cue/reference/components/sinks/generated/azure_blob.cue
index 5ea0c1dd20221..8d962c30adbdb 100644
--- a/website/cue/reference/components/sinks/generated/azure_blob.cue
+++ b/website/cue/reference/components/sinks/generated/azure_blob.cue
@@ -1,6 +1,16 @@
 package metadata
 
 generated: components: sinks: azure_blob: configuration: {
+	account_name: {
+		description: """
+			The Azure Blob Storage Account name.
+
+			If provided, this will be used instead of the `connection_string`.
+			This is useful for authenticating with an Azure credential.
+			"""
+		required: false
+		type: string: examples: ["mylogstorage"]
+	}
 	acknowledgements: {
 		description: """
 			Controls how acknowledgements are handled for this sink.
@@ -27,6 +37,123 @@ generated: components: sinks: azure_blob: configuration: {
 			type: bool: {}
 		}
 	}
+	auth: {
+		description: "Azure service principal authentication."
+		required:    false
+		type: object: options: {
+			azure_client_id: {
+				description: """
+					The [Azure Client ID][azure_client_id].
+
+					[azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+					"""
+				relevant_when: "azure_credential_kind = \"client_certificate_credential\" or azure_credential_kind = \"client_secret_credential\""
+				required:      true
+				type: string: examples: ["00000000-0000-0000-0000-000000000000", "${AZURE_CLIENT_ID:?err}"]
+			}
+			azure_client_secret: {
+				description: """
+					The [Azure Client Secret][azure_client_secret].
+
+					[azure_client_secret]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+					"""
+				relevant_when: "azure_credential_kind = \"client_secret_credential\""
+				required:      true
+				type: string: examples: ["00-00~000000-0000000~0000000000000000000", "${AZURE_CLIENT_SECRET:?err}"]
+			}
+			azure_credential_kind: {
+				description: "The kind of Azure credential to use."
+				required:    true
+				type: string: enum: {
+					azure_cli:                         "Use Azure CLI credentials"
+					client_certificate_credential:     "Use certificate credentials"
+					client_secret_credential:          "Use client ID/secret credentials"
+					managed_identity:                  "Use Managed Identity credentials"
+					managed_identity_client_assertion: "Use Managed Identity with Client Assertion credentials"
+					workload_identity:                 "Use Workload Identity credentials"
+				}
+			}
+			azure_tenant_id: {
+				description: """
+					The [Azure Tenant ID][azure_tenant_id].
+
+					[azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+					"""
+				relevant_when: "azure_credential_kind = \"client_certificate_credential\" or azure_credential_kind = \"client_secret_credential\""
+				required:      true
+				type: string: examples: ["00000000-0000-0000-0000-000000000000", "${AZURE_TENANT_ID:?err}"]
+			}
+			certificate_password: {
+				description:   "The password for the client certificate, if applicable."
+				relevant_when: "azure_credential_kind = \"client_certificate_credential\""
+				required:      false
+				type: string: examples: ["${AZURE_CLIENT_CERTIFICATE_PASSWORD}"]
+			}
+			certificate_path: {
+				description:   "PKCS12 certificate with RSA private key."
+				relevant_when: "azure_credential_kind = \"client_certificate_credential\""
+				required:      true
+				type: string: examples: ["path/to/certificate.pfx", "${AZURE_CLIENT_CERTIFICATE_PATH:?err}"]
+			}
+			client_assertion_client_id: {
+				description:   "The target Client ID to use."
+				relevant_when: "azure_credential_kind = \"managed_identity_client_assertion\""
+				required:      true
+				type: string: examples: ["00000000-0000-0000-0000-000000000000"]
+			}
+			client_assertion_tenant_id: {
+				description:   "The target Tenant ID to use."
+				relevant_when: "azure_credential_kind = \"managed_identity_client_assertion\""
+				required:      true
+				type: string: examples: ["00000000-0000-0000-0000-000000000000"]
+			}
+			client_id: {
+				description: """
+					The [Azure Client ID][azure_client_id]. Defaults to the value of the environment variable `AZURE_CLIENT_ID`.
+
+					[azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+					"""
+				relevant_when: "azure_credential_kind = \"workload_identity\""
+				required:      false
+				type: string: examples: ["00000000-0000-0000-0000-000000000000", "${AZURE_CLIENT_ID}"]
+			}
+			tenant_id: {
+				description: """
+					The [Azure Tenant ID][azure_tenant_id]. Defaults to the value of the environment variable `AZURE_TENANT_ID`.
+
+					[azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+					"""
+				relevant_when: "azure_credential_kind = \"workload_identity\""
+				required:      false
+				type: string: examples: ["00000000-0000-0000-0000-000000000000", "${AZURE_TENANT_ID}"]
+			}
+			token_file_path: {
+				description:   "Path of a file containing a Kubernetes service account token. Defaults to the value of the environment variable `AZURE_FEDERATED_TOKEN_FILE`."
+				relevant_when: "azure_credential_kind = \"workload_identity\""
+				required:      false
+				type: string: examples: ["/var/run/secrets/azure/tokens/azure-identity-token", "${AZURE_FEDERATED_TOKEN_FILE}"]
+			}
+			user_assigned_managed_identity_id: {
+				description:   "The User Assigned Managed Identity to use."
+				relevant_when: "azure_credential_kind = \"managed_identity\" or azure_credential_kind = \"managed_identity_client_assertion\""
+				required:      false
+				type: string: examples: ["00000000-0000-0000-0000-000000000000"]
+			}
+			user_assigned_managed_identity_id_type: {
+				description: """
+					The type of the User Assigned Managed Identity ID provided (Client ID, Object ID,
+					or Resource ID). Defaults to Client ID.
+					"""
+				relevant_when: "azure_credential_kind = \"managed_identity\" or azure_credential_kind = \"managed_identity_client_assertion\""
+				required:      false
+				type: string: enum: {
+					client_id:   "Client ID"
+					object_id:   "Object ID"
+					resource_id: "Resource ID"
+				}
+			}
+		}
+	}
 	batch: {
 		description: "Event batching behavior."
 		required:    false
@@ -74,6 +201,16 @@ generated: components: sinks: azure_blob: configuration: {
 		required: false
 		type: bool: {}
 	}
+	blob_endpoint: {
+		description: """
+			The Azure Blob Storage endpoint.
+
+			If provided, this will be used instead of the `connection_string`.
+			This is useful for authenticating with an Azure credential.
+			"""
+		required: false
+		type: string: examples: ["https://mylogstorage.blob.core.windows.net/"]
+	}
 	blob_prefix: {
 		description: """
 			A prefix to apply to all blob keys.
@@ -165,8 +302,9 @@ generated: components: sinks: azure_blob: configuration: {
 			| Allowed resource types | Container & Object |
 			| Allowed permissions    | Read & Create      |
 			"""
-		required: true
-		type: string: examples: ["DefaultEndpointsProtocol=https;AccountName=mylogstorage;AccountKey=storageaccountkeybase64encoded;EndpointSuffix=core.windows.net", "BlobEndpoint=https://mylogstorage.blob.core.windows.net/;SharedAccessSignature=generatedsastoken"]
+		required: false
+		type: string: examples: ["DefaultEndpointsProtocol=https;AccountName=mylogstorage;AccountKey=storageaccountkeybase64encoded;EndpointSuffix=core.windows.net", "BlobEndpoint=https://mylogstorage.blob.core.windows.net/;SharedAccessSignature=generatedsastoken", "AccountName=mylogstorage"]
+		warnings: ["Access keys and SAS tokens can be used to gain unauthorized access to Azure Blob Storage resources. Numerous security breaches have occurred due to leaked connection strings. It is important to keep connection strings secure and not expose them in logs, error messages, or version control systems."]
 	}
 	container_name: {
 		description: "The Azure Blob Storage Account container name."
@@ -862,4 +1000,17 @@ generated: components: sinks: azure_blob: configuration: {
 			}
 		}
 	}
+	tls: {
+		description: "TLS configuration."
+		required:    false
+		type: object: options: ca_file: {
+			description: """
+				Absolute path to an additional CA certificate file.
+
+				The certificate must be in PEM (X.509) format.
+				"""
+			required: false
+			type: string: examples: ["/path/to/certificate_authority.crt"]
+		}
+	}
 }
diff --git a/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue b/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue
index ec03373e5354e..2aaf9b628e3c6 100644
--- a/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue
+++ b/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue
@@ -28,8 +28,8 @@ generated: components: sinks: azure_logs_ingestion: configuration: {
 		}
 	}
 	auth: {
-		description: "Configuration of the authentication strategy for interacting with Azure services."
-		required:    false
+		description: "Azure service principal authentication."
+		required:    true
 		type: object: options: {
 			azure_client_id: {
 				description: """
@@ -37,11 +37,9 @@ generated: components: sinks: azure_logs_ingestion: configuration: {
 
 					[azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
 					"""
-				required: false
-				type: string: {
-					default: ""
-					examples: ["00000000-0000-0000-0000-000000000000"]
-				}
+				relevant_when: "azure_credential_kind = \"client_certificate_credential\" or azure_credential_kind = \"client_secret_credential\""
+				required:      true
+				type: string: examples: ["00000000-0000-0000-0000-000000000000", "${AZURE_CLIENT_ID:?err}"]
 			}
 			azure_client_secret: {
 				description: """
@@ -49,17 +47,17 @@ generated: components: sinks: azure_logs_ingestion: configuration: {
 
 					[azure_client_secret]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
 					"""
-				required: false
-				type: string: {
-					default: ""
-					examples: ["00-00~000000-0000000~0000000000000000000"]
-				}
+				relevant_when: "azure_credential_kind = \"client_secret_credential\""
+				required:      true
+				type: string: examples: ["00-00~000000-0000000~0000000000000000000", "${AZURE_CLIENT_SECRET:?err}"]
 			}
 			azure_credential_kind: {
 				description: "The kind of Azure credential to use."
 				required:    true
 				type: string: enum: {
 					azure_cli:                         "Use Azure CLI credentials"
+					client_certificate_credential:     "Use certificate credentials"
+					client_secret_credential:          "Use client ID/secret credentials"
 					managed_identity:                  "Use Managed Identity credentials"
 					managed_identity_client_assertion: "Use Managed Identity with Client Assertion credentials"
 					workload_identity:                 "Use Workload Identity credentials"
@@ -71,11 +69,21 @@ generated: components: sinks: azure_logs_ingestion: configuration: {
 
 					[azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
 					"""
-				required: false
-				type: string: {
-					default: ""
-					examples: ["00000000-0000-0000-0000-000000000000"]
-				}
+				relevant_when: "azure_credential_kind = \"client_certificate_credential\" or azure_credential_kind = \"client_secret_credential\""
+				required:      true
+				type: string: examples: ["00000000-0000-0000-0000-000000000000", "${AZURE_TENANT_ID:?err}"]
+			}
+			certificate_password: {
+				description:   "The password for the client certificate, if applicable."
+				relevant_when: "azure_credential_kind = \"client_certificate_credential\""
+				required:      false
+				type: string: examples: ["${AZURE_CLIENT_CERTIFICATE_PASSWORD}"]
+			}
+			certificate_path: {
+				description:   "PKCS12 certificate with RSA private key."
+				relevant_when: "azure_credential_kind = \"client_certificate_credential\""
+				required:      true
+				type: string: examples: ["path/to/certificate.pfx", "${AZURE_CLIENT_CERTIFICATE_PATH:?err}"]
 			}
 			client_assertion_client_id: {
 				description:   "The target Client ID to use."
@@ -89,12 +97,51 @@ generated: components: sinks: azure_logs_ingestion: configuration: {
 				required:      true
 				type: string: examples: ["00000000-0000-0000-0000-000000000000"]
 			}
+			client_id: {
+				description: """
+					The [Azure Client ID][azure_client_id]. Defaults to the value of the environment variable `AZURE_CLIENT_ID`.
+
+					[azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+					"""
+				relevant_when: "azure_credential_kind = \"workload_identity\""
+				required:      false
+				type: string: examples: ["00000000-0000-0000-0000-000000000000", "${AZURE_CLIENT_ID}"]
+			}
+			tenant_id: {
+				description: """
+					The [Azure Tenant ID][azure_tenant_id]. Defaults to the value of the environment variable `AZURE_TENANT_ID`.
+
+					[azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+					"""
+				relevant_when: "azure_credential_kind = \"workload_identity\""
+				required:      false
+				type: string: examples: ["00000000-0000-0000-0000-000000000000", "${AZURE_TENANT_ID}"]
+			}
+			token_file_path: {
+				description:   "Path of a file containing a Kubernetes service account token. Defaults to the value of the environment variable `AZURE_FEDERATED_TOKEN_FILE`."
+				relevant_when: "azure_credential_kind = \"workload_identity\""
+				required:      false
+				type: string: examples: ["/var/run/secrets/azure/tokens/azure-identity-token", "${AZURE_FEDERATED_TOKEN_FILE}"]
+			}
 			user_assigned_managed_identity_id: {
-				description:   "The User Assigned Managed Identity (Client ID) to use."
+				description:   "The User Assigned Managed Identity to use."
 				relevant_when: "azure_credential_kind = \"managed_identity\" or azure_credential_kind = \"managed_identity_client_assertion\""
 				required:      false
 				type: string: examples: ["00000000-0000-0000-0000-000000000000"]
 			}
+			user_assigned_managed_identity_id_type: {
+				description: """
+					The type of the User Assigned Managed Identity ID provided (Client ID, Object ID,
+					or Resource ID). Defaults to Client ID.
+					"""
+				relevant_when: "azure_credential_kind = \"managed_identity\" or azure_credential_kind = \"managed_identity_client_assertion\""
+				required:      false
+				type: string: enum: {
+					client_id:   "Client ID"
+					object_id:   "Object ID"
+					resource_id: "Resource ID"
+				}
+			}
 		}
 	}
 	batch: {

From 985f669ffae07c1104ae9cec1b097e74130e0341 Mon Sep 17 00:00:00 2001
From: fcfangcc <swjfc22@live.com>
Date: Thu, 9 Apr 2026 01:50:38 +0800
Subject: [PATCH 113/326] fix(file source): high CPU usage after async file
 server migration (#25064)

* fixed reached_eof

* add changelog

* update changlog

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 benches/files.rs                              | 113 +++++++++++++++++-
 ...fixed_high_cpu_usage_in_file_source.fix.md |   3 +
 lib/file-source-common/src/buffer.rs          |   9 +-
 lib/file-source/src/file_watcher/mod.rs       |  30 ++++-
 lib/file-source/src/file_watcher/tests/mod.rs |  68 ++++++++++-
 5 files changed, 212 insertions(+), 11 deletions(-)
 create mode 100644 changelog.d/25064_fixed_high_cpu_usage_in_file_source.fix.md

diff --git a/benches/files.rs b/benches/files.rs
index 703c4a984c8cd..6c6c00f367a66 100644
--- a/benches/files.rs
+++ b/benches/files.rs
@@ -1,9 +1,9 @@
 use std::{convert::TryInto, path::PathBuf, time::Duration};
 
 use bytes::Bytes;
-use criterion::{BatchSize, Criterion, SamplingMode, Throughput, criterion_group};
+use criterion::{BatchSize, BenchmarkId, Criterion, SamplingMode, Throughput, criterion_group};
 use futures::{SinkExt, StreamExt, stream};
-use tempfile::tempdir;
+use tempfile::{TempDir, tempdir};
 use tokio::fs::OpenOptions;
 use tokio_util::codec::{BytesCodec, FramedWrite};
 use vector::{
@@ -12,6 +12,70 @@ use vector::{
 };
 use vector_lib::codecs::{TextSerializerConfig, encoding::FramingConfig};
 
+fn build_file_benchmark_environment(
+    idle_files: usize,
+) -> (
+    tokio::runtime::Runtime,
+    vector::topology::RunningTopology,
+    tokio::fs::File,
+    TempDir,
+) {
+    let temp = tempdir().unwrap();
+    let directory = temp.path().to_path_buf();
+
+    let mut data_dir = directory.clone();
+    data_dir.push("data");
+    std::fs::create_dir(&data_dir).unwrap();
+
+    let active_file = directory.join("active.log");
+    std::fs::write(&active_file, []).unwrap();
+
+    for index in 0..idle_files {
+        let idle_file = directory.join(format!("idle-{index}.log"));
+        std::fs::write(idle_file, []).unwrap();
+    }
+
+    let output = directory.join("output.txt");
+
+    let mut source = sources::file::FileConfig::default();
+    source.include = vec![directory.join("*.log")];
+    source.data_dir = Some(data_dir);
+
+    let mut config = config::Config::builder();
+    config.add_source("in", source);
+    config.add_sink(
+        "out",
+        &["in"],
+        sinks::file::FileSinkConfig {
+            path: output.try_into().unwrap(),
+            idle_timeout: Duration::from_secs(30),
+            encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
+            compression: sinks::file::Compression::None,
+            acknowledgements: Default::default(),
+            timezone: Default::default(),
+            internal_metrics: Default::default(),
+            truncate: Default::default(),
+        },
+    );
+
+    let rt = runtime();
+    let (topology, input) = rt.block_on(async move {
+        let (topology, _crash) = start_topology(config.build().unwrap(), false).await;
+
+        let mut options = OpenOptions::new();
+        options.create(true).append(true).write(true);
+
+        let input = options.open(active_file).await.unwrap();
+
+        // Give the source enough time to discover files and drive the idle watchers to EOF.
+        tokio::time::sleep(Duration::from_millis(250)).await;
+
+        (topology, input)
+    });
+
+    (rt, topology, input, temp)
+}
+
 fn benchmark_files_no_partitions(c: &mut Criterion) {
     let num_lines: usize = 10_000;
     let line_size: usize = 100;
@@ -99,10 +163,53 @@ fn benchmark_files_no_partitions(c: &mut Criterion) {
     group.finish();
 }
 
+fn benchmark_files_with_idle_watchers(c: &mut Criterion) {
+    let num_lines: usize = 10_000;
+    let line_size: usize = 100;
+
+    let mut group = c.benchmark_group("files/idle_watchers");
+    group.throughput(Throughput::Bytes((num_lines * line_size) as u64));
+    group.sampling_mode(SamplingMode::Flat);
+    group.sample_size(10);
+
+    for idle_files in [0usize, 128, 512] {
+        group.bench_with_input(
+            BenchmarkId::from_parameter(idle_files),
+            &idle_files,
+            |b, idle_files| {
+                b.iter_batched(
+                    || build_file_benchmark_environment(*idle_files),
+                    |(rt, topology, input, _temp)| {
+                        rt.block_on(async move {
+                            let mut sink = FramedWrite::new(input, BytesCodec::new());
+                            let raw_lines =
+                                random_lines(line_size).take(num_lines).map(|mut line| {
+                                    line.push('\n');
+                                    Bytes::from(line)
+                                });
+                            let mut lines = stream::iter(raw_lines);
+                            while let Some(line) = lines.next().await {
+                                sink.send(line).await.unwrap();
+                            }
+
+                            // Keep the topology alive briefly so the benchmark includes watcher polling work.
+                            tokio::time::sleep(Duration::from_millis(250)).await;
+                            topology.stop().await;
+                        });
+                    },
+                    BatchSize::LargeInput,
+                )
+            },
+        );
+    }
+
+    group.finish();
+}
+
 criterion_group!(
     name = benches;
     // encapsulates inherent CI noise we saw in
     // https://github.com/vectordotdev/vector/issues/5394
     config = Criterion::default().noise_threshold(0.05);
-    targets = benchmark_files_no_partitions
+    targets = benchmark_files_no_partitions, benchmark_files_with_idle_watchers
 );
diff --git a/changelog.d/25064_fixed_high_cpu_usage_in_file_source.fix.md b/changelog.d/25064_fixed_high_cpu_usage_in_file_source.fix.md
new file mode 100644
index 0000000000000..8d64593e51b5c
--- /dev/null
+++ b/changelog.d/25064_fixed_high_cpu_usage_in_file_source.fix.md
@@ -0,0 +1,3 @@
+Fixed an issue in the `file`/`kubernetes_logs` source that could cause unexpectedly high CPU usage after the async file server migration.
+
+authors: fcfangcc
diff --git a/lib/file-source-common/src/buffer.rs b/lib/file-source-common/src/buffer.rs
index 097331fbf2be3..099d896f4e1e6 100644
--- a/lib/file-source-common/src/buffer.rs
+++ b/lib/file-source-common/src/buffer.rs
@@ -1,5 +1,5 @@
 use crate::FilePosition;
-use std::{cmp::min, io, pin::Pin};
+use std::{cmp::min, io};
 
 use bstr::Finder;
 use bytes::BytesMut;
@@ -34,7 +34,7 @@ pub struct ReadResult {
 /// GiB/s range for buffers of length 1KiB. For buffers any smaller than this
 /// the overhead of setup dominates our benchmarks.
 pub async fn read_until_with_max_size<'a, R: AsyncBufRead + ?Sized + Unpin>(
-    reader: Pin<Box<&'a mut R>>,
+    reader: &'a mut R,
     position: &'a mut FilePosition,
     delim: &'a [u8],
     buf: &'a mut BytesMut,
@@ -45,7 +45,6 @@ pub async fn read_until_with_max_size<'a, R: AsyncBufRead + ?Sized + Unpin>(
     let delim_finder = Finder::new(delim);
     let delim_len = delim.len();
     let mut discarded_for_size_and_truncated = Vec::new();
-    let mut reader = Box::new(reader);
 
     // Used to track partial delimiter matches across buffer boundaries.
     // Data is read in chunks from the reader (see `fill_buf` below).
@@ -294,7 +293,7 @@ mod test {
             let mut reader = BufReader::new(Cursor::new(&chunk));
 
             match read_until_with_max_size(
-                Box::pin(&mut reader),
+                &mut reader,
                 &mut position,
                 &delimiter,
                 &mut buffer,
@@ -425,7 +424,7 @@ mod test {
         for (i, expected_line) in expected_lines.iter().enumerate() {
             let mut buffer = BytesMut::new();
             let result = read_until_with_max_size(
-                Box::pin(&mut reader),
+                &mut reader,
                 &mut position,
                 delimiter,
                 &mut buffer,
diff --git a/lib/file-source/src/file_watcher/mod.rs b/lib/file-source/src/file_watcher/mod.rs
index b750a81433886..6e103cf13f39b 100644
--- a/lib/file-source/src/file_watcher/mod.rs
+++ b/lib/file-source/src/file_watcher/mod.rs
@@ -19,6 +19,9 @@ use file_source_common::{
     buffer::{ReadResult, read_until_with_max_size},
 };
 
+const EOF_READ_BACKOFF_MIN: Duration = Duration::from_millis(1);
+const EOF_READ_BACKOFF_MAX: Duration = Duration::from_millis(250);
+
 #[cfg(test)]
 mod tests;
 
@@ -57,6 +60,7 @@ pub struct FileWatcher {
     reached_eof: bool,
     last_read_attempt: Instant,
     last_read_success: Instant,
+    read_retry_delay: Duration,
     last_seen: Instant,
     max_line_bytes: usize,
     line_delimiter: Bytes,
@@ -166,6 +170,7 @@ impl FileWatcher {
             reached_eof: false,
             last_read_attempt: ts,
             last_read_success: ts,
+            read_retry_delay: EOF_READ_BACKOFF_MIN,
             last_seen: ts,
             max_line_bytes,
             line_delimiter,
@@ -196,6 +201,8 @@ impl FileWatcher {
             self.devno = file_info.portable_dev();
             self.inode = file_info.portable_ino();
         }
+        self.reached_eof = false;
+        self.read_retry_delay = EOF_READ_BACKOFF_MIN;
         self.path = path;
         Ok(())
     }
@@ -235,7 +242,7 @@ impl FileWatcher {
         let file_position = &mut self.file_position;
         let initial_position = *file_position;
         match read_until_with_max_size(
-            Box::pin(reader),
+            reader.as_mut(),
             file_position,
             self.line_delimiter.as_ref(),
             &mut self.buf,
@@ -283,7 +290,7 @@ impl FileWatcher {
                         })
                     }
                 } else {
-                    self.reached_eof = true;
+                    self.track_read_eof();
                     Ok(RawLineResult {
                         raw_line: None,
                         discarded_for_size_and_truncated,
@@ -306,9 +313,24 @@ impl FileWatcher {
 
     #[inline]
     fn track_read_success(&mut self) {
+        self.reached_eof = false;
+        self.read_retry_delay = EOF_READ_BACKOFF_MIN;
         self.last_read_success = Instant::now();
     }
 
+    #[inline]
+    fn track_read_eof(&mut self) {
+        self.read_retry_delay = if self.reached_eof {
+            std::cmp::min(
+                self.read_retry_delay.saturating_mul(2),
+                EOF_READ_BACKOFF_MAX,
+            )
+        } else {
+            EOF_READ_BACKOFF_MIN
+        };
+        self.reached_eof = true;
+    }
+
     #[inline]
     pub fn last_read_success(&self) -> Instant {
         self.last_read_success
@@ -316,6 +338,10 @@ impl FileWatcher {
 
     #[inline]
     pub fn should_read(&self) -> bool {
+        if self.reached_eof && self.last_read_attempt.elapsed() < self.read_retry_delay {
+            return false;
+        }
+
         self.last_read_success.elapsed() < Duration::from_secs(10)
             || self.last_read_attempt.elapsed() > Duration::from_secs(10)
     }
diff --git a/lib/file-source/src/file_watcher/tests/mod.rs b/lib/file-source/src/file_watcher/tests/mod.rs
index 7a9cc92909db0..5384a43802d24 100644
--- a/lib/file-source/src/file_watcher/tests/mod.rs
+++ b/lib/file-source/src/file_watcher/tests/mod.rs
@@ -1,9 +1,13 @@
 mod experiment;
 mod experiment_no_truncations;
 
-use std::str;
+use std::{path::PathBuf, str, thread};
 
+use bytes::{Bytes, BytesMut};
 use quickcheck::{Arbitrary, Gen};
+use tokio::time::Instant;
+
+use super::{EOF_READ_BACKOFF_MAX, EOF_READ_BACKOFF_MIN, FileWatcher, null_reader};
 
 // Welcome.
 //
@@ -171,6 +175,68 @@ impl Arbitrary for FileWatcherAction {
     }
 }
 
+fn watcher_for_timing() -> FileWatcher {
+    let now = Instant::now();
+
+    FileWatcher {
+        path: PathBuf::new(),
+        findable: true,
+        reader: Box::new(null_reader()),
+        file_position: 0,
+        devno: 0,
+        inode: 0,
+        is_dead: false,
+        reached_eof: false,
+        last_read_attempt: now,
+        last_read_success: now,
+        read_retry_delay: EOF_READ_BACKOFF_MIN,
+        last_seen: now,
+        max_line_bytes: 1024,
+        line_delimiter: Bytes::from_static(b"\n"),
+        buf: BytesMut::new(),
+    }
+}
+
+#[test]
+fn backs_off_after_eof() {
+    let mut watcher = watcher_for_timing();
+
+    watcher.track_read_attempt();
+    watcher.track_read_eof();
+
+    assert_eq!(watcher.read_retry_delay, EOF_READ_BACKOFF_MIN);
+    assert!(!watcher.should_read());
+
+    thread::sleep(EOF_READ_BACKOFF_MIN);
+
+    assert!(watcher.should_read());
+
+    watcher.track_read_attempt();
+    watcher.track_read_eof();
+
+    assert_eq!(
+        watcher.read_retry_delay,
+        EOF_READ_BACKOFF_MIN.saturating_mul(2)
+    );
+}
+
+#[test]
+fn caps_and_resets_eof_backoff() {
+    let mut watcher = watcher_for_timing();
+
+    for _ in 0..16 {
+        watcher.track_read_attempt();
+        watcher.track_read_eof();
+    }
+
+    assert_eq!(watcher.read_retry_delay, EOF_READ_BACKOFF_MAX);
+
+    watcher.track_read_success();
+
+    assert_eq!(watcher.read_retry_delay, EOF_READ_BACKOFF_MIN);
+    assert!(!watcher.reached_eof());
+}
+
 #[inline]
 pub fn delay(attempts: u32) {
     let delay = match attempts {

From 9c4abf31a91d888d0b4ca204643b0e6e1a559466 Mon Sep 17 00:00:00 2001
From: tronboto <142882846+tronboto@users.noreply.github.com>
Date: Wed, 8 Apr 2026 21:26:19 +0100
Subject: [PATCH 114/326] fix(shutdown): emit VectorStopped after topology
 drains (#25083)

* move VectorStopped event

* add changelog

* Add VectorStopping event

* Update changelog.d/24532_vector_stopped_log_ordering.fix.md

* Apply suggestion from @pront

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 .../24532_vector_stopped_log_ordering.fix.md  |  5 ++++
 src/app.rs                                    | 25 +++++++++++--------
 src/internal_events/process.rs                | 12 +++++++++
 3 files changed, 32 insertions(+), 10 deletions(-)
 create mode 100644 changelog.d/24532_vector_stopped_log_ordering.fix.md

diff --git a/changelog.d/24532_vector_stopped_log_ordering.fix.md b/changelog.d/24532_vector_stopped_log_ordering.fix.md
new file mode 100644
index 0000000000000..45f1a82eea06f
--- /dev/null
+++ b/changelog.d/24532_vector_stopped_log_ordering.fix.md
@@ -0,0 +1,5 @@
+Fixed log message ordering on shutdown where `Vector has stopped.` was logged before components had finished draining, causing confusing output interleaved with `Waiting on running components` messages.
+
+A new `VectorStoppping` event was added in the place of the `VectorStopped` event.
+
+authors: tronboto
diff --git a/src/app.rs b/src/app.rs
index 6f30f85de1d20..904d42be11968 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -28,7 +28,9 @@ use crate::{
     config::{self, ComponentConfig, ComponentType, Config, ConfigPath},
     extra_context::ExtraContext,
     heartbeat,
-    internal_events::{VectorConfigLoadError, VectorQuit, VectorStarted, VectorStopped},
+    internal_events::{
+        VectorConfigLoadError, VectorQuit, VectorStarted, VectorStopped, VectorStopping,
+    },
     signal::{SignalHandler, SignalPair, SignalRx, SignalTo},
     topology::{
         ReloadOutcome, RunningTopology, SharedTopologyController, ShutdownErrorReceiver,
@@ -493,16 +495,19 @@ impl FinishedApplication {
     }
 
     async fn stop(topology_controller: TopologyController, mut signal_rx: SignalRx) -> ExitStatus {
-        emit!(VectorStopped);
+        emit!(VectorStopping);
         tokio::select! {
-            _ = topology_controller.stop() => ExitStatus::from_raw({
-                #[cfg(windows)]
-                {
-                    exitcode::OK as u32
-                }
-                #[cfg(unix)]
-                exitcode::OK
-            }), // Graceful shutdown finished
+            _ = topology_controller.stop() => {
+                emit!(VectorStopped);
+                ExitStatus::from_raw({
+                    #[cfg(windows)]
+                    {
+                        exitcode::OK as u32
+                    }
+                    #[cfg(unix)]
+                    exitcode::OK
+                })
+            }, // Graceful shutdown finished
             _ = signal_rx.recv() => Self::quit(),
         }
     }
diff --git a/src/internal_events/process.rs b/src/internal_events/process.rs
index cc3609737aea9..987724c2da18d 100644
--- a/src/internal_events/process.rs
+++ b/src/internal_events/process.rs
@@ -38,6 +38,18 @@ impl InternalEvent for VectorReloaded<'_> {
     }
 }
 
+#[derive(Debug, NamedInternalEvent)]
+pub struct VectorStopping;
+
+impl InternalEvent for VectorStopping {
+    fn emit(self) {
+        info!(
+            target: "vector",
+            message = "Vector is stopping.",
+        );
+    }
+}
+
 #[derive(Debug, NamedInternalEvent)]
 pub struct VectorStopped;
 

From 26eef13087e1a463efa4bdcc9d3919b13936e06c Mon Sep 17 00:00:00 2001
From: Lisa Vu <lisavu125@gmail.com>
Date: Wed, 8 Apr 2026 16:26:27 -0400
Subject: [PATCH 115/326] fix(datadog_agent source): preserve `device` tag from
 v2 series resources (#25146)

* fix(datadog_agent source): preserve `device` tag from v2 series resources

The v2 series protobuf format encodes `device` in the `resources` array,
but the decoder only special-cased `host`, causing `device` to be
incorrectly remapped to `resource.device`. This broke tag continuity for
disk, SNMP, and other integrations routing through OPW.

* fix(changelog): use GitHub username for authors field

The spell checker pattern for changelog authors only allows
alphanumeric characters and hyphens. Changed from `lisa.vu` to
`lisaqvu` (GitHub username) to match the expected format.
---
 .../datadog_agent_source_device_tag_v2.fix.md |  5 ++
 src/sources/datadog_agent/metrics.rs          |  4 ++
 src/sources/datadog_agent/tests.rs            | 60 +++++++++++++++++++
 3 files changed, 69 insertions(+)
 create mode 100644 changelog.d/datadog_agent_source_device_tag_v2.fix.md

diff --git a/changelog.d/datadog_agent_source_device_tag_v2.fix.md b/changelog.d/datadog_agent_source_device_tag_v2.fix.md
new file mode 100644
index 0000000000000..669d594f8c89f
--- /dev/null
+++ b/changelog.d/datadog_agent_source_device_tag_v2.fix.md
@@ -0,0 +1,5 @@
+`datadog_agent` source: Preserve `device` as a plain tag when decoding v2 series metrics,
+instead of incorrectly prefixing it as `resource.device`. This matches the v1 series behavior
+and fixes tag remapping for disk, SNMP, and other integrations that use the `device` resource type.
+
+authors: lisaqvu
diff --git a/src/sources/datadog_agent/metrics.rs b/src/sources/datadog_agent/metrics.rs
index d931be05fcab7..6f377e826a8b8 100644
--- a/src/sources/datadog_agent/metrics.rs
+++ b/src/sources/datadog_agent/metrics.rs
@@ -289,6 +289,10 @@ pub(crate) fn decode_ddseries_v2(
                     log_schema()
                         .host_key()
                         .and_then(|key| tags.replace(key.to_string(), r.name));
+                } else if r.r#type.eq("device") {
+                    // The `device` resource type is used by Agent checks (disk, SNMP/NDM, etc.)
+                    // and must be preserved as a plain `device` tag to match the v1 series behavior.
+                    tags.replace("device".into(), r.name);
                 } else {
                     // But to avoid losing information if this situation changes, any other resource type/name will be saved in the tags map
                     tags.replace(format!("resource.{}", r.r#type), r.name);
diff --git a/src/sources/datadog_agent/tests.rs b/src/sources/datadog_agent/tests.rs
index 065b6ec5f78f5..b2dbf9691db00 100644
--- a/src/sources/datadog_agent/tests.rs
+++ b/src/sources/datadog_agent/tests.rs
@@ -2648,6 +2648,66 @@ async fn series_v2_split_metric_namespace_false() {
     .await;
 }
 
+#[tokio::test]
+async fn series_v2_device_resource_preserved_as_tag() {
+    assert_source_compliance(&HTTP_PUSH_SOURCE_TAGS, async {
+        let (rx, _, _, addr, _guard) =
+            source(EventStatus::Delivered, true, true, false, false).await;
+
+        let series = vec![ddmetric_proto::metric_payload::MetricSeries {
+            resources: vec![
+                ddmetric_proto::metric_payload::Resource {
+                    r#type: "host".to_string(),
+                    name: "test_host".to_string(),
+                },
+                ddmetric_proto::metric_payload::Resource {
+                    r#type: "device".to_string(),
+                    name: "sda".to_string(),
+                },
+            ],
+            metric: "system.disk.free".to_string(),
+            tags: vec!["env:prod".to_string()],
+            points: vec![ddmetric_proto::metric_payload::MetricPoint {
+                value: 100.0,
+                timestamp: 1542182950,
+            }],
+            r#type: ddmetric_proto::metric_payload::MetricType::Gauge as i32,
+            unit: "".to_string(),
+            source_type_name: "".to_string(),
+            interval: 0,
+            metadata: None,
+        }];
+
+        let series_payload = ddmetric_proto::MetricPayload { series };
+        let mut buf = Vec::new();
+        series_payload.encode(&mut buf).unwrap();
+        let body = unsafe { String::from_utf8_unchecked(buf) };
+
+        let events = send_and_collect(
+            addr,
+            body,
+            dd_api_key_headers(),
+            DD_API_SERIES_V2_PATH,
+            rx,
+            1,
+        )
+        .await;
+
+        let metric = events[0].as_metric();
+        let tags = metric.tags().unwrap();
+
+        // The `device` resource type must be preserved as a plain `device` tag,
+        // NOT as `resource.device`. This matches v1 series behavior.
+        assert_eq!(tags.get("device"), Some("sda"));
+        assert!(
+            tags.get("resource.device").is_none(),
+            "device should not be prefixed with 'resource.'"
+        );
+        assert_eq!(tags.get("env"), Some("prod"));
+    })
+    .await;
+}
+
 async fn test_sketches_split_metric_namespace_impl(
     split: bool,
     expected_name: &str,

From b57d8b0ef0ec12a1645b556a6b1bf080dc66e50b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 8 Apr 2026 20:53:19 +0000
Subject: [PATCH 116/326] chore(deps): bump basic-ftp from 5.2.0 to 5.2.1 in
 /scripts/environment/npm-tools in the npm_and_yarn group across 1 directory
 (#25147)

chore(deps): bump basic-ftp

Bumps the npm_and_yarn group with 1 update in the /scripts/environment/npm-tools directory: [basic-ftp](https://github.com/patrickjuchli/basic-ftp).


Updates `basic-ftp` from 5.2.0 to 5.2.1
- [Release notes](https://github.com/patrickjuchli/basic-ftp/releases)
- [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/patrickjuchli/basic-ftp/compare/v5.2.0...v5.2.1)

---
updated-dependencies:
- dependency-name: basic-ftp
  dependency-version: 5.2.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 scripts/environment/npm-tools/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/environment/npm-tools/package-lock.json b/scripts/environment/npm-tools/package-lock.json
index 1047d5444f89a..708206c20ade0 100644
--- a/scripts/environment/npm-tools/package-lock.json
+++ b/scripts/environment/npm-tools/package-lock.json
@@ -596,9 +596,9 @@
       "license": "MIT"
     },
     "node_modules/basic-ftp": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.0.tgz",
-      "integrity": "sha512-VoMINM2rqJwJgfdHq6RiUudKt2BV+FY5ZFezP/ypmwayk68+NzzAQy4XXLlqsGD4MCzq3DrmNFD/uUmBJuGoXw==",
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.1.tgz",
+      "integrity": "sha512-0yaL8JdxTknKDILitVpfYfV2Ob6yb3udX/hK97M7I3jOeznBNxQPtVvTUtnhUkyHlxFWyr5Lvknmgzoc7jf+1Q==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

From 51f6fce6d850dc4c6833d910013a189119068734 Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Thu, 9 Apr 2026 13:35:17 +0000
Subject: [PATCH 117/326] chore(shutdown): fix typo in 24532 changelog fragment
 (#25155)

---
 changelog.d/24532_vector_stopped_log_ordering.fix.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/changelog.d/24532_vector_stopped_log_ordering.fix.md b/changelog.d/24532_vector_stopped_log_ordering.fix.md
index 45f1a82eea06f..c5e395c37ab6f 100644
--- a/changelog.d/24532_vector_stopped_log_ordering.fix.md
+++ b/changelog.d/24532_vector_stopped_log_ordering.fix.md
@@ -1,5 +1,5 @@
 Fixed log message ordering on shutdown where `Vector has stopped.` was logged before components had finished draining, causing confusing output interleaved with `Waiting on running components` messages.
 
-A new `VectorStoppping` event was added in the place of the `VectorStopped` event.
+A new `VectorStopping` event was added in the place of the `VectorStopped` event.
 
 authors: tronboto

From a7f6487c94b98766bdff802aac0cd1372b0311f6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Apr 2026 13:07:40 +0000
Subject: [PATCH 118/326] chore(deps): bump basic-ftp from 5.2.1 to 5.2.2 in
 /scripts/environment/npm-tools in the npm_and_yarn group across 1 directory
 (#25170)

chore(deps): bump basic-ftp

Bumps the npm_and_yarn group with 1 update in the /scripts/environment/npm-tools directory: [basic-ftp](https://github.com/patrickjuchli/basic-ftp).


Updates `basic-ftp` from 5.2.1 to 5.2.2
- [Release notes](https://github.com/patrickjuchli/basic-ftp/releases)
- [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/patrickjuchli/basic-ftp/compare/v5.2.1...v5.2.2)

---
updated-dependencies:
- dependency-name: basic-ftp
  dependency-version: 5.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 scripts/environment/npm-tools/package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/environment/npm-tools/package-lock.json b/scripts/environment/npm-tools/package-lock.json
index 708206c20ade0..9e25b17830d18 100644
--- a/scripts/environment/npm-tools/package-lock.json
+++ b/scripts/environment/npm-tools/package-lock.json
@@ -596,9 +596,9 @@
       "license": "MIT"
     },
     "node_modules/basic-ftp": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.1.tgz",
-      "integrity": "sha512-0yaL8JdxTknKDILitVpfYfV2Ob6yb3udX/hK97M7I3jOeznBNxQPtVvTUtnhUkyHlxFWyr5Lvknmgzoc7jf+1Q==",
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.2.tgz",
+      "integrity": "sha512-1tDrzKsdCg70WGvbFss/ulVAxupNauGnOlgpyjKzeQxzyllBLS0CGLV7tjIXTK3ZQA9/FBEm9qyFFN1bciA6pw==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

From 5ab0ba0d27392c70995a3d5e182a8307e65c641f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Apr 2026 10:37:29 -0400
Subject: [PATCH 119/326] chore(website deps): bump axios from 1.13.5 to 1.15.0
 in /website (#25172)

Bumps [axios](https://github.com/axios/axios) from 1.13.5 to 1.15.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.13.5...v1.15.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 website/yarn.lock | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/website/yarn.lock b/website/yarn.lock
index 055e51daa030a..31254815a65f1 100644
--- a/website/yarn.lock
+++ b/website/yarn.lock
@@ -1641,13 +1641,13 @@ autoprefixer@^10.2.5:
     postcss-value-parser "^4.2.0"
 
 axios@^1.6.0, axios@^1.8.4:
-  version "1.13.5"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-1.13.5.tgz#5e464688fa127e11a660a2c49441c009f6567a43"
-  integrity sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==
+  version "1.15.0"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.15.0.tgz#0fcee91ef03d386514474904b27863b2c683bf4f"
+  integrity sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==
   dependencies:
     follow-redirects "^1.15.11"
     form-data "^4.0.5"
-    proxy-from-env "^1.1.0"
+    proxy-from-env "^2.1.0"
 
 babel-plugin-macros@^3.1.0:
   version "3.1.0"
@@ -3190,10 +3190,10 @@ prop-types@^15.7.2:
     object-assign "^4.1.1"
     react-is "^16.13.1"
 
-proxy-from-env@^1.1.0:
-  version "1.1.0"
-  resolved "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz"
-  integrity sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==
+proxy-from-env@^2.1.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/proxy-from-env/-/proxy-from-env-2.1.0.tgz#a7487568adad577cfaaa7e88c49cab3ab3081aba"
+  integrity sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==
 
 purgecss@^4.0.3, purgecss@^4.1.3:
   version "4.1.3"

From 480ca58f52a019454a36e9c9b754791224fcee57 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 13 Apr 2026 11:22:13 -0400
Subject: [PATCH 120/326] chore(vdev): extract vector-vrl-doc-builder into
 unpublished crate (#25034)

* chore(vdev): extract vector-vrl-doc-builder into unpublished crate

* fix(ci): address issues caught by Codex code review

Allow clippy::print_stdout on the doc-builder binary (the workspace-wide
lint denial would otherwise fail clippy) and explicitly request Rust in
the VRL docs CI workflow so it does not rely on cache state.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(ci): update VRL doc-builder workflow filters, caching, and CLI modes

- Replace stale vdev/** path filter with Makefile, drop vdev: true
- Add install-vrl-doc-builder action with binary caching (mirrors vdev pattern)
- Use clap conflicts_with/requires for mutually exclusive CLI flags
- Makefile auto-detects installed binary, falls back to cargo run

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(ci): add protoc to VRL doc-builder workflow

vector-core's build.rs requires protoc for proto compilation.
Previously protoc was installed implicitly via VDEV_NEEDS_COMPILE;
now that vdev is disabled we need to request it explicitly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(ci): drop redundant false overrides from setup action call

mold and cargo-cache default to true which is fine; no need to
explicitly disable them.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../install-vrl-doc-builder/action.yml        | 25 ++++++++++
 .../workflows/check_generated_vrl_docs.yml    | 10 ++--
 Cargo.lock                                    | 13 ++++-
 Cargo.toml                                    |  1 +
 Makefile                                      |  9 +++-
 lib/vector-vrl/doc-builder/Cargo.toml         | 14 ++++++
 lib/vector-vrl/doc-builder/src/main.rs        | 49 +++++++++++++++++++
 vdev/Cargo.toml                               |  2 -
 vdev/src/commands/build/mod.rs                |  2 -
 vdev/src/commands/build/vector_vrl_docs.rs    | 47 ------------------
 10 files changed, 114 insertions(+), 58 deletions(-)
 create mode 100644 .github/actions/install-vrl-doc-builder/action.yml
 create mode 100644 lib/vector-vrl/doc-builder/Cargo.toml
 create mode 100644 lib/vector-vrl/doc-builder/src/main.rs
 delete mode 100644 vdev/src/commands/build/vector_vrl_docs.rs

diff --git a/.github/actions/install-vrl-doc-builder/action.yml b/.github/actions/install-vrl-doc-builder/action.yml
new file mode 100644
index 0000000000000..3748e02e8b295
--- /dev/null
+++ b/.github/actions/install-vrl-doc-builder/action.yml
@@ -0,0 +1,25 @@
+name: "Install vector-vrl-doc-builder"
+description: "Install vector-vrl-doc-builder CLI tool with caching based on source code changes"
+
+branding:
+  icon: tool
+  color: purple
+
+runs:
+  using: "composite"
+  steps:
+    - name: Cache vrl-doc-builder binary
+      id: cache-vrl-doc-builder
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      with:
+        path: ~/.cargo/bin/vector-vrl-doc-builder
+        key: ${{ runner.os }}-vrl-doc-builder-${{ hashFiles('lib/vector-vrl/**', 'Cargo.toml', 'Cargo.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-vrl-doc-builder-
+
+    - name: Build and install vector-vrl-doc-builder
+      if: steps.cache-vrl-doc-builder.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        echo "Building vector-vrl-doc-builder from source (cache miss)"
+        cargo install --path lib/vector-vrl/doc-builder --locked --force
diff --git a/.github/workflows/check_generated_vrl_docs.yml b/.github/workflows/check_generated_vrl_docs.yml
index e183e12578f6e..c2a9852474461 100644
--- a/.github/workflows/check_generated_vrl_docs.yml
+++ b/.github/workflows/check_generated_vrl_docs.yml
@@ -34,7 +34,7 @@ jobs:
           filters: |
             docs:
               - "lib/vector-vrl/**"
-              - "vdev/**"
+              - "Makefile"
               - "Cargo.lock"
               - ".github/workflows/check_generated_vrl_docs.yml"
 
@@ -51,9 +51,11 @@ jobs:
 
       - uses: ./.github/actions/setup
         with:
-          vdev: true
-          mold: false
-          cargo-cache: false
+          rust: true
+          protoc: true
+          vdev: false
+
+      - uses: ./.github/actions/install-vrl-doc-builder
 
       - name: Regenerate VRL docs
         run: make generate-vector-vrl-docs
diff --git a/Cargo.lock b/Cargo.lock
index 45f4a998276fc..054d3afc66007 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -12226,8 +12226,6 @@ dependencies = [
  "tempfile",
  "toml",
  "toml_edit 0.23.9",
- "vector-vrl-functions",
- "vrl",
 ]
 
 [[package]]
@@ -12788,6 +12786,17 @@ dependencies = [
  "vrl",
 ]
 
+[[package]]
+name = "vector-vrl-doc-builder"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "clap",
+ "serde_json",
+ "vector-vrl-functions",
+ "vrl",
+]
+
 [[package]]
 name = "vector-vrl-functions"
 version = "0.1.0"
diff --git a/Cargo.toml b/Cargo.toml
index 25ca1f9e0dec9..9389c9420d248 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -127,6 +127,7 @@ members = [
   "lib/vector-vrl/category",
   "lib/vector-vrl/cli",
   "lib/vector-vrl/dnstap-parser",
+  "lib/vector-vrl/doc-builder",
   "lib/vector-vrl/enrichment",
   "lib/vector-vrl/functions",
   "lib/vector-vrl/metrics",
diff --git a/Makefile b/Makefile
index a923806254d9f..34da1302487d9 100644
--- a/Makefile
+++ b/Makefile
@@ -734,9 +734,16 @@ generate-component-docs: ## Generate per-component Cue docs from the configurati
 		$(if $(findstring true,$(CI)),>/dev/null,)
 	./scripts/cue.sh fmt
 
+VRL_DOC_BUILDER := $(shell command -v vector-vrl-doc-builder 2>/dev/null)
+ifndef VRL_DOC_BUILDER
+VRL_DOC_BUILDER_CMD = cargo run -p vector-vrl-doc-builder --
+else
+VRL_DOC_BUILDER_CMD = vector-vrl-doc-builder
+endif
+
 .PHONY: generate-vector-vrl-docs
 generate-vector-vrl-docs: ## Generate VRL function documentation from Rust source.
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) build vector-vrl-docs --output docs/generated/ \
+	${MAYBE_ENVIRONMENT_EXEC} $(VRL_DOC_BUILDER_CMD) --output docs/generated/ \
 		$(if $(findstring true,$(CI)),>/dev/null,)
 
 .PHONY: generate-vrl-docs
diff --git a/lib/vector-vrl/doc-builder/Cargo.toml b/lib/vector-vrl/doc-builder/Cargo.toml
new file mode 100644
index 0000000000000..75a1d262f4708
--- /dev/null
+++ b/lib/vector-vrl/doc-builder/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "vector-vrl-doc-builder"
+version = "0.1.0"
+authors = ["Vector Contributors <vector@datadoghq.com>"]
+edition = "2024"
+publish = false
+license = "MPL-2.0"
+
+[dependencies]
+anyhow.workspace = true
+clap.workspace = true
+serde_json = { workspace = true, features = ["preserve_order"] }
+vector-vrl-functions = { path = "../functions", features = ["dnstap", "vrl-metrics"] }
+vrl = { workspace = true, features = ["docs"] }
diff --git a/lib/vector-vrl/doc-builder/src/main.rs b/lib/vector-vrl/doc-builder/src/main.rs
new file mode 100644
index 0000000000000..92c38dfea307d
--- /dev/null
+++ b/lib/vector-vrl/doc-builder/src/main.rs
@@ -0,0 +1,49 @@
+use anyhow::Result;
+use std::path::PathBuf;
+use vrl::docs::{build_functions_doc, document_functions_to_dir};
+
+/// Generate Vector-specific VRL function documentation as JSON files.
+///
+/// Two modes of operation:
+///   --output <DIR>              Write one JSON file per function into DIR (uses --extension).
+///   (no --output)               Print all functions to stdout as a JSON array (uses --minify).
+#[derive(clap::Parser, Debug)]
+#[command()]
+struct Cli {
+    /// Output directory to create JSON files. When omitted, output is written to stdout as a JSON
+    /// array.
+    #[arg(short, long, conflicts_with = "minify")]
+    output: Option<PathBuf>,
+
+    /// Whether to minify the JSON output (stdout mode only)
+    #[arg(short, long, default_value_t = false, conflicts_with = "output")]
+    minify: bool,
+
+    /// File extension for generated files (directory mode only)
+    #[arg(short, long, default_value = "json", requires = "output")]
+    extension: String,
+}
+
+#[allow(clippy::print_stdout)]
+fn main() -> Result<()> {
+    let cli = <Cli as clap::Parser>::parse();
+    let functions = vector_vrl_functions::all_without_vrl_stdlib();
+    if let Some(output) = &cli.output {
+        document_functions_to_dir(&functions, output, &cli.extension)?;
+    } else {
+        let built = build_functions_doc(&functions);
+        if cli.minify {
+            println!(
+                "{}",
+                serde_json::to_string(&built).expect("FunctionDoc serialization should not fail")
+            );
+        } else {
+            println!(
+                "{}",
+                serde_json::to_string_pretty(&built)
+                    .expect("FunctionDoc serialization should not fail")
+            );
+        }
+    }
+    Ok(())
+}
diff --git a/vdev/Cargo.toml b/vdev/Cargo.toml
index 8fea6eb281d0a..7de3fc06d5a59 100644
--- a/vdev/Cargo.toml
+++ b/vdev/Cargo.toml
@@ -46,8 +46,6 @@ strum.workspace = true
 indoc.workspace = true
 git2 = { version = "0.20.4" }
 cfg-if.workspace = true
-vector-vrl-functions = { path = "../lib/vector-vrl/functions", features = ["dnstap", "vrl-metrics"] }
-vrl = { workspace = true, features = ["docs"] }
 
 [package.metadata.binstall]
 pkg-url = "{ repo }/releases/download/vdev-v{ version }/{ name }-{ target }-v{ version }.tgz"
diff --git a/vdev/src/commands/build/mod.rs b/vdev/src/commands/build/mod.rs
index 845ae928b84d9..f46d8a8ae210c 100644
--- a/vdev/src/commands/build/mod.rs
+++ b/vdev/src/commands/build/mod.rs
@@ -1,7 +1,6 @@
 mod licenses;
 mod publish_metadata;
 mod vector;
-mod vector_vrl_docs;
 mod vrl_docs;
 mod vrl_wasm;
 
@@ -14,7 +13,6 @@ crate::cli_subcommands! {
     release_cue,
     vector,
     vrl_docs,
-    vector_vrl_docs,
     vrl_wasm,
 }
 
diff --git a/vdev/src/commands/build/vector_vrl_docs.rs b/vdev/src/commands/build/vector_vrl_docs.rs
deleted file mode 100644
index 7c25a23b139c3..0000000000000
--- a/vdev/src/commands/build/vector_vrl_docs.rs
+++ /dev/null
@@ -1,47 +0,0 @@
-use anyhow::Result;
-use std::path::PathBuf;
-use vrl::docs::{build_functions_doc, document_functions_to_dir};
-
-/// Generate Vector-specific VRL function documentation as JSON files.
-#[derive(clap::Args, Debug)]
-#[command()]
-pub struct Cli {
-    /// Output directory to create JSON files. If unspecified output is written to stdout as a JSON
-    /// array
-    #[arg(short, long)]
-    output: Option<PathBuf>,
-
-    /// Whether to pretty-print or minify
-    #[arg(short, long, default_value_t = false)]
-    minify: bool,
-
-    /// File extension for generated files
-    #[arg(short, long, default_value = "json")]
-    extension: String,
-}
-
-impl Cli {
-    pub fn exec(self) -> Result<()> {
-        let functions = vector_vrl_functions::all_without_vrl_stdlib();
-        if let Some(output) = &self.output {
-            document_functions_to_dir(&functions, output, &self.extension)?;
-        } else {
-            let built = build_functions_doc(&functions);
-            #[allow(clippy::print_stdout)]
-            if self.minify {
-                println!(
-                    "{}",
-                    serde_json::to_string(&built)
-                        .expect("FunctionDoc serialization should not fail")
-                );
-            } else {
-                println!(
-                    "{}",
-                    serde_json::to_string_pretty(&built)
-                        .expect("FunctionDoc serialization should not fail")
-                );
-            }
-        }
-        Ok(())
-    }
-}

From 3112033384d47b0eae9fa36a1297dab32cac1f88 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 13 Apr 2026 12:08:25 -0400
Subject: [PATCH 121/326] docs(website): convert TOML config examples to YAML
 (#25163)

* docs(website): convert TOML config examples to YAML across website

YAML is Vector's recommended and default configuration format. This
converts all TOML-only config examples in website docs, guides, blog
posts, and highlight files to YAML for consistency.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs(website): add YAML recommendation to multi-format references

Update docs that mention TOML/YAML/JSON support to explicitly
recommend YAML as the default configuration format.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: add YAML-default guidance to AGENTS.md

Instructs AI tools to generate Vector config in YAML unless
explicitly asked otherwise.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: remove version reference from AGENTS.md YAML guidance

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs(website): fix issues from code review

- Fix invalid YAML escape in template-syntax.md (use single quotes)
- Fix `transform:` typo to `transforms:` in 0-25-0-upgrade-guide.md
- Update remaining `vector.toml` prose references to `vector.yaml`
- Remove anachronistic version reference from 2020 highlight

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs(website): add YAML/TOML format picker tabs to template-syntax.md

Add tabbed config format picker to all examples so users can toggle
between YAML and TOML. Defaults to YAML.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 AGENTS.md                                     |   4 +
 .../en/blog/adaptive-request-concurrency.md   |  16 +-
 website/content/en/blog/graphql-api.md        |  39 +-
 .../content/en/blog/kubernetes-integration.md |  20 +-
 website/content/en/blog/log-namespacing.md    |  45 +-
 .../en/docs/administration/management.md      |   2 +-
 .../en/docs/architecture/guarantees.md        |  13 +-
 .../en/docs/architecture/pipeline-model.md    |   2 +-
 .../en/docs/reference/configuration/_index.md |   5 +-
 .../configuration/template-syntax.md          |  90 +++
 .../reference/configuration/unit-tests.md     | 528 ++++++++--------
 .../setup/going-to-prod/high-availability.md  |  37 +-
 .../advanced/custom-aggregations-with-lua.md  | 245 ++++----
 .../advanced/merge-multiline-logs-with-lua.md |  72 +--
 .../advanced/parsing-csv-logs-with-lua.md     | 193 +++---
 .../en/guides/aws/cloudwatch-logs-firehose.md | 117 ++--
 .../level-up/managing-complex-configs.md      | 217 +++----
 .../en/guides/level-up/managing-schemas.md    | 232 +++----
 .../en/guides/level-up/vector-tap-guide.md    | 121 ++--
 ...-11-25-unit-testing-vector-config-files.md |  57 +-
 .../en/highlights/2019-12-13-custom-dns.md    |   4 +-
 .../en/highlights/2019-12-16-ec2-metadata.md  |  26 +-
 .../2020-01-07-prometheus-source.md           |  11 +-
 ...01-20-splunk-hec-specify-indexed-fields.md |  11 +-
 .../2020-02-05-merge-partial-docker-events.md |   9 +-
 .../2020-02-14-global-log-schema.md           |  10 +-
 ...020-02-21-file-source-multiline-support.md |  20 +-
 .../2020-02-24-swimlanes-transform.md         |  19 +-
 ...3-04-encoding-only-fields-except-fields.md |  16 +-
 .../highlights/2020-03-10-dedupe-transform.md |  16 +-
 ...0-03-11-tag-cardinality-limit-transform.md |  15 +-
 .../highlights/2020-03-31-filter-transform.md |  18 +-
 .../2020-04-01-more-condition-predicates.md   |  10 +-
 ...27-add-support-for-loading-multiple-cas.md |  20 +-
 .../2020-07-10-add-reduce-transform.md        |  79 +--
 .../2020-09-18-adaptive-concurrency.md        |  12 +-
 .../2020-10-27-metrics-integrations.md        |  14 +-
 ...20-11-19-prometheus-remote-integrations.md |  39 +-
 .../2020-11-25-json-yaml-config-formats.md    |   6 +-
 .../en/highlights/2020-12-23-graphql-api.md   |   8 +-
 .../2020-12-23-internal-logs-source.md        |  39 +-
 .../2021-01-10-kafka-sink-metrics.md          |  17 +-
 .../2021-01-20-wildcard-identifiers.md        |  34 +-
 .../2021-02-16-0-12-upgrade-guide.md          |  12 +-
 .../2021-02-16-filter-remap-support.md        |  34 +-
 .../en/highlights/2021-04-21-vector-tap.md    |  29 +-
 .../en/highlights/2021-04-21-vrl-abort.md     |  43 +-
 .../2021-07-14-0-15-upgrade-guide.md          | 102 ++--
 .../en/highlights/2021-07-14-vector-graph.md  | 104 ++--
 .../highlights/2021-07-16-remap-multiple.md   |  65 +-
 .../en/highlights/2021-08-20-rate-limits.md   |   7 +-
 .../2021-08-25-0-16-upgrade-guide.md          |  32 +-
 .../en/highlights/2021-10-06-arc-default.md   |  10 +-
 .../en/highlights/2021-10-06-source-codecs.md |  29 +-
 .../2021-11-12-event-throttle-transform.md    |  13 +-
 .../2021-12-15-splunk-hec-improvements.md     |   9 +-
 .../2021-12-28-0-19-0-upgrade-guide.md        |  14 +-
 ...022-01-12-vector-unit-test-improvements.md |  44 +-
 .../2022-02-08-disk-buffer-v2-beta.md         |  28 +-
 .../en/highlights/2022-03-15-vrl-vm-beta.md   |  16 +-
 .../2022-03-22-0-21-0-upgrade-guide.md        |  26 +-
 .../2022-03-31-native-event-codecs.md         |  44 +-
 .../2022-05-03-0-22-0-upgrade-guide.md        | 572 +++++++++---------
 .../2022-07-07-0-23-0-upgrade-guide.md        |  73 ++-
 .../2022-07-07-secrets-management.md          |  25 +-
 .../en/highlights/2022-07-07-sink-codecs.md   |  17 +-
 .../2022-10-04-0-25-0-upgrade-guide.md        |  60 +-
 .../2024-07-29-0-40-0-upgrade-guide.md        |   9 +-
 68 files changed, 2096 insertions(+), 1829 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 8d25eca40144c..118ebb7461dbf 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -147,6 +147,10 @@ make cue-build
 
 **Note:** Website changes use Hugo, CUE, Tailwind CSS, and TypeScript. See [website/README.md](website/README.md) for details.
 
+## Configuration Format
+
+Always generate Vector configuration examples in **YAML** unless the user explicitly asks for TOML or JSON. YAML is Vector's recommended and default configuration format.
+
 ## Common Patterns
 
 ### Development Tools
diff --git a/website/content/en/blog/adaptive-request-concurrency.md b/website/content/en/blog/adaptive-request-concurrency.md
index b2a701433d638..623d93d3d7749 100644
--- a/website/content/en/blog/adaptive-request-concurrency.md
+++ b/website/content/en/blog/adaptive-request-concurrency.md
@@ -94,13 +94,15 @@ This decision tree is always active and Vector always "knows" what to do, even i
 
 Vector never stops quietly making the linear up vs. exponential down decision in the background, and it works out of the box with zero configuration beyond enabling the feature, which is currently on an opt-in basis in version 0.11. You can enable ARC in an HTTP sink by setting the [`request.concurrency`][request_concurrency] parameter to `adaptive`. Here's an example for a Clickhouse sink:
 
-```toml
-[sinks.clickhouse_internal]
-type = "clickhouse"
-inputs = ["log_stream_1", "log_stream_2"]
-host = "http://clickhouse-prod:8123"
-table = "prod-log-data"
-request.concurrency = "adaptive"
+```yaml
+sinks:
+  clickhouse_internal:
+    type: "clickhouse"
+    inputs: ["log_stream_1", "log_stream_2"]
+    host: "http://clickhouse-prod:8123"
+    table: "prod-log-data"
+    request:
+      concurrency: "adaptive"
 ```
 
 There's also room for fine-tuning if you find yourself needing additional knobs:
diff --git a/website/content/en/blog/graphql-api.md b/website/content/en/blog/graphql-api.md
index f623c4caa921d..6d459dda9de95 100644
--- a/website/content/en/blog/graphql-api.md
+++ b/website/content/en/blog/graphql-api.md
@@ -36,19 +36,22 @@ tuned!
 
 Start up Vector locally with the following config:
 
-```toml
-[api]
-enabled = true
-
-[sources.demo]
-type = "demo_logs"
-format = "json"
-interval = 1.0
-
-[sinks.console]
-type = "console"
-inputs = ["demo"]
-encoding.codec = "text"
+```yaml
+api:
+  enabled: true
+
+sources:
+  demo:
+    type: "demo_logs"
+    format: "json"
+    interval: 1.0
+
+sinks:
+  console:
+    type: "console"
+    inputs: ["demo"]
+    encoding:
+      codec: "text"
 ```
 
 You can then access
@@ -190,12 +193,12 @@ query {
 
 The API is an opt-in feature that spawns an HTTP server to accept queries.
 
-To enable, open your `vector.toml`, and add the following:
+To enable, open your `vector.yaml`, and add the following:
 
-```toml
-[api]
-  enabled = true
-  address = "127.0.0.1:8686" # optional. Change IP/port if required
+```yaml
+api:
+  enabled: true
+  address: "127.0.0.1:8686" # optional. Change IP/port if required
 ```
 
 After restarting Vector, you can access an API playground at
diff --git a/website/content/en/blog/kubernetes-integration.md b/website/content/en/blog/kubernetes-integration.md
index bf60365d98ed1..bf9d7fbbb1cfa 100644
--- a/website/content/en/blog/kubernetes-integration.md
+++ b/website/content/en/blog/kubernetes-integration.md
@@ -27,15 +27,17 @@ The crux of our Kubernetes integration for Vector is the new [`kubernetes_logs`]
 
 This simple Vector configuration, for example, would suffice to send logs from *all* of your Nodes/Pods to [Elasticsearch]:
 
-```toml title="vector.toml"
-[sources.k8s_all]
-type = "kubernetes_logs"
-
-[sinks.es_out]
-type = "elasticsearch"
-inputs = ["k8s_all"]
-host = "http://your-elasticsearch-cluster:9200"
-index = "vector-k8s-%F"
+```yaml title="vector.yaml"
+sources:
+  k8s_all:
+    type: "kubernetes_logs"
+
+sinks:
+  es_out:
+    type: "elasticsearch"
+    inputs: ["k8s_all"]
+    host: "http://your-elasticsearch-cluster:9200"
+    index: "vector-k8s-%F"
 ```
 
 Using this simple topology as a starting point, you can [transform][transforms] your log data in a wide variety of ways, ship it to [other sinks][sinks], and much more.
diff --git a/website/content/en/blog/log-namespacing.md b/website/content/en/blog/log-namespacing.md
index d867f21c9411d..2d7ce9b314e58 100644
--- a/website/content/en/blog/log-namespacing.md
+++ b/website/content/en/blog/log-namespacing.md
@@ -39,27 +39,30 @@ so you can try out Log Namespacing on individual sources.
 The following example enables the `log_namespace` feature globally, then disables it for a single
 source.
 
-```toml
-schema.log_namespace = true
-
-[sources.input_with_log_namespace]
-type = "demo_logs"
-format = "shuffle"
-lines = ["input_with_log_namespace"]
-interval = 1
-
-[sources.input_without_log_namespace]
-type = "demo_logs"
-format = "shuffle"
-lines = ["input_without_log_namespace"]
-interval = 1
-log_namespace = false
-
-[sinks.console]
-type = "console"
-inputs = ["input_with_log_namespace", "input_without_log_namespace"]
-encoding.codec = "json"
-
+```yaml
+schema:
+  log_namespace: true
+
+sources:
+  input_with_log_namespace:
+    type: "demo_logs"
+    format: "shuffle"
+    lines: ["input_with_log_namespace"]
+    interval: 1
+
+  input_without_log_namespace:
+    type: "demo_logs"
+    format: "shuffle"
+    lines: ["input_without_log_namespace"]
+    interval: 1
+    log_namespace: false
+
+sinks:
+  console:
+    type: "console"
+    inputs: ["input_with_log_namespace", "input_without_log_namespace"]
+    encoding:
+      codec: "json"
 ```
 
 ## How It Works
diff --git a/website/content/en/docs/administration/management.md b/website/content/en/docs/administration/management.md
index dff4be7153bbf..7f91c26cdd191 100644
--- a/website/content/en/docs/administration/management.md
+++ b/website/content/en/docs/administration/management.md
@@ -176,7 +176,7 @@ docker restart -f $(docker ps -aqf "name=vector")
 {{< /tab >}}
 {{< /tabs >}}
 
-The commands above involve configuring Vector using TOML, but you can also use JSON or YAML. You can also use one of
+The commands above involve configuring Vector using YAML, but you can also use TOML or JSON. You can also use one of
 three image variants (the commands assume `alpine`):
 
 | Variant | Image basis |
diff --git a/website/content/en/docs/architecture/guarantees.md b/website/content/en/docs/architecture/guarantees.md
index 76028d4e42fe1..14a1c0c9a72d8 100644
--- a/website/content/en/docs/architecture/guarantees.md
+++ b/website/content/en/docs/architecture/guarantees.md
@@ -61,12 +61,13 @@ delivery?](#faq-at-least-once) FAQ below).
 In order to achieve at-least-once delivery between restarts,
 your sink must be configured to use disk-based buffers:
 
-```toml title="vector.toml"
-[sinks.my_sink_id]
-  [sinks.my_sink_id.buffer]
-    type = "disk"
-    when_full = "block"
-    max_size = 104900000 # 100MiB
+```yaml title="vector.yaml"
+sinks:
+  my_sink_id:
+    buffer:
+      type: "disk"
+      when_full: "block"
+      max_size: 104900000 # 100MiB
 ```
 
 Refer to each [sink's][sinks] documentation for further guidance on its buffer options.
diff --git a/website/content/en/docs/architecture/pipeline-model.md b/website/content/en/docs/architecture/pipeline-model.md
index 49cc846f7ac96..ddb6d84bc3b8c 100644
--- a/website/content/en/docs/architecture/pipeline-model.md
+++ b/website/content/en/docs/architecture/pipeline-model.md
@@ -10,7 +10,7 @@ Vector's pipeline model is based on a [directed acyclic graph][dag] of [componen
 
 ## Defining pipelines
 
-A Vector pipeline is defined through a YAML, TOML, or JSON [configuration] file. For maintainability, many Vector users use configuration and data templating languages like [Jsonnet] or [CUE].
+A Vector pipeline is defined through a YAML, TOML, or JSON [configuration] file. We recommend using YAML as the default format. For maintainability, many Vector users use configuration and data templating languages like [Jsonnet] or [CUE].
 
 Configuration is checked at pipeline compile time (when Vector boots). This prevents simple mistakes and enforces DAG properties.
 
diff --git a/website/content/en/docs/reference/configuration/_index.md b/website/content/en/docs/reference/configuration/_index.md
index 9e19281d9024c..65782a59b6000 100644
--- a/website/content/en/docs/reference/configuration/_index.md
+++ b/website/content/en/docs/reference/configuration/_index.md
@@ -250,8 +250,9 @@ Refer to the [Environment Variables](docs/reference/environment_variables/) page
 ### Formats
 
 Vector supports [YAML], [TOML], and [JSON] to ensure that Vector fits into your
-workflow. A side benefit of supporting YAML and JSON is that they enable you to use
-data templating languages such as [ytt], [Jsonnet] and [Cue].
+workflow. We recommend using YAML as the default configuration format. A side
+benefit of supporting YAML and JSON is that they enable you to use data templating
+languages such as [ytt], [Jsonnet] and [Cue].
 
 #### Location
 
diff --git a/website/content/en/docs/reference/configuration/template-syntax.md b/website/content/en/docs/reference/configuration/template-syntax.md
index 43822e137c555..96135c0183745 100644
--- a/website/content/en/docs/reference/configuration/template-syntax.md
+++ b/website/content/en/docs/reference/configuration/template-syntax.md
@@ -12,6 +12,20 @@ data. Any option that supports this syntax will be clearly documented as such in
 Let's partition data on AWS S3 by "application_id" and "date". We can accomplish this with the `key_prefix` option in
 the `aws_s3` sink:
 
+{{< tabs default="YAML" >}}
+{{< tab title="YAML" >}}
+
+```yaml
+sinks:
+  backup:
+    type: "aws_s3"
+    bucket: "all_application_logs"
+    key_prefix: "application_id={{ application_id }}/date=%F/"
+```
+
+{{< /tab >}}
+{{< tab title="TOML" >}}
+
 ```toml
 [sinks.backup]
   type = "aws_s3"
@@ -19,6 +33,9 @@ the `aws_s3` sink:
   key_prefix = "application_id={{ application_id }}/date=%F/"
 ```
 
+{{< /tab >}}
+{{< /tabs >}}
+
 Notice that Vector allows direct field references as well as "strftime" specifiers. If we were to run the following log
 event through Vector:
 
@@ -45,18 +62,44 @@ enables dynamic partitioning, something fundamental to storing log data in files
 
 Individual [log event][log] fields can be accessed using `{{ ... }}` to wrap a VRL [path expression][path_expression]:
 
+{{< tabs default="YAML" >}}
+{{< tab title="YAML" >}}
+
+```yaml
+option: "{{ .parent.child }}"
+```
+
+{{< /tab >}}
+{{< tab title="TOML" >}}
+
 ```toml
 option = "{{ .parent.child }}"
 ```
 
+{{< /tab >}}
+{{< /tabs >}}
+
 ### Strftime specifiers
 
 In addition to directly accessing fields, Vector offers a shortcut for injecting [strftime specifiers][strftime]:
 
+{{< tabs default="YAML" >}}
+{{< tab title="YAML" >}}
+
+```yaml
+option: "year=%Y/month=%m/day=%d/"
+```
+
+{{< /tab >}}
+{{< tab title="TOML" >}}
+
 ```toml
 option = "year=%Y/month=%m/day=%d/"
 ```
 
+{{< /tab >}}
+{{< /tabs >}}
+
 {{< info >}}
 The value is derived from the [`timestamp` field](/docs/architecture/data-model/log/#timestamps)
 and the name of this field can be changed via the [global `timestamp_key` option](/docs/reference/configuration/schema/#log_schema.timestamp_key).
@@ -67,16 +110,42 @@ and the name of this field can be changed via the [global `timestamp_key` option
 You can escape this syntax by prefixing the character with a `\`. For example, you can escape the event field syntax
 like this:
 
+{{< tabs default="YAML" >}}
+{{< tab title="YAML" >}}
+
+```yaml
+option: '\{{ field_name }}'
+```
+
+{{< /tab >}}
+{{< tab title="TOML" >}}
+
 ```toml
 option = "\{{ field_name }}"
 ```
 
+{{< /tab >}}
+{{< /tabs >}}
+
 And [strftime] specified like so:
 
+{{< tabs default="YAML" >}}
+{{< tab title="YAML" >}}
+
+```yaml
+option: "year=\\%Y/month=\\%m/day=\\%d/"
+```
+
+{{< /tab >}}
+{{< tab title="TOML" >}}
+
 ```toml
 option = "year=\%Y/month=\%m/day=\%d/"
 ```
 
+{{< /tab >}}
+{{< /tabs >}}
+
 Each of the values above would be treated literally.
 
 ## How it works
@@ -91,6 +160,24 @@ You can find additional examples for accessing fields in the
 Vector doesn't currently support fallback values, [issue 1692][1692] is open to add this functionality. In the interim,
 you can use the [`remap` transform][remap] to set a default value:
 
+{{< tabs default="YAML" >}}
+{{< tab title="YAML" >}}
+
+```yaml
+transforms:
+  set_defaults:
+    type: "remap"
+    inputs:
+      - "my-source-id"
+    source: |
+      if !exists(.my_field) {
+        .my_field = "default"
+      }
+```
+
+{{< /tab >}}
+{{< tab title="TOML" >}}
+
 ```toml
 [transforms.set_defaults]
   type = "remap"
@@ -102,6 +189,9 @@ you can use the [`remap` transform][remap] to set a default value:
   '''
 ```
 
+{{< /tab >}}
+{{< /tabs >}}
+
 ### Missing fields
 
 If a field is missing, an error is logged and Vector drops the event. The `component_errors_total` internal
diff --git a/website/content/en/docs/reference/configuration/unit-tests.md b/website/content/en/docs/reference/configuration/unit-tests.md
index 5e11240c9136f..d470813252518 100644
--- a/website/content/en/docs/reference/configuration/unit-tests.md
+++ b/website/content/en/docs/reference/configuration/unit-tests.md
@@ -77,12 +77,11 @@ functions][type], functions like [`exists`][exists], [`includes`][includes],
 [`is_nullish`][is_nullish] and [`contains`][contains], and VRL [comparisons]. Here's an example
 usage of a Boolean expression passed to an `assert` function:
 
-```toml
-[[tests.outputs.conditions]]
-type = "vrl"
-source = '''
-assert!(is_string(.message) && is_timestamp(.timestamp) && !exists(.other))
-'''
+```yaml
+conditions:
+  - type: "vrl"
+    source: |
+      assert!(is_string(.message) && is_timestamp(.timestamp) && !exists(.other))
 ```
 
 In this case, the VRL program (under `source`) evaluates to a single Boolean that expresses the
@@ -94,29 +93,27 @@ following:
 
 It's also possible to break a test up into multiple `assert` or `assert_eq` statements:
 
-```toml
-source = '''
-assert!(exists(.message), "no message field provided")
-assert!(!is_nullish(.message), "message field is an empty string")
-assert!(is_string(.message), "message field has as unexpected type")
-assert_eq!(.message, "success", "message field had an unexpected value")
-assert!(exists(.timestamp), "no timestamp provided")
-assert!(is_timestamp(.timestamp), "timestamp is invalid")
-assert!(!exists(.other), "extraneous other field present")
-'''
+```yaml
+source: |
+  assert!(exists(.message), "no message field provided")
+  assert!(!is_nullish(.message), "message field is an empty string")
+  assert!(is_string(.message), "message field has as unexpected type")
+  assert_eq!(.message, "success", "message field had an unexpected value")
+  assert!(exists(.timestamp), "no timestamp provided")
+  assert!(is_timestamp(.timestamp), "timestamp is invalid")
+  assert!(!exists(.other), "extraneous other field present")
 ```
 
 You can also store the Boolean expressions in variables rather than passing the entire statement to
 the `assert` function:
 
-```toml
-source = '''
-message_field_valid = exists(.message) &&
-  !is_nullish(.message) &&
-  .message == "success"
+```yaml
+source: |
+  message_field_valid = exists(.message) &&
+    !is_nullish(.message) &&
+    .message == "success"
 
-assert!(message_field_valid)
-'''
+  assert!(message_field_valid)
 ```
 
 ## Example unit test configuration {#example}
@@ -124,48 +121,48 @@ assert!(message_field_valid)
 Below is an annotated example of a unit test suite for a transform called `add_metadata`, which
 adds a unique ID and a timestamp to log events:
 
-```toml
-[sources.all_container_services]
-type = "docker_logs"
-docker_host = "http://localhost:2375"
-include_images = ["web_frontend", "web_backend", "auth_service"]
+```yaml
+sources:
+  all_container_services:
+    type: "docker_logs"
+    docker_host: "http://localhost:2375"
+    include_images: ["web_frontend", "web_backend", "auth_service"]
 
 # The transform being tested is a Vector Remap Language (VRL) transform that
 # adds two fields to each incoming log event: a timestamp and a unique ID
-[transforms.add_metadata]
-type = "remap"
-inputs = ["all_container_services"]
-source = '''
-.timestamp = now()
-.id = uuid_v4()
-'''
+transforms:
+  add_metadata:
+    type: "remap"
+    inputs: ["all_container_services"]
+    source: |
+      .timestamp = now()
+      .id = uuid_v4()
 
 # Here we begin configuring our test suite
-[[tests]]
-name = "Test for the add_metadata transform"
-
-# The inputs for the test
-[[tests.inputs]]
-insert_at = "add_metadata" # The transform into which the testing event is inserted
-type = "log"               # The event type (either log or metric)
-
-# The test log event that is passed to the `add_metadata` transform
-[tests.inputs.log_fields]
-message = "successful transaction"
-code = 200
-
-# The expected outputs of the test
-[[tests.outputs]]
-extract_from = "add_metadata" # The transform from which the resulting event is extracted
-
-# The declaration of what we expect
-[[tests.outputs.conditions]]
-type = "vrl"
-source = '''
-assert!(is_timestamp(.timestamp))
-assert!(is_string(.id))
-assert_eq!(.message, "successful transaction")
-'''
+tests:
+  - name: "Test for the add_metadata transform"
+
+    # The inputs for the test
+    inputs:
+      - insert_at: "add_metadata" # The transform into which the testing event is inserted
+        type: "log"               # The event type (either log or metric)
+
+        # The test log event that is passed to the `add_metadata` transform
+        log_fields:
+          message: "successful transaction"
+          code: 200
+
+    # The expected outputs of the test
+    outputs:
+      - extract_from: "add_metadata" # The transform from which the resulting event is extracted
+
+        # The declaration of what we expect
+        conditions:
+          - type: "vrl"
+            source: |
+              assert!(is_timestamp(.timestamp))
+              assert!(is_string(.id))
+              assert_eq!(.message, "successful transaction")
 ```
 
 This example represents a complete test of the `add_metadata` transform, include test `inputs`
@@ -187,7 +184,7 @@ unit tests as a way of **mocking observability data sources** and ensuring that
 respond to those mock sources the way that you would expect.
 
 {{< success title="Multiple config formats available" >}}
-The unit testing example above is in TOML but Vector also supports YAML and JSON as configuration
+The unit testing example above is in YAML but Vector also supports TOML and JSON as configuration
 formats.
 {{< /success >}}
 
@@ -198,16 +195,15 @@ same config file alongside your transform definitions or split them out into a s
 
 Unit tests need are specified inside of a `tests` array. Each test requires a `name`:
 
-```toml
-[[tests]]
-name = "test 1"
-# Other test config
+```yaml
+tests:
+  - name: "test 1"
+    # Other test config
 
-[[tests]]
-name = "test_2"
-# Other test config
+  - name: "test_2"
+    # Other test config
 
-# etc.
+  # etc.
 ```
 
 Inside each test definition, you need to specify two things:
@@ -230,18 +226,19 @@ In the `inputs` array for the test, you have these options:
 
 Here's an example `inputs` declaration:
 
-```toml
-[transforms.add_metadata]
-# transform config
+```yaml
+transforms:
+  add_metadata:
+    # transform config
 
-[[tests]]
-name = "Test add_metadata transform"
+tests:
+  - name: "Test add_metadata transform"
 
-[[tests.inputs]]
-insert_at = "add_metadata"
+    inputs:
+      - insert_at: "add_metadata"
 
-[tests.inputs.log_fields]
-message = "<102>1 2020-12-22T15:22:31.111Z vector-user.biz su 2666 ID389 - Something went wrong"
+        log_fields:
+          message: "<102>1 2020-12-22T15:22:31.111Z vector-user.biz su 2666 ID389 - Something went wrong"
 ```
 
 ### Outputs
@@ -262,16 +259,15 @@ Each condition in the `conditions` array has two fields:
 
 Here's an example `outputs` declaration:
 
-```toml
-[[tests.outputs]]
-extract_from = "add_metadata"
-
-[[tests.outputs.conditions]]
-type = "vrl"
-source = '''
-assert!(is_string(.id))
-assert!(exists(.tags))
-'''
+```yaml
+outputs:
+  - extract_from: "add_metadata"
+
+    conditions:
+      - type: "vrl"
+        source: |
+          assert!(is_string(.id))
+          assert!(exists(.tags))
 ```
 
 #### Asserting no output
@@ -280,10 +276,10 @@ In some cases, you may need to assert that _no_ event is output by a transform.
 this at the root level of a specific test's configuration using the `no_outputs_from` parameter,
 which takes a list of transform names. Here's an example:
 
-```toml
-[[tests]]
-name = "Ensure no output"
-no_outputs_from = ["log_filter", "metric_filter"]
+```yaml
+tests:
+  - name: "Ensure no output"
+    no_outputs_from: ["log_filter", "metric_filter"]
 ```
 
 In this test configuration, Vector would expect that the `log_filter` and `metric_filter` transforms
@@ -298,26 +294,27 @@ Some examples of use cases for `no_outputs_from`:
 
 Below is a full example of using `no_outputs_from` in a Vector unit test:
 
-```toml
-[transforms.log_filter]
-type = "filter"
-inputs = ["log_source"]
-condition = '.env == "production"'
-
-[[tests]]
-name = "Filter out non-production events"
-no_outputs_from = ["log_filter"]
-
-[[tests.inputs]]
-type = "log"
-insert_at = "log_filter"
-
-[tests.inputs.log_fields]
-message = "success"
-code = 202
-endpoint = "/transactions"
-method = "POST"
-env = "staging"
+```yaml
+transforms:
+  log_filter:
+    type: "filter"
+    inputs: ["log_source"]
+    condition: '.env == "production"'
+
+tests:
+  - name: "Filter out non-production events"
+    no_outputs_from: ["log_filter"]
+
+    inputs:
+      - type: "log"
+        insert_at: "log_filter"
+
+        log_fields:
+          message: "success"
+          code: 202
+          endpoint: "/transactions"
+          method: "POST"
+          env: "staging"
 ```
 
 This unit test passes because the `env` field of the input event has a value of `staging`, which
@@ -340,11 +337,11 @@ either a structured event [object](#object) or a raw [string](#raw-string-value)
 
 To specify a structured log event as your test input, use `log_fields`:
 
-```toml
-[tests.inputs.log_fields]
-message = "successful transaction"
-code = 200
-id = "38c5b0d0-5e7e-42aa-ae86-2b642ad2d1b8"
+```yaml
+log_fields:
+  message: "successful transaction"
+  code: 200
+  id: "38c5b0d0-5e7e-42aa-ae86-2b642ad2d1b8"
 ```
 
 If there are hyphens in the field name, you will need to quote this part (at least in YAML):
@@ -362,38 +359,38 @@ If there are hyphens in the field name, you will need to quote this part (at lea
 
 To specify a raw string value for a log event, use `value`:
 
-```toml
-[[tests.inputs]]
-insert_at = "add_metadata"
-value = "<102>1 2020-12-22T15:22:31.111Z vector-user.biz su 2666 ID389 - Something went wrong"
+```yaml
+inputs:
+  - insert_at: "add_metadata"
+    value: "<102>1 2020-12-22T15:22:31.111Z vector-user.biz su 2666 ID389 - Something went wrong"
 ```
 
 ##### VRL program
 
 To specify a program to construct the log event, use `source`:
 
-```toml
-[[tests.inputs]]
-  insert_at = "canary"
-  type = "vrl"
-  source = """
-    . = {"a": {"b": "c"}, "d": now()}
-  """
+```yaml
+inputs:
+  - insert_at: "canary"
+    type: "vrl"
+    source: |
+      . = {"a": {"b": "c"}, "d": now()}
 ```
 
 #### Metrics
 
 You can specify the fields in a metric event to be unit tested using a `metric` object:
 
-```toml
-[[tests.inputs]]
-insert_at = "my_metric_transform"
-type = "metric"
+```yaml
+inputs:
+  - insert_at: "my_metric_transform"
+    type: "metric"
 
-[tests.inputs.metric]
-name = "count"
-kind = "absolute"
-counter = { value = 1 }
+    metric:
+      name: "count"
+      kind: "absolute"
+      counter:
+        value: 1
 ```
 
 Aggregated metrics are a little different:
@@ -414,40 +411,40 @@ tests:
 
 Here's a full end-to-end example of unit testing a metric through a transform:
 
-```toml
-[transforms.add_env_to_metric]
-type = "remap"
-inputs = []
-source = '''
-env, err = get_env_var("ENV")
-if err != null {
-  log(err, level: "error")
-}
-tags.environment = env
-'''
-
-[[tests]]
-name = "add_unique_id_test"
-
-[[tests.inputs]]
-insert_at = "add_env_to_metric"
-type = "metric"
-
-[tests.inputs.metric]
-name = "website_hits"
-kind = "absolute"
-counter = { value = 1 }
-
-[[tests.outputs]]
-extract_from = "add_env_to_metric"
-
-[[tests.outputs.conditions]]
-type = "vrl"
-source = '''
-assert_eq!(.name, "website_hits")
-assert_eq!(.kind, "absolute")
-assert_eq!(.tags.environment, "production")
-'''
+```yaml
+transforms:
+  add_env_to_metric:
+    type: "remap"
+    inputs: []
+    source: |
+      env, err = get_env_var("ENV")
+      if err != null {
+        log(err, level: "error")
+      }
+      tags.environment = env
+
+tests:
+  - name: "add_unique_id_test"
+
+    inputs:
+      - insert_at: "add_env_to_metric"
+        type: "metric"
+
+        metric:
+          name: "website_hits"
+          kind: "absolute"
+          counter:
+            value: 1
+
+    outputs:
+      - extract_from: "add_env_to_metric"
+
+        conditions:
+          - type: "vrl"
+            source: |
+              assert_eq!(.name, "website_hits")
+              assert_eq!(.kind, "absolute")
+              assert_eq!(.tags.environment, "production")
 ```
 
 ## Multiple transforms {#multiple}
@@ -464,73 +461,71 @@ You may notice that the three transforms in this example could be combined into
 transform. Their separation into multiple transforms here is purely for demonstration purposes.
 {{< /warning >}}
 
-```toml
+```yaml
 # This source, like all sources, is ignored in the unit test itself
-[sources.web_backend]
-type = "docker_logs"
-docker_host = "http://localhost:2375"
-include_images = ["web_backend"]
+sources:
+  web_backend:
+    type: "docker_logs"
+    docker_host: "http://localhost:2375"
+    include_images: ["web_backend"]
 
 # The first transform in the chain
-[transforms.add_env_metadata]
-type = "remap"
-inputs = ["web_backend"]
-source = '''
-.tags.environment = "production"
-'''
-
-# The second transform in the chain
-[transforms.sanitize]
-type = "remap"
-inputs = ["add_env_metadata"]
-source = '''
-del(.username)
-del(.email)
-'''
-
-# The final transform in the chain
-[transforms.add_host_metadata]
-type = "remap"
-inputs = ["sanitize"]
-source = '''
-.tags.host = "web-backend1.vector-user.biz"
-'''
-
-[[tests]]
-name = "Multiple chained remap transforms"
-
-[[tests.inputs]]
-type = "log"
-# Insert test input events into the first transform
-insert_at = "add_env_metadata"
-
-# The input event to insert into the first transform in the chain
-[tests.inputs.log_fields]
-message = "image successfully uploaded"
-code = 202
-username = "tonydanza1337"
-email = "tony@whostheboss.com"
-transaction_id = "bcef6a6a-2b72-4a9a-99a0-97ae89d82815"
-
-[[tests.outputs]]
-# Extract test outputs from the last transform
-extract_from = "add_host_metadata"
-
-[[tests.outputs.conditions]]
-type = "vrl"
-# Our VRL assertions for the test output
-source = '''
-assert_eq!(.tags.environment, "production", "incorrect environment tag")
-assert_eq!(.tags.host, "web-backend1.vector-user.biz", "incorrect host tag")
-assert!(!exists(.username))
-assert!(!exists(.email))
-
-valid_transaction_id = exists(.transaction_id) &&
-  is_string(.transaction_id) &&
-  length!(.transaction_id) == 36
-
-assert!(valid_transaction_id, "transaction ID invalid")
-'''
+transforms:
+  add_env_metadata:
+    type: "remap"
+    inputs: ["web_backend"]
+    source: |
+      .tags.environment = "production"
+
+  # The second transform in the chain
+  sanitize:
+    type: "remap"
+    inputs: ["add_env_metadata"]
+    source: |
+      del(.username)
+      del(.email)
+
+  # The final transform in the chain
+  add_host_metadata:
+    type: "remap"
+    inputs: ["sanitize"]
+    source: |
+      .tags.host = "web-backend1.vector-user.biz"
+
+tests:
+  - name: "Multiple chained remap transforms"
+
+    inputs:
+      - type: "log"
+        # Insert test input events into the first transform
+        insert_at: "add_env_metadata"
+
+        # The input event to insert into the first transform in the chain
+        log_fields:
+          message: "image successfully uploaded"
+          code: 202
+          username: "tonydanza1337"
+          email: "tony@whostheboss.com"
+          transaction_id: "bcef6a6a-2b72-4a9a-99a0-97ae89d82815"
+
+    outputs:
+      - # Extract test outputs from the last transform
+        extract_from: "add_host_metadata"
+
+        conditions:
+          - type: "vrl"
+            # Our VRL assertions for the test output
+            source: |
+              assert_eq!(.tags.environment, "production", "incorrect environment tag")
+              assert_eq!(.tags.host, "web-backend1.vector-user.biz", "incorrect host tag")
+              assert!(!exists(.username))
+              assert!(!exists(.email))
+
+              valid_transaction_id = exists(.transaction_id) &&
+                is_string(.transaction_id) &&
+                length!(.transaction_id) == 36
+
+              assert!(valid_transaction_id, "transaction ID invalid")
 ```
 
 From a testing standpoint, all three transforms here can be thought of as a single unit. One example
@@ -541,41 +536,40 @@ extracted from the end of the chain (`add_host_metadata`), and one set of VRL
 You could also test a subset of this transform chain. This configuration, for example, would test
 only the first two transforms (`add_env_metadata` and `sanitize`):
 
-```toml
-[[tests]]
-name = "First two transforms"
-
-[[tests.inputs]]
-type = "log"
-# Insert test input into the first transform
-insert_at = "add_env_metadata"
-
-# For comparison, we can use the same input event as above
-[tests.inputs.log_fields]
-message = "image successfully uploaded"
-code = 202
-username = "tonydanza1337"
-email = "tony@whostheboss.com"
-transaction_id = "bcef6a6a-2b72-4a9a-99a0-97ae89d82815"
-
-[[tests.outputs]]
-# Extract test output from the second transform rather than the last
-extract_from = "sanitize"
-
-[[tests.outputs.conditions]]
-type = "vrl"
-source = '''
-assert_eq!(.tags.environment, "production", "incorrect environment tag")
-assert!(!exists(.tags.host), "host tag included")
-assert!(!exists(.username))
-assert!(!exists(.email))
+```yaml
+tests:
+  - name: "First two transforms"
 
-valid_transaction_id = exists(.transaction_id) &&
-  is_string(.transaction_id) &&
-  length!(.transaction_id) == 36
+    inputs:
+      - type: "log"
+        # Insert test input into the first transform
+        insert_at: "add_env_metadata"
 
-assert!(valid_transaction_id, "transaction ID invalid")
-'''
+        # For comparison, we can use the same input event as above
+        log_fields:
+          message: "image successfully uploaded"
+          code: 202
+          username: "tonydanza1337"
+          email: "tony@whostheboss.com"
+          transaction_id: "bcef6a6a-2b72-4a9a-99a0-97ae89d82815"
+
+    outputs:
+      - # Extract test output from the second transform rather than the last
+        extract_from: "sanitize"
+
+        conditions:
+          - type: "vrl"
+            source: |
+              assert_eq!(.tags.environment, "production", "incorrect environment tag")
+              assert!(!exists(.tags.host), "host tag included")
+              assert!(!exists(.username))
+              assert!(!exists(.email))
+
+              valid_transaction_id = exists(.transaction_id) &&
+                is_string(.transaction_id) &&
+                length!(.transaction_id) == 36
+
+              assert!(valid_transaction_id, "transaction ID invalid")
 ```
 
 In the VRL conditions for this two-transform test, notice that the assertion regarding the `host`
diff --git a/website/content/en/docs/setup/going-to-prod/high-availability.md b/website/content/en/docs/setup/going-to-prod/high-availability.md
index 768d40d16ea59..7fa71f52291a2 100644
--- a/website/content/en/docs/setup/going-to-prod/high-availability.md
+++ b/website/content/en/docs/setup/going-to-prod/high-availability.md
@@ -53,23 +53,26 @@ We recommend routing dropped events immediately to a backup destination to prior
 
 The following is an example configuration that routes failed events from a `remap` transform to a `aws_s3` sink:
 
-```toml
-[sources.input]
-    type = "datadog_agent"
-
-[transforms.parsing]
-    inputs = ["input"]
-    type = "remap"
-    reroute_dropped = true
-    source = "..."
-
-[sinks.analysis]
-    inputs = ["parsing"]
-    type = "datadog_logs"
-
-[sinks.backup]
-    inputs = ["**parsing.dropped**"] # dropped events from the `parsing` transform
-    type = "aws_s3"
+```yaml
+sources:
+  input:
+    type: "datadog_agent"
+
+transforms:
+  parsing:
+    inputs: ["input"]
+    type: "remap"
+    reroute_dropped: true
+    source: "..."
+
+sinks:
+  analysis:
+    inputs: ["parsing"]
+    type: "datadog_logs"
+
+  backup:
+    inputs: ["parsing.dropped"] # dropped events from the `parsing` transform
+    type: "aws_s3"
 ```
 
 {{< info >}}
diff --git a/website/content/en/guides/advanced/custom-aggregations-with-lua.md b/website/content/en/guides/advanced/custom-aggregations-with-lua.md
index 262f6b7a2d4c8..4cfc4578b2343 100644
--- a/website/content/en/guides/advanced/custom-aggregations-with-lua.md
+++ b/website/content/en/guides/advanced/custom-aggregations-with-lua.md
@@ -31,12 +31,12 @@ There are three types of hooks: `init`, `process`, and `shutdown`.
 
 The most important of them is `process`, which is called on each incoming events. It can be defined like this:
 
-```toml
-hooks.process = """
-function (event, emit)
-  -- do something
-end
-"""
+```yaml
+hooks:
+  process: |
+    function (event, emit)
+      -- do something
+    end
 ```
 
 It takes a single event and can output one or many of them using the `emit` function provided as the second argument.
@@ -76,54 +76,54 @@ variables.
 
 Using the knowledge from the previous section, it is possible to write down the following transform definition:
 
-```toml title="vector.toml"
-[transforms.aggregator]
-type = "lua"
-version = "2"
-inputs = [] # add IDs of the input components here
-
-hooks.init = """
-  function (emit)
-    count = 0 -- initialize state by setting a global variable
-  end
-"""
-
-hooks.process = """
-  function (event, emit)
-    count = count + 1 -- increment the counter and exit
-  end
-"""
-
-timers = [{interval_seconds = 5, handler = """
-  function (emit)
-    emit {
-      metric = {
-        name = "event_counter",
-        kind = "incremental",
-        timestamp = os.date("!*t"),
-        counter = {
-          value = counter
-        }
-      }
-    }
-    counter = 0
-  end
-"""}]
-
-hooks.shutdown = """
-  function (emit)
-    emit {
-      metric = {
-        name = "event_counter",
-        kind = "incremental",
-        timestamp = os.date("!*t"),
-        counter = {
-          value = counter
-        }
-      }
-    }
-  end
-"""
+```yaml title="vector.yaml"
+transforms:
+  aggregator:
+    type: "lua"
+    version: "2"
+    inputs: [] # add IDs of the input components here
+
+    hooks:
+      init: |
+        function (emit)
+          count = 0 -- initialize state by setting a global variable
+        end
+
+      process: |
+        function (event, emit)
+          count = count + 1 -- increment the counter and exit
+        end
+
+      shutdown: |
+        function (emit)
+          emit {
+            metric = {
+              name = "event_counter",
+              kind = "incremental",
+              timestamp = os.date("!*t"),
+              counter = {
+                value = counter
+              }
+            }
+          }
+        end
+
+    timers:
+      - interval_seconds: 5
+        handler: |
+          function (emit)
+            emit {
+              metric = {
+                name = "event_counter",
+                kind = "incremental",
+                timestamp = os.date("!*t"),
+                counter = {
+                  value = counter
+                }
+              }
+            }
+            counter = 0
+          end
 ```
 
 One could plug it into a [pipeline][docs.about.concepts#pipelines] and it would work!
@@ -137,8 +137,8 @@ identical. It is possible make the config more [DRY][urls.dry_code] by extractin
 a dedicated function. Such a function can be placed into the [source][docs.transforms.lua#source]
 section of the config:
 
-```toml
-source = """
+```yaml
+source: |
   function make_counter(value)
     return metric = {
       name = "event_counter",
@@ -149,28 +149,28 @@ source = """
       }
     }
   end
-"""
 ```
 
 and then adjusting the timer handler
 
-```toml
-timers = [{interval_seconds = 5, handler = """
-  function (emit)
-    emit(make_counter(counter))
-    counter = 0
-  end
-"""}]
+```yaml
+timers:
+  - interval_seconds: 5
+    handler: |
+      function (emit)
+        emit(make_counter(counter))
+        counter = 0
+      end
 ```
 
 and the `shutdown` hook:
 
-```toml
-hooks.shutdown = """
-  function (emit)
-    emit(make_counter(counter))
-  end
-"""
+```yaml
+hooks:
+  shutdown: |
+    function (emit)
+      emit(make_counter(counter))
+    end
 ```
 
 ## Keep All Code Together
@@ -178,45 +178,48 @@ hooks.shutdown = """
 The new config looks tidier, but in order to make it more readable, it is also possible to gather implementations of
 all functions into the `source` section, resulting in the following component declaration:
 
-```toml title="vector.toml"
-[transforms.aggregator]
-type = "lua"
-version = "2"
-inputs = [] # add IDs of the input components here
-hooks.init = "init"
-hooks.process = "process"
-hooks.shutdown = "shutdown"
-timers = [{interval_seconds = 5, handler = "timer_handler"}]
-
-source = """
-  function init()
-    count = 0
-  end
-
-  function process()
-    count = count + 1
-  end
-
-  function timer_handler(emit)
-    emit(make_counter(counter))
-    counter = 0
-  end
-
-  function shutdown(emit)
-    emit(make_counter(counter))
-  end
-
-  function make_counter(value)
-    return metric = {
-      name = "event_counter",
-      kind = "incremental",
-      timestamp = os.date("!*t"),
-      counter = {
-        value = value
-      }
-    }
-  end
-"""
+```yaml title="vector.yaml"
+transforms:
+  aggregator:
+    type: "lua"
+    version: "2"
+    inputs: [] # add IDs of the input components here
+    hooks:
+      init: "init"
+      process: "process"
+      shutdown: "shutdown"
+    timers:
+      - interval_seconds: 5
+        handler: "timer_handler"
+
+    source: |
+      function init()
+        count = 0
+      end
+
+      function process()
+        count = count + 1
+      end
+
+      function timer_handler(emit)
+        emit(make_counter(counter))
+        counter = 0
+      end
+
+      function shutdown(emit)
+        emit(make_counter(counter))
+      end
+
+      function make_counter(value)
+        return metric = {
+          name = "event_counter",
+          kind = "incremental",
+          timestamp = os.date("!*t"),
+          counter = {
+            value = value
+          }
+        }
+      end
 ```
 
 ## A Loadable Module
@@ -262,16 +265,20 @@ end
 
 and
 
-```toml title="vector.toml"
-[transforms.aggregator]
-type = "lua"
-version = "2"
-inputs = [] # add IDs of the input components here
-hooks.init = "init"
-hooks.process = "process"
-hooks.shutdown = "shutdown"
-timers = [{interval_seconds = 5, handler = "timer_handler"}]
-source = "require('aggregator')"
+```yaml title="vector.yaml"
+transforms:
+  aggregator:
+    type: "lua"
+    version: "2"
+    inputs: [] # add IDs of the input components here
+    hooks:
+      init: "init"
+      process: "process"
+      shutdown: "shutdown"
+    timers:
+      - interval_seconds: 5
+        handler: "timer_handler"
+    source: "require('aggregator')"
 ```
 
 There are also [other possibilities][urls.lua_modules_tutorial] to define Lua modules which do not require to use
diff --git a/website/content/en/guides/advanced/merge-multiline-logs-with-lua.md b/website/content/en/guides/advanced/merge-multiline-logs-with-lua.md
index c90fa50527457..45dd47ea4c7ff 100644
--- a/website/content/en/guides/advanced/merge-multiline-logs-with-lua.md
+++ b/website/content/en/guides/advanced/merge-multiline-logs-with-lua.md
@@ -43,44 +43,44 @@ in the [guide on parsing CSV logs][guides.parsing-csv-logs-with-lua]. The underl
 
 Such an algorithm can be implemented, for example, with the following transform config:
 
-```toml title="vector.toml"
-[transforms.lua]
-  inputs = []
-  type = "lua"
-  version = "2"
-  source = """
-    csv = require("csv") -- load the `lua-csv` module
-    expected_columns = 23 -- expected number of columns in incoming CSV lines
-    line_separator = "\\r\\n" -- note the double escaping required by the TOML format
-  """
-  hooks.process = """
-    function (event, emit)
-      merged_event = merge(event)
-      if merged_event == nil then -- a global variable containing the merged event
-        merged_event = event -- if it is empty, set it to the current event
-      else -- otherwise, concatenate the line in the stored merged event
-           -- with the next line
-        merged_event.log.message = merged_event.log.message ..
-                                  line_separator .. event.log.message
-      end
-
-      fields = csv.openstring(event.log.message):lines()() -- parse CSV
-      if #fields < expected_columns then
-        return -- not all fields are present in the merged event yet
-      end
-
-      -- do something with the array of the parsed fields
-      merged_event.log.csv_fields = fields -- for example, just store them in an
-                                           -- array field
-
-      emit(merged_event) -- emit the resulting event
-      merged_event = nil -- clear the merged event
-    end
-  """
+```yaml title="vector.yaml"
+transforms:
+  lua:
+    inputs: []
+    type: "lua"
+    version: "2"
+    source: |
+      csv = require("csv") -- load the `lua-csv` module
+      expected_columns = 23 -- expected number of columns in incoming CSV lines
+      line_separator = "\r\n"
+    hooks:
+      process: |
+        function (event, emit)
+          merged_event = merge(event)
+          if merged_event == nil then -- a global variable containing the merged event
+            merged_event = event -- if it is empty, set it to the current event
+          else -- otherwise, concatenate the line in the stored merged event
+               -- with the next line
+            merged_event.log.message = merged_event.log.message ..
+                                      line_separator .. event.log.message
+          end
+
+          fields = csv.openstring(event.log.message):lines()() -- parse CSV
+          if #fields < expected_columns then
+            return -- not all fields are present in the merged event yet
+          end
+
+          -- do something with the array of the parsed fields
+          merged_event.log.csv_fields = fields -- for example, just store them in an
+                                               -- array field
+
+          emit(merged_event) -- emit the resulting event
+          merged_event = nil -- clear the merged event
+        end
 ```
 
-In this code sample, the `source` option defines code that's executed when the transform is created.
-while the `hooks.process` option defines a function that's called for each incoming event.
+In this code sample, the `source` option defines code that is executed when the transform is created,
+while the `hooks.process` option defines a function that is called for each incoming event.
 
 ## How It Works
 
diff --git a/website/content/en/guides/advanced/parsing-csv-logs-with-lua.md b/website/content/en/guides/advanced/parsing-csv-logs-with-lua.md
index 00123d1ace5d0..634b04f7e3006 100644
--- a/website/content/en/guides/advanced/parsing-csv-logs-with-lua.md
+++ b/website/content/en/guides/advanced/parsing-csv-logs-with-lua.md
@@ -36,36 +36,40 @@ log file:
 
 Let us draft an initial version of the Vector's configuration file:
 
-```toml title="vector.toml"
-data_dir = "."
-
-[sources.file]
-  type = "file"
-  include = ["*.csv"]
-  ignore_checkpoints = true
-
-[transforms.lua]
-  inputs = ["file"]
-  type = "lua"
-  version = "2"
-  hooks.process = """
-    function (event, emit)
-      -- to be expanded
-      emit(event)
-    end
-  """
-
-[sinks.console]
-  inputs = ["lua"]
-  type = "console"
-  encoding.codec = "json"
+```yaml title="vector.yaml"
+data_dir: "."
+
+sources:
+  file:
+    type: "file"
+    include: ["*.csv"]
+    ignore_checkpoints: true
+
+transforms:
+  lua:
+    inputs: ["file"]
+    type: "lua"
+    version: "2"
+    hooks:
+      process: |
+        function (event, emit)
+          -- to be expanded
+          emit(event)
+        end
+
+sinks:
+  console:
+    inputs: ["lua"]
+    type: "console"
+    encoding:
+      codec: "json"
 ```
 
 This config sets up a [pipeline][docs.meta.glossary#pipeline] that reads log files, pipes them through the parsing
 transform (which currently is configured to just pass the events through), and displays the produced log events using
 [`console`][docs.sinks.console] sink.
 
-At this point, running `vector --config vector.toml` results in the following output:
+At this point, running `vector --config vector.yaml` results in the following output:
 
 ```json
 {"file":"log.csv","host":"localhost","message":"2020-04-09 12:48:49.661 UTC,,,1,,localhost.1,1,,2020-04-09 12:48:49 UTC,,0,LOG,00000,\"ending log output to stderr\",,\"Future log output will go to log destination \"\"csvlog\"\".\",,,,,,,\"\"","timestamp":"2020-04-09T14:33:28Z"}
@@ -77,7 +81,7 @@ At this point, running `vector --config vector.toml` results in the following ou
 
 In order to perform actual parsing, it is possible to leverage [`lua-csv`][urls.lua_csv_repo].
 Because it consists of a [single file][urls.lua_csv_view], it is possible to just download it to the same
-directory where `vector.toml` is stored:
+directory where `vector.yaml` is stored:
 
 ```bash
 curl -o csv.lua https://raw.githubusercontent.com/geoffleyland/lua-csv/d20cd42d61dc52e7f6bcb13b596ac7a7d4282fbf/lua/csv.lua
@@ -86,10 +90,9 @@ curl -o csv.lua https://raw.githubusercontent.com/geoffleyland/lua-csv/d20cd42d6
 Then it would be possible to load it by calling [`require`][urls.lua_require] Lua function in the
 [`source`][docs.transforms.lua#source] configuration section:
 
-```toml
-source = """
+```yaml
+source: |
   csv = require("csv")
-"""
 ```
 
 With this `source` the `csv` module is loaded when Vector is started up (or if the `lua` transform is added later and the
@@ -99,85 +102,85 @@ config is automatically reloaded) and can be used through the global variable `c
 
 With the `csv` module, the [`hooks.process`][docs.transforms.lua#process] can be changed to the following:
 
-```toml
-hooks.process = """
-  function (event, emit)
-    fields = csv.openstring(event.log.message):lines()() -- parse the `message` field
-    event.log.message = nil -- drop the `message` field
+```yaml
+hooks:
+  process: |
+    function (event, emit)
+      fields = csv.openstring(event.log.message):lines()() -- parse the `message` field
+      event.log.message = nil -- drop the `message` field
 
-    column_names = {  -- a sequence containing CSV column names
-      -- ...
-    }
+      column_names = {  -- a sequence containing CSV column names
+        -- ...
+      }
 
-    for column, value in ipairs(fields) do -- iterate over CSV columns
-      column_name = column_names[column] -- get column name
-      event.log[column_name] = value -- set the corresponding field in the event
-    end
+      for column, value in ipairs(fields) do -- iterate over CSV columns
+        column_name = column_names[column] -- get column name
+        event.log[column_name] = value -- set the corresponding field in the event
+      end
 
-    emit(event) -- emit the transformed event
-  end
-"""
+      emit(event) -- emit the transformed event
+    end
 ```
 
 Note that the `column_names` can be created just once, in the `source` section instead to speed up processing.
 Putting it there and using the column names from the PostgreSQL documentation results in the following definition of
 the whole transform:
 
-```toml title="vector.toml"
+```yaml title="vector.yaml"
+# ...
+transforms:
+  lua:
+    inputs: ["file"]
+    type: "lua"
+    version: "2"
+    source: |
+      csv = require("csv") -- load external module for parsing CSV
+      column_names = {  -- a sequence containing CSV column names
+        "log_time",
+        "user_name",
+        "database_name",
+        "process_id",
+        "connection_from",
+        "session_id",
+        "session_line_num",
+        "command_tag",
+        "session_start_time",
+        "virtual_transaction_id",
+        "transaction_id",
+        "error_severity",
+        "sql_state_code",
+        "message",
+        "detail",
+        "hint",
+        "internal_query",
+        "internal_query_pos",
+        "context",
+        "query",
+        "query_pos",
+        "location",
+        "application_name",
+        -- available only in postgres > 13, to remove for postgres <= 13
+        "backend_type",
+        "leader_pid",
+        "query_id"
+      }
+    hooks:
+      process: |
+        function (event, emit)
+          fields = csv.openstring(event.log.message):lines()() -- parse the `message` field
+          event.log.message = nil -- drop the `message` field
+
+          for column, column_name in ipairs(column_names) do -- iterate over column names
+            value = fields[column] -- get field value
+            event.log[column_name] = value -- set the corresponding field in the event
+          end
+
+          emit(event) -- emit the transformed event
+        end
 # ...
-[transforms.lua]
-  inputs = ["file"]
-  type = "lua"
-  version = "2"
-  source = """
-    csv = require("csv") -- load external module for parsing CSV
-    column_names = {  -- a sequence containing CSV column names
-      "log_time",
-      "user_name",
-      "database_name",
-      "process_id",
-      "connection_from",
-      "session_id",
-      "session_line_num",
-      "command_tag",
-      "session_start_time",
-      "virtual_transaction_id",
-      "transaction_id",
-      "error_severity",
-      "sql_state_code",
-      "message",
-      "detail",
-      "hint",
-      "internal_query",
-      "internal_query_pos",
-      "context",
-      "query",
-      "query_pos",
-      "location",
-      "application_name",
-      -- available only in postgres > 13, to remove for postgres <= 13
-      "backend_type",
-      "leader_pid",
-      "query_id"
-    }
-  """
-  hooks.process = """
-    function (event, emit)
-      fields = csv.openstring(event.log.message):lines()() -- parse the `message` field
-      event.log.message = nil -- drop the `message` field
-
-      for column, column_name in ipairs(column_names) do -- iterate over column names
-        value = fields[column] -- get field value
-        event.log[column_name] = value -- set the corresponding field in the event
-      end
-
-      emit(event) -- emit the transformed event
-    end
-    """
-#...
 ```
 
-Trying to run `vector --config vector.toml` with the same input file results in structured events being output:
+Trying to run `vector --config vector.yaml` with the same input file results in structured events being output:
 
 ```json
 {"application_name":"","backend_type":"not initialized","command_tag":"","connection_from":"","context":"","database_name":"","detail":"","error_severity":"LOG","file":"log.csv","hint":"Future log output will go to log destination \"csvlog\".","host":"localhost","internal_query":"","internal_query_pos":"","leader_pid":"","location":"","log_time":"2020-04-09 12:48:49.661 UTC","message":"ending log output to stderr","process_id":"1","query":"","query_id":"0","query_pos":"","session_id":"localhost.1","session_line_num":"1","session_start_time":"2020-04-09 12:48:49 UTC","sql_state_code":"00000","timestamp":"2020-04-09T19:49:07Z","transaction_id":"0","user_name":"","virtual_transaction_id":""}
diff --git a/website/content/en/guides/aws/cloudwatch-logs-firehose.md b/website/content/en/guides/aws/cloudwatch-logs-firehose.md
index 02c4e48b40146..0760a1e2d70e8 100644
--- a/website/content/en/guides/aws/cloudwatch-logs-firehose.md
+++ b/website/content/en/guides/aws/cloudwatch-logs-firehose.md
@@ -79,33 +79,36 @@ export FIREHOSE_S3_BUCKET="firehose-${AWS_ACCOUNT_ID}" # a bucket to write event
 
 Let's take a look at the configuration we will be using:
 
-```toml title="vector.toml"
-[sources.firehose]
-  type = "aws_kinesis_firehose"
-  address = "0.0.0.0:8080" # the public URL will be set when configuring Firehose
-  access_key = "${FIREHOSE_ACCESS_KEY} # this will also be set when configuring Firehose
-
-[transforms.parse]
-  type = "remap"
-  inputs = ["firehose"]
-  drop_on_error = false
-  source = '''
-    parsed = parse_aws_cloudwatch_log_subscription_message!(.message)
-    . = unnest(parsed.log_events)
-    . = map_values(.) -> |value| {
-       event = del(value.log_events)
-       value |= event
-       message = del(.message)
-       . |= object!(parse_json!(message))
-    }
-  '''
+```yaml title="vector.yaml"
+sources:
+  firehose:
+    type: "aws_kinesis_firehose"
+    address: "0.0.0.0:8080" # the public URL will be set when configuring Firehose
+    access_key: "${FIREHOSE_ACCESS_KEY}" # this will also be set when configuring Firehose
+
+transforms:
+  parse:
+    type: "remap"
+    inputs: ["firehose"]
+    drop_on_error: false
+    source: |
+      parsed = parse_aws_cloudwatch_log_subscription_message!(.message)
+      . = unnest(parsed.log_events)
+      . = map_values(.) -> |value| {
+         event = del(value.log_events)
+         value |= event
+         message = del(.message)
+         . |= object!(parse_json!(message))
+      }
 
 # you may want to add more transforms here
 
-[sinks.console]
-  type = "console"
-  inputs = ["parse"]
-  encoding.codec = "json"
+sinks:
+  console:
+    type: "console"
+    inputs: ["parse"]
+    encoding:
+      codec: "json"
 ```
 
 This will configure `vector` to listen for Firehose messages on the configured
@@ -352,16 +355,19 @@ delivery stream.
 To make sure everything is wired up correctly, let's send some logs to the log
 group we've setup. We can use Vector for this too!
 
-```bash
-[sources.stdin]
-  type = "stdin"
-[sinks.cloudwatch]
-  type = "aws_cloudwatch_logs"
-  inputs = ["stdin"]
-  group_name = "${LOG_GROUP}"
-  stream_name = "test"
-  region = "us-east-1"
-  encoding.codec = "json"
+```yaml
+sources:
+  stdin:
+    type: "stdin"
+sinks:
+  cloudwatch:
+    type: "aws_cloudwatch_logs"
+    inputs: ["stdin"]
+    group_name: "${LOG_GROUP}"
+    stream_name: "test"
+    region: "us-east-1"
+    encoding:
+      codec: "json"
 ```
 
 This will read lines from `stdin` and write them to CloudWatch Logs. See the
@@ -377,7 +383,7 @@ Let's send some logs. For this, I'm using
 log data.
 
 ```bash
-flog -f json | vector --config config.toml
+flog -f json | vector --config config.yaml
 ```
 
 This will send some logs to your log group. Within 300 seconds (the default
@@ -450,11 +456,12 @@ send it as an HTTP request:
 
 The [`aws_kinesis_firehose`][aws_kinesis_firehose] source:
 
-```toml
-[sources.firehose]
-  type = "aws_kinesis_firehose"
-  address = "0.0.0.0:8080" # the public URL will be set in the Firehose config
-  access_key = "my secret key" # this will also be set in the Firehose config
+```yaml
+sources:
+  firehose:
+    type: "aws_kinesis_firehose"
+    address: "0.0.0.0:8080" # the public URL will be set in the Firehose config
+    access_key: "my secret key" # this will also be set in the Firehose config
 ```
 
 will accept this request, decode the record (which is gzip'ed and then base64 encoded), to produce an event that looks like:
@@ -479,21 +486,21 @@ can use a [`remap`][remap] transform and leverage the [`parse_aws_cloudwatch_log
 [`unnest`][unnest], [`map_values`][map_values], and [`parse_json`][parse_json]
 functions:
 
-```toml
-[transforms.parse]
-  type = "remap"
-  inputs = ["firehose"]
-  drop_on_error = false
-  source = '''
-    parsed = parse_aws_cloudwatch_log_subscription_message!(.message)
-    . = unnest(parsed.log_events)
-    . = map_values(.) -> |value| {
-       event = del(value.log_events)
-       value |= event
-       message = del(.message)
-       . |= object!(parse_json!(message))
-    }
-  '''
+```yaml
+transforms:
+  parse:
+    type: "remap"
+    inputs: ["firehose"]
+    drop_on_error: false
+    source: |
+      parsed = parse_aws_cloudwatch_log_subscription_message!(.message)
+      . = unnest(parsed.log_events)
+      . = map_values(.) -> |value| {
+         event = del(value.log_events)
+         value |= event
+         message = del(.message)
+         . |= object!(parse_json!(message))
+      }
 ```
 
 Let's step through this program one function at a time.
diff --git a/website/content/en/guides/level-up/managing-complex-configs.md b/website/content/en/guides/level-up/managing-complex-configs.md
index 5f55a70be97ae..88c7a58a93923 100644
--- a/website/content/en/guides/level-up/managing-complex-configs.md
+++ b/website/content/en/guides/level-up/managing-complex-configs.md
@@ -40,28 +40,32 @@ For example, if we wished to create a chain of three transforms; `remap`, `filte
 and `reduce`, we can run:
 
 ```bash
-vector generate /remap,filter,reduce > vector.toml
+vector generate /remap,filter,reduce > vector.yaml
 # Find out more with `vector generate --help`
 ```
 
 And most of the boilerplate will be written for us, with each component printed
 with an `inputs` field that specifies the component before it:
 
-```toml title="vector.toml"
-[transforms.transform0]
-  inputs = [ "somewhere" ]
-  type = "remap"
-  # etc ...
-
-[transforms.transform1]
-  inputs = [ "transform0" ]
-  type = "filter"
-  # etc ...
-
-[transforms.transform2]
-  inputs = [ "transform1" ]
-  type = "reduce"
-  # etc ...
+```yaml title="vector.yaml"
+transforms:
+  transform0:
+    inputs:
+      - "somewhere"
+    type: "remap"
+    # etc ...
+
+  transform1:
+    inputs:
+      - "transform0"
+    type: "filter"
+    # etc ...
+
+  transform2:
+    inputs:
+      - "transform1"
+    type: "reduce"
+    # etc ...
 ```
 
 The IDs of the generated components are sequential (`transform0`,
@@ -79,18 +83,20 @@ Let's imagine we are in the process of building the config from the [unit test
 guide][guides.unit-testing], we might start off with our source and
 the grok parser:
 
-```toml title="vector.toml"
-[sources.over_tcp]
-  type = "socket"
-  mode = "tcp"
-  address = "0.0.0.0:9000"
-
-[transforms.foo]
-  inputs = ["over_tcp"]
-  type = "remap"
-  source = '''
-  . = parse_grok!(.message, s'%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}')
-'''
+```yaml title="vector.yaml"
+sources:
+  over_tcp:
+    type: "socket"
+    mode: "tcp"
+    address: "0.0.0.0:9000"
+
+transforms:
+  foo:
+    inputs:
+      - "over_tcp"
+    type: "remap"
+    source: |
+      . = parse_grok!(.message, s'%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}')
 ```
 
 A common way to test this transform might be to temporarily change the source
@@ -101,30 +107,28 @@ our config to run tests rather than focusing on features.
 Instead, we can leave our source as a `socket` type and add a unit test to the
 end of our config:
 
-```toml title="vector.toml"
-[[tests]]
-  name = "check_simple_log"
-
-  [[tests.inputs]]
-    insert_at = "foo"
-    type = "raw"
-    value = "2019-11-28T12:00:00+00:00 info Sorry, I'm busy this week Cecil"
-
-  [[tests.outputs]]
-    extract_from = "foo"
+```yaml title="vector.yaml"
+tests:
+  - name: "check_simple_log"
+    inputs:
+      - insert_at: "foo"
+        type: "raw"
+        value: "2019-11-28T12:00:00+00:00 info Sorry, I'm busy this week Cecil"
+    outputs:
+      - extract_from: "foo"
 ```
 
 When we add a unit test output without any conditions it will simply print the
 input and output events of a transform, allowing us to inspect its behavior:
 
 ```sh
-$ vector test ./vector.toml
-Running vector.toml tests
-test vector.toml: check_simple_log ... passed
+$ vector test ./vector.yaml
+Running vector.yaml tests
+test vector.yaml: check_simple_log ... passed
 
 inspections:
 
---- vector.toml ---
+--- vector.yaml ---
 
 test 'check_simple_log':
 
@@ -137,28 +141,23 @@ As we introduce new transforms to our config we can change the test output
 to check the latest transform. Or, occasionally, we can add conditions to an
 output in order to turn it into a regression test:
 
-```toml title="vector.toml"
-[[tests]]
-  name = "check_simple_log"
-
-  [[tests.inputs]]
-    insert_at = "foo"
-    type = "raw"
-    value = "2019-11-28T12:00:00+00:00 info Sorry, I'm busy this week Cecil"
-
-  # This is now a regression test
-  [[tests.outputs]]
-    extract_from = "foo"
-    [[tests.outputs.conditions]]
-      type = "vrl"
-      source = """
-        assert_eq!(.message, "Sorry, I'm busy this week Cecil")
-      """
-
-  # And we add a new output without conditions for inspecting
-  # a new transform
-  [[tests.outputs]]
-    extract_from = "bar"
+```yaml title="vector.yaml"
+tests:
+  - name: "check_simple_log"
+    inputs:
+      - insert_at: "foo"
+        type: "raw"
+        value: "2019-11-28T12:00:00+00:00 info Sorry, I'm busy this week Cecil"
+    outputs:
+      # This is now a regression test
+      - extract_from: "foo"
+        conditions:
+          - type: "vrl"
+            source: |
+              assert_eq!(.message, "Sorry, I'm busy this week Cecil")
+      # And we add a new output without conditions for inspecting
+      # a new transform
+      - extract_from: "bar"
 ```
 
 How many tests you add is at your discretion, but you probably don't need to
@@ -175,10 +174,10 @@ With Vector you can split a config down into as many files as you like and run
 them all as a larger topology:
 
 ```bash
-# These three examples run the same two configs together:
-vector -c ./configs/foo.toml -c ./configs/bar.toml
-vector -c ./configs/*.toml
-vector -c ./configs/foo.toml ./configs/bar.toml
+# These three examples run the same two configs together:
+vector -c ./configs/foo.yaml -c ./configs/bar.yaml
+vector -c ./configs/*.yaml
+vector -c ./configs/foo.yaml ./configs/bar.yaml
 ```
 
 If you have a large chain of components it's a good idea to break them out into
@@ -193,52 +192,58 @@ With Vector you can define a component configuration inside a component type fol
 
 Let's take an example with the following configuration file:
 
-```toml title="vector.toml"
-[sources.syslog]
-type = "syslog"
-address = "0.0.0.0:514"
-max_length = 42000
-mode = "tcp"
-
-[transforms.change_fields]
-type = "remap"
-inputs = ["syslog"]
-source = """
-.new_field = "some value"
-"""
-
-[sinks.stdout]
-type = "console"
-inputs = ["change_fields"]
-target = "stdout"
-encoding.codec = "json"
+```yaml title="vector.yaml"
+sources:
+  syslog:
+    type: "syslog"
+    address: "0.0.0.0:514"
+    max_length: 42000
+    mode: "tcp"
+
+transforms:
+  change_fields:
+    type: "remap"
+    inputs:
+      - "syslog"
+    source: |
+      .new_field = "some value"
+
+sinks:
+  stdout:
+    type: "console"
+    inputs:
+      - "change_fields"
+    target: "stdout"
+    encoding:
+      codec: "json"
 ```
 
-We can extract the `syslog` source in the file `/etc/vector/sources/syslog.toml`
+We can extract the `syslog` source in the file `/etc/vector/sources/syslog.yaml`
 
-```toml title="syslog.toml"
-type = "syslog"
-address = "0.0.0.0:514"
-max_length = 42000
-mode = "tcp"
+```yaml title="syslog.yaml"
+type: "syslog"
+address: "0.0.0.0:514"
+max_length: 42000
+mode: "tcp"
 ```
 
-The `change_fields` transform in the file `/etc/vector/transforms/change_fields.toml`
+The `change_fields` transform in the file `/etc/vector/transforms/change_fields.yaml`
 
-```toml title="change_fields.toml"
-type = "remap"
-inputs = ["syslog"]
-source = """
-.new_field = "some value"
-"""
+```yaml title="change_fields.yaml"
+type: "remap"
+inputs:
+  - "syslog"
+source: |
+  .new_field = "some value"
 ```
 
-And the `stdout` sink in the file `/etc/vector/sinks/stdout.toml`
+And the `stdout` sink in the file `/etc/vector/sinks/stdout.yaml`
 
-```toml title="stdout.toml"
-type = "console"
-inputs = ["change_fields"]
-target = "stdout"
+```yaml title="stdout.yaml"
+type: "console"
+inputs:
+  - "change_fields"
+target: "stdout"
 ```
 
 And for Vector to look for the configuration in the component type related folders,
diff --git a/website/content/en/guides/level-up/managing-schemas.md b/website/content/en/guides/level-up/managing-schemas.md
index ab48bee63f6e8..168e330c8312d 100644
--- a/website/content/en/guides/level-up/managing-schemas.md
+++ b/website/content/en/guides/level-up/managing-schemas.md
@@ -41,13 +41,13 @@ By default, Vector primarily operates on three fields: `host`, `message`, and `t
 
 Vector sets these fields on logs as it ingests data (from a [source][docs.sources]). It may be that your data does not
 follow this convention. In this case you can modify the global defaults for all incoming data in the `log_schema`
-section of your `vector.toml`.
+section of your `vector.yaml`.
 
-```toml title="vector.toml"
-[log_schema]
-host_key = "instance" # default "host"
-message_key = "info" # default "message"
-timestamp_key = "datetime" # default "timestamp"
+```yaml title="vector.yaml"
+log_schema:
+  host_key: "instance" # default "host"
+  message_key: "info" # default "message"
+  timestamp_key: "datetime" # default "timestamp"
 
 # Sources, transforms, and sinks...
 ```
@@ -65,15 +65,16 @@ and you'll likely need to configure this at a more fine-grained level.
 Some services will produce logs with the timestamp field mapped to `@timestamp` or some other value.
 
 If your vector pipeline is only working with data passing through these systems, you can add the following to your
-`vector.toml`:
+`vector.yaml`:
 
-```toml title="vector.toml"
-[log_schema]
-  timestamp_key = "@timestamp"  # Applies to all sources, sinks, and transforms!
+```yaml title="vector.yaml"
+log_schema:
+  timestamp_key: "@timestamp" # Applies to all sources, sinks, and transforms!
 
-[sources.my_naming_confused_source]
-  type = "logplex"
-  address = "0.0.0.0:8088"
+sources:
+  my_naming_confused_source:
+    type: "logplex"
+    address: "0.0.0.0:8088"
 ```
 
 
@@ -91,24 +92,24 @@ Commonly you'll want to do this near either the source or sink of your pipeline.
 
 A transform of this type looks like this:
 
-```toml title="vector.toml"
-[transforms.strip_personal_details]
-type = "remap"
-inputs = ["my-source-id"]
-source = '''
-  del(.email, .passport_number)
-'''
+```yaml title="vector.yaml"
+transforms:
+  strip_personal_details:
+    type: "remap"
+    inputs: ["my-source-id"]
+    source: |
+      del(.email, .passport_number)
 ```
 
 The `remap` transform has a wealth of mapping functions, and in cases where we wish to flip this concept and drop all fields except for a list of exceptions we can do that with the `only_fields` function:
 
-```toml title="vector.toml"
-[transforms.strip_personal_details]
-type = "remap"
-inputs = ["my-source-id"]
-source = '''
-  only_fields(.timestamp, .message, .host, .user_id)
-'''
+```yaml title="vector.yaml"
+transforms:
+  strip_personal_details:
+    type: "remap"
+    inputs: ["my-source-id"]
+    source: |
+      only_fields(.timestamp, .message, .host, .user_id)
 ```
 
 ### Example: Filtering data for GDPR compliance
@@ -127,51 +128,54 @@ config, just a little example!)
 
 We can build a config that will do the first part of this, but we'll just output to console for ease of this example.
 
-```toml title="vector.toml"
-data_dir = "./data"
-dns_servers = []
-
-[sources.application]
-max_length = 102400
-type = "stdin"
-
-[transforms.parse]
-inputs = ["application"]
-type = "remap"
-source = '''
-. = parse_json!(.message)
-'''
-
-[transforms.not_gdpr]
-type = "filter"
-inputs = ["parse"]
-condition = ".gdpr == false"
-
-[transforms.gdpr_to_strip]
-type = "filter"
-inputs = ["parse"]
-condition = ".gdpr == true"
-
-[transforms.gdpr_stripped]
-type = "remap"
-inputs = ["gdpr_to_strip"]
-source = "del(.email)"
-
-[sinks.console]
-healthcheck = true
-inputs = ["not_gdpr", "gdpr_stripped"]
-type = "console"
-encoding.codec = "json"
-[sinks.console.buffer]
-type = "memory"
-max_events = 500
-when_full = "block"
+```yaml title="vector.yaml"
+data_dir: "./data"
+dns_servers: []
+
+sources:
+  application:
+    max_length: 102400
+    type: "stdin"
+
+transforms:
+  parse:
+    inputs: ["application"]
+    type: "remap"
+    source: |
+      . = parse_json!(.message)
+
+  not_gdpr:
+    type: "filter"
+    inputs: ["parse"]
+    condition: ".gdpr == false"
+
+  gdpr_to_strip:
+    type: "filter"
+    inputs: ["parse"]
+    condition: ".gdpr == true"
+
+  gdpr_stripped:
+    type: "remap"
+    inputs: ["gdpr_to_strip"]
+    source: "del(.email)"
+
+sinks:
+  console:
+    healthcheck: true
+    inputs: ["not_gdpr", "gdpr_stripped"]
+    type: "console"
+    encoding:
+      codec: "json"
+    buffer:
+      type: "memory"
+      max_events: 500
+      when_full: "block"
 ```
 
 Let's have a look:
 
 ```bash
-$ cat <<-EOF | cargo run -- --config test.toml
+$ cat <<-EOF | cargo run -- --config test.yaml
 { "id": "user1", "gdpr": false, "email": "us-user1@datadoghq.com" }
 { "id": "user2", "gdpr": false, "email": "us-user2@datadoghq.com" }
 { "id": "user3", "gdpr": true, "email": "eu-user3@datadoghq.com" }
@@ -202,15 +206,17 @@ The applications for this include some of the reasons discussed in
 
 Lets take a look at what that might look like:
 
-```toml title="vector.toml"
-[sinks.output]
-  inputs = ["demo_logs"]
-  type = "kafka"
-
-  # Put events in the host specific topic.
-  topic = "{{service}}"
-  encoding.except_fields = ["service"] # Remove this field now and save some bytes
-  # ...
+```yaml title="vector.yaml"
+sinks:
+  output:
+    inputs: ["demo_logs"]
+    type: "kafka"
+
+    # Put events in the host specific topic.
+    topic: "{{service}}"
+    encoding:
+      except_fields: ["service"] # Remove this field now and save some bytes
+    # ...
 ```
 
 {{< warning >}}
@@ -222,14 +228,14 @@ a field which you want templatable open an issue and let us know.
 
 It's fairly common for one part of your pipeline to expect a field to be named differently than another part! The `remap` transform can also be used to slide data around for you.
 
-```toml title="vector.toml"
-[transforms.rename_timestamp]
-  type = "remap"
-  inputs = ["source0"]
-  source = '''
-    ."@timestamp" = .timestamp
-    del(.timestamp)
-  '''
+```yaml title="vector.yaml"
+transforms:
+  rename_timestamp:
+    type: "remap"
+    inputs: ["source0"]
+    source: |
+      ."@timestamp" = .timestamp
+      del(.timestamp)
 ```
 
 Other times you might need to concatenate fields together, or perform arithmetic on their numerical values, the [`remap`][docs.transforms.remap] transform can be used to do all of these things.
@@ -246,14 +252,14 @@ It's useful for when:
 Let's pretend one of your teammates falsely assumed folks always have first and last names, so we have a `first_name`
 and a `last_name` field coming from a source, and we'd like to output a `name` field to a sink.
 
-```toml title="vector.toml"
-[transforms.moosh_names]
-  type = "remap"
-  inputs = ["source0"]
-  source = '''
-    .name = .first_name + " " + .last_name
-    del(.first_name, .last_name)
-  '''
+```yaml title="vector.yaml"
+transforms:
+  moosh_names:
+    type: "remap"
+    inputs: ["source0"]
+    source: |
+      .name = .first_name + " " + .last_name
+      del(.first_name, .last_name)
 ```
 
 ## Coercing Data Types
@@ -263,14 +269,14 @@ should be a number, or vice versa.
 
 Gadzooks! The [`remap`][docs.transforms.remap] transform is also the correct tool for this job!
 
-```toml title="vector.toml"
-[transforms.correct_source_types]
-  type = "remap"
-  inputs = ["source0"]
-  source = '''
-    .count = int(.count)
-    .date = timestamp(.date, "%F")
-  '''
+```yaml title="vector.yaml"
+transforms:
+  correct_source_types:
+    type: "remap"
+    inputs: ["source0"]
+    source: |
+      .count = int(.count)
+      .date = timestamp(.date, "%F")
 ```
 
 Remember that you can follow the coercion mappings with `del` or `only_fields` functions, empowering it to drop
@@ -286,12 +292,12 @@ To do this we'll use the `timestamp` function with a format string argument. To
 [`strftime`](https://docs.rs/chrono/0.4.10/chrono/format/strftime/index.html) documentation. Let's ship some Canadian
 friendly logs up to the great white north!
 
-```toml title="vector.toml"
-[transforms.format_timestamp]
-  type = "remap"
-  source = '''
-    .timestamp = timestamp(.timestamp, "%Y/%m/%d:%H:%M:%S %z")
-  '''
+```yaml title="vector.yaml"
+transforms:
+  format_timestamp:
+    type: "remap"
+    source: |
+      .timestamp = timestamp(.timestamp, "%Y/%m/%d:%H:%M:%S %z")
 ```
 
 ## Working with data formats
@@ -305,12 +311,14 @@ supported. In these cases, you can use the `encoding` option.
 The [`console`][docs.sinks.console] sink supports both `json` and `text` as its
 output format
 
-```toml title="vector.toml"
-[sinks.print]
-  type = "console"
-  inputs = ["source0"]
-  target = "stdout"
-  encoding.codec = "json"
+```yaml title="vector.yaml"
+sinks:
+  print:
+    type: "console"
+    inputs: ["source0"]
+    target: "stdout"
+    encoding:
+      codec: "json"
 ```
 
 You can also use a transform like [`remap`][docs.transforms.remap] or to parse out
diff --git a/website/content/en/guides/level-up/vector-tap-guide.md b/website/content/en/guides/level-up/vector-tap-guide.md
index c0622994311fa..0ace743aff5d3 100644
--- a/website/content/en/guides/level-up/vector-tap-guide.md
+++ b/website/content/en/guides/level-up/vector-tap-guide.md
@@ -31,27 +31,26 @@ To start, we'll reference the following base configuration, but feel free to
 substitute your own. Just note that the [Vector API] must be enabled for `vector
 tap` to work. See [under the hood](#under-the-hood) for more details.
 
-```toml
-[api]
-enabled = true
-
-[sources.in]
-type = "demo_logs"
-format = "shuffle"
-lines = [
-  "test1",
-  "test2",
-]
-
-[sinks.out]
-type = "blackhole"
-inputs = ["in*"]
+```yaml
+api:
+  enabled: true
+
+sources:
+  in:
+    type: "demo_logs"
+    format: "shuffle"
+    lines: ["test1", "test2"]
+
+sinks:
+  out:
+    type: "blackhole"
+    inputs: ["in*"]
 ```
 
 Run Vector with this configuration and watch the configuration for changes.
 
 ```console
-vector --config path/to/config.toml -w
+vector --config path/to/config.yaml -w
 ```
 
 Now run `vector tap`! You should start seeing a stream of
@@ -125,14 +124,12 @@ accordingly by re-matching your provided patterns.
 With `vector tap` running, add the following `demo_logs` source to the base
 configuration.
 
-```toml
-[sources.in-2]
-type = "demo_logs"
-format = "shuffle"
-lines = [
-  "new test1",
-  "new test2",
-]
+```yaml
+sources:
+  in-2:
+    type: "demo_logs"
+    format: "shuffle"
+    lines: ["new test1", "new test2"]
 ```
 
 You'll now see events from component `in-2` appear in `tap` output.
@@ -155,43 +152,45 @@ troubleshoot a pipeline.
 
 We'll use the following Vector configuration.
 
-```toml
-[api]
-enabled = true
-
-[sources.in]
-type = "demo_logs"
-format = "shuffle"
-lines = [
-  '{ "type": "icecream", "flavor": "strawberry" }',
-  '{ "type": "icecream", "flavor": "chocolate" }',
-  '{ "type": "icecream", "flavor": "wasabi" }',
-]
-
-[transforms.picky]
-type = "remap"
-inputs = ["in"]
-drop_on_abort = true
-reroute_dropped = true
-source = '''
-  if .flavor == "strawberry" {
-    .happiness = 10
-  } else if .flavor == "chocolate" {
-    .happiness = 5
-  } else {
-    abort
-  }
-'''
-
-[sinks.store]
-type = "console"
-inputs = ["picky"]
-target = "stdout"
-encoding.codec = "json"
-
-[sinks.trash]
-type = "blackhole"
-inputs = ["picky.dropped"]
+```yaml
+api:
+  enabled: true
+
+sources:
+  in:
+    type: "demo_logs"
+    format: "shuffle"
+    lines:
+      - '{ "type": "icecream", "flavor": "strawberry" }'
+      - '{ "type": "icecream", "flavor": "chocolate" }'
+      - '{ "type": "icecream", "flavor": "wasabi" }'
+
+transforms:
+  picky:
+    type: "remap"
+    inputs: ["in"]
+    drop_on_abort: true
+    reroute_dropped: true
+    source: |
+      if .flavor == "strawberry" {
+        .happiness = 10
+      } else if .flavor == "chocolate" {
+        .happiness = 5
+      } else {
+        abort
+      }
+
+sinks:
+  store:
+    type: "console"
+    inputs: ["picky"]
+    target: "stdout"
+    encoding:
+      codec: "json"
+
+  trash:
+    type: "blackhole"
+    inputs: ["picky.dropped"]
 ```
 
 Running this configuration, we expect to see our favorite ice cream logs appear
diff --git a/website/content/en/highlights/2019-11-25-unit-testing-vector-config-files.md b/website/content/en/highlights/2019-11-25-unit-testing-vector-config-files.md
index 141437904cc99..90799c6d1ef9d 100644
--- a/website/content/en/highlights/2019-11-25-unit-testing-vector-config-files.md
+++ b/website/content/en/highlights/2019-11-25-unit-testing-vector-config-files.md
@@ -26,40 +26,39 @@ mission-critical production pipelines that are collaborated on.
 Let's look at a basic example that uses the [`regex_parser`
 transform][docs.transforms.regex_parser] to parse log lines:
 
-```toml title="vector.toml"
-[sources.my_logs]
-  type    = "file"
-  include = ["/var/log/my-app.log"]
-
-[transforms.parser]
-  inputs = ["my_logs"]
-  type   = "regex_parser"
-  regex  = "^(?P<timestamp>[\\w\\-:\\+]+) (?P<level>\\w+) (?P<message>.*)$"
-
-[[tests]]
-  name = "verify_regex"
-
-  [tests.input]
-    insert_at = "parser"
-    type = "raw"
-    value = "2019-11-28T12:00:00+00:00 info Hello world"
-
-  [[tests.outputs]]
-    extract_from = "parser"
-
-    [[tests.outputs.conditions]]
-      type = "check_fields"
-      "timestamp.equals" = "2019-11-28T12:00:00+00:00"
-      "level.equals" = "info"
-      "message.equals" = "Hello world"
+```yaml title="vector.yaml"
+sources:
+  my_logs:
+    type: "file"
+    include: ["/var/log/my-app.log"]
+
+transforms:
+  parser:
+    inputs: ["my_logs"]
+    type: "regex_parser"
+    regex: "^(?P<timestamp>[\\w\\-:\\+]+) (?P<level>\\w+) (?P<message>.*)$"
+
+tests:
+  - name: "verify_regex"
+    input:
+      insert_at: "parser"
+      type: "raw"
+      value: "2019-11-28T12:00:00+00:00 info Hello world"
+    outputs:
+      - extract_from: "parser"
+        conditions:
+          - type: "check_fields"
+            "timestamp.equals": "2019-11-28T12:00:00+00:00"
+            "level.equals": "info"
+            "message.equals": "Hello world"
 ```
 
 And you can run the tests via the new `test` subcommand:
 
 ```sh
-$ vector test ./vector.toml
-Running ./vector.toml tests
-Test ./vector.toml: verify_regex ... passed
+$ vector test ./vector.yaml
+Running ./vector.yaml tests
+Test ./vector.yaml: verify_regex ... passed
 ```
 
 ## Why?
diff --git a/website/content/en/highlights/2019-12-13-custom-dns.md b/website/content/en/highlights/2019-12-13-custom-dns.md
index 3fcbd88fd24c0..a9d0088aa4675 100644
--- a/website/content/en/highlights/2019-12-13-custom-dns.md
+++ b/website/content/en/highlights/2019-12-13-custom-dns.md
@@ -20,8 +20,8 @@ servers in your configs.
 
 The configuration isn't complicated, it's a global array field `dns_servers`:
 
-```toml
-dns_servers = ["0.0.0.0:53"]
+```yaml
+dns_servers: ["0.0.0.0:53"]
 ```
 
 When `dns_servers` is set Vector will ignore the system configuration and use
diff --git a/website/content/en/highlights/2019-12-16-ec2-metadata.md b/website/content/en/highlights/2019-12-16-ec2-metadata.md
index 58d92e577ad63..117441d3db43d 100644
--- a/website/content/en/highlights/2019-12-16-ec2-metadata.md
+++ b/website/content/en/highlights/2019-12-16-ec2-metadata.md
@@ -21,19 +21,19 @@ our brand spanking new [`aws_ec2_metadata` transform][docs.transforms.aws_ec2_me
 Configuration isn't complicated, just add and hook up the transform. If you
 don't want all enrichments added then white-list them with the `fields` option:
 
-```toml
-[transforms.fill_me_up]
-  type = "aws_ec2_metadata"
-  inputs = ["my-source-id"]
-  fields = [
-    "instance-id",
-    "local-hostname",
-    "public-hostname",
-    "public-ipv4",
-    "ami-id",
-    "availability-zone",
-    "region",
-  ]
+```yaml
+transforms:
+  fill_me_up:
+    type: "aws_ec2_metadata"
+    inputs: ["my-source-id"]
+    fields:
+      - "instance-id"
+      - "local-hostname"
+      - "public-hostname"
+      - "public-ipv4"
+      - "ami-id"
+      - "availability-zone"
+      - "region"
 ```
 
 For more guidance get on the [reference page][docs.transforms.aws_ec2_metadata].
diff --git a/website/content/en/highlights/2020-01-07-prometheus-source.md b/website/content/en/highlights/2020-01-07-prometheus-source.md
index 2d1797aff9749..45ca46ead7bc3 100644
--- a/website/content/en/highlights/2020-01-07-prometheus-source.md
+++ b/website/content/en/highlights/2020-01-07-prometheus-source.md
@@ -25,11 +25,12 @@ metrics data model and tested our interoperability between metrics sources.
 To use it simply add the source config and point it towards the hosts you wish
 to scrape:
 
-```toml
-[sources.my_source_id]
-  type = "prometheus_scrape"
-  hosts = ["http://localhost:9090"]
-  scrape_interval_secs = 1
+```yaml
+sources:
+  my_source_id:
+    type: "prometheus_scrape"
+    hosts: ["http://localhost:9090"]
+    scrape_interval_secs: 1
 ```
 
 For more guidance get on the [reference page][docs.sources.prometheus].
diff --git a/website/content/en/highlights/2020-01-20-splunk-hec-specify-indexed-fields.md b/website/content/en/highlights/2020-01-20-splunk-hec-specify-indexed-fields.md
index e8d6f6a018f61..d1aadc19bc248 100644
--- a/website/content/en/highlights/2020-01-20-splunk-hec-specify-indexed-fields.md
+++ b/website/content/en/highlights/2020-01-20-splunk-hec-specify-indexed-fields.md
@@ -21,9 +21,10 @@ will _not_ index any fields by default.
 In order to mark desired fields as indexed you can use the optional
 configuration option `indexed_fields`:
 
-```toml title="vector.toml"
- [sinks.my_sink_id]
-   type = "splunk_hec"
-   inputs = ["my-source-id"]
-+  indexed_fields = ["foo", "bar"]
+```yaml title="vector.yaml"
+ sinks:
+   my_sink_id:
+     type: "splunk_hec"
+     inputs: ["my-source-id"]
++    indexed_fields: ["foo", "bar"]
 ```
diff --git a/website/content/en/highlights/2020-02-05-merge-partial-docker-events.md b/website/content/en/highlights/2020-02-05-merge-partial-docker-events.md
index 2dc7a049aba31..d1af3aaae1249 100644
--- a/website/content/en/highlights/2020-02-05-merge-partial-docker-events.md
+++ b/website/content/en/highlights/2020-02-05-merge-partial-docker-events.md
@@ -20,10 +20,11 @@ events. This can be a very difficult and frustrating problem to solve with
 other tools (we speak from experience). In this release, Vector solves this
 automatically with a new `auto_partial_merge` option in the `docker_logs` source.
 
-```toml title="vector.toml"
-[sources.my_source_id]
-  type = "docker_logs"
-  auto_partial_merge = true
+```yaml title="vector.yaml"
+sources:
+  my_source_id:
+    type: "docker_logs"
+    auto_partial_merge: true
 ```
 
 We love assimilation and look forward to a future where our individualistic
diff --git a/website/content/en/highlights/2020-02-14-global-log-schema.md b/website/content/en/highlights/2020-02-14-global-log-schema.md
index 6949d0d409fae..213030fd5a3d5 100644
--- a/website/content/en/highlights/2020-02-14-global-log-schema.md
+++ b/website/content/en/highlights/2020-02-14-global-log-schema.md
@@ -24,11 +24,11 @@ the default names for the [`message_key`][docs.global-options#message_key],
 [`host_key`][docs.global-options#host_key],
 [`timestamp_key`][docs.global-options#host_key], and more:
 
-```toml title="vector.toml"
-[log_schema]
-  host_key = "host" # default
-  message_key = "message" # default
-  timestamp_key = "timestamp" # default
+```yaml title="vector.yaml"
+log_schema:
+  host_key: "host" # default
+  message_key: "message" # default
+  timestamp_key: "timestamp" # default
 ```
 
 Why is this useful?
diff --git a/website/content/en/highlights/2020-02-21-file-source-multiline-support.md b/website/content/en/highlights/2020-02-21-file-source-multiline-support.md
index 762faf8c73e4f..f09c9f4789c95 100644
--- a/website/content/en/highlights/2020-02-21-file-source-multiline-support.md
+++ b/website/content/en/highlights/2020-02-21-file-source-multiline-support.md
@@ -34,16 +34,16 @@ foobar.rb:6:in `/': divided by 0 (ZeroDivisionError)
 
 You can merge them with the following config:
 
-```toml title="vector.toml"
-[sources.my_file_source]
-  type = "file"
-  # ...
-
-  [sources.my_file_source.multiline]
-    start_pattern = "^[^\\s]"
-    mode = "continue_through"
-    condition_pattern = "^[\\s]+from"
-    timeout_ms = 1000
+```yaml title="vector.yaml"
+sources:
+  my_file_source:
+    type: "file"
+    # ...
+    multiline:
+      start_pattern: "^[^\\s]"
+      mode: "continue_through"
+      condition_pattern: "^[\\s]+from"
+      timeout_ms: 1000
 ```
 
 And if this doesn't do it, you can always fall back to the [`lua` transform][docs.transforms.lua].
diff --git a/website/content/en/highlights/2020-02-24-swimlanes-transform.md b/website/content/en/highlights/2020-02-24-swimlanes-transform.md
index 815694d51fea5..29e7c67cc280a 100644
--- a/website/content/en/highlights/2020-02-24-swimlanes-transform.md
+++ b/website/content/en/highlights/2020-02-24-swimlanes-transform.md
@@ -16,15 +16,16 @@ The new [`swimlanes` transform][docs.transforms.swimlanes] makes it much easier
 to configure conditional branches of transforms and sinks. For example, you can
 easily create [if/else pipelines][docs.transforms.swimlanes#examples].
 
-```toml title="vector.toml"
-[transforms.lanes]
-  types = "swimlanes"
-
-  [transforms.my_transform_id.lanes.errors]
-    "level.eq" = "error"
-
-  [transforms.my_transform_id.lanes.not_errors]
-    "level.neq" = "error"
+```yaml title="vector.yaml"
+transforms:
+  lanes:
+    types: "swimlanes"
+  my_transform_id:
+    lanes:
+      errors:
+        "level.eq": "error"
+      not_errors:
+        "level.neq": "error"
 ```
 
 Remember to occasionally let your branches mingle so that they don't completely
diff --git a/website/content/en/highlights/2020-03-04-encoding-only-fields-except-fields.md b/website/content/en/highlights/2020-03-04-encoding-only-fields-except-fields.md
index 08032a186b521..7f6e5833a431d 100644
--- a/website/content/en/highlights/2020-03-04-encoding-only-fields-except-fields.md
+++ b/website/content/en/highlights/2020-03-04-encoding-only-fields-except-fields.md
@@ -23,11 +23,13 @@ Vector has deprecated the root-level `encoding` option in favor of new
 
 Upgrading is easy:
 
-```toml title="vector.toml"
- [sinks.my-sink]
-   type = "..."
--  encoding = "json"
-+  encoding.codec = "json"
-+  encoding.except_fields = ["_meta"] # optional
-+  encoding.timestamp_format = "rfc3339" # optional
+```yaml title="vector.yaml"
+ sinks:
+   my-sink:
+     type: "..."
+-    encoding: "json"
++    encoding:
++      codec: "json"
++      except_fields: ["_meta"] # optional
++      timestamp_format: "rfc3339" # optional
 ```
diff --git a/website/content/en/highlights/2020-03-10-dedupe-transform.md b/website/content/en/highlights/2020-03-10-dedupe-transform.md
index 4a596b98f448b..44b68d9d489d1 100644
--- a/website/content/en/highlights/2020-03-10-dedupe-transform.md
+++ b/website/content/en/highlights/2020-03-10-dedupe-transform.md
@@ -22,14 +22,16 @@ mistakes that accidentally duplicate logs. This mistake can easily double
 
 Simply add the transform to your pipeline:
 
-```toml
-[transforms.my_transform_id]
-  # General
-  type = "dedupe" # required
-  inputs = ["my-source-id"] # required
+```yaml
+transforms:
+  my_transform_id:
+    # General
+    type: "dedupe" # required
+    inputs: ["my-source-id"] # required
 
-  # Fields
-  fields.match = ["timestamp", "host", "message"] # optional, default
+    # Fields
+    fields:
+      match: ["timestamp", "host", "message"] # optional, default
 ```
 
 {{< success >}}
diff --git a/website/content/en/highlights/2020-03-11-tag-cardinality-limit-transform.md b/website/content/en/highlights/2020-03-11-tag-cardinality-limit-transform.md
index c6a053786906a..b184613dbbcfb 100644
--- a/website/content/en/highlights/2020-03-11-tag-cardinality-limit-transform.md
+++ b/website/content/en/highlights/2020-03-11-tag-cardinality-limit-transform.md
@@ -20,13 +20,14 @@ protect against this we built a new
 
 Getting started is easy. Simply add this component to your pipeline:
 
-```toml title="vector.toml"
-[transforms.tag_protection]
-  type = "tag_cardinality_limit"
-  inputs = ["my-source-id"]
-  limit_exceeded_action = "drop_tag"
-  mode = "exact"
-  value_limit = 500
+```yaml title="vector.yaml"
+transforms:
+  tag_protection:
+    type: "tag_cardinality_limit"
+    inputs: ["my-source-id"]
+    limit_exceeded_action: "drop_tag"
+    mode: "exact"
+    value_limit: 500
 ```
 
 {{< success >}}
diff --git a/website/content/en/highlights/2020-03-31-filter-transform.md b/website/content/en/highlights/2020-03-31-filter-transform.md
index b1524f5d60910..5409db5a6b28a 100644
--- a/website/content/en/highlights/2020-03-31-filter-transform.md
+++ b/website/content/en/highlights/2020-03-31-filter-transform.md
@@ -20,15 +20,17 @@ transform since it is much more expressive.
 
 ## Get Started
 
-```toml title="vector.toml"
-[transforms.haproxy_errors]
-  # General
-  type = "filter"
-  inputs = ["my-source-id"]
+```yaml title="vector.yaml"
+transforms:
+  haproxy_errors:
+    # General
+    type: "filter"
+    inputs: ["my-source-id"]
 
-  # Conditions
-  condition."level.eq" = "error"
-  condition."service.eq" = "haproxy"
+    # Conditions
+    condition:
+      "level.eq": "error"
+      "service.eq": "haproxy"
 ```
 
 Check out the [docs][docs.transforms.filter] for a fill list of available
diff --git a/website/content/en/highlights/2020-04-01-more-condition-predicates.md b/website/content/en/highlights/2020-04-01-more-condition-predicates.md
index 277e780274890..68d56c1b9d38e 100644
--- a/website/content/en/highlights/2020-04-01-more-condition-predicates.md
+++ b/website/content/en/highlights/2020-04-01-more-condition-predicates.md
@@ -31,10 +31,12 @@ following predicates were added:
 For example, you can filter all messages that contain the `error` term with
 the new `contains` predicate:
 
-```toml
-[transforms.errors]
-  type = "filter"
-  condition."message.contain" = "error"
+```yaml
+transforms:
+  errors:
+    type: "filter"
+    condition:
+      "message.contain": "error"
 ```
 
 The world is your oyster.
diff --git a/website/content/en/highlights/2020-05-27-add-support-for-loading-multiple-cas.md b/website/content/en/highlights/2020-05-27-add-support-for-loading-multiple-cas.md
index dc5a36becf1a4..6124b4d055aa7 100644
--- a/website/content/en/highlights/2020-05-27-add-support-for-loading-multiple-cas.md
+++ b/website/content/en/highlights/2020-05-27-add-support-for-loading-multiple-cas.md
@@ -15,15 +15,17 @@ Working with `openssl` isn't very fun, and we don't want to inflict that on you.
 
 This is particularly useful if you have a socket source:
 
-```toml title="vector.toml"
-[sources.tls]
-  type = "socket"
-  address = "0.0.0.0:6514"
-  mode = "tcp"
-  tls.enabled = true
-  tls.crt_path = "cert.pfx"
-  tls.ca_path = "ca.pem" # Now supported: More complicated PEMS!
-  tls.verify_certificate = true
+```yaml title="vector.yaml"
+sources:
+  tls:
+    type: "socket"
+    address: "0.0.0.0:6514"
+    mode: "tcp"
+    tls:
+      enabled: true
+      crt_path: "cert.pfx"
+      ca_path: "ca.pem" # Now supported: More complicated PEMS!
+      verify_certificate: true
 ```
 
 If it doesn't, that's a bug. [**Report it.**][urls.new_bug_report] We squash bugs.
diff --git a/website/content/en/highlights/2020-07-10-add-reduce-transform.md b/website/content/en/highlights/2020-07-10-add-reduce-transform.md
index 96b757c11f88c..fc7034c4cd871 100644
--- a/website/content/en/highlights/2020-07-10-add-reduce-transform.md
+++ b/website/content/en/highlights/2020-07-10-add-reduce-transform.md
@@ -54,42 +54,49 @@ Then output this (but not formatted so nicely!):
 
 We'll run this config:
 
-```toml title=vector.toml
-data_dir = "tmp"
-
-[sources.source0]
-  include = ["input.log"]
-  start_at_beginning = true
-  type = "file"
-  fingerprinting.strategy = "device_and_inode"
-
-[transforms.transform0]
-  inputs = ["source0"]
-  type = "json_parser"
-  field = "message"
-
-[transforms.transform1]
-  inputs = ["transform0"]
-  type = "reduce"
-  identifier_fields = ["request_id"]
-  ends_when.type = "check_fields"
-  ends_when."response_status.exists" = true
-  merge_strategies.message = "discard"
-  merge_strategies.query = "discard"
-  merge_strategies.template = "discard"
-  merge_strategies.query_duration_ms = "sum"
-  merge_strategies.render_duration_ms = "sum"
-  merge_strategies.response_duration_ms = "sum"
-
-[sinks.sink0]
-  healthcheck = true
-  inputs = ["transform1"]
-  type = "file"
-  path = "output.log"
-  encoding = "ndjson"
-  buffer.type = "memory"
-  buffer.max_events = 500
-  buffer.when_full = "block"s
+```yaml title=vector.yaml
+data_dir: "tmp"
+
+sources:
+  source0:
+    include: ["input.log"]
+    start_at_beginning: true
+    type: "file"
+    fingerprinting:
+      strategy: "device_and_inode"
+
+transforms:
+  transform0:
+    inputs: ["source0"]
+    type: "json_parser"
+    field: "message"
+
+  transform1:
+    inputs: ["transform0"]
+    type: "reduce"
+    identifier_fields: ["request_id"]
+    ends_when:
+      type: "check_fields"
+      "response_status.exists": true
+    merge_strategies:
+      message: "discard"
+      query: "discard"
+      template: "discard"
+      query_duration_ms: "sum"
+      render_duration_ms: "sum"
+      response_duration_ms: "sum"
+
+sinks:
+  sink0:
+    healthcheck: true
+    inputs: ["transform1"]
+    type: "file"
+    path: "output.log"
+    encoding: "ndjson"
+    buffer:
+      type: "memory"
+      max_events: 500
+      when_full: "block"
 ```
 
 We hope you find this useful!
diff --git a/website/content/en/highlights/2020-09-18-adaptive-concurrency.md b/website/content/en/highlights/2020-09-18-adaptive-concurrency.md
index a7236e736224d..925f66081b7b6 100644
--- a/website/content/en/highlights/2020-09-18-adaptive-concurrency.md
+++ b/website/content/en/highlights/2020-09-18-adaptive-concurrency.md
@@ -25,11 +25,13 @@ inspired by TCP congestion control algorithms.
 This feature, like all Vector features, will begin its life in public beta and
 be available on an opt-in basis. To get it, enable it for each sink:
 
-```toml
-[sinks.my-sink]
-type = "..." # any http-based sink
-request.concurrency = "adaptive"
-# and remove the request.rate_limit_* settings
+```yaml
+sinks:
+  my-sink:
+    type: "..." # any http-based sink
+    request:
+      concurrency: "adaptive"
+    # and remove the request.rate_limit_* settings
 ```
 
 [announcement]: /blog/adaptive-request-concurrency/
diff --git a/website/content/en/highlights/2020-10-27-metrics-integrations.md b/website/content/en/highlights/2020-10-27-metrics-integrations.md
index 50bd6e8132ca1..6666f50fd247b 100644
--- a/website/content/en/highlights/2020-10-27-metrics-integrations.md
+++ b/website/content/en/highlights/2020-10-27-metrics-integrations.md
@@ -39,14 +39,16 @@ the single agent for all of your logs, metrics, and traces.
 
 To get started with these sources, define them and go:
 
-```toml
-[sources.host_metrics]
-type = "host_metrics" # or apache_metrics, mongodb_metrics, or internal_metrics
+```yaml
+sources:
+  host_metrics:
+    type: "host_metrics" # or apache_metrics, mongodb_metrics, or internal_metrics
 
 # Then connect them to a sink:
-[sinks.prometheus]
-type = "prometheus"
-inputs = ["host_metrics"]
+sinks:
+  prometheus:
+    type: "prometheus"
+    inputs: ["host_metrics"]
 ```
 
 Tada! One agent for all of your data. Check out the [docs][docs] for more
diff --git a/website/content/en/highlights/2020-11-19-prometheus-remote-integrations.md b/website/content/en/highlights/2020-11-19-prometheus-remote-integrations.md
index 604b85bfc4bf7..965b42c6b0365 100644
--- a/website/content/en/highlights/2020-11-19-prometheus-remote-integrations.md
+++ b/website/content/en/highlights/2020-11-19-prometheus-remote-integrations.md
@@ -31,17 +31,20 @@ Prometheus operators can route a stream of Prometheus data to the archiving
 solution of their choice. For this use case we recommend object stores for their
 cheap and durable qualities:
 
-```toml title="vector.toml"
-[sources.prometheus]
-  type = "prometheus_remote_write"
-
-[transforms.convert]
-  type = "metric_to_log"
-  inputs = ["prometheus"]
-
-[sinks.backup]
-  type = "aws_s3"
-  inputs = ["convert"]
+```yaml title="vector.yaml"
+sources:
+  prometheus:
+    type: "prometheus_remote_write"
+
+transforms:
+  convert:
+    type: "metric_to_log"
+    inputs: ["prometheus"]
+
+sinks:
+  backup:
+    type: "aws_s3"
+    inputs: ["convert"]
 ```
 
 Swap `aws_s3` with `gcp_cloud_storage` or other object stores.
@@ -68,13 +71,15 @@ To get started, setup the new
 your metrics to [Datadog][datadog], [New Relic][new_relic], [Influx][influx],
 [Elasticsearch][elastic], and [many other sinks][sinks]:
 
-```toml title="vector.toml"
-[sources.prometheus]
-  type = "prometheus_remote_write"
+```yaml title="vector.yaml"
+sources:
+  prometheus:
+    type: "prometheus_remote_write"
 
-[sinks.datadog]
-  type = "datadog_metrics"
-  inputs = ["prometheus"]
+sinks:
+  datadog:
+    type: "datadog_metrics"
+    inputs: ["prometheus"]
 ```
 
 [chronosphere]: https://chronosphere.io/
diff --git a/website/content/en/highlights/2020-11-25-json-yaml-config-formats.md b/website/content/en/highlights/2020-11-25-json-yaml-config-formats.md
index db44d80923daf..f977ab64a4de8 100644
--- a/website/content/en/highlights/2020-11-25-json-yaml-config-formats.md
+++ b/website/content/en/highlights/2020-11-25-json-yaml-config-formats.md
@@ -12,9 +12,9 @@ badges:
 ---
 
 To ensure Vector fits into existing workflows, like Kubernetes, we've added
-support for JSON and YAML config formats in addition to TOML. TOML will
-continue to be our default format, but users are welcome to use JSON and YAML
-as they see fit.
+support for JSON and YAML config formats in addition to TOML. YAML is now the
+recommended and default configuration format, but users are welcome to use
+TOML and JSON as they see fit.
 
 ## Use cases
 
diff --git a/website/content/en/highlights/2020-12-23-graphql-api.md b/website/content/en/highlights/2020-12-23-graphql-api.md
index 70c40ebfac28a..e749377c8dd05 100644
--- a/website/content/en/highlights/2020-12-23-graphql-api.md
+++ b/website/content/en/highlights/2020-12-23-graphql-api.md
@@ -28,10 +28,10 @@ The GraphQL API for Vector is **disabled by default**. We want to keep Vector's
 behavior as predictable and secure as possible, so we chose to make the feature
 opt-in. To enable the API, add this to your Vector config:
 
-```toml
-[api]
-enabled = true
-address = "127.0.0.1:8686" # optional. Change IP/port if required
+```yaml
+api:
+  enabled: true
+  address: "127.0.0.1:8686" # optional. Change IP/port if required
 ```
 
 ## Read more
diff --git a/website/content/en/highlights/2020-12-23-internal-logs-source.md b/website/content/en/highlights/2020-12-23-internal-logs-source.md
index b90f1899975e8..fb8ae9aed167e 100644
--- a/website/content/en/highlights/2020-12-23-internal-logs-source.md
+++ b/website/content/en/highlights/2020-12-23-internal-logs-source.md
@@ -38,24 +38,27 @@ metrics and modify and ship them however you wish.
 Here's an example Vector configuration that ships Vector's logs to Splunk and
 allows its internal metrics to be scraped by [Prometheus]:
 
-```toml
-[sources.vector_logs]
-type = "internal_logs"
-
-[sources.vector_metrics]
-type = "internal_metrics"
-
-[sinks.splunk]
-type = "splunk_hec"
-inputs = ["vector_logs"]
-endpoint = "https://my-account.splunkcloud.com"
-token = "${SPLUNK_HEC_TOKEN}"
-encoding.codec = "json"
-
-[sinks.prometheus]
-type = "prometheus"
-inputs = ["vector_metrics"]
-address = "0.0.0.0:9090"
+```yaml
+sources:
+  vector_logs:
+    type: "internal_logs"
+
+  vector_metrics:
+    type: "internal_metrics"
+
+sinks:
+  splunk:
+    type: "splunk_hec"
+    inputs: ["vector_logs"]
+    endpoint: "https://my-account.splunkcloud.com"
+    token: "${SPLUNK_HEC_TOKEN}"
+    encoding:
+      codec: "json"
+
+  prometheus:
+    type: "prometheus"
+    inputs: ["vector_metrics"]
+    address: "0.0.0.0:9090"
 ```
 
 [internal_logs]: /docs/reference/configuration/sources/internal_logs
diff --git a/website/content/en/highlights/2021-01-10-kafka-sink-metrics.md b/website/content/en/highlights/2021-01-10-kafka-sink-metrics.md
index 389e85dbf50ff..35e95c6444eba 100644
--- a/website/content/en/highlights/2021-01-10-kafka-sink-metrics.md
+++ b/website/content/en/highlights/2021-01-10-kafka-sink-metrics.md
@@ -18,14 +18,17 @@ metric events through Kafka. Metrics events are encoded into a format that
 mimics our [internal metrics data model], ideal for custom consumers on the
 other end. Getting started is easy:
 
-```toml
-[sources.host_metrics]
-type = "host_metrics"
+```yaml
+sources:
+  host_metrics:
+    type: "host_metrics"
 
-[sinks.kafka]
-type = "kafka"
-inputs = ["host_metrics"]
-encoding.codec = "json"
+sinks:
+  kafka:
+    type: "kafka"
+    inputs: ["host_metrics"]
+    encoding:
+      codec: "json"
 ```
 
 ## Caveats
diff --git a/website/content/en/highlights/2021-01-20-wildcard-identifiers.md b/website/content/en/highlights/2021-01-20-wildcard-identifiers.md
index 9cff6a92702d1..88f82a0d75539 100644
--- a/website/content/en/highlights/2021-01-20-wildcard-identifiers.md
+++ b/website/content/en/highlights/2021-01-20-wildcard-identifiers.md
@@ -15,26 +15,28 @@ badges:
 [PR 6170][pr_6170] introduced wildcards when referencing component names in the `inputs` option. This allows you to build
 dynamic topologies. This feature comes with one limitation: the wildcard must be at the end of the string.
 
-```toml
-[sources.app1_logs]
-type = "file"
-includes = ["/var/log/app1.log"]
+```yaml
+sources:
+  app1_logs:
+    type: "file"
+    includes: ["/var/log/app1.log"]
 
-[sources.app2_logs]
-type = "file"
-includes = ["/var/log/app.log"]
+  app2_logs:
+    type: "file"
+    includes: ["/var/log/app.log"]
 
-[sources.system_logs]
-type = "file"
-includes = ["/var/log/system.log"]
+  system_logs:
+    type: "file"
+    includes: ["/var/log/system.log"]
 
-[sinks.app_logs]
-type = "datadog_logs"
-inputs = ["app*"]
+sinks:
+  app_logs:
+    type: "datadog_logs"
+    inputs: ["app*"]
 
-[sinks.archive]
-type = "aws_s3"
-inputs = ["app*", "system_logs"]
+  archive:
+    type: "aws_s3"
+    inputs: ["app*", "system_logs"]
 ```
 
 [pr_6170]: https://github.com/vectordotdev/vector/pull/6170
diff --git a/website/content/en/highlights/2021-02-16-0-12-upgrade-guide.md b/website/content/en/highlights/2021-02-16-0-12-upgrade-guide.md
index 9f05bda354d2f..7f5a8f361039d 100644
--- a/website/content/en/highlights/2021-02-16-0-12-upgrade-guide.md
+++ b/website/content/en/highlights/2021-02-16-0-12-upgrade-guide.md
@@ -117,12 +117,12 @@ The following transforms have been deprecated in favor of the new [`remap` trans
 Deprecation notices have been placed on each of these transforms with example VRL programs that demonstrate how to
 migrate to the new `remap` transform. For example, migrating from the `json_parser` transform is as simple as:
 
-```toml
-[transforms.remap]
-type = "remap"
-source = '''
-. = merge(., parse_json!(.message))
-'''
+```yaml
+transforms:
+  remap:
+    type: "remap"
+    source: |
+      . = merge(., parse_json!(.message))
 ```
 
 **You do not need to upgrade immediately. These transforms will not be removed until Vector hits 1.0, a milestone that
diff --git a/website/content/en/highlights/2021-02-16-filter-remap-support.md b/website/content/en/highlights/2021-02-16-filter-remap-support.md
index 50d47fbabb7d5..26cc72dff7ce5 100644
--- a/website/content/en/highlights/2021-02-16-filter-remap-support.md
+++ b/website/content/en/highlights/2021-02-16-filter-remap-support.md
@@ -24,20 +24,26 @@ Previously, the `filter` transform required you to specify conditions using
 The example configuration below shows the same `filter` transform using the old
 system (`check_fields`) and the new system (`remap`):
 
-```toml
-[transforms.filter_out_non_critical]
-type = "filter"
-inputs = ["http-server-logs"]f
-
-# Using check_fields
-condition.type = "check_fields"
-condition.message.status_code.ne = 200
-condition.message.severity.ne = "info"
-condition.message.severity.ne = "debug"
-
-# Using remap
-condition.type = "remap"
-condition.source = '.status_code != 200 && !includes(["info", "debug"], .severity)'
+```yaml
+transforms:
+  filter_out_non_critical:
+    type: "filter"
+    inputs: ["http-server-logs"]
+
+    # Using check_fields
+    condition:
+      type: "check_fields"
+      message:
+        status_code:
+          ne: 200
+        severity:
+          ne: "info"
+          # ne: "debug"
+
+    # Using remap
+    condition:
+      type: "remap"
+      source: '.status_code != 200 && !includes(["info", "debug"], .severity)'
 ```
 
 [filter]: /docs/reference/configuration/transforms/filter
diff --git a/website/content/en/highlights/2021-04-21-vector-tap.md b/website/content/en/highlights/2021-04-21-vector-tap.md
index be234b5ac9d89..39b89194cbab4 100644
--- a/website/content/en/highlights/2021-04-21-vector-tap.md
+++ b/website/content/en/highlights/2021-04-21-vector-tap.md
@@ -27,19 +27,22 @@ of this component.
 
 For example, given the configuration:
 
-```toml
-[api]
-  enabled =  true
-[sources.in]
-  type = "generator"
-  format = "shuffle"
-  interval = 1.0
-  lines = ["Hello World"]
-  sequence = true
-
-[sinks.out]
-  type = "blackhole"
-  inputs = ["in"]
+```yaml
+api:
+  enabled: true
+
+sources:
+  in:
+    type: "generator"
+    format: "shuffle"
+    interval: 1.0
+    lines: ["Hello World"]
+    sequence: true
+
+sinks:
+  out:
+    type: "blackhole"
+    inputs: ["in"]
 ```
 
 If you were to run `vector` and then, in another terminal, run `vector tap in`,
diff --git a/website/content/en/highlights/2021-04-21-vrl-abort.md b/website/content/en/highlights/2021-04-21-vrl-abort.md
index 5e784ab56d505..234fa9a948c37 100644
--- a/website/content/en/highlights/2021-04-21-vrl-abort.md
+++ b/website/content/en/highlights/2021-04-21-vrl-abort.md
@@ -28,27 +28,32 @@ validation on the event before processing it, discarding any invalid events.
 
 Given a config of:
 
-```toml
-[sources.in]
-  type = "generator"
-  format = "shuffle"
-  interval = 1.0
-  lines = ['{ "message": "valid message", "type": "ok"}', '{ "message": "invalid message", "type": "unknown"}']
+```yaml
+sources:
+  in:
+    type: "generator"
+    format: "shuffle"
+    interval: 1.0
+    lines:
+      - '{ "message": "valid message", "type": "ok"}'
+      - '{ "message": "invalid message", "type": "unknown"}'
 
-[transforms.remap]
-  type = "remap"
-  inputs = ["in"]
-  source = """
-    . |= object!(parse_json!(string!(.message)))
-    if .type != "ok" {
-      abort # unknown type
-    }
-  """
+transforms:
+  remap:
+    type: "remap"
+    inputs: ["in"]
+    source: |
+      . |= object!(parse_json!(string!(.message)))
+      if .type != "ok" {
+        abort # unknown type
+      }
 
-[sinks.out]
-  type = "console"
-  inputs = ["remap"]
-  encoding.codec = "json"
+sinks:
+  out:
+    type: "console"
+    inputs: ["remap"]
+    encoding:
+      codec: "json"
 ```
 
 You would expect to see something like:
diff --git a/website/content/en/highlights/2021-07-14-0-15-upgrade-guide.md b/website/content/en/highlights/2021-07-14-0-15-upgrade-guide.md
index 38b39874a1b5f..10d03ca5a8f74 100644
--- a/website/content/en/highlights/2021-07-14-0-15-upgrade-guide.md
+++ b/website/content/en/highlights/2021-07-14-0-15-upgrade-guide.md
@@ -42,38 +42,42 @@ This means, if you are presently using the deprecated `check_fields` syntax, you
 
 For example, if you previously had:
 
-```toml
-[transforms.sample]
-type = "sample"
-inputs = ["in"]
-rate = 10
-key_field = "message"
-exclude."message.contains" = "error"
+```yaml
+transforms:
+  sample:
+    type: "sample"
+    inputs: ["in"]
+    rate: 10
+    key_field: "message"
+    exclude:
+      "message.contains": "error"
 ```
 
 You will need to add `exclude.type = "check_fields"` like:
 
-```toml
-[transforms.sample]
-type = "sample"
-inputs = ["in"]
-rate = 10
-key_field = "message"
-exclude."type" = "check_fields"
-exclude."message.contains" = "error"
+```yaml
+transforms:
+  sample:
+    type: "sample"
+    inputs: ["in"]
+    rate: 10
+    key_field: "message"
+    exclude:
+      "type": "check_fields"
+      "message.contains": "error"
 ```
 
 To convert this to the new [VRL][VRL] conditions, you would write:
 
-```toml
-[transforms.sample]
-type = "sample"
-inputs = ["in"]
-rate = 10
-key_field = "message"
-exclude = """
-  contains!(.message, "error")
-"""
+```yaml
+transforms:
+  sample:
+    type: "sample"
+    inputs: ["in"]
+    rate: 10
+    key_field: "message"
+    exclude: |
+      contains!(.message, "error")
 ```
 
 We recommend upgrading to the [VRL][VRL] conditions as these are much more powerful than the legacy `check_fields`-style
@@ -85,40 +89,42 @@ The `remap` condition type has been renamed `vrl` in this release to better high
 a [VRL][VRL] program. Most examples of using this condition type have the short-hand condition config of just specifying
 the [VRL][VRL] program without specifying a `type`. For example:
 
-```toml
-[transforms.filter_a]
-  inputs = ["stdin"]
-  type = "filter"
-  condition = '''
+```yaml
+transforms:
+  filter_a:
+    inputs: ["stdin"]
+    type: "filter"
+    condition: |
       message = if exists(.tags) { .tags.message } else { .message }
       message == "test filter 1"
-    '''
 ```
 
 Which is automatically a [VRL][VRL] condition. However, if you were specifying the `type` like:
 
-```toml
-[transforms.filter_a]
-inputs = ["stdin"]
-type = "filter"
-condition.type = "remap"
-condition.source = '''
-    message = if exists(.tags) { .tags.message } else { .message }
-    message == "test filter 1"
-'''
+```yaml
+transforms:
+  filter_a:
+    inputs: ["stdin"]
+    type: "filter"
+    condition:
+      type: "remap"
+      source: |
+        message = if exists(.tags) { .tags.message } else { .message }
+        message == "test filter 1"
 ```
 
 Then you will need to update `type = "remap"` to `type = "vrl"` like:
 
-```toml
-[transforms.filter_a]
-inputs = ["stdin"]
-type = "filter"
-condition.type = "vrl"
-condition.source = '''
-    message = if exists(.tags) { .tags.message } else { .message }
-    message == "test filter 1"
-'''
+```yaml
+transforms:
+  filter_a:
+    inputs: ["stdin"]
+    type: "filter"
+    condition:
+      type: "vrl"
+      source: |
+        message = if exists(.tags) { .tags.message } else { .message }
+        message == "test filter 1"
 ```
 
 [vrl]: /docs/reference/vrl/
diff --git a/website/content/en/highlights/2021-07-14-vector-graph.md b/website/content/en/highlights/2021-07-14-vector-graph.md
index 07a85dbd18f82..b8e7ddcdfc83c 100644
--- a/website/content/en/highlights/2021-07-14-vector-graph.md
+++ b/website/content/en/highlights/2021-07-14-vector-graph.md
@@ -14,74 +14,78 @@ badges:
 This release adds a new subcommand `vector graph` to output the topology specified by you Vector configuration as
 a graph in [DOT][DOT] format. This output can then be visualized using [Graphviz] to produce an image.
 
-For example, if you had a config, `vector.toml`, like:
+For example, if you had a config, `vector.yaml`, like:
 
-```toml
+```yaml
 ##
 ## Sources
 ##
 
-[sources.internal_metrics]
-type = "internal_metrics"
+sources:
+  internal_metrics:
+    type: "internal_metrics"
 
-[sources.dd_logs]
-type = "datadog_logs" # required
-acknowledgements = false # optional, default
-address = "0.0.0.0:8282" # required
+  dd_logs:
+    type: "datadog_logs" # required
+    acknowledgements: false # optional, default
+    address: "0.0.0.0:8282" # required
 
-[sources.file_gen]
-type = "file"
-include = ["/var/log/file_gen/**/*.log"]
-read_from = "beginning"
+  file_gen:
+    type: "file"
+    include: ["/var/log/file_gen/**/*.log"]
+    read_from: "beginning"
 
 ##
 ## Transforms
 ##
 
-[transforms.remap]
-type = "remap"
-inputs = ["file_gen"]
-source = '''
-.agent_name = "vector"
-parsed, err = parse_json(.message)
-if err == null {
-    .message = parsed
-    .format = "json"
-} else {
-    .format = "ascii"
-}
-matches = parse_regex!(.file, r'.*/(?P<num>\d+)-(?P<name>\w+).log')
-.origin, err = .host + "/" + matches.name + "/" + matches.num
-if err != null {
-    log("Failed to parse origin from file name", level: "error")
-}
-'''
+transforms:
+  remap:
+    type: "remap"
+    inputs: ["file_gen"]
+    source: |
+      .agent_name = "vector"
+      parsed, err = parse_json(.message)
+      if err == null {
+          .message = parsed
+          .format = "json"
+      } else {
+          .format = "ascii"
+      }
+      matches = parse_regex!(.file, r'.*/(?P<num>\d+)-(?P<name>\w+).log')
+      .origin, err = .host + "/" + matches.name + "/" + matches.num
+      if err != null {
+          log("Failed to parse origin from file name", level: "error")
+      }
 
 ##
 ## Sinks
 ##
 
-[sinks.prometheus]
-type = "prometheus_exporter"
-inputs = ["internal_metrics"]
-address = "0.0.0.0:9598"
-
-[sinks.dd_logs_egress]
-type = "datadog_logs"
-inputs = ["dd_logs"]
-default_api_key = ""
-encoding.codec = "json"
-request.concurrency = "adaptive"
-batch.max_bytes = 5242880
-request.rate_limit_num = 1000
-
-
-[sinks.blackhole]
-type = "blackhole"
-inputs = ["remap"]
+sinks:
+  prometheus:
+    type: "prometheus_exporter"
+    inputs: ["internal_metrics"]
+    address: "0.0.0.0:9598"
+
+  dd_logs_egress:
+    type: "datadog_logs"
+    inputs: ["dd_logs"]
+    default_api_key: ""
+    encoding:
+      codec: "json"
+    request:
+      concurrency: "adaptive"
+      rate_limit_num: 1000
+    batch:
+      max_bytes: 5242880
+
+  blackhole:
+    type: "blackhole"
+    inputs: ["remap"]
 ```
 
-And you ran the new `vector graph --config vector.toml` you would see:
+And you ran the new `vector graph --config vector.yaml` you would see:
 
 ```dot
 digraph {
@@ -102,7 +106,7 @@ digraph {
 To render this, if you have [Graphviz] installed, you could do:
 
 ```shell
-vector graph --config vector.toml | dot -Tpng > graph.png
+vector graph --config vector.yaml | dot -Tpng > graph.png
 ```
 
 To get an image that looks like:
diff --git a/website/content/en/highlights/2021-07-16-remap-multiple.md b/website/content/en/highlights/2021-07-16-remap-multiple.md
index 5d23a59fabce9..80a0d5fa4d4a6 100644
--- a/website/content/en/highlights/2021-07-16-remap-multiple.md
+++ b/website/content/en/highlights/2021-07-16-remap-multiple.md
@@ -20,13 +20,13 @@ will create one log event for each event in the array.
 
 For example:
 
-```toml
-[transforms.remap]
-type = "remap"
-inputs = []
-source = """
-. = [{"message": "hello"}, {"message": "world"}]
-"""
+```yaml
+transforms:
+  remap:
+    type: "remap"
+    inputs: []
+    source: |
+      . = [{"message": "hello"}, {"message": "world"}]
 ```
 
 Would generate two output events:
@@ -45,15 +45,15 @@ Additionally, to make it easier to convert an incoming log event into an array,
 function to VRL that transforms an incoming event where one of the fields is an array into an array of events, each with
 one of the elements from the array field. This is easiest to see with an example:
 
-```toml
-[transforms.remap]
-type = "remap"
-inputs = []
-source = """
-. = {"host": "localhost", "events": [{"message": "hello"}, {"message": "world"}]} # to represent the incoming event
+```yaml
+transforms:
+  remap:
+    type: "remap"
+    inputs: []
+    source: |
+      . = {"host": "localhost", "events": [{"message": "hello"}, {"message": "world"}]} # to represent the incoming event
 
-. = unnest(.events)
-"""
+      . = unnest(.events)
 ```
 
 Would output the following log events:
@@ -69,24 +69,23 @@ and another `remap` transform to receive each new event.
 
 An example of this:
 
-```toml
-[transforms.explode]
-type = "remap"
-inputs = []
-source = """
-. = {"host": "localhost", "events": [{"message": "hello"}, {"message": "world"}]} # to represent the incoming event
-
-. = unnest(.events)
-"""
-
-[transforms.map]
-type = "remap"
-inputs = ["explode"]
-source = """
-# example of pulling up the nested field to merge it into the top-level
-. |= .events
-del(.events)
-"""
+```yaml
+transforms:
+  explode:
+    type: "remap"
+    inputs: []
+    source: |
+      . = {"host": "localhost", "events": [{"message": "hello"}, {"message": "world"}]} # to represent the incoming event
+
+      . = unnest(.events)
+
+  map:
+    type: "remap"
+    inputs: ["explode"]
+    source: |
+      # example of pulling up the nested field to merge it into the top-level
+      . |= .events
+      del(.events)
 ```
 
 Would output the following log events:
diff --git a/website/content/en/highlights/2021-08-20-rate-limits.md b/website/content/en/highlights/2021-08-20-rate-limits.md
index 5be8d63e4fa41..5668116faa5da 100644
--- a/website/content/en/highlights/2021-08-20-rate-limits.md
+++ b/website/content/en/highlights/2021-08-20-rate-limits.md
@@ -23,9 +23,10 @@ have no rate limiting and a maximum number of concurrent requests of 1024.
 To configure a request rate limit or maximum concurrency on a HTTP-based sink,
 you can set the `request` parameters like:
 
-```toml
-request.concurrency = 5 # limit to 5 in-flight requests
-request.rate_limit_num = 10 # limit to 10 requests / second
+```yaml
+request:
+  concurrency: 5 # limit to 5 in-flight requests
+  rate_limit_num: 10 # limit to 10 requests / second
 ```
 
 If you haven't already, we recommend trying out our [adaptive concurrency
diff --git a/website/content/en/highlights/2021-08-25-0-16-upgrade-guide.md b/website/content/en/highlights/2021-08-25-0-16-upgrade-guide.md
index 96c30410f344c..5a33295331e6c 100644
--- a/website/content/en/highlights/2021-08-25-0-16-upgrade-guide.md
+++ b/website/content/en/highlights/2021-08-25-0-16-upgrade-guide.md
@@ -30,11 +30,12 @@ components.
 
 For example, with the component config:
 
-```toml
-[transforms.parse_nginx]
-type = "remap"
-inputs = []
-source = ""
+```yaml
+transforms:
+  parse_nginx:
+    type: "remap"
+    inputs: []
+    source: ""
 ```
 
 The `parse_nginx` part of the config is now only referred to as `ID` in the documentation.
@@ -57,19 +58,22 @@ limitations and is only useful for backward compatibility with older clients.
 We no longer allow you to set the encoding of the payloads in the Datadog logs
 sink. For instance, if your configuration looks like so:
 
-```toml
-[sinks.dd_logs_egress]
-type = "datadog_logs"
-inputs = ["datadog_agent"]
-encoding.codec = "json"
+```yaml
+sinks:
+  dd_logs_egress:
+    type: "datadog_logs"
+    inputs: ["datadog_agent"]
+    encoding:
+      codec: "json"
 ```
 
 You should remove `encoding.codec` entirely, leaving you with:
 
-```toml
-[sinks.dd_logs_egress]
-type = "datadog_logs"
-inputs = ["datadog_agent"]
+```yaml
+sinks:
+  dd_logs_egress:
+    type: "datadog_logs"
+    inputs: ["datadog_agent"]
 ```
 
 Encoding fields other than `codec` are still valid.
diff --git a/website/content/en/highlights/2021-10-06-arc-default.md b/website/content/en/highlights/2021-10-06-arc-default.md
index 54cfb15f834be..49344701a0eb3 100644
--- a/website/content/en/highlights/2021-10-06-arc-default.md
+++ b/website/content/en/highlights/2021-10-06-arc-default.md
@@ -20,8 +20,9 @@ increased pressure downstream, to avoid overwhelming the sink destination.
 This feature was previously able to be opted into with the following
 configuration:
 
-```toml
-request.concurrency = "adaptive"
+```yaml
+request:
+  concurrency: "adaptive"
 ```
 
 This is the new default for HTTP-based sinks. As mentioned in the [announcement
@@ -35,8 +36,9 @@ If you would like to instead use a fixed concurrency as was previously the
 default, you can set a static value like:
 
 
-```toml
-request.concurrency = 5
+```yaml
+request:
+  concurrency: 5
 ```
 
 This will tell Vector to limit to 5 concurrent requests.
diff --git a/website/content/en/highlights/2021-10-06-source-codecs.md b/website/content/en/highlights/2021-10-06-source-codecs.md
index 09967fc40923f..7b4b307c5b923 100644
--- a/website/content/en/highlights/2021-10-06-source-codecs.md
+++ b/website/content/en/highlights/2021-10-06-source-codecs.md
@@ -17,12 +17,14 @@ added new `decoding` options to [most sources][9404].
 For example, if you have a `kafka` source that has JSON-encoded messages, now
 you can simply add `decoding.codec = "json"` to your source configuration like:
 
-```toml
-[sources.kafka]
-type = "kafka"
-bootstrap_servers = "localhost:9200"
-topics = ["my_topic"]
-decoding.codec = "json"
+```yaml
+sources:
+  kafka:
+    type: "kafka"
+    bootstrap_servers: "localhost:9200"
+    topics: ["my_topic"]
+    decoding:
+      codec: "json"
 ```
 
 This will decode your messages from JSON, thus saving you from an additional
@@ -35,12 +37,15 @@ separating messages).
 For example, if you have an `http` source where the messages are delimited by
 commas instead of newlines, you can configure this like:
 
-```toml
-[sources.http]
-type = "http"
-address = "0.0.0.0:8080"
-framing.method = "character_delimited"
-framing.character_delimited.delimiter = ","
+```yaml
+sources:
+  http:
+    type: "http"
+    address: "0.0.0.0:8080"
+    framing:
+      method: "character_delimited"
+      character_delimited:
+        delimiter: ","
 ```
 
 To have Vector parse each comma-delimited element as a new message. This can be
diff --git a/website/content/en/highlights/2021-11-12-event-throttle-transform.md b/website/content/en/highlights/2021-11-12-event-throttle-transform.md
index 4f029774a0e84..c6e51d7307b9f 100644
--- a/website/content/en/highlights/2021-11-12-event-throttle-transform.md
+++ b/website/content/en/highlights/2021-11-12-event-throttle-transform.md
@@ -48,12 +48,13 @@ Given these incoming log events:
 
 ...and this configuration...
 
-```toml
-[transforms.my_transform_id]
-type = "throttle"
-inputs = [ "my-source-or-transform-id" ]
-threshold = 1
-window_secs = 60
+```yaml
+transforms:
+  my_transform_id:
+    type: "throttle"
+    inputs: ["my-source-or-transform-id"]
+    threshold: 1
+    window_secs: 60
 ```
 
 ...only one event will be allowed through:
diff --git a/website/content/en/highlights/2021-12-15-splunk-hec-improvements.md b/website/content/en/highlights/2021-12-15-splunk-hec-improvements.md
index a4e4d0a87b766..54b5f2b85e1e3 100644
--- a/website/content/en/highlights/2021-12-15-splunk-hec-improvements.md
+++ b/website/content/en/highlights/2021-12-15-splunk-hec-improvements.md
@@ -31,8 +31,8 @@ would not work with Splunk senders that required them.
 
 Now, you can configure the `splunk_hec` source to use the indexer acknowledgements protocol by configuring:
 
-```toml
-acknowledgements = true
+```yaml
+acknowledgements: true
 ```
 
 When enabled, responses to incoming requests will include an ID that can be used to query for acknowledgement status at the newly exposed `/services/collector/ack` endpoint ([learn more here][indexer how it works]). The acknowledgement status is wired into Vector's
@@ -51,8 +51,9 @@ acknowledgements][indexer] part of the HEC protocol.
 This has defaulted to on to provide higher guarantees, but can be disabled to
 restore the previous behavior by configuring:
 
-```toml
-acknowledgements.indexer_acknowledgements_enabled = false
+```yaml
+acknowledgements:
+  indexer_acknowledgements_enabled: false
 ```
 
 ## Passthrough Token Routing
diff --git a/website/content/en/highlights/2021-12-28-0-19-0-upgrade-guide.md b/website/content/en/highlights/2021-12-28-0-19-0-upgrade-guide.md
index e23e7b54c9f5e..7655ac4027eb9 100644
--- a/website/content/en/highlights/2021-12-28-0-19-0-upgrade-guide.md
+++ b/website/content/en/highlights/2021-12-28-0-19-0-upgrade-guide.md
@@ -165,11 +165,11 @@ source, you will now see a `splunk_channel` field in events output from the
 included channel information from requests in their events. If you want to
 remove this field, you can simply drop it with a `remap` transform like follows:
 
-```toml
-[transforms.foo]
-type = "remap"
-inputs = ["bar"] # where bar is the splunk_hec source
-source = '''
-  del(.splunk_channel)
-'''
+```yaml
+transforms:
+  foo:
+    type: "remap"
+    inputs: ["bar"] # where bar is the splunk_hec source
+    source: |
+      del(.splunk_channel)
 ```
diff --git a/website/content/en/highlights/2022-01-12-vector-unit-test-improvements.md b/website/content/en/highlights/2022-01-12-vector-unit-test-improvements.md
index 9444f10cbb47a..be461a4bc60e2 100644
--- a/website/content/en/highlights/2022-01-12-vector-unit-test-improvements.md
+++ b/website/content/en/highlights/2022-01-12-vector-unit-test-improvements.md
@@ -13,30 +13,28 @@ full support for testing task-style transforms (previously there may have been
 issues when using multiple inputs with task transforms). For example, you can
 now test `remap` transform's `dropped` output like so,
 
-```toml
-[transforms.foo]
-  type = "remap"
-  inputs = []
-  drop_on_abort = true
-  reroute_dropped = true
-  source = "abort"
+```yaml
+transforms:
+  foo:
+    type: "remap"
+    inputs: []
+    drop_on_abort: true
+    reroute_dropped: true
+    source: "abort"
 
-[[tests]]
-  name = "remap_dropped_output"
-  no_outputs_from = [ "foo" ]
-
-  [[tests.inputs]]
-    insert_at = "foo"
-    type = "log"
-    [tests.inputs.log_fields]
-      message = "I will be dropped"
-
-  [[tests.outputs]]
-    extract_from = "foo.dropped"
-
-    [[tests.outputs.conditions]]
-      type = "vrl"
-      source = 'assert_eq!(.message, "I will be dropped", "incorrect message")'
+tests:
+  - name: "remap_dropped_output"
+    no_outputs_from: ["foo"]
+    inputs:
+      - insert_at: "foo"
+        type: "log"
+        log_fields:
+          message: "I will be dropped"
+    outputs:
+      - extract_from: "foo.dropped"
+        conditions:
+          - type: "vrl"
+            source: 'assert_eq!(.message, "I will be dropped", "incorrect message")'
 ```
 
 Under-the-hood, we've reworked the unit testing implementation to more closely
diff --git a/website/content/en/highlights/2022-02-08-disk-buffer-v2-beta.md b/website/content/en/highlights/2022-02-08-disk-buffer-v2-beta.md
index 560c5389473cc..54c118ea395ff 100644
--- a/website/content/en/highlights/2022-02-08-disk-buffer-v2-beta.md
+++ b/website/content/en/highlights/2022-02-08-disk-buffer-v2-beta.md
@@ -33,10 +33,12 @@ persistence, regardless of issues with Vector and the host system.
 
 You may already be familiar with disk buffers if you have a sink configuration that looks like this:
 
-```toml
-[sinks.http]
-# ...
-buffer.type = "disk"
+```yaml
+sinks:
+  http:
+    # ...
+    buffer:
+      type: "disk"
 ```
 
 ## Current disk buffer implementation
@@ -74,16 +76,20 @@ for those who don't utilize a stateless deployment process as mentioned above.
 With all of that said, changing Vector to use the new disk buffer implementation is as simple as
 changing a single line:
 
-```toml
+```yaml
 # From this:
-[sinks.http]
-# ...
-buffer.type = "disk"
+sinks:
+  http:
+    # ...
+    buffer:
+      type: "disk"
 
 # To this:
-[sinks.http]
-# ...
-buffer.type = "disk_v2"
+sinks:
+  http:
+    # ...
+    buffer:
+      type: "disk_v2"
 ```
 
 ## Let us know what you think!
diff --git a/website/content/en/highlights/2022-03-15-vrl-vm-beta.md b/website/content/en/highlights/2022-03-15-vrl-vm-beta.md
index f4bd959f259c6..399782a428435 100644
--- a/website/content/en/highlights/2022-03-15-vrl-vm-beta.md
+++ b/website/content/en/highlights/2022-03-15-vrl-vm-beta.md
@@ -20,14 +20,14 @@ the VRL program that is being run.
 
 You can give the VM a try by adding the `runtime` configuration option to your Remap transform:
 
-```toml
-[transforms.remap]
-type = "remap"
-inputs = [ "..." ]
-runtime = "vm"
-source = '''
-...
-'''
+```yaml
+transforms:
+  remap:
+    type: "remap"
+    inputs: ["..."]
+    runtime: "vm"
+    source: |
+      ...
 ```
 
 ## Let us know what you think!
diff --git a/website/content/en/highlights/2022-03-22-0-21-0-upgrade-guide.md b/website/content/en/highlights/2022-03-22-0-21-0-upgrade-guide.md
index 761e6d861455b..96714e842b4ce 100644
--- a/website/content/en/highlights/2022-03-22-0-21-0-upgrade-guide.md
+++ b/website/content/en/highlights/2022-03-22-0-21-0-upgrade-guide.md
@@ -64,24 +64,28 @@ Here are some examples that require migrating
 | foo\\"bar | "foo\\"bar" | Double quotes and backlashes must be escaped _inside_ quotes |
 
 
-### TOML transform example
+### YAML transform example
 
 Old syntax
 
-```toml
-[transforms.dedupe]
-type = "dedupe"
-inputs = ["input"]
-fields.match = ["message.user-identifier"]
+```yaml
+transforms:
+  dedupe:
+    type: "dedupe"
+    inputs: ["input"]
+    fields:
+      match: ["message.user-identifier"]
 ```
 
 New syntax (the dash requires the field name to be quoted)
 
-```toml
-[transforms.dedupe]
-type = "dedupe"
-inputs = ["input"]
-fields.match = ["message.\"user-identifier\""]
+```yaml
+transforms:
+  dedupe:
+    type: "dedupe"
+    inputs: ["input"]
+    fields:
+      match: ['message."user-identifier"']
 ```
 
 For more information on the new syntax, you can review the [VRL path expressions documentation](https://vector.dev/docs/reference/vrl/expressions/#path)
diff --git a/website/content/en/highlights/2022-03-31-native-event-codecs.md b/website/content/en/highlights/2022-03-31-native-event-codecs.md
index 0a10938afffea..1f1b301caca82 100644
--- a/website/content/en/highlights/2022-03-31-native-event-codecs.md
+++ b/website/content/en/highlights/2022-03-31-native-event-codecs.md
@@ -23,12 +23,14 @@ transform.
 For example, an `exec` source can now be configured to receive events via the
 `native_json` codec:
 
-```toml
-[sources.in]
-type = "exec"
-mode = "scheduled"
-command = ["./scrape.sh"]
-decoding.codec = "native_json"
+```yaml
+sources:
+  in:
+    type: "exec"
+    mode: "scheduled"
+    command: ["./scrape.sh"]
+    decoding:
+      codec: "native_json"
 ```
 
 If `scrape.sh` contained:
@@ -82,24 +84,28 @@ deserialize directly to the same native representation within Vector.
 
 Example source configuration:
 
-```toml
-[sources.in]
-type = "kafka"
-bootstrap_servers = "localhost:9092"
-topics = ["vector"]
-decoding.codec = "native"
+```yaml
+sources:
+  in:
+    type: "kafka"
+    bootstrap_servers: "localhost:9092"
+    topics: ["vector"]
+    decoding:
+      codec: "native"
 ```
 
 This would allow an instance of Vector to receive events from another Vector
 instance that has a `kafka` sink configured like:
 
-```toml
-[sinks.out]
-type = "kafka"
-inputs = ["..."]
-bootstrap_servers = "localhost:9092"
-topic = "vector"
-encoding.codec = "native"
+```yaml
+sinks:
+  out:
+    type: "kafka"
+    inputs: ["..."]
+    bootstrap_servers: "localhost:9092"
+    topic: "vector"
+    encoding:
+      codec: "native"
 ```
 
 Note that the new `native` encoding option is not yet documented on sinks as we
diff --git a/website/content/en/highlights/2022-05-03-0-22-0-upgrade-guide.md b/website/content/en/highlights/2022-05-03-0-22-0-upgrade-guide.md
index b7be9fad5dd50..f9a18b8e47cba 100644
--- a/website/content/en/highlights/2022-05-03-0-22-0-upgrade-guide.md
+++ b/website/content/en/highlights/2022-05-03-0-22-0-upgrade-guide.md
@@ -32,40 +32,39 @@ The `gcp_stackdriver_metrics` sink now matches the `gcp_stackdriver_logs`
 configuration, and doesn't require an additional `labels` section to add
 labels to submitted metrics.
 
-##### TOML transform example
+##### YAML transform example
 
 Old configuration
 
-```toml
-[sinks.my_sink_id]
-type = "gcp_stackdriver_metrics"
-inputs = [ "my-source-or-transform-id" ]
-credentials_path = "/path/to/credentials.json"
-project_id = "vector-123456"
-
-  [sinks.my_sink_id.resource]
-  type = "global"
-
-    [sinks.my_sink_id.resource.labels]
-    projectId = "vector-123456"
-    instanceId = "Twilight"
-    zone = "us-central1-a"
+```yaml
+sinks:
+  my_sink_id:
+    type: "gcp_stackdriver_metrics"
+    inputs: ["my-source-or-transform-id"]
+    credentials_path: "/path/to/credentials.json"
+    project_id: "vector-123456"
+    resource:
+      type: "global"
+      labels:
+        projectId: "vector-123456"
+        instanceId: "Twilight"
+        zone: "us-central1-a"
 ```
 
 New configuration
 
-```toml
-[sinks.my_sink_id]
-type = "gcp_stackdriver_metrics"
-inputs = [ "my-source-or-transform-id" ]
-credentials_path = "/path/to/credentials.json"
-project_id = "vector-123456"
-
-  [sinks.my_sink_id.resource]
-  type = "global"
-  projectId = "vector-123456"
-  instanceId = "Twilight"
-  zone = "us-central1-a"
+```yaml
+sinks:
+  my_sink_id:
+    type: "gcp_stackdriver_metrics"
+    inputs: ["my-source-or-transform-id"]
+    credentials_path: "/path/to/credentials.json"
+    project_id: "vector-123456"
+    resource:
+      type: "global"
+      projectId: "vector-123456"
+      instanceId: "Twilight"
+      zone: "us-central1-a"
 ```
 
 For more information on the new syntax, you can review the [GCP Stackdriver Metrics sink documentation](https://vector.dev/docs/reference/configuration/sinks/gcp_stackdriver_metrics/)
@@ -179,413 +178,442 @@ transform.
 
 Before:
 
-```toml
-[transforms.add_fields]
-type = "add_fields"
-inputs = ["some_input"]
-fields.parent.child2 = "value2"
+```yaml
+transforms:
+  add_fields:
+    type: "add_fields"
+    inputs: ["some_input"]
+    fields:
+      parent:
+        child2: "value2"
 ```
 
 After:
 
-```toml
-[transforms.add_fields]
-type = "remap"
-inputs = ["some_input"]
-source = '''
-.parent.child2 = "value2"
-'''
+```yaml
+transforms:
+  add_fields:
+    type: "remap"
+    inputs: ["some_input"]
+    source: |
+      .parent.child2 = "value2"
 ```
 
 ##### `add_tags`
 
 Before:
 
-```toml
-[transforms.add_tags]
-type = "add_tags"
-inputs = ["some_input"]
-tags.some_tag = "some_value"
+```yaml
+transforms:
+  add_tags:
+    type: "add_tags"
+    inputs: ["some_input"]
+    tags:
+      some_tag: "some_value"
 ```
 
 After:
 
-```toml
-[transforms.add_tags]
-type = "remap"
-inputs = ["some_input"]
-source = '''
-.tags.some_tag = "some_value"
-'''
+```yaml
+transforms:
+  add_tags:
+    type: "remap"
+    inputs: ["some_input"]
+    source: |
+      .tags.some_tag = "some_value"
 ```
 
 ##### `ansi_stripper`
 
 Before:
 
-```toml
-[transforms.ansi_stripper]
-type = "ansi_stripper"
-inputs = ["some_input"]
+```yaml
+transforms:
+  ansi_stripper:
+    type: "ansi_stripper"
+    inputs: ["some_input"]
 ```
 
 After:
 
-```toml
-[transforms.ansi_stripper]
-type = "remap"
-inputs = ["some_input"]
-drop_on_error = false
-source = '''
-.message = strip_ansi_escape_codes(string!(.message))
-'''
+```yaml
+transforms:
+  ansi_stripper:
+    type: "remap"
+    inputs: ["some_input"]
+    drop_on_error: false
+    source: |
+      .message = strip_ansi_escape_codes(string!(.message))
 ```
 
 ##### `aws_cloudwatch_logs_subscription_parser`
 
 Before:
 
-```toml
-[transforms.aws_cloudwatch_logs_subscription_parser]
-type = "aws_cloudwatch_logs_subscription_parser"
-inputs = ["some_input"]
+```yaml
+transforms:
+  aws_cloudwatch_logs_subscription_parser:
+    type: "aws_cloudwatch_logs_subscription_parser"
+    inputs: ["some_input"]
 ```
 
 After:
 
-```toml
-[transforms.aws_cloudwatch_logs_subscription_parser]
-type = "remap"
-inputs = ["some_input"]
-drop_on_error = false
-source = '''
-. |= parse_aws_cloudwatch_log_subscription_message!(.message)
-'''
+```yaml
+transforms:
+  aws_cloudwatch_logs_subscription_parser:
+    type: "remap"
+    inputs: ["some_input"]
+    drop_on_error: false
+    source: |
+      . |= parse_aws_cloudwatch_log_subscription_message!(.message)
 ```
 
 ##### `coercer`
 
 Before:
 
-```toml
-[transforms.coercer]
-type = "coercer"
-inputs = ["some_input"]
-types.some_bool = "bool"
-types.some_float = "float"
-types.some_int = "int"
-types.some_string = "string"
-types.some_timestamp = "timestamp"
+```yaml
+transforms:
+  coercer:
+    type: "coercer"
+    inputs: ["some_input"]
+    types:
+      some_bool: "bool"
+      some_float: "float"
+      some_int: "int"
+      some_string: "string"
+      some_timestamp: "timestamp"
 ```
 
 After:
 
-```toml
-[transforms.coercer]
-type = "remap"
-inputs = ["some_input"]
-source = '''
-.some_bool = to_bool!(.some_bool)
-.some_float = to_float!(.some_float)
-.some_int = to_int!(.some_int)
-.some_string = to_string!(.some_string)
-.some_timestamp = to_timestamp!(.some_timestamp)
-'''
+```yaml
+transforms:
+  coercer:
+    type: "remap"
+    inputs: ["some_input"]
+    source: |
+      .some_bool = to_bool!(.some_bool)
+      .some_float = to_float!(.some_float)
+      .some_int = to_int!(.some_int)
+      .some_string = to_string!(.some_string)
+      .some_timestamp = to_timestamp!(.some_timestamp)
 ```
 
 ##### `concat`
 
 Before:
 
-```toml
-[transforms.concat]
-type = "concat"
-inputs = ["some_input"]
-items = ["month", "day", "year"]
-target = "date"
-joiner = "/"
+```yaml
+transforms:
+  concat:
+    type: "concat"
+    inputs: ["some_input"]
+    items: ["month", "day", "year"]
+    target: "date"
+    joiner: "/"
 ```
 
 After:
 
-```toml
-[transforms.concat]
-type = "remap"
-inputs = ["some_input"]
-drop_on_error = false
-source = '''
-.date = join!([.month, .day, .year], "/")
-'''
+```yaml
+transforms:
+  concat:
+    type: "remap"
+    inputs: ["some_input"]
+    drop_on_error: false
+    source: |
+      .date = join!([.month, .day, .year], "/")
 ```
 
 ##### `grok_parser`
 
 Before:
 
-```toml
-[transforms.grok_parser]
-type = "grok_parser"
-inputs = ["some_input"]
-pattern = "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}"
-types.timestamp = "timestamp|%+"
-types.level = "string"
-types.message = "string"
+```yaml
+transforms:
+  grok_parser:
+    type: "grok_parser"
+    inputs: ["some_input"]
+    pattern: "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}"
+    types:
+      timestamp: "timestamp|%+"
+      level: "string"
+      message: "string"
 ```
 
 After:
 
-```toml
-[transforms.grok_parser]
-type = "remap"
-inputs = ["some_input"]
-drop_on_error = false
-source = '''
-. |= parse_grok!(.message, "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}")
-.timestamp = parse_timestamp!(.timestamp , format: "%+")
-'''
+```yaml
+transforms:
+  grok_parser:
+    type: "remap"
+    inputs: ["some_input"]
+    drop_on_error: false
+    source: |
+      . |= parse_grok!(.message, "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}")
+      .timestamp = parse_timestamp!(.timestamp , format: "%+")
 ```
 
 ##### `json_parser`
 
 Before:
 
-```toml
-[transforms.json_parser]
-type = "json_parser"
-inputs = ["some_input"]
+```yaml
+transforms:
+  json_parser:
+    type: "json_parser"
+    inputs: ["some_input"]
 ```
 
 After:
 
-```toml
-[transforms.json_parser]
-type = "remap"
-inputs = ["some_input"]
-drop_on_error = false
-source = '''
-. |= object!(parse_json(.message))
-'''
+```yaml
+transforms:
+  json_parser:
+    type: "remap"
+    inputs: ["some_input"]
+    drop_on_error: false
+    source: |
+      . |= object!(parse_json(.message))
 ```
 
 ##### `key_value_parser`
 
 Before:
 
-```toml
-[transforms.key_value_parser]
-type = "key_value_parser"
-inputs = ["some_input"]
+```yaml
+transforms:
+  key_value_parser:
+    type: "key_value_parser"
+    inputs: ["some_input"]
 ```
 
 After:
 
-```toml
-[transforms.key_value_parser]
-type = "remap"
-inputs = ["some_input"]
-drop_on_error = false
-source = '''
-. |= parse_key_value!(.message)
-'''
+```yaml
+transforms:
+  key_value_parser:
+    type: "remap"
+    inputs: ["some_input"]
+    drop_on_error: false
+    source: |
+      . |= parse_key_value!(.message)
 ```
 
 ##### `logfmt_parser`
 
 Before:
 
-```toml
-[transforms.logfmt_parser]
-type = "logfmt_parser"
-inputs = ["some_input"]
+```yaml
+transforms:
+  logfmt_parser:
+    type: "logfmt_parser"
+    inputs: ["some_input"]
 ```
 
 After:
 
-```toml
-[transforms.logfmt_parser]
-type = "remap"
-inputs = ["some_input"]
-drop_on_error = false
-source = '''
-. |= parse_logfmt!(.message)
-'''
+```yaml
+transforms:
+  logfmt_parser:
+    type: "remap"
+    inputs: ["some_input"]
+    drop_on_error: false
+    source: |
+      . |= parse_logfmt!(.message)
 ```
 
 ##### `merge`
 
 Before:
 
-```toml
-[transforms.merge]
-type = "merge"
-inputs = ["some_input"]
+```yaml
+transforms:
+  merge:
+    type: "merge"
+    inputs: ["some_input"]
 ```
 
 After:
 
-```toml
-[transforms.merge]
-type = "reduce"
-inputs = ["some_input"]
-starts_when = "._partial == true"
-merge_strategies.message = "concat"
+```yaml
+transforms:
+  merge:
+    type: "reduce"
+    inputs: ["some_input"]
+    starts_when: "._partial == true"
+    merge_strategies:
+      message: "concat"
 ```
 
 ##### `regex_parser`
 
 Before:
 
-```toml
-[transforms.regex_parser]
-type = "regex_parser"
-inputs = ["some_input"]
-patterns = ['^(?P<host>[\w\.]+) - (?P<user>[\w]+) (?P<bytes_in>[\d]+) \[(?P<timestamp>.*)\] "(?P<method>[\w]+) (?P<path>.*)" (?P<status>[\d]+) (?P<bytes_out>[\d]+)$']
-types.bytes_in = "int"
-types.timestamp = "timestamp|%d/%m/%Y:%H:%M:%S %z"
-types.status = "int"
-types.bytes_out = "int"
+```yaml
+transforms:
+  regex_parser:
+    type: "regex_parser"
+    inputs: ["some_input"]
+    patterns:
+      - '^(?P<host>[\w\.]+) - (?P<user>[\w]+) (?P<bytes_in>[\d]+) \[(?P<timestamp>.*)\] "(?P<method>[\w]+) (?P<path>.*)" (?P<status>[\d]+) (?P<bytes_out>[\d]+)$'
+    types:
+      bytes_in: "int"
+      timestamp: "timestamp|%d/%m/%Y:%H:%M:%S %z"
+      status: "int"
+      bytes_out: "int"
 ```
 
 After:
 
-```toml
-[transforms.regex_parser]
-type = "remap"
-inputs = ["some_input"]
-drop_on_error = false
-source = '''
-. |= parse_regex!(.message, [#"^(?P<host>[\w\.]+) - (?P<user>[\w]+) (?P<bytes_in>[\d]+) \[(?P<timestamp>.*)\] "(?P<method>[\w]+) (?P<path>.*)" (?P<status>[\d]+) (?P<bytes_out>[\d]+)$"#]
-.bytes_in = to_int!(.bytes_in)
-.some_timestamp = parse_timestamp!(.some_timestamp, "%d/%m/%Y:%H:%M:%S %z")
-.status = to_int!(.status)
-.bytes_out = to_int!(.bytes_out)
-'''
+```yaml
+transforms:
+  regex_parser:
+    type: "remap"
+    inputs: ["some_input"]
+    drop_on_error: false
+    source: |
+      . |= parse_regex!(.message, [#"^(?P<host>[\w\.]+) - (?P<user>[\w]+) (?P<bytes_in>[\d]+) \[(?P<timestamp>.*)\] "(?P<method>[\w]+) (?P<path>.*)" (?P<status>[\d]+) (?P<bytes_out>[\d]+)$"#]
+      .bytes_in = to_int!(.bytes_in)
+      .some_timestamp = parse_timestamp!(.some_timestamp, "%d/%m/%Y:%H:%M:%S %z")
+      .status = to_int!(.status)
+      .bytes_out = to_int!(.bytes_out)
 ```
 
 ##### `remove_fields`
 
 Before:
 
-```toml
-[transforms.remove_fields]
-type = "remove_fields"
-inputs = ["some_input"]
-fields = ["parent.child"]
+```yaml
+transforms:
+  remove_fields:
+    type: "remove_fields"
+    inputs: ["some_input"]
+    fields: ["parent.child"]
 ```
 
 After:
 
-```toml
-[transforms.remove_fields]
-type = "remap"
-inputs = ["some_input"]
-source = '''
-del(.parent.child)
-'''
+```yaml
+transforms:
+  remove_fields:
+    type: "remap"
+    inputs: ["some_input"]
+    source: |
+      del(.parent.child)
 ```
 
 ##### `remove_tags`
 
 Before:
 
-```toml
-[transforms.remove_tags]
-type = "remove_tags"
-inputs = ["some_input"]
-tags = ["some_tag"]
+```yaml
+transforms:
+  remove_tags:
+    type: "remove_tags"
+    inputs: ["some_input"]
+    tags: ["some_tag"]
 ```
 
 After:
 
-```toml
-[transforms.remove_tags]
-type = "remap"
-inputs = ["some_input"]
-source = '''
-del(.tags.some_tag)
-'''
+```yaml
+transforms:
+  remove_tags:
+    type: "remap"
+    inputs: ["some_input"]
+    source: |
+      del(.tags.some_tag)
 ```
 
 ##### `rename_fields`
 
 Before:
 
-```toml
-[transforms.rename_fields]
-type = "rename_fields"
-inputs = ["some_input"]
-fields.new_name = ["old_name"]
+```yaml
+transforms:
+  rename_fields:
+    type: "rename_fields"
+    inputs: ["some_input"]
+    fields:
+      new_name: ["old_name"]
 ```
 
 After:
 
-```toml
-[transforms.rename_fields]
-type = "remap"
-inputs = ["some_input"]
-source = '''
-.new_name = del(.old_name)
-'''
+```yaml
+transforms:
+  rename_fields:
+    type: "remap"
+    inputs: ["some_input"]
+    source: |
+      .new_name = del(.old_name)
 ```
 
 ##### `split`
 
 Before:
 
-```toml
-[transforms.split]
-type = "split"
-inputs = ["some_input"]
-field_names = ["remote_addr", "user_id", "timestamp", "message", "status", "bytes"]
-types.status = "int"
-types.bytes = "int"
+```yaml
+transforms:
+  split:
+    type: "split"
+    inputs: ["some_input"]
+    field_names: ["remote_addr", "user_id", "timestamp", "message", "status", "bytes"]
+    types:
+      status: "int"
+      bytes: "int"
 ```
 
 After:
 
-```toml
-[transforms.split]
-type = "remap"
-inputs = ["some_input"]
-drop_on_error = false
-source = '''
-values = split(.message)
-.remote_addr = values[0]
-.user_id = values[1]
-.timestamp = values[2]
-.message = values[3]
-.status = to_int!(values[4])
-.bytes = to_int!(values[5])
-'''
+```yaml
+transforms:
+  split:
+    type: "remap"
+    inputs: ["some_input"]
+    drop_on_error: false
+    source: |
+      values = split(.message)
+      .remote_addr = values[0]
+      .user_id = values[1]
+      .timestamp = values[2]
+      .message = values[3]
+      .status = to_int!(values[4])
+      .bytes = to_int!(values[5])
 ```
 
 ##### `tokenizer`
 
 Before:
 
-```toml
-[transforms.tokenizer]
-type = "tokenizer"
-inputs = ["some_input"]
-field_names = ["remote_addr", "ident", "user_id", "timestamp", "message", "status", "bytes"]
-.types.status = "int"
-.types.bytes = "int"
+```yaml
+transforms:
+  tokenizer:
+    type: "tokenizer"
+    inputs: ["some_input"]
+    field_names: ["remote_addr", "ident", "user_id", "timestamp", "message", "status", "bytes"]
+    types:
+      status: "int"
+      bytes: "int"
 ```
 
 After:
 
-```toml
-[transforms.tokenizer]
-type = "remap"
-inputs = ["some_input"]
-drop_on_error = false
-source = '''
-values = parse_tokens!(.message)
-.remote_addr = values[0]
-.user_id = values[1]
-.timestamp = values[2]
-.message = values[3]
-.status = to_int!(values[4])
-.bytes = to_int!(values[5])
-'''
+```yaml
+transforms:
+  tokenizer:
+    type: "remap"
+    inputs: ["some_input"]
+    drop_on_error: false
+    source: |
+      values = parse_tokens!(.message)
+      .remote_addr = values[0]
+      .user_id = values[1]
+      .timestamp = values[2]
+      .message = values[3]
+      .status = to_int!(values[4])
+      .bytes = to_int!(values[5])
 ```
diff --git a/website/content/en/highlights/2022-07-07-0-23-0-upgrade-guide.md b/website/content/en/highlights/2022-07-07-0-23-0-upgrade-guide.md
index 7fb2d3003977c..b71453f2e9cd1 100644
--- a/website/content/en/highlights/2022-07-07-0-23-0-upgrade-guide.md
+++ b/website/content/en/highlights/2022-07-07-0-23-0-upgrade-guide.md
@@ -135,15 +135,16 @@ will give a compile-time error if you try to mutate the event in a condition.
 
 Example filter transform config
 
-```toml
-[transforms.filter]
-type = "filter"
-inputs = [ "input" ]
-condition.type = "vrl"
-condition.source = """
-.foo = "bar"
-true
-"""
+```yaml
+transforms:
+  filter:
+    type: "filter"
+    inputs: ["input"]
+    condition:
+      type: "vrl"
+      source: |
+        .foo = "bar"
+        true
 ```
 
 New error
@@ -253,8 +254,9 @@ need to remove it to avoid Vector from erroring on startup.
 The `gcp_pubsub` sink now supports a variety of codecs. To encode your logs as JSON before
 publishing them to Cloud Pub/Sub, add the following encoding option
 
-```toml
-encoding.codec = "json"
+```yaml
+encoding:
+  codec: "json"
 ```
 
 to the config of your `gcp_pubsub` sink.
@@ -264,8 +266,9 @@ to the config of your `gcp_pubsub` sink.
 The `humio_metrics` sink configuration no longer expects an `encoding` option.
 If you previously used the encoding option
 
-```toml
-encoding.codec = "json"
+```yaml
+encoding:
+  codec: "json"
 ```
 
 you need to remove the line from your `humio_metrics` config. Metrics are now
@@ -277,8 +280,9 @@ We streamlined the encoding configuration for our sinks, enabling all applicable
 from a variety of codecs: `json`, `text`, `raw`, `logfmt`, `avro`, `native` or `native_json`, e.g.
 by setting
 
-```toml
-encoding.codec = "json"
+```yaml
+encoding:
+  codec: "json"
 ```
 
 in your sink configuration.
@@ -287,8 +291,9 @@ Additionally, some sinks now support configuring how encoded events should be se
 stream or batch: `bytes`, `character_delimited`, `length_delimited` or `newline_delimited`, e.g. by
 setting
 
-```toml
-framing.method = "newline_delimited"
+```yaml
+framing:
+  method: "newline_delimited"
 ```
 
 in your sink configuration.
@@ -353,10 +358,9 @@ This was introduced in order to better handle metrics sent from the `datadog_age
 
 The result is that configurations with VRL expressions that expect the namespace to be in the name will need to be adapted to either remove the namespace from the name, or join the namespace and the name, for example:
 
-```toml
-full_metric_name = """
-join([.namespace, .name], ".")
-"""
+```yaml
+full_metric_name: |
+  join([.namespace, .name], ".")
 ```
 
 ### Deprecations
@@ -365,14 +369,15 @@ join([.namespace, .name], ".")
 
 We are deprecating setting encoding options by a shorthand string. E.g. when your sink encoding used
 
-```toml
-encoding = "json"
+```yaml
+encoding: "json"
 ```
 
 it should now be replaced by explicitly setting the `codec`
 
-```toml
-encoding.codec = "json"
+```yaml
+encoding:
+  codec: "json"
 ```
 
 #### Sink encoding value `ndjson` is now `json` encoding + `newline_delimited` framing {#sink-encoding-ndjson-json}
@@ -382,20 +387,24 @@ can be set explicitly via a dedicated `framing` option.
 
 This affects all sink configurations that previously used
 
-```toml
-encoding.codec = "ndjson"
+```yaml
+encoding:
+  codec: "ndjson"
 ```
 
 The `http`, `aws_s3`, `gcp_cloud_storage` and `azure_blob` sinks should be configured to use a combination of `json`
 encoding and `newline_delimited` framing instead
 
-```toml
-framing.method = "newline_delimited"
-encoding.codec = "json"
+```yaml
+framing:
+  method: "newline_delimited"
+encoding:
+  codec: "json"
 ```
 
 For all other sinks, simply set the codec to `json` to maintain the current behavior
 
-```toml
-encoding.codec = "json"
+```yaml
+encoding:
+  codec: "json"
 ```
diff --git a/website/content/en/highlights/2022-07-07-secrets-management.md b/website/content/en/highlights/2022-07-07-secrets-management.md
index 5f69e3783df04..6fc766134e671 100644
--- a/website/content/en/highlights/2022-07-07-secrets-management.md
+++ b/website/content/en/highlights/2022-07-07-secrets-management.md
@@ -19,21 +19,24 @@ these values can be read if a user on a host has access to read from the `/proc`
 
 A secret backend can be configured like this:
 
-```toml
-[secret.backend_1]
-type = "exec" # exec is the only supported backend as of writing
-command = ["/path/to/cmd1"]
+```yaml
+secret:
+  backend_1:
+    type: "exec" # exec is the only supported backend as of writing
+    command: ["/path/to/cmd1"]
 ```
 
 You can then specify where secrets should be read via `SECRET[<backend name>.<secret name>]` in the config like:
 
-```toml
-[sources.my_source_id]
-type = "aws_sqs"
-region = "us-east-1"
-queue_url = "https://sqs.us-east-2.amazonaws.com/123456789012/MyQueue"
-auth.access_key_id = "SECRET[backend_1.aws_access_key_id]"
-auth.secret_access_key = "SECRET[backend_1.aws_secret_access_key]"
+```yaml
+sources:
+  my_source_id:
+    type: "aws_sqs"
+    region: "us-east-1"
+    queue_url: "https://sqs.us-east-2.amazonaws.com/123456789012/MyQueue"
+    auth:
+      access_key_id: "SECRET[backend_1.aws_access_key_id]"
+      secret_access_key: "SECRET[backend_1.aws_secret_access_key]"
 ```
 
 Here `auth.access_key_id` and `auth.secret_access_key` will use secrets provided by the `backend_1` secret backend.
diff --git a/website/content/en/highlights/2022-07-07-sink-codecs.md b/website/content/en/highlights/2022-07-07-sink-codecs.md
index 7e00290826a50..d6c0f75c47020 100644
--- a/website/content/en/highlights/2022-07-07-sink-codecs.md
+++ b/website/content/en/highlights/2022-07-07-sink-codecs.md
@@ -20,13 +20,16 @@ For example, if you have a `socket` sink that you want to send
 [length-delimited][length_delimited] JSON-encoded, messages, you can now do so
 with configuration like:
 
-```toml
-[sinks.socket]
-type = "socket"
-address = "92.12.333.224:5000"
-mode = "tcp"
-framing.method = "length_delimited"
-encoding.codec = "json"
+```yaml
+sinks:
+  socket:
+    type: "socket"
+    address: "92.12.333.224:5000"
+    mode: "tcp"
+    framing:
+      method: "length_delimited"
+    encoding:
+      codec: "json"
 ```
 
 This will encode messages flowing into this sink as JSON and frame them using
diff --git a/website/content/en/highlights/2022-10-04-0-25-0-upgrade-guide.md b/website/content/en/highlights/2022-10-04-0-25-0-upgrade-guide.md
index 8464524b01c45..61050ecefca6b 100644
--- a/website/content/en/highlights/2022-10-04-0-25-0-upgrade-guide.md
+++ b/website/content/en/highlights/2022-10-04-0-25-0-upgrade-guide.md
@@ -67,16 +67,17 @@ Additionally, the [account ID][nr_account_id] must also now be specified.
 All put together, here's an example of converting from a `new_relic_logs` sink configuration over to
 the `new_relic` sink configuration:
 
-```toml
-[sinks.new_relic_logs]
-type = "new_relic_logs"
-license_key = "xxxx"
-
-[sinks.new_relic]
-type = "new_relic"
-license_key = "xxxx"
-account_id = "yyyy"
-api = "logs"
+```yaml
+sinks:
+  new_relic_logs:
+    type: "new_relic_logs"
+    license_key: "xxxx"
+
+  new_relic:
+    type: "new_relic"
+    license_key: "xxxx"
+    account_id: "yyyy"
+    api: "logs"
 ```
 
 [0-24-0-upgrade-guide]: https://vector.dev/highlights/2022-08-16-0-24-0-upgrade-guide/#deprecated-components
@@ -143,27 +144,28 @@ The older version 1 API is now deprecated and will be removed in a future versio
 
 For example, the following partial configuration:
 
-```toml
-[transform.example]
-type = "lua"
-version = 1
-source = """
-  event["a"] = "some value"
-  event["b"] = nil
-"""
+```yaml
+transforms:
+  example:
+    type: "lua"
+    version: 1
+    source: |
+      event["a"] = "some value"
+      event["b"] = nil
 ```
 
 would need to be converted to the following:
 
-```toml
-[transform.example]
-type = "lua"
-version = 2
-hooks.process = """
-  function (event, emit)
-    event.log.a = "some value"
-    event.log.b = nil
-    emit(event)
-  end
-"""
+```yaml
+transforms:
+  example:
+    type: "lua"
+    version: 2
+    hooks:
+      process: |
+        function (event, emit)
+          event.log.a = "some value"
+          event.log.b = nil
+          emit(event)
+        end
 ```
diff --git a/website/content/en/highlights/2024-07-29-0-40-0-upgrade-guide.md b/website/content/en/highlights/2024-07-29-0-40-0-upgrade-guide.md
index 5813dfc248a40..7160cfc402ca0 100644
--- a/website/content/en/highlights/2024-07-29-0-40-0-upgrade-guide.md
+++ b/website/content/en/highlights/2024-07-29-0-40-0-upgrade-guide.md
@@ -73,10 +73,11 @@ The new behavior is to use the default strategy based on the element type.
 
 ###### Config
 
-```toml
-group_by = [ "id" ]
-merge_strategies.id = "discard"
-merge_strategies."a.b[0]" = "array"
+```yaml
+group_by: ["id"]
+merge_strategies:
+  id: "discard"
+  "a.b[0]": "array"
 ```
 
 ###### Event 1

From 43f620435a353b048c40661f59a2d2d18f2419ed Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 13 Apr 2026 12:24:37 -0400
Subject: [PATCH 122/326] fix(observability): fix panic in allocation tracing
 dealloc path (#25136)

* fix(observability): fix panic in allocation tracing when deallocating pre-tracking memory

When `--allocation-tracing` is enabled at runtime, the custom allocator
wraps every allocation with an extra byte to store the allocation group
ID. Previously, allocations made before tracking was enabled used the
original (unwrapped) layout. When those were later freed, `dealloc`
read an out-of-bounds byte as the group ID, hitting
`NonZeroU8::new_unchecked(0)` -- undefined behavior that recent Rust
toolchains (>= ~1.78) turn into an abort in debug builds.

Additionally, reentrant allocations (wrapped layout but tracing closure
skipped) left the group ID header uninitialized, causing misattributed
deallocations and skewed per-group memory accounting.

Fix: always allocate with the wrapped layout, regardless of whether
tracking is currently enabled. The group ID header byte is set to:
- UNTRACKED (0): tracking was off at allocation time
- UNTRACED (u8::MAX): tracking was on but the tracing closure was
  skipped due to reentrancy
- A real group ID (1..254): normal traced allocation

On deallocation, all paths free with the wrapped layout (which is
always correct now). UNTRACKED and UNTRACED skip `trace_deallocation`
to keep per-group accounting balanced.

This eliminates:
- The original panic/UB from `NonZero::new_unchecked(0)`
- Layout mismatches for pre-tracking allocations (including realloc)
- Accounting skew from uninitialized headers on reentrant allocations

This bug has been latent since #15221 (Nov 2022) which introduced the
runtime toggle.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* add authors

* fix(observability): strengthen allocation tracing tests

Harden test coverage based on code review feedback:
- Assert exact ROOT group ID and trace counters in tracked alloc test
- Add end-to-end reentrant allocation test that exercises the real
  reentrancy path via thread-local borrow
- Remove redundant manual-sentinel test now covered by reentrant test
- Rename sentinel collision test to reflect what it actually checks

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 ...ix_allocation_tracing_dealloc_panic.fix.md |   3 +
 .../allocator/tracing_allocator.rs            | 202 ++++++++++++++++--
 2 files changed, 192 insertions(+), 13 deletions(-)
 create mode 100644 changelog.d/fix_allocation_tracing_dealloc_panic.fix.md

diff --git a/changelog.d/fix_allocation_tracing_dealloc_panic.fix.md b/changelog.d/fix_allocation_tracing_dealloc_panic.fix.md
new file mode 100644
index 0000000000000..732c836eac0e8
--- /dev/null
+++ b/changelog.d/fix_allocation_tracing_dealloc_panic.fix.md
@@ -0,0 +1,3 @@
+Fixed a panic (abort) when running with `--allocation-tracing` in debug builds, caused by deallocating memory that was allocated before tracking was enabled. Also fixed per-group memory accounting skew for reentrant allocations whose tracing closure was skipped, which left the group ID header uninitialized and caused deallocations to be attributed to wrong groups.
+
+authors: pront
diff --git a/src/internal_telemetry/allocations/allocator/tracing_allocator.rs b/src/internal_telemetry/allocations/allocator/tracing_allocator.rs
index 8d1eff3e36d4e..d0a2027eeb2e4 100644
--- a/src/internal_telemetry/allocations/allocator/tracing_allocator.rs
+++ b/src/internal_telemetry/allocations/allocator/tracing_allocator.rs
@@ -9,8 +9,24 @@ use super::{
 };
 use crate::internal_telemetry::allocations::TRACK_ALLOCATIONS;
 
+/// Header value for allocations made while tracking is disabled.
+/// On deallocation we free with the wrapped layout but skip tracing.
+const UNTRACKED: u8 = 0;
+
+/// Header value for allocations whose tracing closure was skipped due to
+/// reentrancy. `register()` never hands out `u8::MAX`, so this cannot
+/// collide with a real group ID. On deallocation we free with the wrapped
+/// layout but skip `trace_deallocation` to keep accounting balanced.
+const UNTRACED: u8 = u8::MAX;
+
 /// A tracing allocator that groups allocation events by groups.
 ///
+/// Every allocation made through this allocator uses the "wrapped" layout:
+/// the requested layout extended by one byte to store an allocation group
+/// ID. This byte is always present regardless of whether tracking is
+/// enabled, which guarantees that `dealloc` can always read a valid header
+/// and free with the correct (wrapped) layout.
+///
 /// This allocator can only be used when specified via `#[global_allocator]`.
 pub struct GroupedTraceableAllocator<A, T> {
     allocator: A,
@@ -29,11 +45,6 @@ unsafe impl<A: GlobalAlloc, T: Tracer> GlobalAlloc for GroupedTraceableAllocator
     #[inline]
     unsafe fn alloc(&self, object_layout: Layout) -> *mut u8 {
         unsafe {
-            if !TRACK_ALLOCATIONS.load(Ordering::Relaxed) {
-                return self.allocator.alloc(object_layout);
-            }
-
-            // Allocate our wrapped layout and make sure the allocation succeeded.
             let (actual_layout, offset_to_group_id) = get_wrapped_layout(object_layout);
             let actual_ptr = self.allocator.alloc(actual_layout);
             if actual_ptr.is_null() {
@@ -42,6 +53,16 @@ unsafe impl<A: GlobalAlloc, T: Tracer> GlobalAlloc for GroupedTraceableAllocator
 
             let group_id_ptr = actual_ptr.add(offset_to_group_id).cast::<u8>();
 
+            if !TRACK_ALLOCATIONS.load(Ordering::Relaxed) {
+                group_id_ptr.write(UNTRACKED);
+                return actual_ptr;
+            }
+
+            // Write the untraced sentinel so that `dealloc` always finds a
+            // valid header, even when the tracing closure below is skipped
+            // due to reentrancy.
+            group_id_ptr.write(UNTRACED);
+
             let object_size = object_layout.size();
 
             try_with_suspended_allocation_group(
@@ -58,19 +79,19 @@ unsafe impl<A: GlobalAlloc, T: Tracer> GlobalAlloc for GroupedTraceableAllocator
     #[inline]
     unsafe fn dealloc(&self, object_ptr: *mut u8, object_layout: Layout) {
         unsafe {
-            if !TRACK_ALLOCATIONS.load(Ordering::Relaxed) {
-                self.allocator.dealloc(object_ptr, object_layout);
-                return;
-            }
-            // Regenerate the wrapped layout so we know where we have to look, as the pointer we've given relates to the
-            // requested layout, not the wrapped layout that was actually allocated.
             let (wrapped_layout, offset_to_group_id) = get_wrapped_layout(object_layout);
-
             let raw_group_id = object_ptr.add(offset_to_group_id).cast::<u8>().read();
 
-            // Deallocate before tracking, just to make sure we're reclaiming memory as soon as possible.
+            // Always free with the wrapped layout since all allocations
+            // (tracked or not) use it.
             self.allocator.dealloc(object_ptr, wrapped_layout);
 
+            // Skip tracing for untracked (tracking was off) and untraced
+            // (reentrant, closure skipped) allocations.
+            if raw_group_id == UNTRACKED || raw_group_id == UNTRACED {
+                return;
+            }
+
             let object_size = object_layout.size();
             let source_group_id = AllocationGroupId::from_raw(raw_group_id);
 
@@ -96,3 +117,158 @@ fn get_wrapped_layout(object_layout: Layout) -> (Layout, usize) {
 
     (actual_layout.pad_to_align(), offset_to_group_id)
 }
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        alloc::{GlobalAlloc, Layout, System},
+        sync::atomic::{AtomicUsize, Ordering},
+    };
+
+    use serial_test::serial;
+
+    use super::*;
+    use crate::internal_telemetry::allocations::allocator::{
+        token::AllocationGroupId, tracer::Tracer,
+    };
+
+    /// RAII guard that enables `TRACK_ALLOCATIONS` on creation and
+    /// restores it to `false` on drop, ensuring cleanup even if the
+    /// test panics.
+    struct TrackingGuard;
+
+    impl TrackingGuard {
+        fn enable() -> Self {
+            TRACK_ALLOCATIONS.store(true, Ordering::Release);
+            Self
+        }
+    }
+
+    impl Drop for TrackingGuard {
+        fn drop(&mut self) {
+            TRACK_ALLOCATIONS.store(false, Ordering::Release);
+        }
+    }
+
+    struct CountingTracer {
+        allocs: AtomicUsize,
+        deallocs: AtomicUsize,
+    }
+
+    impl CountingTracer {
+        const fn new() -> Self {
+            Self {
+                allocs: AtomicUsize::new(0),
+                deallocs: AtomicUsize::new(0),
+            }
+        }
+    }
+
+    impl Tracer for CountingTracer {
+        fn trace_allocation(&self, _size: usize, _group_id: AllocationGroupId) {
+            self.allocs.fetch_add(1, Ordering::Relaxed);
+        }
+
+        fn trace_deallocation(&self, _size: usize, _source_group_id: AllocationGroupId) {
+            self.deallocs.fetch_add(1, Ordering::Relaxed);
+        }
+    }
+
+    #[test]
+    fn sentinels_do_not_collide_with_root_id() {
+        assert_eq!(UNTRACED, u8::MAX);
+        assert_ne!(UNTRACED, AllocationGroupId::ROOT.as_raw());
+        assert_ne!(UNTRACKED, AllocationGroupId::ROOT.as_raw());
+    }
+
+    /// Allocations made while tracking is disabled get UNTRACKED (0) in the
+    /// header. Deallocating them (whether tracking is on or off) must use
+    /// the wrapped layout and skip tracing.
+    #[test]
+    #[serial]
+    fn untracked_alloc_dealloc_skips_tracing() {
+        let allocator = GroupedTraceableAllocator::new(System, CountingTracer::new());
+        let layout = Layout::from_size_align(64, 8).unwrap();
+
+        // Tracking starts off (default state). Allocate while disabled.
+        let ptr = unsafe { allocator.alloc(layout) };
+        assert!(!ptr.is_null());
+
+        // Header must be UNTRACKED.
+        let (_, offset) = get_wrapped_layout(layout);
+        let raw_id = unsafe { ptr.add(offset).cast::<u8>().read() };
+        assert_eq!(raw_id, UNTRACKED);
+
+        // Enable tracking, then dealloc -- must not panic, no trace events.
+        let _guard = TrackingGuard::enable();
+        unsafe { allocator.dealloc(ptr, layout) };
+
+        assert_eq!(allocator.tracer.allocs.load(Ordering::Relaxed), 0);
+        assert_eq!(allocator.tracer.deallocs.load(Ordering::Relaxed), 0);
+    }
+
+    /// Tracked allocation: header is a valid non-zero, non-sentinel group
+    /// ID, tracing fires for both alloc and dealloc, and dealloc completes
+    /// without panic.
+    #[test]
+    #[serial]
+    fn tracked_alloc_dealloc_does_not_panic() {
+        let allocator = GroupedTraceableAllocator::new(System, CountingTracer::new());
+        let layout = Layout::from_size_align(64, 8).unwrap();
+
+        let _guard = TrackingGuard::enable();
+        let ptr = unsafe { allocator.alloc(layout) };
+        assert!(!ptr.is_null());
+
+        let (_, offset) = get_wrapped_layout(layout);
+        let raw_id = unsafe { ptr.add(offset).cast::<u8>().read() };
+        assert_eq!(
+            raw_id,
+            AllocationGroupId::ROOT.as_raw(),
+            "header must be the ROOT group ID"
+        );
+        assert_eq!(allocator.tracer.allocs.load(Ordering::Relaxed), 1);
+
+        unsafe { allocator.dealloc(ptr, layout) };
+
+        assert_eq!(allocator.tracer.deallocs.load(Ordering::Relaxed), 1);
+    }
+
+    /// End-to-end reentrant allocation: hold a mutable borrow on the
+    /// thread-local group stack so `try_with_suspended_allocation_group`
+    /// skips the tracing closure. The header must be UNTRACED and both
+    /// trace counters must stay at zero through alloc + dealloc.
+    #[test]
+    #[serial]
+    fn reentrant_alloc_writes_untraced_and_skips_tracing() {
+        use crate::internal_telemetry::allocations::allocator::token::LOCAL_ALLOCATION_GROUP_STACK;
+
+        let allocator = GroupedTraceableAllocator::new(System, CountingTracer::new());
+        let layout = Layout::from_size_align(64, 8).unwrap();
+
+        let _guard = TrackingGuard::enable();
+
+        // Hold a mutable borrow to simulate reentrancy -- any nested
+        // `try_borrow_mut` inside `try_with_suspended_allocation_group`
+        // will fail, causing the tracing closure to be skipped.
+        LOCAL_ALLOCATION_GROUP_STACK.with(|group_stack| {
+            let _borrow = group_stack.borrow_mut();
+
+            let ptr = unsafe { allocator.alloc(layout) };
+            assert!(!ptr.is_null());
+
+            let (_, offset) = get_wrapped_layout(layout);
+            let raw_id = unsafe { ptr.add(offset).cast::<u8>().read() };
+            assert_eq!(
+                raw_id, UNTRACED,
+                "reentrant alloc must write UNTRACED sentinel"
+            );
+
+            assert_eq!(allocator.tracer.allocs.load(Ordering::Relaxed), 0);
+
+            unsafe { allocator.dealloc(ptr, layout) };
+
+            assert_eq!(allocator.tracer.deallocs.load(Ordering::Relaxed), 0);
+        });
+    }
+}

From c6574fd66c328ef57fba27d2ad5422666c3e18eb Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 13 Apr 2026 12:26:51 -0400
Subject: [PATCH 123/326] enhancement(api)!: replace custom Health RPC with
 standard gRPC health service (#25139)

* enhancement(api)!: replace custom Health RPC with standard gRPC health service

Replace the custom `ObservabilityService/Health` RPC with the standard
`grpc.health.v1.Health` service on the observability API (port 8686).

This enables native Kubernetes gRPC health probes, `grpc-health-probe`,
and other standard tooling to work out of the box. The empty service
name (`""`) is used for whole-server health, matching what Kubernetes
probes and `grpc-health-probe` query by default.

Key changes:
- Remove Health RPC, HealthRequest, HealthResponse from the proto
- Add tonic_health standard health service to the gRPC server
- Switch vector-api-client to use tonic_health HealthClient; the
  client checks ServingStatus and returns NotServing error if not SERVING
- Flip health to NOT_SERVING in TopologyController::stop before draining
  the topology, so Kubernetes removes the pod from endpoints early
- Update docs, changelog, and add integration test

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix gate

* cleanup

* Update src/topology/controller.rs

Co-authored-by: Thomas <thomas.schneider@datadoghq.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock                                  |  1 +
 Cargo.toml                                  |  1 +
 changelog.d/graphql_to_grpc_api.breaking.md |  4 +-
 lib/vector-api-client/Cargo.toml            |  1 +
 lib/vector-api-client/src/client.rs         | 51 ++++++++++++++++-----
 lib/vector-api-client/src/error.rs          |  3 ++
 lib/vector-api-client/src/lib.rs            |  6 +--
 proto/vector/observability.proto            | 11 +----
 src/api/grpc/service.rs                     | 21 ++-------
 src/api/grpc_server.rs                      | 34 +++++++++-----
 src/app.rs                                  |  3 --
 src/topology/controller.rs                  | 21 +++++----
 src/topology/running.rs                     |  9 +---
 tests/vector_api/health.rs                  | 25 ++++++++++
 tests/vector_api/lib.rs                     |  1 +
 website/content/en/docs/reference/api.md    |  4 +-
 16 files changed, 119 insertions(+), 77 deletions(-)
 create mode 100644 tests/vector_api/health.rs

diff --git a/Cargo.lock b/Cargo.lock
index 054d3afc66007..d013bc09432ec 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -12453,6 +12453,7 @@ dependencies = [
  "tokio-stream",
  "tonic 0.11.0",
  "tonic-build 0.11.0",
+ "tonic-health",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 9389c9420d248..84d89c50096f9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -561,6 +561,7 @@ docker = ["dep:bollard", "dep:dirs-next"]
 api = [
   "dep:base64",
   "dep:tonic",
+  "dep:tonic-health",
   "dep:tonic-reflection",
   "dep:prost",
   "dep:prost-types",
diff --git a/changelog.d/graphql_to_grpc_api.breaking.md b/changelog.d/graphql_to_grpc_api.breaking.md
index 20ab9d67b35e3..2c9756ee16a89 100644
--- a/changelog.d/graphql_to_grpc_api.breaking.md
+++ b/changelog.d/graphql_to_grpc_api.breaking.md
@@ -27,8 +27,8 @@ vector top --url http://localhost:8686
   [grpcurl](https://github.com/fullstorydev/grpcurl):
 
 ```bash
-# Check health
-grpcurl -plaintext localhost:8686 vector.observability.v1.ObservabilityService/Health
+# Check health (standard gRPC health check, compatible with Kubernetes gRPC probes)
+grpcurl -plaintext localhost:8686 grpc.health.v1.Health/Check
 
 # List components
 grpcurl -plaintext localhost:8686 vector.observability.v1.ObservabilityService/GetComponents
diff --git a/lib/vector-api-client/Cargo.toml b/lib/vector-api-client/Cargo.toml
index 00243fb9d0ecd..260a84a927e76 100644
--- a/lib/vector-api-client/Cargo.toml
+++ b/lib/vector-api-client/Cargo.toml
@@ -9,6 +9,7 @@ license = "MPL-2.0"
 [dependencies]
 # gRPC
 tonic.workspace = true
+tonic-health.workspace = true
 prost.workspace = true
 prost-types.workspace = true
 
diff --git a/lib/vector-api-client/src/client.rs b/lib/vector-api-client/src/client.rs
index fcba2702a3e2a..0d8fda1b15aaf 100644
--- a/lib/vector-api-client/src/client.rs
+++ b/lib/vector-api-client/src/client.rs
@@ -1,17 +1,20 @@
 use http::Uri;
 use tokio_stream::{Stream, StreamExt};
 use tonic::transport::{Channel, Endpoint};
+use tonic_health::pb::{
+    HealthCheckRequest, health_check_response::ServingStatus, health_client::HealthClient,
+};
 
 use crate::{
     error::{Error, Result},
     proto::{
         GetAllocationTracingStatusRequest, GetAllocationTracingStatusResponse,
-        GetComponentsRequest, GetComponentsResponse, GetMetaRequest, GetMetaResponse,
-        HealthRequest, HealthResponse, MetricName, StreamComponentAllocatedBytesRequest,
-        StreamComponentAllocatedBytesResponse, StreamComponentMetricsRequest,
-        StreamComponentMetricsResponse, StreamHeartbeatRequest, StreamHeartbeatResponse,
-        StreamOutputEventsRequest, StreamOutputEventsResponse, StreamUptimeRequest,
-        StreamUptimeResponse, observability_service_client::ObservabilityServiceClient,
+        GetComponentsRequest, GetComponentsResponse, GetMetaRequest, GetMetaResponse, MetricName,
+        StreamComponentAllocatedBytesRequest, StreamComponentAllocatedBytesResponse,
+        StreamComponentMetricsRequest, StreamComponentMetricsResponse, StreamHeartbeatRequest,
+        StreamHeartbeatResponse, StreamOutputEventsRequest, StreamOutputEventsResponse,
+        StreamUptimeRequest, StreamUptimeResponse,
+        observability_service_client::ObservabilityServiceClient,
     },
 };
 
@@ -19,6 +22,7 @@ use crate::{
 #[derive(Debug, Clone)]
 pub struct Client {
     endpoint: Endpoint,
+    channel: Option<Channel>,
     client: Option<ObservabilityServiceClient<Channel>>,
 }
 
@@ -33,6 +37,7 @@ impl Client {
     pub fn new(uri: Uri) -> Self {
         Self {
             endpoint: Endpoint::from(uri),
+            channel: None,
             client: None,
         }
     }
@@ -40,7 +45,8 @@ impl Client {
     /// Connect to the gRPC server
     pub async fn connect(&mut self) -> Result<()> {
         let channel = self.endpoint.connect().await?;
-        self.client = Some(ObservabilityServiceClient::new(channel));
+        self.client = Some(ObservabilityServiceClient::new(channel.clone()));
+        self.channel = Some(channel);
         Ok(())
     }
 
@@ -49,13 +55,34 @@ impl Client {
         self.client.as_mut().ok_or(Error::NotConnected)
     }
 
+    /// Get the underlying channel
+    fn channel(&self) -> Result<&Channel> {
+        self.channel.as_ref().ok_or(Error::NotConnected)
+    }
+
     // ========== Unary RPCs ==========
 
-    /// Check if the API server is healthy
-    pub async fn health(&mut self) -> Result<HealthResponse> {
-        let client = self.ensure_connected()?;
-        let response = client.health(HealthRequest {}).await?;
-        Ok(response.into_inner())
+    /// Check if the API server is healthy using the standard gRPC health check
+    /// protocol (grpc.health.v1.Health/Check).
+    ///
+    /// Queries the empty service name (`""`), which represents whole-server
+    /// health. This is the default used by Kubernetes gRPC probes and
+    /// `grpc-health-probe`.
+    ///
+    /// Returns `Ok(())` if the server is `SERVING`, or an error otherwise.
+    pub async fn health(&mut self) -> Result<()> {
+        let channel = self.channel()?.clone();
+        let mut health_client = HealthClient::new(channel);
+        let response = health_client
+            .check(HealthCheckRequest {
+                service: String::new(),
+            })
+            .await?;
+        let status = response.into_inner().status;
+        if status != ServingStatus::Serving as i32 {
+            return Err(Error::NotServing { status });
+        }
+        Ok(())
     }
 
     /// Get metadata about the Vector instance
diff --git a/lib/vector-api-client/src/error.rs b/lib/vector-api-client/src/error.rs
index 65fcfd80b511f..34eb347af12d8 100644
--- a/lib/vector-api-client/src/error.rs
+++ b/lib/vector-api-client/src/error.rs
@@ -16,6 +16,9 @@ pub enum Error {
     #[snafu(display("Not connected to gRPC server"))]
     NotConnected,
 
+    #[snafu(display("Server is not serving (status: {})", status))]
+    NotServing { status: i32 },
+
     #[snafu(display("Stream error: {}", message))]
     Stream { message: String },
 }
diff --git a/lib/vector-api-client/src/lib.rs b/lib/vector-api-client/src/lib.rs
index a05002ebb3e61..74b72f2f0ea5b 100644
--- a/lib/vector-api-client/src/lib.rs
+++ b/lib/vector-api-client/src/lib.rs
@@ -11,9 +11,9 @@
 //! let mut client = Client::new("http://localhost:9999".parse().unwrap());
 //! client.connect().await?;
 //!
-//! // Check health
-//! let health = client.health().await?;
-//! println!("Healthy: {}", health.healthy);
+//! // Check health (standard gRPC health check)
+//! client.health().await?;
+//! println!("Server is healthy");
 //!
 //! // Get components
 //! let components = client.get_components(0).await?;
diff --git a/proto/vector/observability.proto b/proto/vector/observability.proto
index 9996a47908949..57ce1a3f40002 100644
--- a/proto/vector/observability.proto
+++ b/proto/vector/observability.proto
@@ -8,9 +8,6 @@ import "event.proto";
 service ObservabilityService {
   // ========== Simple Queries ==========
 
-  // Check if the API server is healthy and responding
-  rpc Health(HealthRequest) returns (HealthResponse);
-
   // Get metadata about the Vector instance (version, hostname)
   rpc GetMeta(GetMetaRequest) returns (GetMetaResponse);
 
@@ -42,13 +39,7 @@ service ObservabilityService {
   rpc StreamOutputEvents(StreamOutputEventsRequest) returns (stream StreamOutputEventsResponse);
 }
 
-// ========== Health & Meta Messages ==========
-
-message HealthRequest {}
-
-message HealthResponse {
-  bool healthy = 1;
-}
+// ========== Meta Messages ==========
 
 message GetMetaRequest {}
 
diff --git a/src/api/grpc/service.rs b/src/api/grpc/service.rs
index 580ebb69b5219..110ef9d5ba441 100644
--- a/src/api/grpc/service.rs
+++ b/src/api/grpc/service.rs
@@ -4,10 +4,7 @@ use std::pin::Pin;
 // (only used in synchronous map updates inside IntervalStream closures), so the
 // cheaper std mutex is correct here. tokio::sync::Mutex is only needed when the
 // critical section itself contains .await.
-use std::sync::{
-    Arc, Mutex,
-    atomic::{AtomicBool, Ordering},
-};
+use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
 use futures::{StreamExt as FuturesStreamExt, stream};
@@ -399,12 +396,11 @@ fn ports_to_proto_outputs(
 /// gRPC observability service implementation.
 pub struct ObservabilityService {
     watch_rx: WatchRx,
-    running: Arc<AtomicBool>,
 }
 
 impl ObservabilityService {
-    pub const fn new(watch_rx: WatchRx, running: Arc<AtomicBool>) -> Self {
-        Self { watch_rx, running }
+    pub const fn new(watch_rx: WatchRx) -> Self {
+        Self { watch_rx }
     }
 }
 
@@ -412,17 +408,6 @@ impl ObservabilityService {
 impl observability::Service for ObservabilityService {
     // ========== Simple Queries ==========
 
-    async fn health(
-        &self,
-        _request: Request<HealthRequest>,
-    ) -> Result<Response<HealthResponse>, Status> {
-        if self.running.load(Ordering::Relaxed) {
-            Ok(Response::new(HealthResponse { healthy: true }))
-        } else {
-            Err(Status::unavailable("Vector is shutting down"))
-        }
-    }
-
     async fn get_meta(
         &self,
         _request: Request<GetMetaRequest>,
diff --git a/src/api/grpc_server.rs b/src/api/grpc_server.rs
index 714459cd39b79..ce33b0da3f7d5 100644
--- a/src/api/grpc_server.rs
+++ b/src/api/grpc_server.rs
@@ -1,11 +1,8 @@
-use std::{
-    error::Error as StdError,
-    net::SocketAddr,
-    sync::{Arc, atomic::AtomicBool},
-};
+use std::{error::Error as StdError, net::SocketAddr};
 use tokio::sync::oneshot;
 use tokio_stream::wrappers::TcpListenerStream;
 use tonic::transport::Server as TonicServer;
+use tonic_health::server::{HealthReporter, health_reporter};
 use vector_lib::tap::topology::WatchRx;
 
 use super::grpc::ObservabilityService;
@@ -14,6 +11,7 @@ use crate::{config::Config, proto::observability::Server as ObservabilityServer}
 /// gRPC API server for Vector observability.
 pub struct GrpcServer {
     _shutdown: oneshot::Sender<()>,
+    health_reporter: HealthReporter,
     addr: SocketAddr,
 }
 
@@ -25,11 +23,7 @@ impl GrpcServer {
     /// is dropped.
     ///
     /// Returns an error if the server fails to bind to the configured address.
-    pub async fn start(
-        config: &Config,
-        watch_rx: WatchRx,
-        running: Arc<AtomicBool>,
-    ) -> crate::Result<Self> {
+    pub async fn start(config: &Config, watch_rx: WatchRx) -> crate::Result<Self> {
         let addr = config.api.address.ok_or_else(|| {
             crate::Error::from("API address not configured in config.api.address")
         })?;
@@ -46,7 +40,11 @@ impl GrpcServer {
 
         info!("GRPC API server bound to {}.", actual_addr);
 
-        let service = ObservabilityService::new(watch_rx, running);
+        let service = ObservabilityService::new(watch_rx);
+
+        // Create the standard gRPC health service (grpc.health.v1.Health).
+        // The empty service ("") is registered as SERVING by default.
+        let (health_reporter, health_service) = health_reporter();
 
         let (_shutdown, rx) = oneshot::channel();
 
@@ -59,10 +57,12 @@ impl GrpcServer {
                 .register_encoded_file_descriptor_set(
                     crate::proto::observability::FILE_DESCRIPTOR_SET,
                 )
+                .register_encoded_file_descriptor_set(tonic_health::pb::FILE_DESCRIPTOR_SET)
                 .build()
                 .expect("Failed to build reflection service");
 
             let result = TonicServer::builder()
+                .add_service(health_service)
                 .add_service(ObservabilityServer::new(service))
                 .add_service(reflection_service)
                 .serve_with_incoming_shutdown(incoming, async {
@@ -85,10 +85,22 @@ impl GrpcServer {
 
         Ok(Self {
             _shutdown,
+            health_reporter,
             addr: actual_addr,
         })
     }
 
+    /// Signal that the server is no longer serving.
+    ///
+    /// Call this **before** draining the topology so that Kubernetes gRPC
+    /// readiness probes fail early and the pod is removed from endpoints
+    /// before the process exits.
+    pub async fn set_not_serving(&mut self) {
+        self.health_reporter
+            .set_service_status("", tonic_health::ServingStatus::NotServing)
+            .await;
+    }
+
     /// Get the address the server is listening on
     pub const fn addr(&self) -> SocketAddr {
         self.addr
diff --git a/src/app.rs b/src/app.rs
index 904d42be11968..580c06642a6e3 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -38,8 +38,6 @@ use crate::{
     },
     trace,
 };
-#[cfg(feature = "api")]
-use std::sync::Arc;
 
 static WORKER_THREADS: AtomicUsize = AtomicUsize::new(0);
 
@@ -143,7 +141,6 @@ impl ApplicationConfig {
             let api_server = handle.block_on(api::GrpcServer::start(
                 self.topology.config(),
                 self.topology.watch(),
-                Arc::clone(&self.topology.running),
             ));
             match api_server {
                 Ok(server) => {
diff --git a/src/topology/controller.rs b/src/topology/controller.rs
index b77629828a577..efbe82cf594ac 100644
--- a/src/topology/controller.rs
+++ b/src/topology/controller.rs
@@ -76,13 +76,7 @@ impl TopologyController {
         } else if self.api_server.is_none() {
             debug!("Starting gRPC API server.");
 
-            match api::GrpcServer::start(
-                self.topology.config(),
-                self.topology.watch(),
-                Arc::clone(&self.topology.running),
-            )
-            .await
-            {
+            match api::GrpcServer::start(self.topology.config(), self.topology.watch()).await {
                 Ok(api_server) => {
                     let addr = api_server.addr();
                     info!(
@@ -156,7 +150,18 @@ impl TopologyController {
         }
     }
 
-    pub async fn stop(self) {
+    #[cfg_attr(not(feature = "api"), allow(unused_mut))]
+    pub async fn stop(mut self) {
+        // Phase 1: Mark the gRPC API as unavailable so that external probes
+        // (e.g. Kubernetes readiness) fail early and stop routing traffic
+        // to this instance.
+        #[cfg(feature = "api")]
+        if let Some(server) = self.api_server.as_mut() {
+            server.set_not_serving().await;
+        }
+
+        // Phase 2: Drain the topology -- shuts down sources, waits for
+        // in-flight events to flush through transforms and sinks.
         self.topology.stop().await;
     }
 
diff --git a/src/topology/running.rs b/src/topology/running.rs
index 6839379cd0f1a..a1ecf7278ae89 100644
--- a/src/topology/running.rs
+++ b/src/topology/running.rs
@@ -1,9 +1,6 @@
 use std::{
     collections::{HashMap, HashSet},
-    sync::{
-        Arc, Mutex,
-        atomic::{AtomicBool, Ordering},
-    },
+    sync::{Arc, Mutex},
 };
 
 use futures::{Future, FutureExt, future};
@@ -66,7 +63,6 @@ pub struct RunningTopology {
     pub(crate) config: Config,
     pub(crate) abort_tx: mpsc::UnboundedSender<ShutdownError>,
     watch: (WatchTx, WatchRx),
-    pub(crate) running: Arc<AtomicBool>,
     graceful_shutdown_duration: Option<Duration>,
     utilization_registry: Option<UtilizationRegistry>,
     utilization_task: Option<TaskHandle>,
@@ -90,7 +86,6 @@ impl RunningTopology {
             tasks: HashMap::new(),
             abort_tx,
             watch: watch::channel(TapResource::default()),
-            running: Arc::new(AtomicBool::new(true)),
             graceful_shutdown_duration: config.graceful_shutdown_duration,
             config,
             utilization_registry: None,
@@ -148,8 +143,6 @@ impl RunningTopology {
     /// dropped then everything from this RunningTopology instance is fully
     /// dropped.
     pub fn stop(self) -> impl Future<Output = ()> {
-        // Update the API's health endpoint to signal shutdown
-        self.running.store(false, Ordering::Relaxed);
         // Create handy handles collections of all tasks for the subsequent
         // operations.
         let mut wait_handles = Vec::new();
diff --git a/tests/vector_api/health.rs b/tests/vector_api/health.rs
new file mode 100644
index 0000000000000..a17d16eecf913
--- /dev/null
+++ b/tests/vector_api/health.rs
@@ -0,0 +1,25 @@
+//! Integration tests for the standard gRPC health check on the observability API.
+
+use super::{common::*, harness::*};
+
+// ============================================================================
+// Tests
+// ============================================================================
+
+/// Verifies that the standard gRPC health check (empty service = whole-server
+/// health) reports SERVING on a running Vector instance.
+#[tokio::test]
+async fn health_check_reports_serving() {
+    let config = single_source_config("demo", 1.0, None);
+    let mut harness = TestHarness::new(&config)
+        .await
+        .expect("Vector should start");
+
+    harness
+        .api_client()
+        .health()
+        .await
+        .expect("health check should report SERVING");
+
+    assert!(harness.check_running(), "Vector should still be running");
+}
diff --git a/tests/vector_api/lib.rs b/tests/vector_api/lib.rs
index e82f39d41b42e..c6c7fbec35dd6 100644
--- a/tests/vector_api/lib.rs
+++ b/tests/vector_api/lib.rs
@@ -5,5 +5,6 @@
 
 mod common;
 mod harness;
+mod health;
 mod tap;
 mod top;
diff --git a/website/content/en/docs/reference/api.md b/website/content/en/docs/reference/api.md
index 11a3566f6acfa..949353241929b 100644
--- a/website/content/en/docs/reference/api.md
+++ b/website/content/en/docs/reference/api.md
@@ -24,8 +24,8 @@ You can interact with it using any standard gRPC tooling.
 ### Example using grpcurl
 
 ```bash
-# Check health
-grpcurl -plaintext localhost:8686 vector.observability.v1.ObservabilityService/Health
+# Check health (standard gRPC health check, compatible with Kubernetes gRPC probes)
+grpcurl -plaintext localhost:8686 grpc.health.v1.Health/Check
 
 # List components
 grpcurl -plaintext localhost:8686 vector.observability.v1.ObservabilityService/GetComponents

From 44637c3056c8850752e6f1c6aef8ab5ead810b0f Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 14 Apr 2026 11:04:29 -0400
Subject: [PATCH 124/326] chore(deps): bump datadog-ci from 5.12.0 to 5.13.0
 (#25187)

---
 .../environment/npm-tools/package-lock.json   | 2421 +----------------
 scripts/environment/npm-tools/package.json    |    2 +-
 2 files changed, 145 insertions(+), 2278 deletions(-)

diff --git a/scripts/environment/npm-tools/package-lock.json b/scripts/environment/npm-tools/package-lock.json
index 9e25b17830d18..d9e098652b6ad 100644
--- a/scripts/environment/npm-tools/package-lock.json
+++ b/scripts/environment/npm-tools/package-lock.json
@@ -1,332 +1,27 @@
 {
-  "name": "environment",
+  "name": "npm-tools",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "dependencies": {
-        "@datadog/datadog-ci": "5.12.0",
+        "@datadog/datadog-ci": "5.13.0",
         "markdownlint-cli2": "0.22.0",
         "prettier": "3.8.1"
       }
     },
-    "node_modules/@antfu/install-pkg": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@antfu/install-pkg/-/install-pkg-1.1.0.tgz",
-      "integrity": "sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==",
-      "license": "MIT",
-      "dependencies": {
-        "package-manager-detector": "^1.3.0",
-        "tinyexec": "^1.0.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/antfu"
-      }
-    },
     "node_modules/@datadog/datadog-ci": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci/-/datadog-ci-5.12.0.tgz",
-      "integrity": "sha512-8zJOgx0ouVZtspXTGdx327Yt6UiRnaQSlMc7c343a1HaKC9nIlQhnd90G1frFZhopiqA1KD8h9CWBhygxAJW7w==",
+      "version": "5.13.0",
+      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci/-/datadog-ci-5.13.0.tgz",
+      "integrity": "sha512-QEooWT2OE6J//OV4gka3F8Ca8QkmVGEyKR8zpJVZ6EufJVsNSnBX2V2VE3tzkvndcKRe2/Q9ZCiL9GUiZ4wTLA==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@datadog/datadog-ci-base": "5.12.0",
-        "@datadog/datadog-ci-plugin-coverage": "5.12.0",
-        "@datadog/datadog-ci-plugin-deployment": "5.12.0",
-        "@datadog/datadog-ci-plugin-dora": "5.12.0",
-        "@datadog/datadog-ci-plugin-gate": "5.12.0",
-        "@datadog/datadog-ci-plugin-junit": "5.12.0",
-        "@datadog/datadog-ci-plugin-sarif": "5.12.0",
-        "@datadog/datadog-ci-plugin-sbom": "5.12.0",
-        "clipanion": "3.2.1",
-        "typanion": "3.14.0"
-      },
       "bin": {
-        "datadog-ci": "dist/cli.js"
+        "datadog-ci": "dist/bundle.js"
       },
       "engines": {
         "node": ">=20"
       }
     },
-    "node_modules/@datadog/datadog-ci-base": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-base/-/datadog-ci-base-5.12.0.tgz",
-      "integrity": "sha512-ZyobD2nbzwRksWiYvcxl3ZuYE4+AX1is26qjWAs1ufhVyGBCx1cVqiDFEAILeyqkncZYIFGppjCyjUcxev+CBg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@antfu/install-pkg": "1.1.0",
-        "@types/datadog-metrics": "0.6.1",
-        "async-retry": "1.3.3",
-        "axios": "1.13.5",
-        "chalk": "3.0.0",
-        "clipanion": "3.2.1",
-        "datadog-metrics": "0.9.3",
-        "debug": "4.4.1",
-        "deep-extend": "0.6.0",
-        "fast-xml-parser": "5.5.9",
-        "form-data": "4.0.4",
-        "glob": "13.0.6",
-        "inquirer": "8.2.7",
-        "is-docker": "4.0.0",
-        "jest-diff": "30.2.0",
-        "js-yaml": "4.1.1",
-        "jszip": "3.10.1",
-        "proxy-agent": "6.4.0",
-        "semver": "7.6.3",
-        "simple-git": "3.33.0",
-        "terminal-link": "2.1.1",
-        "tiny-async-pool": "2.1.0",
-        "typanion": "3.14.0",
-        "upath": "2.0.1"
-      },
-      "peerDependencies": {
-        "@datadog/datadog-ci-plugin-aas": "5.12.0",
-        "@datadog/datadog-ci-plugin-cloud-run": "5.12.0",
-        "@datadog/datadog-ci-plugin-container-app": "5.12.0",
-        "@datadog/datadog-ci-plugin-coverage": "5.12.0",
-        "@datadog/datadog-ci-plugin-deployment": "5.12.0",
-        "@datadog/datadog-ci-plugin-dora": "5.12.0",
-        "@datadog/datadog-ci-plugin-gate": "5.12.0",
-        "@datadog/datadog-ci-plugin-junit": "5.12.0",
-        "@datadog/datadog-ci-plugin-lambda": "5.12.0",
-        "@datadog/datadog-ci-plugin-sarif": "5.12.0",
-        "@datadog/datadog-ci-plugin-sbom": "5.12.0",
-        "@datadog/datadog-ci-plugin-stepfunctions": "5.11.0",
-        "@datadog/datadog-ci-plugin-synthetics": "5.11.0",
-        "@datadog/datadog-ci-plugin-terraform": "5.11.0"
-      },
-      "peerDependenciesMeta": {
-        "@datadog/datadog-ci-plugin-aas": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-cloud-run": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-container-app": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-coverage": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-deployment": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-dora": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-gate": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-junit": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-lambda": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-sarif": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-sbom": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-stepfunctions": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-synthetics": {
-          "optional": true
-        },
-        "@datadog/datadog-ci-plugin-terraform": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@datadog/datadog-ci-base/node_modules/debug": {
-      "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.1.tgz",
-      "integrity": "sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.3"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@datadog/datadog-ci-plugin-coverage": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-coverage/-/datadog-ci-plugin-coverage-5.12.0.tgz",
-      "integrity": "sha512-ll4aBYF+FMOlOjAnNiPjO8iPmVB/qfBHrUOCk2EMnOaQn6Eve/FajCaSqeV2BoI9+3UXv04P6eH5nxPtpcM/cg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "chalk": "3.0.0",
-        "fast-xml-parser": "5.5.9",
-        "form-data": "4.0.4",
-        "upath": "2.0.1"
-      },
-      "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.12.0"
-      }
-    },
-    "node_modules/@datadog/datadog-ci-plugin-deployment": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-deployment/-/datadog-ci-plugin-deployment-5.12.0.tgz",
-      "integrity": "sha512-6KDwUmdxwGxYoBEYqAY0uo7ocvtTq3p3cXW4KjpDXwZyr1wWstzXQxTx7qquZzMMNvsD6JCq+HDqwdTgaHSAog==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "axios": "1.13.5",
-        "chalk": "3.0.0",
-        "simple-git": "3.33.0"
-      },
-      "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.12.0"
-      }
-    },
-    "node_modules/@datadog/datadog-ci-plugin-dora": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-dora/-/datadog-ci-plugin-dora-5.12.0.tgz",
-      "integrity": "sha512-HrC6H5lLzRTv3tKiS2f5YMU/WWwgzMF2kHIJU6+pe0y/v1xUYCELV112XYldbg3dkENfpG/AwjUeO6B8rE3s+g==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "chalk": "3.0.0",
-        "simple-git": "3.33.0"
-      },
-      "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.12.0"
-      }
-    },
-    "node_modules/@datadog/datadog-ci-plugin-gate": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-gate/-/datadog-ci-plugin-gate-5.12.0.tgz",
-      "integrity": "sha512-YNZuRigmGDGK2tK6xRsaq0PPx/4CRVZ4U6q7xabIP+jmhoG7mbI1RFUjlXSnGfeU1SXm0bVQw8F69AcZCHtNOA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/uuid": "9.0.8",
-        "chalk": "3.0.0",
-        "uuid": "9.0.1"
-      },
-      "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.12.0"
-      }
-    },
-    "node_modules/@datadog/datadog-ci-plugin-junit": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-junit/-/datadog-ci-plugin-junit-5.12.0.tgz",
-      "integrity": "sha512-XPVULYU1RUN2kFmSWGfAgU+psGFhPu+5NxnHeAQubs/wYcGwdZUEAD2+tn4F3PxpCkTduEb4FO6mLpYbjBpuqA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "chalk": "3.0.0",
-        "fast-xml-parser": "5.5.9",
-        "form-data": "4.0.4",
-        "upath": "2.0.1",
-        "uuid": "9.0.1"
-      },
-      "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.12.0"
-      }
-    },
-    "node_modules/@datadog/datadog-ci-plugin-sarif": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-sarif/-/datadog-ci-plugin-sarif-5.12.0.tgz",
-      "integrity": "sha512-tmUEv6sJWsFG9vnriSu9RZSrLvYo0EfvRaHiiO3ufxBC+NvU0HZYhtTqXVT6NnsUSVv/2FBnzl0hCnPDHhyBFg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "ajv": "8.18.0",
-        "ajv-formats": "3.0.1",
-        "chalk": "3.0.0",
-        "form-data": "4.0.4",
-        "upath": "2.0.1",
-        "uuid": "9.0.1"
-      },
-      "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.12.0"
-      }
-    },
-    "node_modules/@datadog/datadog-ci-plugin-sbom": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/@datadog/datadog-ci-plugin-sbom/-/datadog-ci-plugin-sbom-5.12.0.tgz",
-      "integrity": "sha512-F0c0gfX4O+Qm1heLEhNCTl/tUPlVQvyFGYTUqJ0Z2niqT4Y3z7Oi6RSodgUSwGCKl6bwacRjTTdCrzI3V0n3nA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "ajv": "8.18.0",
-        "ajv-formats": "3.0.1",
-        "axios": "1.13.5",
-        "chalk": "3.0.0",
-        "packageurl-js": "2.0.1"
-      },
-      "peerDependencies": {
-        "@datadog/datadog-ci-base": "5.12.0"
-      }
-    },
-    "node_modules/@inquirer/external-editor": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/@inquirer/external-editor/-/external-editor-1.0.3.tgz",
-      "integrity": "sha512-RWbSrDiYmO4LbejWY7ttpxczuwQyZLBUyygsA9Nsv95hpzUWwnNTVQmAq3xuh7vNwCp07UTmE5i11XAEExx4RA==",
-      "license": "MIT",
-      "dependencies": {
-        "chardet": "^2.1.1",
-        "iconv-lite": "^0.7.0"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "peerDependencies": {
-        "@types/node": ">=18"
-      },
-      "peerDependenciesMeta": {
-        "@types/node": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@jest/diff-sequences": {
-      "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.0.1.tgz",
-      "integrity": "sha512-n5H8QLDJ47QqbCNn5SuFjCRDrOLEZ0h8vAHCK5RL9Ls7Xa8AQLa/YxAc9UjFqoEDM48muwtBGjtMY5cr0PLDCw==",
-      "license": "MIT",
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/get-type": {
-      "version": "30.1.0",
-      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.1.0.tgz",
-      "integrity": "sha512-eMbZE2hUnx1WV0pmURZY9XoXPkUYjpc55mb0CrhtdWLtzMQPFvu/rZkTLZFTsdaVQa+Tr4eWAteqcUzoawq/uA==",
-      "license": "MIT",
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@jest/schemas": {
-      "version": "30.0.5",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.0.5.tgz",
-      "integrity": "sha512-DmdYgtezMkh3cpU8/1uyXakv3tJRcmcXxBOcO0tbaozPwpmh4YMsnWrQm9ZmZMfa5ocbxzbFk6O4bDPEc/iAnA==",
-      "license": "MIT",
-      "dependencies": {
-        "@sinclair/typebox": "^0.34.0"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/@kwsites/file-exists": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@kwsites/file-exists/-/file-exists-1.1.1.tgz",
-      "integrity": "sha512-m9/5YGR18lIwxSFDwfE3oA7bWuq9kdau6ugN4H2rJeyhFQZcG9AgSHkQtSD15a8WvTgfz9aikZMrKPHvbpqFiw==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.1.1"
-      }
-    },
-    "node_modules/@kwsites/promise-deferred": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@kwsites/promise-deferred/-/promise-deferred-1.1.1.tgz",
-      "integrity": "sha512-GaHYm+c0O9MjZRu0ongGBRbinu8gVAMd2UZjji6jVmqKtZluZnptXGWhz1E8j8D2HJ3f/yMxKAUC0b+57wncIw==",
-      "license": "MIT"
-    },
     "node_modules/@nodelib/fs.scandir": {
       "version": "2.1.5",
       "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -362,12 +57,6 @@
         "node": ">= 8"
       }
     },
-    "node_modules/@sinclair/typebox": {
-      "version": "0.34.49",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.49.tgz",
-      "integrity": "sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A==",
-      "license": "MIT"
-    },
     "node_modules/@sindresorhus/merge-streams": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/@sindresorhus/merge-streams/-/merge-streams-4.0.0.tgz",
@@ -380,18 +69,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@tootallnate/quickjs-emscripten": {
-      "version": "0.23.0",
-      "resolved": "https://registry.npmjs.org/@tootallnate/quickjs-emscripten/-/quickjs-emscripten-0.23.0.tgz",
-      "integrity": "sha512-C5Mc6rdnsaJDjO3UpGW/CQTHtCKaYlScZTly4JIu97Jxo/odCiH0ITnDXSJPTOrEKk/ycSZ0AOgTmkDtkOsvIA==",
-      "license": "MIT"
-    },
-    "node_modules/@types/datadog-metrics": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/@types/datadog-metrics/-/datadog-metrics-0.6.1.tgz",
-      "integrity": "sha512-p6zVpfmNcXwtcXjgpz7do/fKyfndGhU5sGJVtb5Gn5PvLDiQUAgD0mI/itf/99sBi9DRxeyhFQ9dQF6OxxQNbA==",
-      "license": "MIT"
-    },
     "node_modules/@types/debug": {
       "version": "4.1.13",
       "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
@@ -419,733 +96,127 @@
       "integrity": "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==",
       "license": "MIT"
     },
-    "node_modules/@types/uuid": {
-      "version": "9.0.8",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-9.0.8.tgz",
-      "integrity": "sha512-jg+97EGIcY9AGHJJRaaPVgetKDsrTgbRjQ5Msgjh/DQKEFl0DtyRr/VCOyD1T2R1MNeWPK/u7JoGhlDZnKBAfA==",
-      "license": "MIT"
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "license": "Python-2.0"
     },
-    "node_modules/agent-base": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+    "node_modules/braces": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
       "license": "MIT",
+      "dependencies": {
+        "fill-range": "^7.1.1"
+      },
       "engines": {
-        "node": ">= 14"
+        "node": ">=8"
       }
     },
-    "node_modules/ajv": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
-      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
+    "node_modules/character-entities": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
+      "integrity": "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==",
       "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
-      },
       "funding": {
         "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/ajv-formats": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
-      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+    "node_modules/character-entities-legacy": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-3.0.0.tgz",
+      "integrity": "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==",
       "license": "MIT",
-      "dependencies": {
-        "ajv": "^8.0.0"
-      },
-      "peerDependencies": {
-        "ajv": "^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "ajv": {
-          "optional": true
-        }
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/ansi-escapes": {
-      "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
-      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+    "node_modules/character-reference-invalid": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/character-reference-invalid/-/character-reference-invalid-2.0.1.tgz",
+      "integrity": "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==",
       "license": "MIT",
-      "dependencies": {
-        "type-fest": "^0.21.3"
-      },
-      "engines": {
-        "node": ">=8"
-      },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+    "node_modules/commander": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
+      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
       "license": "MIT",
       "engines": {
-        "node": ">=8"
+        "node": ">= 12"
       }
     },
-    "node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "license": "MIT",
       "dependencies": {
-        "color-convert": "^2.0.1"
+        "ms": "^2.1.3"
       },
       "engines": {
-        "node": ">=8"
+        "node": ">=6.0"
       },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
       }
     },
-    "node_modules/argparse": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
-      "license": "Python-2.0"
-    },
-    "node_modules/ast-types": {
-      "version": "0.13.4",
-      "resolved": "https://registry.npmjs.org/ast-types/-/ast-types-0.13.4.tgz",
-      "integrity": "sha512-x1FCFnFifvYDDzTaLII71vG5uvDwgtmDTEVWAxrgeiR8VjMONcCXJx7E+USjDtHlwFmt9MysbqgF9b9Vjr6w+w==",
+    "node_modules/decode-named-character-reference": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
+      "integrity": "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==",
       "license": "MIT",
       "dependencies": {
-        "tslib": "^2.0.1"
+        "character-entities": "^2.0.0"
       },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/async-retry": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/async-retry/-/async-retry-1.3.3.tgz",
-      "integrity": "sha512-wfr/jstw9xNi/0teMHrRW7dsz3Lt5ARhYNZ2ewpadnhaIp5mbALhOAP+EAdsC7t4Z6wqsDVv9+W6gm1Dk9mEyw==",
-      "license": "MIT",
-      "dependencies": {
-        "retry": "0.13.1"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/asynckit": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
-      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
-      "license": "MIT"
-    },
-    "node_modules/axios": {
-      "version": "1.13.5",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.5.tgz",
-      "integrity": "sha512-cz4ur7Vb0xS4/KUN0tPWe44eqxrIu31me+fbang3ijiNscE129POzipJJA6zniq2C/Z6sJCjMimjS8Lc/GAs8Q==",
+    "node_modules/dequal": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
+      "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
       "license": "MIT",
-      "dependencies": {
-        "follow-redirects": "^1.15.11",
-        "form-data": "^4.0.5",
-        "proxy-from-env": "^1.1.0"
+      "engines": {
+        "node": ">=6"
       }
     },
-    "node_modules/axios/node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+    "node_modules/devlop": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
+      "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
       "license": "MIT",
       "dependencies": {
-        "asynckit": "^0.4.0",
-        "combined-stream": "^1.0.8",
-        "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "dequal": "^2.0.0"
       },
-      "engines": {
-        "node": ">= 6"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "license": "MIT",
+    "node_modules/entities": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+      "license": "BSD-2-Clause",
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
       }
     },
-    "node_modules/base64-js": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/basic-ftp": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.2.tgz",
-      "integrity": "sha512-1tDrzKsdCg70WGvbFss/ulVAxupNauGnOlgpyjKzeQxzyllBLS0CGLV7tjIXTK3ZQA9/FBEm9qyFFN1bciA6pw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10.0.0"
-      }
-    },
-    "node_modules/bignumber.js": {
-      "version": "9.3.1",
-      "resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-9.3.1.tgz",
-      "integrity": "sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ==",
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/bl": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
-      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
-      "license": "MIT",
-      "dependencies": {
-        "buffer": "^5.5.0",
-        "inherits": "^2.0.4",
-        "readable-stream": "^3.4.0"
-      }
-    },
-    "node_modules/bl/node_modules/readable-stream": {
-      "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
-      "license": "MIT",
-      "dependencies": {
-        "inherits": "^2.0.3",
-        "string_decoder": "^1.1.1",
-        "util-deprecate": "^1.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
-    "node_modules/braces": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
-      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
-      "license": "MIT",
-      "dependencies": {
-        "fill-range": "^7.1.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/buffer": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "base64-js": "^1.3.1",
-        "ieee754": "^1.1.13"
-      }
-    },
-    "node_modules/call-bind-apply-helpers": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
-      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "function-bind": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/chalk": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-3.0.0.tgz",
-      "integrity": "sha512-4D3B6Wf41KOYRFdszmDqMCGq5VV/uMAB273JILmO+3jAlh8X4qDtdtgCR3fxtbLEMzSx22QdhnDcJvu2u1fVwg==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/character-entities": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
-      "integrity": "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/character-entities-legacy": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-3.0.0.tgz",
-      "integrity": "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/character-reference-invalid": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/character-reference-invalid/-/character-reference-invalid-2.0.1.tgz",
-      "integrity": "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/chardet": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/chardet/-/chardet-2.1.1.tgz",
-      "integrity": "sha512-PsezH1rqdV9VvyNhxxOW32/d75r01NY7TQCmOqomRo15ZSOKbpTFVsfjghxo6JloQUCGnH4k1LGu0R4yCLlWQQ==",
-      "license": "MIT"
-    },
-    "node_modules/cli-cursor": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-3.1.0.tgz",
-      "integrity": "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==",
-      "license": "MIT",
-      "dependencies": {
-        "restore-cursor": "^3.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cli-spinners": {
-      "version": "2.9.2",
-      "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-2.9.2.tgz",
-      "integrity": "sha512-ywqV+5MmyL4E7ybXgKys4DugZbX0FC6LnwrhjuykIjnK9k8OQacQ7axGKnjDXWNhns0xot3bZI5h55H8yo9cJg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/cli-width": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/cli-width/-/cli-width-3.0.0.tgz",
-      "integrity": "sha512-FxqpkPPwu1HjuN93Omfm4h8uIanXofW0RxVEW3k5RKx+mJJYSthzNhp32Kzxxy3YAEZ/Dc/EWN1vZRY0+kOhbw==",
-      "license": "ISC",
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/clipanion": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/clipanion/-/clipanion-3.2.1.tgz",
-      "integrity": "sha512-dYFdjLb7y1ajfxQopN05mylEpK9ZX0sO1/RfMXdfmwjlIsPkbh4p7A682x++zFPLDCo1x3p82dtljHf5cW2LKA==",
-      "license": "MIT",
-      "workspaces": [
-        "website"
-      ],
-      "dependencies": {
-        "typanion": "^3.8.0"
-      },
-      "peerDependencies": {
-        "typanion": "*"
-      }
-    },
-    "node_modules/clone": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/clone/-/clone-1.0.4.tgz",
-      "integrity": "sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
-    "node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "license": "MIT"
-    },
-    "node_modules/combined-stream": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
-      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
-      "license": "MIT",
-      "dependencies": {
-        "delayed-stream": "~1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/commander": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
-      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12"
-      }
-    },
-    "node_modules/core-util-is": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
-      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
-      "license": "MIT"
-    },
-    "node_modules/data-uri-to-buffer": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-6.0.2.tgz",
-      "integrity": "sha512-7hvf7/GW8e86rW0ptuwS3OcBGDjIi6SZva7hCyWC0yYry2cOPmLIjXAUHI6DK2HsnwJd9ifmt57i8eV2n4YNpw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/datadog-metrics": {
-      "version": "0.9.3",
-      "resolved": "https://registry.npmjs.org/datadog-metrics/-/datadog-metrics-0.9.3.tgz",
-      "integrity": "sha512-BVsBX2t+4yA3tHs7DnB5H01cHVNiGJ/bHA8y6JppJDyXG7s2DLm6JaozPGpgsgVGd42Is1CHRG/yMDQpt877Xg==",
-      "license": "MIT",
-      "dependencies": {
-        "debug": "3.1.0",
-        "dogapi": "2.8.4"
-      }
-    },
-    "node_modules/datadog-metrics/node_modules/debug": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-3.1.0.tgz",
-      "integrity": "sha512-OX8XqP7/1a9cqkxYw2yXss15f26NKWBpDXQd0/uK/KPqdQhxbPa994hnzjcE2VqQpDslf55723cKPUOGSmMY3g==",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "2.0.0"
-      }
-    },
-    "node_modules/datadog-metrics/node_modules/ms": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "license": "MIT"
-    },
-    "node_modules/debug": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.3"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/decode-named-character-reference": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
-      "integrity": "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==",
-      "license": "MIT",
-      "dependencies": {
-        "character-entities": "^2.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/deep-extend": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
-      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=4.0.0"
-      }
-    },
-    "node_modules/defaults": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/defaults/-/defaults-1.0.4.tgz",
-      "integrity": "sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==",
-      "license": "MIT",
-      "dependencies": {
-        "clone": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/degenerator": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/degenerator/-/degenerator-5.0.1.tgz",
-      "integrity": "sha512-TllpMR/t0M5sqCXfj85i4XaAzxmS5tVA16dqvdkMwGmzI+dXLXnw3J+3Vdv7VKw+ThlTMboK6i9rnZ6Nntj5CQ==",
-      "license": "MIT",
-      "dependencies": {
-        "ast-types": "^0.13.4",
-        "escodegen": "^2.1.0",
-        "esprima": "^4.0.1"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/delayed-stream": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
-      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/dequal": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
-      "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/devlop": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
-      "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
-      "license": "MIT",
-      "dependencies": {
-        "dequal": "^2.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/dogapi": {
-      "version": "2.8.4",
-      "resolved": "https://registry.npmjs.org/dogapi/-/dogapi-2.8.4.tgz",
-      "integrity": "sha512-065fsvu5dB0o4+ENtLjZILvXMClDNH/yA9H6L8nsdcNiz9l0Hzpn7aQaCOPYXxqyzq4CRPOdwkFXUjDOXfRGbg==",
-      "license": "MIT",
-      "dependencies": {
-        "extend": "^3.0.2",
-        "json-bigint": "^1.0.0",
-        "lodash": "^4.17.21",
-        "minimist": "^1.2.5",
-        "rc": "^1.2.8"
-      },
-      "bin": {
-        "dogapi": "bin/dogapi"
-      }
-    },
-    "node_modules/dunder-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
-      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "gopd": "^1.2.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "license": "MIT"
-    },
-    "node_modules/entities": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
-      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=0.12"
-      },
-      "funding": {
-        "url": "https://github.com/fb55/entities?sponsor=1"
-      }
-    },
-    "node_modules/es-define-property": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
-      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-errors": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
-      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-object-atoms": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-set-tostringtag": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
-      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
-      "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.6",
-        "has-tostringtag": "^1.0.2",
-        "hasown": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/escape-string-regexp": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.0"
-      }
-    },
-    "node_modules/escodegen": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/escodegen/-/escodegen-2.1.0.tgz",
-      "integrity": "sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w==",
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "esprima": "^4.0.1",
-        "estraverse": "^5.2.0",
-        "esutils": "^2.0.2"
-      },
-      "bin": {
-        "escodegen": "bin/escodegen.js",
-        "esgenerate": "bin/esgenerate.js"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "optionalDependencies": {
-        "source-map": "~0.6.1"
-      }
-    },
-    "node_modules/esprima": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
-      "license": "BSD-2-Clause",
-      "bin": {
-        "esparse": "bin/esparse.js",
-        "esvalidate": "bin/esvalidate.js"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/estraverse": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
-      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/esutils": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
-      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
-      "license": "BSD-2-Clause",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/extend": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
-      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
-      "license": "MIT"
-    },
-    "node_modules/fast-deep-equal": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "license": "MIT"
-    },
     "node_modules/fast-glob": {
       "version": "3.3.3",
       "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
@@ -1162,57 +233,6 @@
         "node": ">=8.6.0"
       }
     },
-    "node_modules/fast-uri": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
-      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/fast-xml-builder": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz",
-      "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "path-expression-matcher": "^1.1.3"
-      }
-    },
-    "node_modules/fast-xml-parser": {
-      "version": "5.5.9",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.9.tgz",
-      "integrity": "sha512-jldvxr1MC6rtiZKgrFnDSvT8xuH+eJqxqOBThUVjYrxssYTo1avZLGql5l0a0BAERR01CadYzZ83kVEkbyDg+g==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "fast-xml-builder": "^1.1.4",
-        "path-expression-matcher": "^1.2.0",
-        "strnum": "^2.2.2"
-      },
-      "bin": {
-        "fxparser": "src/cli/cli.js"
-      }
-    },
     "node_modules/fastq": {
       "version": "1.20.1",
       "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
@@ -1222,388 +242,69 @@
         "reusify": "^1.0.4"
       }
     },
-    "node_modules/figures": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/figures/-/figures-3.2.0.tgz",
-      "integrity": "sha512-yaduQFRKLXYOGgEn6AZau90j3ggSOyiqXU0F9JZfeXYhNa+Jk4X+s45A2zg5jns87GAFa34BBm2kXw4XpNcbdg==",
-      "license": "MIT",
-      "dependencies": {
-        "escape-string-regexp": "^1.0.5"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/fill-range": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
-      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
-      "license": "MIT",
-      "dependencies": {
-        "to-regex-range": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/follow-redirects": {
-      "version": "1.15.11",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz",
-      "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==",
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/RubenVerborgh"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=4.0"
-      },
-      "peerDependenciesMeta": {
-        "debug": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/form-data": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
-      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
-      "license": "MIT",
-      "dependencies": {
-        "asynckit": "^0.4.0",
-        "combined-stream": "^1.0.8",
-        "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/function-bind": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
-      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-east-asian-width": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.5.0.tgz",
-      "integrity": "sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/get-intrinsic": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
-      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
-      "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.2",
-        "es-define-property": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "es-object-atoms": "^1.1.1",
-        "function-bind": "^1.1.2",
-        "get-proto": "^1.0.1",
-        "gopd": "^1.2.0",
-        "has-symbols": "^1.1.0",
-        "hasown": "^2.0.2",
-        "math-intrinsics": "^1.1.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
-      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
-      "license": "MIT",
-      "dependencies": {
-        "dunder-proto": "^1.0.1",
-        "es-object-atoms": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/get-uri": {
-      "version": "6.0.5",
-      "resolved": "https://registry.npmjs.org/get-uri/-/get-uri-6.0.5.tgz",
-      "integrity": "sha512-b1O07XYq8eRuVzBNgJLstU6FYc1tS6wnMtF1I1D9lE8LxZSOGZ7LhxN54yPP6mGw5f2CkXY2BQUL9Fx41qvcIg==",
-      "license": "MIT",
-      "dependencies": {
-        "basic-ftp": "^5.0.2",
-        "data-uri-to-buffer": "^6.0.2",
-        "debug": "^4.3.4"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/glob": {
-      "version": "13.0.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
-      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "minimatch": "^10.2.2",
-        "minipass": "^7.1.3",
-        "path-scurry": "^2.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/glob-parent": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
-      "license": "ISC",
-      "dependencies": {
-        "is-glob": "^4.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/globby": {
-      "version": "16.1.1",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-16.1.1.tgz",
-      "integrity": "sha512-dW7vl+yiAJSp6aCekaVnVJxurRv7DCOLyXqEG3RYMYUg7AuJ2jCqPkZTA8ooqC2vtnkaMcV5WfFBMuEnTu1OQg==",
-      "license": "MIT",
-      "dependencies": {
-        "@sindresorhus/merge-streams": "^4.0.0",
-        "fast-glob": "^3.3.3",
-        "ignore": "^7.0.5",
-        "is-path-inside": "^4.0.0",
-        "slash": "^5.1.0",
-        "unicorn-magic": "^0.4.0"
-      },
-      "engines": {
-        "node": ">=20"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/gopd": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
-      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-flag": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/has-symbols": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
-      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-tostringtag": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
-      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
-      "license": "MIT",
-      "dependencies": {
-        "has-symbols": "^1.0.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
-      "license": "MIT",
-      "dependencies": {
-        "function-bind": "^1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/http-proxy-agent": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
-      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.0",
-        "debug": "^4.3.4"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+    "node_modules/fill-range": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
       "license": "MIT",
       "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
+        "to-regex-range": "^5.0.1"
       },
       "engines": {
-        "node": ">=0.10.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "node": ">=8"
       }
     },
-    "node_modules/ieee754": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/ignore": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
+    "node_modules/get-east-asian-width": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.5.0.tgz",
+      "integrity": "sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA==",
       "license": "MIT",
       "engines": {
-        "node": ">= 4"
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/immediate": {
-      "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/immediate/-/immediate-3.0.6.tgz",
-      "integrity": "sha512-XXOFtyqDjNDAQxVfYxuF7g9Il/IbWmmlQg2MYKOH8ExIT1qg6xc4zyS3HaEEATgs1btfzxq15ciUiY7gjSXRGQ==",
-      "license": "MIT"
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "license": "ISC"
-    },
-    "node_modules/ini": {
-      "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
-      "license": "ISC"
-    },
-    "node_modules/inquirer": {
-      "version": "8.2.7",
-      "resolved": "https://registry.npmjs.org/inquirer/-/inquirer-8.2.7.tgz",
-      "integrity": "sha512-UjOaSel/iddGZJ5xP/Eixh6dY1XghiBw4XK13rCCIJcJfyhhoul/7KhLLUGtebEj6GDYM6Vnx/mVsjx2L/mFIA==",
-      "license": "MIT",
+    "node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "license": "ISC",
       "dependencies": {
-        "@inquirer/external-editor": "^1.0.0",
-        "ansi-escapes": "^4.2.1",
-        "chalk": "^4.1.1",
-        "cli-cursor": "^3.1.0",
-        "cli-width": "^3.0.0",
-        "figures": "^3.0.0",
-        "lodash": "^4.17.21",
-        "mute-stream": "0.0.8",
-        "ora": "^5.4.1",
-        "run-async": "^2.4.0",
-        "rxjs": "^7.5.5",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0",
-        "through": "^2.3.6",
-        "wrap-ansi": "^6.0.1"
+        "is-glob": "^4.0.1"
       },
       "engines": {
-        "node": ">=12.0.0"
+        "node": ">= 6"
       }
     },
-    "node_modules/inquirer/node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+    "node_modules/globby": {
+      "version": "16.1.1",
+      "resolved": "https://registry.npmjs.org/globby/-/globby-16.1.1.tgz",
+      "integrity": "sha512-dW7vl+yiAJSp6aCekaVnVJxurRv7DCOLyXqEG3RYMYUg7AuJ2jCqPkZTA8ooqC2vtnkaMcV5WfFBMuEnTu1OQg==",
       "license": "MIT",
       "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
+        "@sindresorhus/merge-streams": "^4.0.0",
+        "fast-glob": "^3.3.3",
+        "ignore": "^7.0.5",
+        "is-path-inside": "^4.0.0",
+        "slash": "^5.1.0",
+        "unicorn-magic": "^0.4.0"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">=20"
       },
       "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/ip-address": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
-      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+    "node_modules/ignore": {
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
       "license": "MIT",
       "engines": {
-        "node": ">= 12"
+        "node": ">= 4"
       }
     },
     "node_modules/is-alphabetical": {
@@ -1640,21 +341,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/is-docker": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-4.0.0.tgz",
-      "integrity": "sha512-LHE+wROyG/Y/0ZnbktRCoTix2c1RhgWaZraMZ8o1Q7zCh0VSrICJQO5oqIIISrcSBtrXv0o233w1IYwsWCjTzA==",
-      "license": "MIT",
-      "bin": {
-        "is-docker": "cli.js"
-      },
-      "engines": {
-        "node": ">=20"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/is-extglob": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
@@ -1664,15 +350,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/is-glob": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
@@ -1695,15 +372,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/is-interactive": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-interactive/-/is-interactive-1.0.0.tgz",
-      "integrity": "sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/is-number": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
@@ -1725,55 +393,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/is-unicode-supported": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz",
-      "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/isarray": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
-      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
-      "license": "MIT"
-    },
-    "node_modules/jest-diff": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.2.0.tgz",
-      "integrity": "sha512-dQHFo3Pt4/NLlG5z4PxZ/3yZTZ1C7s9hveiOj+GCN+uT109NC2QgsoVZsVOAvbJ3RgKkvyLGXZV9+piDpWbm6A==",
-      "license": "MIT",
-      "dependencies": {
-        "@jest/diff-sequences": "30.0.1",
-        "@jest/get-type": "30.1.0",
-        "chalk": "^4.1.2",
-        "pretty-format": "30.2.0"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/jest-diff/node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
     "node_modules/js-yaml": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
@@ -1786,21 +405,6 @@
         "js-yaml": "bin/js-yaml.js"
       }
     },
-    "node_modules/json-bigint": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-bigint/-/json-bigint-1.0.0.tgz",
-      "integrity": "sha512-SiPv/8VpZuWbvLSMtTDU8hEfrZWg/mH/nV/b4o0CYbSxu1UIQPLdwKOCIyLQX+VIPO5vrLX3i8qtqFyhdPSUSQ==",
-      "license": "MIT",
-      "dependencies": {
-        "bignumber.js": "^9.0.0"
-      }
-    },
-    "node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "license": "MIT"
-    },
     "node_modules/jsonc-parser": {
       "version": "3.3.1",
       "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
@@ -1816,18 +420,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/jszip": {
-      "version": "3.10.1",
-      "resolved": "https://registry.npmjs.org/jszip/-/jszip-3.10.1.tgz",
-      "integrity": "sha512-xXDvecyTpGLrqFrvkrUSoxxfJI5AH7U8zxxtVclpsUtMCq4JQ290LY8AW5c7Ggnr/Y/oK+bQMbqK2qmtk3pN4g==",
-      "license": "(MIT OR GPL-3.0-or-later)",
-      "dependencies": {
-        "lie": "~3.3.0",
-        "pako": "~1.0.2",
-        "readable-stream": "~2.3.6",
-        "setimmediate": "^1.0.5"
-      }
-    },
     "node_modules/katex": {
       "version": "0.16.44",
       "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.44.tgz",
@@ -1844,15 +436,6 @@
         "katex": "cli.js"
       }
     },
-    "node_modules/lie": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/lie/-/lie-3.3.0.tgz",
-      "integrity": "sha512-UaiMJzeWRlEujzAuw5LokY1L5ecNQYZKfmyZ9L7wDHb/p5etKaxXhohBcrw0EYby+G/NA52vRSN4N39dxHAIwQ==",
-      "license": "MIT",
-      "dependencies": {
-        "immediate": "~3.0.5"
-      }
-    },
     "node_modules/linkify-it": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.0.tgz",
@@ -1862,53 +445,6 @@
         "uc.micro": "^2.0.0"
       }
     },
-    "node_modules/lodash": {
-      "version": "4.18.1",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
-      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
-      "license": "MIT"
-    },
-    "node_modules/log-symbols": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz",
-      "integrity": "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==",
-      "license": "MIT",
-      "dependencies": {
-        "chalk": "^4.1.0",
-        "is-unicode-supported": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/log-symbols/node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/lru-cache": {
-      "version": "11.3.0",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.3.0.tgz",
-      "integrity": "sha512-sr8xPKE25m6vJVcrdn6NxtC0fVfuPowbscLypegRgOm0yXSqr5JNHCAY3hnusdJ7HRBW04j6Ip4khvHU778DuQ==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
     "node_modules/markdown-it": {
       "version": "14.1.1",
       "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.1.tgz",
@@ -2030,15 +566,6 @@
         "url": "https://github.com/chalk/strip-ansi?sponsor=1"
       }
     },
-    "node_modules/math-intrinsics": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
-      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
     "node_modules/mdurl": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-2.0.0.tgz",
@@ -2552,220 +1079,38 @@
     "node_modules/micromark-util-types": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.2.tgz",
-      "integrity": "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==",
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/micromatch": {
-      "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
-      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
-      "license": "MIT",
-      "dependencies": {
-        "braces": "^3.0.3",
-        "picomatch": "^2.3.1"
-      },
-      "engines": {
-        "node": ">=8.6"
-      }
-    },
-    "node_modules/mime-db": {
-      "version": "1.52.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
-      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/mime-types": {
-      "version": "2.1.35",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
-      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-db": "1.52.0"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/mimic-fn": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/minimatch": {
-      "version": "10.2.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "brace-expansion": "^5.0.5"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/minimist": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "license": "MIT"
-    },
-    "node_modules/mute-stream": {
-      "version": "0.0.8",
-      "resolved": "https://registry.npmjs.org/mute-stream/-/mute-stream-0.0.8.tgz",
-      "integrity": "sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA==",
-      "license": "ISC"
-    },
-    "node_modules/netmask": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/netmask/-/netmask-2.0.2.tgz",
-      "integrity": "sha512-dBpDMdxv9Irdq66304OLfEmQ9tbNRFnFTuZiLo+bD+r332bBmMJ8GBLXklIXXgxd3+v9+KUnZaUR5PJMa75Gsg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4.0"
-      }
-    },
-    "node_modules/onetime": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
-      "license": "MIT",
-      "dependencies": {
-        "mimic-fn": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/ora": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/ora/-/ora-5.4.1.tgz",
-      "integrity": "sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==",
-      "license": "MIT",
-      "dependencies": {
-        "bl": "^4.1.0",
-        "chalk": "^4.1.0",
-        "cli-cursor": "^3.1.0",
-        "cli-spinners": "^2.5.0",
-        "is-interactive": "^1.0.0",
-        "is-unicode-supported": "^0.1.0",
-        "log-symbols": "^4.1.0",
-        "strip-ansi": "^6.0.0",
-        "wcwidth": "^1.0.1"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/ora/node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/pac-proxy-agent": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/pac-proxy-agent/-/pac-proxy-agent-7.2.0.tgz",
-      "integrity": "sha512-TEB8ESquiLMc0lV8vcd5Ql/JAKAoyzHFXaStwjkzpOpC5Yv+pIzLfHvjTSdf3vpa2bMiUQrg9i6276yn8666aA==",
-      "license": "MIT",
-      "dependencies": {
-        "@tootallnate/quickjs-emscripten": "^0.23.0",
-        "agent-base": "^7.1.2",
-        "debug": "^4.3.4",
-        "get-uri": "^6.0.1",
-        "http-proxy-agent": "^7.0.0",
-        "https-proxy-agent": "^7.0.6",
-        "pac-resolver": "^7.0.1",
-        "socks-proxy-agent": "^8.0.5"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
+      "integrity": "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "license": "MIT"
     },
-    "node_modules/pac-resolver": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/pac-resolver/-/pac-resolver-7.0.1.tgz",
-      "integrity": "sha512-5NPgf87AT2STgwa2ntRMr45jTKrYBGkVU36yT0ig/n/GMAa3oPqhZfIQ2kMEimReg0+t9kZViDVZ83qfVUlckg==",
+    "node_modules/micromatch": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
       "license": "MIT",
       "dependencies": {
-        "degenerator": "^5.0.0",
-        "netmask": "^2.0.2"
+        "braces": "^3.0.3",
+        "picomatch": "^2.3.1"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">=8.6"
       }
     },
-    "node_modules/package-manager-detector": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.6.0.tgz",
-      "integrity": "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==",
-      "license": "MIT"
-    },
-    "node_modules/packageurl-js": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-2.0.1.tgz",
-      "integrity": "sha512-N5ixXjzTy4QDQH0Q9YFjqIWd6zH6936Djpl2m9QNFmDv5Fum8q8BjkpAcHNMzOFE0IwQrFhJWex3AN6kS0OSwg==",
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
-    "node_modules/pako": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
-      "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==",
-      "license": "(MIT AND Zlib)"
-    },
     "node_modules/parse-entities": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/parse-entities/-/parse-entities-4.0.2.tgz",
@@ -2785,37 +1130,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/path-expression-matcher": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.2.1.tgz",
-      "integrity": "sha512-d7gQQmLvAKXKXE2GeP9apIGbMYKz88zWdsn/BN2HRWVQsDFdUY36WSLTY0Jvd4HWi7Fb30gQ62oAOzdgJA6fZw==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/path-scurry": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
-      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "lru-cache": "^11.0.0",
-        "minipass": "^7.1.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/picomatch": {
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
@@ -2843,72 +1157,6 @@
         "url": "https://github.com/prettier/prettier?sponsor=1"
       }
     },
-    "node_modules/pretty-format": {
-      "version": "30.2.0",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.2.0.tgz",
-      "integrity": "sha512-9uBdv/B4EefsuAL+pWqueZyZS2Ba+LxfFeQ9DN14HU4bN8bhaxKdkpjpB6fs9+pSjIBu+FXQHImEg8j/Lw0+vA==",
-      "license": "MIT",
-      "dependencies": {
-        "@jest/schemas": "30.0.5",
-        "ansi-styles": "^5.2.0",
-        "react-is": "^18.3.1"
-      },
-      "engines": {
-        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      }
-    },
-    "node_modules/pretty-format/node_modules/ansi-styles": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
-      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/process-nextick-args": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
-      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
-      "license": "MIT"
-    },
-    "node_modules/proxy-agent": {
-      "version": "6.4.0",
-      "resolved": "https://registry.npmjs.org/proxy-agent/-/proxy-agent-6.4.0.tgz",
-      "integrity": "sha512-u0piLU+nCOHMgGjRbimiXmA9kM/L9EHh3zL81xCdp7m+Y2pHIsnmbdDoEDoAz5geaonNR6q6+yOPQs6n4T6sBQ==",
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.0.2",
-        "debug": "^4.3.4",
-        "http-proxy-agent": "^7.0.1",
-        "https-proxy-agent": "^7.0.3",
-        "lru-cache": "^7.14.1",
-        "pac-proxy-agent": "^7.0.1",
-        "proxy-from-env": "^1.1.0",
-        "socks-proxy-agent": "^8.0.2"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/proxy-agent/node_modules/lru-cache": {
-      "version": "7.18.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-7.18.3.tgz",
-      "integrity": "sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "license": "MIT"
-    },
     "node_modules/punycode.js": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/punycode.js/-/punycode.js-2.3.1.tgz",
@@ -2938,73 +1186,6 @@
       ],
       "license": "MIT"
     },
-    "node_modules/rc": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
-      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
-      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
-      "dependencies": {
-        "deep-extend": "^0.6.0",
-        "ini": "~1.3.0",
-        "minimist": "^1.2.0",
-        "strip-json-comments": "~2.0.1"
-      },
-      "bin": {
-        "rc": "cli.js"
-      }
-    },
-    "node_modules/react-is": {
-      "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
-      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
-      "license": "MIT"
-    },
-    "node_modules/readable-stream": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
-      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
-      "license": "MIT",
-      "dependencies": {
-        "core-util-is": "~1.0.0",
-        "inherits": "~2.0.3",
-        "isarray": "~1.0.0",
-        "process-nextick-args": "~2.0.0",
-        "safe-buffer": "~5.1.1",
-        "string_decoder": "~1.1.1",
-        "util-deprecate": "~1.0.1"
-      }
-    },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/restore-cursor": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-3.1.0.tgz",
-      "integrity": "sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==",
-      "license": "MIT",
-      "dependencies": {
-        "onetime": "^5.1.0",
-        "signal-exit": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/retry": {
-      "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
-      "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
-      }
-    },
     "node_modules/reusify": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
@@ -3015,15 +1196,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/run-async": {
-      "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/run-async/-/run-async-2.4.1.tgz",
-      "integrity": "sha512-tvVnVv01b8c1RrA6Ep7JkStj85Guv/YrMcwqYQnwjsAS2cTmmPGBBjAjpCW7RrSodNSoE2/qg9O4bceNvUuDgQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.12.0"
-      }
-    },
     "node_modules/run-parallel": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
@@ -3047,66 +1219,6 @@
         "queue-microtask": "^1.2.2"
       }
     },
-    "node_modules/rxjs": {
-      "version": "7.8.2",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.2.tgz",
-      "integrity": "sha512-dhKf903U/PQZY6boNNtAGdWbG85WAbjT/1xYoZIC7FAY0yWapOBQVsVrDl58W86//e1VpMNBtRV4MaXfdMySFA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.1.0"
-      }
-    },
-    "node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "license": "MIT"
-    },
-    "node_modules/safer-buffer": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "license": "MIT"
-    },
-    "node_modules/semver": {
-      "version": "7.6.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz",
-      "integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==",
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/setimmediate": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/setimmediate/-/setimmediate-1.0.5.tgz",
-      "integrity": "sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA==",
-      "license": "MIT"
-    },
-    "node_modules/signal-exit": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
-      "license": "ISC"
-    },
-    "node_modules/simple-git": {
-      "version": "3.33.0",
-      "resolved": "https://registry.npmjs.org/simple-git/-/simple-git-3.33.0.tgz",
-      "integrity": "sha512-D4V/tGC2sjsoNhoMybKyGoE+v8A60hRawKQ1iFRA1zwuDgGZCBJ4ByOzZ5J8joBbi4Oam0qiPH+GhzmSBwbJng==",
-      "license": "MIT",
-      "dependencies": {
-        "@kwsites/file-exists": "^1.1.1",
-        "@kwsites/promise-deferred": "^1.1.1",
-        "debug": "^4.4.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/steveukx/git-js?sponsor=1"
-      }
-    },
     "node_modules/slash": {
       "version": "5.1.0",
       "resolved": "https://registry.npmjs.org/slash/-/slash-5.1.0.tgz",
@@ -3119,16 +1231,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/smart-buffer": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
-      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 6.0.0",
-        "npm": ">= 3.0.0"
-      }
-    },
     "node_modules/smol-toml": {
       "version": "1.6.0",
       "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.0.tgz",
@@ -3141,162 +1243,6 @@
         "url": "https://github.com/sponsors/cyyynthia"
       }
     },
-    "node_modules/socks": {
-      "version": "2.8.7",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
-      "integrity": "sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==",
-      "license": "MIT",
-      "dependencies": {
-        "ip-address": "^10.0.1",
-        "smart-buffer": "^4.2.0"
-      },
-      "engines": {
-        "node": ">= 10.0.0",
-        "npm": ">= 3.0.0"
-      }
-    },
-    "node_modules/socks-proxy-agent": {
-      "version": "8.0.5",
-      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
-      "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "^4.3.4",
-        "socks": "^2.8.3"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/source-map": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "license": "BSD-3-Clause",
-      "optional": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/string_decoder": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "~5.1.0"
-      }
-    },
-    "node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-json-comments": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
-      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/strnum": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.2.tgz",
-      "integrity": "sha512-DnR90I+jtXNSTXWdwrEy9FakW7UX+qUZg28gj5fk2vxxl7uS/3bpI4fjFYVmdK9etptYBPNkpahuQnEwhwECqA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/supports-color": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-      "license": "MIT",
-      "dependencies": {
-        "has-flag": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/supports-hyperlinks": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/supports-hyperlinks/-/supports-hyperlinks-2.3.0.tgz",
-      "integrity": "sha512-RpsAZlpWcDwOPQA22aCH4J0t7L8JmAvsCxfOSEwm7cQs3LshN36QaTkwd70DnBOXDWGssw2eUoc8CaRWT0XunA==",
-      "license": "MIT",
-      "dependencies": {
-        "has-flag": "^4.0.0",
-        "supports-color": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/terminal-link": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/terminal-link/-/terminal-link-2.1.1.tgz",
-      "integrity": "sha512-un0FmiRUQNr5PJqy9kP7c40F5BOfpGlYTrxonDChEZB7pzZxRNp/bt+ymiy9/npwXya9KH99nJ/GXFIiUkYGFQ==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-escapes": "^4.2.1",
-        "supports-hyperlinks": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/through": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/through/-/through-2.3.8.tgz",
-      "integrity": "sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg==",
-      "license": "MIT"
-    },
-    "node_modules/tiny-async-pool": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/tiny-async-pool/-/tiny-async-pool-2.1.0.tgz",
-      "integrity": "sha512-ltAHPh/9k0STRQqaoUX52NH4ZQYAJz24ZAEwf1Zm+HYg3l9OXTWeqWKyYsHu40wF/F0rxd2N2bk5sLvX2qlSvg==",
-      "license": "MIT"
-    },
-    "node_modules/tinyexec": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.4.tgz",
-      "integrity": "sha512-u9r3uZC0bdpGOXtlxUIdwf9pkmvhqJdrVCH9fapQtgy/OeTTMZ1nqH7agtvEfmGui6e1XxjcdrlxvxJvc3sMqw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -3309,33 +1255,6 @@
         "node": ">=8.0"
       }
     },
-    "node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/typanion": {
-      "version": "3.14.0",
-      "resolved": "https://registry.npmjs.org/typanion/-/typanion-3.14.0.tgz",
-      "integrity": "sha512-ZW/lVMRabETuYCd9O9ZvMhAh8GslSqaUjxmK/JLPCh6l73CvLBiuXswj/+7LdnWOgYsQ130FqLzFz5aGT4I3Ug==",
-      "license": "MIT",
-      "workspaces": [
-        "website"
-      ]
-    },
-    "node_modules/type-fest": {
-      "version": "0.21.3",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
-      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
-      "license": "(MIT OR CC0-1.0)",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/uc.micro": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-2.1.0.tgz",
@@ -3353,58 +1272,6 @@
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
-    },
-    "node_modules/upath": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/upath/-/upath-2.0.1.tgz",
-      "integrity": "sha512-1uEe95xksV1O0CYKXo8vQvN1JEbtJp7lb7C5U9HMsIp6IVwntkH/oNUzyVNQSd4S1sYk2FpSSW44FqMc8qee5w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=4",
-        "yarn": "*"
-      }
-    },
-    "node_modules/util-deprecate": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
-      "license": "MIT"
-    },
-    "node_modules/uuid": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
-    "node_modules/wcwidth": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/wcwidth/-/wcwidth-1.0.1.tgz",
-      "integrity": "sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==",
-      "license": "MIT",
-      "dependencies": {
-        "defaults": "^1.0.3"
-      }
-    },
-    "node_modules/wrap-ansi": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
-      "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
     }
   }
 }
diff --git a/scripts/environment/npm-tools/package.json b/scripts/environment/npm-tools/package.json
index a7ec2311e71d2..a40c7f7c3e2ae 100644
--- a/scripts/environment/npm-tools/package.json
+++ b/scripts/environment/npm-tools/package.json
@@ -2,7 +2,7 @@
   "private": true,
   "description": "Pinned npm tools for CI. Run 'npm ci' to install with exact versions from package-lock.json.",
   "dependencies": {
-    "@datadog/datadog-ci": "5.12.0",
+    "@datadog/datadog-ci": "5.13.0",
     "markdownlint-cli2": "0.22.0",
     "prettier": "3.8.1"
   }

From 16458a84ba60660bbdc4258e3245981102da2921 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 14 Apr 2026 11:48:09 -0400
Subject: [PATCH 125/326] chore(website deps): bump follow-redirects from
 1.15.11 to 1.16.0 in /website (#25189)

chore(website deps): bump follow-redirects in /website

Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.11 to 1.16.0.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.11...v1.16.0)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 website/yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/website/yarn.lock b/website/yarn.lock
index 31254815a65f1..c2d1c9ed279dc 100644
--- a/website/yarn.lock
+++ b/website/yarn.lock
@@ -2383,9 +2383,9 @@ fn.name@1.x.x:
   integrity sha512-GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==
 
 follow-redirects@^1.15.11:
-  version "1.15.11"
-  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.11.tgz#777d73d72a92f8ec4d2e410eb47352a56b8e8340"
-  integrity sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.16.0.tgz#28474a159d3b9d11ef62050a14ed60e4df6d61bc"
+  integrity sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==
 
 form-data@^4.0.5:
   version "4.0.5"

From e32661adb9138ff721d882f059f35eaf792d355c Mon Sep 17 00:00:00 2001
From: Peter Ehikhuemen <peter.ehikhuemen@datadoghq.com>
Date: Tue, 14 Apr 2026 18:53:04 -0400
Subject: [PATCH 126/326] feat(aws_s3 sink): add Parquet encoder with
 schema_file and auto infer schema support (#25156)

* feat(codecs): add Parquet encoder with schema_file and schema_mode support

* fix broken tests

* remove benches stuff

* fix the integration tests

* Add compression level to compression type

* update teh aws_s3.cue file

* Minor updates based on my own PR review of szibis initial PR

* fix minor issue from batch encoder

* fix tests from szibis PR

* Fix the tests

* Fix cargo fmt and deny issues

* fix cargo markdown and license errors

* Revert cargo.lock serde_json back to what it was

* rebuild cargo.lock, don't want to pull in non needed upgrades

* update warning and licenses

* revert weird test updates

* merge internal_events

* cargo fmt fix

* Throw a validation error if someone tries to use arrow encoding with amazon s3 sink

* update licenses after re-installing dd-rust-license-tool

* Short circuit when there's a serialization error instead of just emitting an error

* PR comments feedback

* emit dropped events metric when there's an error in encoding

* put JsonSerializationError under parquet feature

* emit ArrowWriterError and dropped events

* remove formatting changes in cargo.toml

* Apply suggestions from May's code review

Co-authored-by: May Lee <may.lee@datadoghq.com>

* remove whitespace updates from lib/codecs/cargo.toml

---------

Co-authored-by: May Lee <may.lee@datadoghq.com>
---
 .github/actions/spelling/expect.txt           |   1 +
 .gitignore                                    |   7 +
 Cargo.lock                                    |  64 ++
 Cargo.toml                                    |  10 +-
 LICENSE-3rdparty.csv                          |   5 +
 .../aws_s3_parquet_encoding.feature.md        |  10 +
 deny.toml                                     |   1 +
 lib/codecs/Cargo.toml                         |  11 +-
 lib/codecs/src/encoding/encoder.rs            |  16 +-
 lib/codecs/src/encoding/format/arrow.rs       |  62 +-
 lib/codecs/src/encoding/format/mod.rs         |   6 +
 lib/codecs/src/encoding/format/parquet.rs     | 943 ++++++++++++++++++
 lib/codecs/src/encoding/mod.rs                |   4 +
 lib/codecs/src/encoding/serializer.rs         |  30 +-
 lib/codecs/src/internal_events.rs             | 101 +-
 lib/vector-lib/Cargo.toml                     |   1 +
 src/sinks/aws_s3/config.rs                    | 334 ++++++-
 src/sinks/aws_s3/integration_tests.rs         | 106 ++
 src/sinks/aws_s3/sink.rs                      |   8 +-
 src/sinks/clickhouse/config.rs                |  12 +-
 .../cue/reference/components/sinks/aws_s3.cue | 129 +++
 21 files changed, 1818 insertions(+), 43 deletions(-)
 create mode 100644 changelog.d/aws_s3_parquet_encoding.feature.md
 create mode 100644 lib/codecs/src/encoding/format/parquet.rs

diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index ddd945006f1c4..3656732c51bba 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -604,6 +604,7 @@ transitioning
 Trauring
 Treemap
 trialled
+Trino
 Trivago
 trivy
 trl
diff --git a/.gitignore b/.gitignore
index 1963fcca25fcc..a713eeb297f9a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@ cargo-timing*.html
 target
 tests/data/wasm/*/target
 bench_output.txt
+rust-analyzer.toml
 
 # Python
 *.pyc
@@ -64,3 +65,9 @@ volumes/
 
 # LLM tools
 copilot-instructions.md
+
+# local files not checked in
+local/
+
+# vscode
+.vscode/
diff --git a/Cargo.lock b/Cargo.lock
index d013bc09432ec..ae4c753529775 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -382,6 +382,7 @@ dependencies = [
  "arrow-data",
  "arrow-schema",
  "chrono",
+ "chrono-tz",
  "half",
  "hashbrown 0.16.0",
  "num",
@@ -2428,6 +2429,7 @@ dependencies = [
  "async-trait",
  "bytes",
  "chrono",
+ "chrono-tz",
  "csv-core",
  "derivative",
  "derive_more 2.1.1",
@@ -2440,6 +2442,7 @@ dependencies = [
  "metrics",
  "opentelemetry-proto",
  "ordered-float 4.6.0",
+ "parquet",
  "pin-project",
  "prost 0.12.6",
  "prost-reflect",
@@ -5525,6 +5528,12 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "integer-encoding"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8bb03732005da905c88227371639bf1ad885cc712789c011c31c5fb3ab3ccf02"
+
 [[package]]
 name = "inventory"
 version = "0.3.22"
@@ -7568,6 +7577,37 @@ dependencies = [
  "windows-link 0.2.0",
 ]
 
+[[package]]
+name = "parquet"
+version = "56.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0dbd48ad52d7dccf8ea1b90a3ddbfaea4f69878dd7683e51c507d4bc52b5b27"
+dependencies = [
+ "ahash 0.8.11",
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-cast",
+ "arrow-data",
+ "arrow-ipc",
+ "arrow-schema",
+ "arrow-select",
+ "base64 0.22.1",
+ "bytes",
+ "chrono",
+ "flate2",
+ "half",
+ "hashbrown 0.16.0",
+ "lz4_flex",
+ "num",
+ "num-bigint",
+ "paste",
+ "seq-macro",
+ "snap",
+ "thrift",
+ "twox-hash",
+ "zstd 0.13.2",
+]
+
 [[package]]
 name = "parse-size"
 version = "1.1.0"
@@ -7580,6 +7620,12 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13242a5ce97f39a8095d03c8b273e91d09f2690c0b7d69a2af844941115bab24"
 
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
 [[package]]
 name = "pastey"
 version = "0.2.1"
@@ -9755,6 +9801,12 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "seq-macro"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
+
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -11021,6 +11073,17 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "thrift"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e54bc85fc7faa8bc175c4bab5b92ba8d9a3ce893d0e9f42cc455c8ab16a9e09"
+dependencies = [
+ "byteorder",
+ "integer-encoding",
+ "ordered-float 2.10.1",
+]
+
 [[package]]
 name = "tikv-jemalloc-sys"
 version = "0.6.1+5.3.0-1-ge13ca993e8ccb9ba9847cc330696e02839f328f7"
@@ -12348,6 +12411,7 @@ dependencies = [
  "openssl-probe",
  "openssl-src",
  "ordered-float 4.6.0",
+ "parquet",
  "pastey",
  "percent-encoding",
  "pin-project",
diff --git a/Cargo.toml b/Cargo.toml
index 84d89c50096f9..6b233580143c8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -204,7 +204,7 @@ tonic-build = { version = "0.11", default-features = false, features = ["transpo
 tonic-health = { version = "0.11", default-features = false }
 tonic-reflection = { version = "0.11", default-features = false, features = ["server"] }
 tracing = { version = "0.1.44", default-features = false }
-tracing-subscriber = { version = "0.3.22", default-features = false, features = ["fmt"]  }
+tracing-subscriber = { version = "0.3.22", default-features = false, features = ["fmt"] }
 url = { version = "2.5.4", default-features = false, features = ["serde"] }
 uuid = { version = "1.22.0", features = ["v4", "v7", "serde", "fast-rng"] }
 vector-config = { path = "lib/vector-config" }
@@ -353,6 +353,13 @@ async-compression = { version = "0.4.27", default-features = false, features = [
 apache-avro = { version = "0.16.0", default-features = false, optional = true }
 arrow = { version = "56.2.0", default-features = false, features = ["ipc"], optional = true }
 arrow-schema = { version = "56.2.0", default-features = false, optional = true }
+parquet = { version = "56.2.0", default-features = false, features = [
+  "arrow",
+  "snap",
+  "zstd",
+  "lz4",
+  "flate2-rust_backened",
+], optional = true }
 axum = { version = "0.6.20", default-features = false }
 base64 = { workspace = true, optional = true }
 bloomy = { version = "1.2.0", default-features = false, optional = true }
@@ -609,6 +616,7 @@ enrichment-tables-memory = ["dep:evmap", "dep:evmap-derive", "dep:thread_local"]
 
 # Codecs
 codecs-arrow = ["dep:arrow", "dep:arrow-schema", "vector-lib/arrow"]
+codecs-parquet = ["dep:parquet", "codecs-arrow", "vector-lib/parquet"]
 codecs-opentelemetry = ["vector-lib/opentelemetry"]
 codecs-syslog = ["vector-lib/syslog"]
 
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 9a135f0479f51..ac6f8bc2acb4a 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -382,6 +382,7 @@ inotify,https://github.com/hannobraun/inotify,ISC,"Hanno Braun <mail@hannobraun.
 inotify-sys,https://github.com/hannobraun/inotify-sys,ISC,Hanno Braun <hb@hannobraun.de>
 inout,https://github.com/RustCrypto/utils,MIT OR Apache-2.0,RustCrypto Developers
 instability,https://github.com/ratatui-org/instability,MIT,"Stephen M. Coakley <me@stephencoakley.com>, Joshka"
+integer-encoding,https://github.com/dermesser/integer-encoding-rs,MIT,Lewin Bormann <lbo@spheniscida.de>
 inventory,https://github.com/dtolnay/inventory,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 ipconfig,https://github.com/liranringel/ipconfig,MIT OR Apache-2.0,Liran Ringel <liranringel@gmail.com>
 ipcrypt-rs,https://github.com/jedisct1/rust-ipcrypt2,ISC,Frank Denis <github@pureftpd.org>
@@ -533,8 +534,10 @@ pad,https://github.com/ogham/rust-pad,MIT,Ben S <ogham@bsago.me>
 parking,https://github.com/smol-rs/parking,Apache-2.0 OR MIT,"Stjepan Glavina <stjepang@gmail.com>, The Rust Project Developers"
 parking_lot,https://github.com/Amanieu/parking_lot,MIT OR Apache-2.0,Amanieu d'Antras <amanieu@gmail.com>
 parking_lot_core,https://github.com/Amanieu/parking_lot,MIT OR Apache-2.0,Amanieu d'Antras <amanieu@gmail.com>
+parquet,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
 parse-size,https://github.com/kennytm/parse-size,MIT,kennytm <kennytm@gmail.com>
 passt,https://github.com/kevingimbel/passt,MIT OR Apache-2.0,Kevin Gimbel <hallo@kevingimbel.com>
+paste,https://github.com/dtolnay/paste,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 pastey,https://github.com/as1100k/pastey,MIT OR Apache-2.0,"Aditya Kumar <git@adityais.dev>, David Tolnay <dtolnay@gmail.com>"
 pbkdf2,https://github.com/RustCrypto/password-hashes/tree/master/pbkdf2,MIT OR Apache-2.0,RustCrypto Developers
 peeking_take_while,https://github.com/fitzgen/peeking_take_while,MIT OR Apache-2.0,Nick Fitzgerald <fitzgen@gmail.com>
@@ -674,6 +677,7 @@ secrecy,https://github.com/iqlusioninc/crates/tree/main/secrecy,Apache-2.0 OR MI
 security-framework,https://github.com/kornelski/rust-security-framework,MIT OR Apache-2.0,"Steven Fackler <sfackler@gmail.com>, Kornel <kornel@geekhood.net>"
 security-framework-sys,https://github.com/kornelski/rust-security-framework,MIT OR Apache-2.0,"Steven Fackler <sfackler@gmail.com>, Kornel <kornel@geekhood.net>"
 semver,https://github.com/dtolnay/semver,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
+seq-macro,https://github.com/dtolnay/seq-macro,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 serde,https://github.com/serde-rs/serde,MIT OR Apache-2.0,"Erick Tryzelaar <erick.tryzelaar@gmail.com>, David Tolnay <dtolnay@gmail.com>"
 serde-aux,https://github.com/iddm/serde-aux,MIT,Victor Polevoy <maintainer@vpolevoy.com>
 serde-toml-merge,https://github.com/jdrouet/serde-toml-merge,MIT,Jeremie Drouet <jeremie.drouet@gmail.com>
@@ -756,6 +760,7 @@ terminal_size,https://github.com/eminence/terminal-size,MIT OR Apache-2.0,Andrew
 thiserror,https://github.com/dtolnay/thiserror,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 thiserror-impl,https://github.com/dtolnay/thiserror,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 thread_local,https://github.com/Amanieu/thread_local-rs,MIT OR Apache-2.0,Amanieu d'Antras <amanieu@gmail.com>
+thrift,https://github.com/apache/thrift/tree/master/lib/rs,Apache-2.0,Apache Thrift Developers <dev@thrift.apache.org>
 tikv-jemalloc-sys,https://github.com/tikv/jemallocator,MIT OR Apache-2.0,"Alex Crichton <alex@alexcrichton.com>, Gonzalo Brito Gadeschi <gonzalobg88@gmail.com>, The TiKV Project Developers"
 tikv-jemallocator,https://github.com/tikv/jemallocator,MIT OR Apache-2.0,"Alex Crichton <alex@alexcrichton.com>, Gonzalo Brito Gadeschi <gonzalobg88@gmail.com>, Simon Sapin <simon.sapin@exyr.org>, Steven Fackler <sfackler@gmail.com>, The TiKV Project Developers"
 time,https://github.com/time-rs/time,MIT OR Apache-2.0,"Jacob Pratt <open-source@jhpratt.dev>, Time contributors"
diff --git a/changelog.d/aws_s3_parquet_encoding.feature.md b/changelog.d/aws_s3_parquet_encoding.feature.md
new file mode 100644
index 0000000000000..afaa01cc70c26
--- /dev/null
+++ b/changelog.d/aws_s3_parquet_encoding.feature.md
@@ -0,0 +1,10 @@
+Add Apache Parquet batch encoding support for the `aws_s3` sink with flexible schema definitions.
+
+Events can now be encoded as Parquet columnar files with multiple schema input options:
+
+- **Native Parquet schema** — automatically generate a schema or supply `.schema` file
+- **Configurable compression** - (Snappy, ZSTD, GZIP, LZ4, None).
+
+Enable the `codecs-parquet` feature and configure `batch_encoding` with `codec = "parquet"` in the S3 sink configuration.
+
+authors: szibis petere-datadog
diff --git a/deny.toml b/deny.toml
index b8e0be77f41c8..c19b0a23f5ee6 100644
--- a/deny.toml
+++ b/deny.toml
@@ -44,4 +44,5 @@ ignore = [
   { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained (https://github.com/vectordotdev/vector/issues/24940)" },
   { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile is unmaintained - unpatched crate (https://github.com/bytebeamio/rumqtt/issues/1010) & tonic/reqwest upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
   { id = "RUSTSEC-2026-0049", reason = "rustls-webpki 0.102 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
+  { id = "RUSTSEC-2024-0436", reason = "paste crate is unmaintained - transitive dependency via parquet v56.2.0, no safe upgrade available" },
 ]
diff --git a/lib/codecs/Cargo.toml b/lib/codecs/Cargo.toml
index 90a5fd2780109..b9043b7223d8a 100644
--- a/lib/codecs/Cargo.toml
+++ b/lib/codecs/Cargo.toml
@@ -15,9 +15,17 @@ path = "tests/bin/generate-avro-fixtures.rs"
 [dependencies]
 apache-avro = { version = "0.20.0", default-features = false }
 arrow = { version = "56.2.0", default-features = false, features = ["ipc", "json"], optional = true }
+parquet = { version = "56.2.0", default-features = false, features = [
+    "arrow",
+    "snap",
+    "zstd",
+    "lz4",
+    "flate2-rust_backened",
+], optional = true }
 async-trait.workspace = true
 bytes.workspace = true
 chrono.workspace = true
+chrono-tz.workspace = true
 rust_decimal.workspace = true
 csv-core = { version = "0.1.13", default-features = false }
 derivative.workspace = true
@@ -69,7 +77,8 @@ uuid.workspace = true
 vrl.workspace = true
 
 [features]
-arrow = ["dep:arrow"]
+arrow = ["dep:arrow", "arrow/chrono-tz"]
+parquet = ["dep:parquet", "arrow"]
 opentelemetry = ["dep:opentelemetry-proto"]
 syslog = ["dep:syslog_loose", "dep:strum", "dep:derive_more", "dep:serde-aux", "dep:toml"]
 test = []
diff --git a/lib/codecs/src/encoding/encoder.rs b/lib/codecs/src/encoding/encoder.rs
index 4924dd05447b1..b3ca9a00216ec 100644
--- a/lib/codecs/src/encoding/encoder.rs
+++ b/lib/codecs/src/encoding/encoder.rs
@@ -5,6 +5,8 @@ use vector_core::event::Event;
 
 #[cfg(feature = "arrow")]
 use crate::encoding::ArrowStreamSerializer;
+#[cfg(feature = "parquet")]
+use crate::encoding::ParquetSerializer;
 use crate::{
     encoding::{Error, Framer, Serializer},
     internal_events::{EncoderFramingError, EncoderSerializeError},
@@ -16,6 +18,9 @@ pub enum BatchSerializer {
     /// Arrow IPC stream format serializer.
     #[cfg(feature = "arrow")]
     Arrow(ArrowStreamSerializer),
+    /// Parquet format serializer.
+    #[cfg(feature = "parquet")]
+    Parquet(Box<ParquetSerializer>),
 }
 
 /// An encoder that encodes batches of events.
@@ -36,10 +41,12 @@ impl BatchEncoder {
     }
 
     /// Get the HTTP content type.
-    #[cfg(feature = "arrow")]
+    #[cfg(any(feature = "arrow", feature = "parquet"))]
     pub const fn content_type(&self) -> &'static str {
         match &self.serializer {
             BatchSerializer::Arrow(_) => "application/vnd.apache.arrow.stream",
+            #[cfg(feature = "parquet")]
+            BatchSerializer::Parquet(_) => "application/vnd.apache.parquet",
         }
     }
 }
@@ -63,6 +70,11 @@ impl tokio_util::codec::Encoder<Vec<Event>> for BatchEncoder {
                     }
                 })
             }
+            #[cfg(feature = "parquet")]
+            BatchSerializer::Parquet(serializer) => serializer
+                .encode(events, buffer)
+                .map_err(Error::SerializingError),
+            #[allow(unreachable_patterns)]
             _ => unreachable!("BatchSerializer cannot be constructed without encode()"),
         }
     }
@@ -74,7 +86,7 @@ pub enum EncoderKind {
     /// Uses framing to encode individual events
     Framed(Box<Encoder<Framer>>),
     /// Encodes events in batches without framing
-    #[cfg(feature = "arrow")]
+    #[cfg(any(feature = "arrow", feature = "parquet"))]
     Batch(BatchEncoder),
 }
 
diff --git a/lib/codecs/src/encoding/format/arrow.rs b/lib/codecs/src/encoding/format/arrow.rs
index 236d6292d375e..b8c86239ddb6a 100644
--- a/lib/codecs/src/encoding/format/arrow.rs
+++ b/lib/codecs/src/encoding/format/arrow.rs
@@ -6,6 +6,7 @@
 
 use arrow::{
     datatypes::{DataType, Field, Fields, Schema, SchemaRef},
+    error::ArrowError,
     ipc::writer::StreamWriter,
     json::reader::ReaderBuilder,
     record_batch::RecordBatch,
@@ -203,7 +204,13 @@ pub fn encode_events_to_arrow_ipc_stream(
         return Err(ArrowEncodingError::NoEvents);
     }
 
-    let record_batch = build_record_batch(schema, events)?;
+    let json_values = vector_log_events_to_json_values(events).map_err(|e| {
+        ArrowEncodingError::RecordBatchCreation {
+            source: ArrowError::JsonError(e.to_string()),
+        }
+    })?;
+
+    let record_batch = build_record_batch(schema, &json_values)?;
 
     let mut buffer = BytesMut::new().writer();
     let mut writer =
@@ -271,7 +278,7 @@ fn make_field_nullable(field: &Field) -> Result<Field, ArrowEncodingError> {
 /// Find non-nullable schema fields that are missing or null in any of the given events.
 pub fn find_null_non_nullable_fields<'a>(
     schema: &'a Schema,
-    values: &[&vrl::value::Value],
+    values: &[serde_json::Value],
 ) -> Vec<&'a str> {
     schema
         .fields()
@@ -282,38 +289,41 @@ pub fn find_null_non_nullable_fields<'a>(
                     value
                         .as_object()
                         .and_then(|map| map.get(field.name().as_str()))
-                        .is_none_or(vrl::value::Value::is_null)
+                        .is_none_or(serde_json::Value::is_null)
                 })
         })
         .map(|field| field.name().as_str())
         .collect()
 }
 
-/// Build an Arrow RecordBatch from a slice of events using the provided schema.
-fn build_record_batch(
-    schema: SchemaRef,
+pub(crate) fn vector_log_events_to_json_values(
     events: &[Event],
-) -> Result<RecordBatch, ArrowEncodingError> {
-    let values: Vec<_> = events
+) -> Result<Vec<serde_json::Value>, serde_json::Error> {
+    events
         .iter()
         .filter_map(Event::maybe_as_log)
-        .map(|log| log.value())
-        .collect();
+        .map(serde_json::to_value)
+        .collect()
+}
 
+/// Build an Arrow RecordBatch from a slice of events using the provided schema.
+pub(crate) fn build_record_batch(
+    schema: SchemaRef,
+    values: &[serde_json::Value],
+) -> Result<RecordBatch, ArrowEncodingError> {
     if values.is_empty() {
         return Err(ArrowEncodingError::NoEvents);
     }
 
-    let missing = find_null_non_nullable_fields(&schema, &values);
+    let missing = find_null_non_nullable_fields(&schema, values);
     if !missing.is_empty() {
-        for field_name in &missing {
-            let error: vector_common::Error = Box::new(ArrowEncodingError::NullConstraint {
-                field_name: field_name.to_string(),
-            });
-            vector_common::internal_event::emit(
-                crate::internal_events::EncoderNullConstraintError { error: &error },
-            );
-        }
+        let error: vector_common::Error = Box::new(ArrowEncodingError::NullConstraint {
+            field_name: missing.join(", "),
+        });
+        vector_common::internal_event::emit(crate::internal_events::EncoderNullConstraintError {
+            error: &error,
+            count: values.len(),
+        });
         return Err(ArrowEncodingError::NullConstraint {
             field_name: missing.join(", "),
         });
@@ -323,7 +333,7 @@ fn build_record_batch(
         .build_decoder()
         .context(RecordBatchCreationSnafu)?;
 
-    decoder.serialize(&values).context(ArrowJsonDecodeSnafu)?;
+    decoder.serialize(values).context(ArrowJsonDecodeSnafu)?;
 
     decoder
         .flush()
@@ -885,8 +895,10 @@ mod tests {
                 ("a", Value::Bytes("val".into())),
                 ("b", Value::Integer(42)),
             ]);
-            let value = event.as_log().value();
-            let missing = find_null_non_nullable_fields(&schema, &[value]);
+            let missing = find_null_non_nullable_fields(
+                &schema,
+                &vector_log_events_to_json_values(&[event]).unwrap(),
+            );
             assert!(
                 missing.is_empty(),
                 "Expected no missing fields, got: {missing:?}"
@@ -898,8 +910,10 @@ mod tests {
             let schema = Schema::new(vec![Field::new("a", DataType::Utf8, false)]);
 
             let event = create_event(vec![("a", Value::Null)]);
-            let value = event.as_log().value();
-            let missing = find_null_non_nullable_fields(&schema, &[value]);
+            let missing = find_null_non_nullable_fields(
+                &schema,
+                &vector_log_events_to_json_values(&[event]).unwrap(),
+            );
             assert_eq!(missing, vec!["a"]);
         }
     }
diff --git a/lib/codecs/src/encoding/format/mod.rs b/lib/codecs/src/encoding/format/mod.rs
index 85bc094b26947..f760ea5c8dd83 100644
--- a/lib/codecs/src/encoding/format/mod.rs
+++ b/lib/codecs/src/encoding/format/mod.rs
@@ -16,6 +16,8 @@ mod native;
 mod native_json;
 #[cfg(feature = "opentelemetry")]
 mod otlp;
+#[cfg(feature = "parquet")]
+mod parquet;
 mod protobuf;
 mod raw_message;
 #[cfg(feature = "syslog")]
@@ -24,6 +26,10 @@ mod text;
 
 use std::fmt::Debug;
 
+#[cfg(feature = "parquet")]
+pub use self::parquet::{
+    ParquetCompression, ParquetSchemaMode, ParquetSerializer, ParquetSerializerConfig,
+};
 #[cfg(feature = "arrow")]
 pub use arrow::{
     ArrowEncodingError, ArrowStreamSerializer, ArrowStreamSerializerConfig, SchemaProvider,
diff --git a/lib/codecs/src/encoding/format/parquet.rs b/lib/codecs/src/encoding/format/parquet.rs
new file mode 100644
index 0000000000000..7349119371a5b
--- /dev/null
+++ b/lib/codecs/src/encoding/format/parquet.rs
@@ -0,0 +1,943 @@
+//! Parquet batch format codec for batched event encoding
+//!
+//! Provides Apache Parquet format encoding with schema file support and auto-inference.
+//! Reuses the Arrow record batch building logic from the Arrow IPC codec,
+//! then writes the batch as a complete Parquet file using `ArrowWriter`.
+
+use std::collections::HashSet;
+use std::path::PathBuf;
+use std::sync::Arc;
+
+use arrow::datatypes::{DataType, Field, Schema, SchemaRef};
+use arrow::error::ArrowError;
+use arrow::json::reader::infer_json_schema_from_iterator;
+use arrow::record_batch::RecordBatch;
+use bytes::{BufMut, BytesMut};
+use derivative::Derivative;
+use parquet::arrow::ArrowWriter;
+use parquet::basic::ZstdLevel;
+use parquet::basic::{Compression as ParquetCodecCompression, GzipLevel};
+use parquet::file::properties::WriterProperties;
+use std::io::{Error, ErrorKind};
+use tracing::warn;
+use vector_common::internal_event::{
+    ComponentEventsDropped, Count, InternalEventHandle, Registered, UNINTENTIONAL, emit, register,
+};
+use vector_config::configurable_component;
+use vector_core::event::Event;
+
+use super::arrow::{ArrowEncodingError, build_record_batch};
+use crate::encoding::format::arrow::vector_log_events_to_json_values;
+use crate::internal_events::{ArrowWriterError, JsonSerializationError, SchemaGenerationError};
+
+type EventsDroppedError = ComponentEventsDropped<'static, UNINTENTIONAL>;
+
+/// Compression algorithm and optional level for archive objects.
+#[configurable_component]
+#[derive(Default, Copy, Clone, Debug, PartialEq)]
+#[serde(tag = "algorithm", rename_all = "snake_case")]
+pub enum ParquetCompression {
+    /// Zstd compression. Level must be between 1 and 21.
+    Zstd {
+        /// Compression level (1–21). This is the range Vector currently supports; higher values compress more but are slower.
+        #[configurable(validation(range(min = 1, max = 21)))]
+        level: u8,
+    },
+    /// Gzip compression. Level must be between 1 and 9.
+    Gzip {
+        /// Compression level (1–9). This is the range Vector currently supports; higher values compress more but are slower.
+        #[configurable(validation(range(min = 1, max = 9)))]
+        level: u8,
+    },
+
+    /// Snappy compression (no level).
+    #[default]
+    Snappy,
+
+    /// LZ4 raw compression
+    Lz4,
+
+    /// No compression
+    None,
+}
+
+impl TryFrom<ParquetCompression> for ParquetCodecCompression {
+    type Error = parquet::errors::ParquetError;
+    fn try_from(
+        value: ParquetCompression,
+    ) -> Result<ParquetCodecCompression, parquet::errors::ParquetError> {
+        match value {
+            ParquetCompression::None => Ok(ParquetCodecCompression::UNCOMPRESSED),
+            ParquetCompression::Snappy => Ok(ParquetCodecCompression::SNAPPY),
+            ParquetCompression::Zstd { level } => Ok(ParquetCodecCompression::ZSTD(
+                ZstdLevel::try_new(level.into())?,
+            )),
+            ParquetCompression::Gzip { level } => Ok(ParquetCodecCompression::GZIP(
+                GzipLevel::try_new(level.into())?,
+            )),
+            ParquetCompression::Lz4 => Ok(ParquetCodecCompression::LZ4_RAW),
+        }
+    }
+}
+
+/// Schema handling mode.
+#[configurable_component]
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum ParquetSchemaMode {
+    /// Missing fields become null. Extra fields are silently dropped.
+    #[default]
+    Relaxed,
+    /// Missing fields become null. Extra fields cause an error.
+    Strict,
+    /// Auto infer schema based on the batch. No schema file needed.
+    AutoInfer,
+}
+
+/// Configuration for the Parquet serializer.
+///
+/// Encodes events as Apache Parquet columnar files, optimized for analytical queries
+/// via Athena, Trino, Spark, and other columnar query engines.
+///
+/// Either `schema_file` must be provided, or `schema_mode` must be set to `auto_infer`.
+#[configurable_component]
+#[derive(Clone, Debug, Default)]
+pub struct ParquetSerializerConfig {
+    /// Path to a native Parquet schema file (`.schema`).
+    ///
+    /// Required unless `schema_mode` is `auto_infer`. The file must contain a valid
+    /// Parquet message type definition.
+    #[serde(default)]
+    pub schema_file: Option<PathBuf>,
+
+    /// Compression codec applied per column page inside the Parquet file.
+    #[serde(default)]
+    #[configurable(derived)]
+    pub compression: ParquetCompression,
+
+    /// Controls how events with fields not present in the schema are handled.
+    #[serde(default)]
+    #[configurable(derived)]
+    pub schema_mode: ParquetSchemaMode,
+}
+
+impl ParquetSerializerConfig {
+    /// Resolve the Arrow schema from the configured schema source.
+    fn resolve_schema(&self) -> Result<Schema, Box<dyn std::error::Error + Send + Sync>> {
+        if self.schema_mode == ParquetSchemaMode::AutoInfer {
+            return Ok(Schema::empty());
+        }
+
+        let path = self
+            .schema_file
+            .as_ref()
+            .ok_or("schema_file is required unless schema_mode is auto_infer")?;
+
+        let content = read_schema_file(path, "schema_file")?;
+        let parquet_type = parquet::schema::parser::parse_message_type(&content)
+            .map_err(|e| format!("Failed to parse Parquet schema: {e}"))?;
+        let schema_desc = parquet::schema::types::SchemaDescriptor::new(Arc::new(parquet_type));
+        let arrow_schema = parquet::arrow::parquet_to_arrow_schema(&schema_desc, None)
+            .map_err(|e| format!("Failed to convert Parquet schema to Arrow: {e}"))?;
+        Ok(arrow_schema)
+    }
+
+    /// The data type of events that are accepted by `ParquetSerializer`.
+    pub fn input_type(&self) -> vector_core::config::DataType {
+        vector_core::config::DataType::Log
+    }
+
+    /// The schema required by the serializer.
+    pub fn schema_requirement(&self) -> vector_core::schema::Requirement {
+        vector_core::schema::Requirement::empty()
+    }
+}
+
+fn read_schema_file(
+    path: &std::path::Path,
+    field_name: &str,
+) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
+    const MAX_SCHEMA_FILE_SIZE: u64 = 10 * 1024 * 1024; // 10 MB
+    let display = path.display();
+    let metadata = std::fs::metadata(path)
+        .map_err(|e| format!("Failed to read {field_name} '{display}': {e}"))?;
+    if metadata.len() > MAX_SCHEMA_FILE_SIZE {
+        return Err(format!(
+            "{field_name} '{display}' is too large ({} bytes, max {MAX_SCHEMA_FILE_SIZE})",
+            metadata.len()
+        )
+        .into());
+    }
+    std::fs::read_to_string(path)
+        .map_err(|e| format!("Failed to read {field_name} '{display}': {e}").into())
+}
+
+/// Check the resolved Arrow schema for data types unsupported by the JSON-based
+/// encode path (`arrow::json::reader::ReaderBuilder`). Binary variants are
+/// accepted by Parquet/Arrow at the schema level but the JSON decoder rejects
+/// them at runtime, so we fail fast here at config time.
+fn reject_unsupported_arrow_types(
+    schema: &Schema,
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    fn check_field(field: &Field, path: &str, bad: &mut Vec<String>) {
+        let name = if path.is_empty() {
+            field.name().to_string()
+        } else {
+            format!("{path}.{}", field.name())
+        };
+        match field.data_type() {
+            DataType::Binary | DataType::LargeBinary | DataType::FixedSizeBinary(_) => {
+                bad.push(format!("'{name}' ({:?})", field.data_type()));
+            }
+            DataType::Struct(fields) => {
+                for f in fields {
+                    check_field(f, &name, bad);
+                }
+            }
+            DataType::List(inner) | DataType::LargeList(inner) => {
+                check_field(inner, &name, bad);
+            }
+            DataType::Map(entries_field, _) => {
+                if let DataType::Struct(kv) = entries_field.data_type() {
+                    for f in kv {
+                        check_field(f, &name, bad);
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+
+    let mut bad = Vec::new();
+    for field in schema.fields() {
+        check_field(field, "", &mut bad);
+    }
+    if !bad.is_empty() {
+        return Err(format!(
+            "Schema contains binary field(s) unsupported by the JSON-based Arrow encoder: {}. \
+             Use Utf8 for base64/hex-encoded data instead.",
+            bad.join(", ")
+        )
+        .into());
+    }
+    Ok(())
+}
+
+/// Parquet batch serializer.
+#[derive(Derivative)]
+#[derivative(Debug, Clone)]
+pub struct ParquetSerializer {
+    schema: SchemaRef,
+    writer_props: Arc<WriterProperties>,
+    schema_mode: ParquetSchemaMode,
+    /// Pre-built set of schema field names for O(1) strict-mode lookups.
+    schema_field_names: HashSet<String>,
+
+    #[derivative(Debug = "ignore")]
+    events_dropped_handle: Registered<EventsDroppedError>,
+}
+
+impl ParquetSerializer {
+    /// Create a new `ParquetSerializer` from the given configuration.
+    pub fn new(
+        config: ParquetSerializerConfig,
+    ) -> Result<Self, Box<dyn std::error::Error + Send + Sync + 'static>> {
+        let schema = config.resolve_schema()?;
+        reject_unsupported_arrow_types(&schema)?;
+        let schema_ref = SchemaRef::new(schema);
+
+        let schema_field_names = schema_ref
+            .fields()
+            .iter()
+            .map(|f| f.name().clone())
+            .collect::<HashSet<_>>();
+
+        let writer_props = Arc::new(
+            WriterProperties::builder()
+                .set_compression(config.compression.try_into()?)
+                .build(),
+        );
+
+        Ok(Self {
+            schema: schema_ref,
+            writer_props,
+            schema_mode: config.schema_mode,
+            schema_field_names,
+            events_dropped_handle: register(EventsDroppedError::from(
+                "Events could not be serialized to parquet",
+            )),
+        })
+    }
+
+    /// Returns the MIME content type for Parquet data.
+    pub const fn content_type(&self) -> &'static str {
+        "application/vnd.apache.parquet"
+    }
+
+    /// Writes `record_batch` into `buffer` as a complete Parquet file.
+    ///
+    /// On failure, emits an [`ArrowWriterError`] internal event (which also
+    /// increments `component_errors_total` and emits the events-dropped metric)
+    /// before returning the error.
+    fn write_record_batch(
+        &self,
+        record_batch: &RecordBatch,
+        buffer: &mut BytesMut,
+        event_count: usize,
+    ) -> Result<(), parquet::errors::ParquetError> {
+        let mut writer = ArrowWriter::try_new(
+            buffer.writer(),
+            Arc::clone(record_batch.schema_ref()),
+            Some((*self.writer_props).clone()),
+        )
+        .inspect_err(|e| {
+            emit(ArrowWriterError {
+                error: e,
+                batch_count: event_count,
+            });
+        })?;
+
+        writer.write(record_batch).inspect_err(|e| {
+            emit(ArrowWriterError {
+                error: e,
+                batch_count: event_count,
+            });
+        })?;
+
+        writer.close().inspect_err(|e| {
+            emit(ArrowWriterError {
+                error: e,
+                batch_count: event_count,
+            });
+        })?;
+
+        Ok(())
+    }
+}
+
+impl tokio_util::codec::Encoder<Vec<Event>> for ParquetSerializer {
+    type Error = vector_common::Error;
+
+    fn encode(&mut self, events: Vec<Event>, buffer: &mut BytesMut) -> Result<(), Self::Error> {
+        if events.is_empty() {
+            return Ok(());
+        }
+
+        let json_values = match vector_log_events_to_json_values(&events) {
+            Ok(values) => values,
+            Err(e) => {
+                emit(JsonSerializationError {
+                    error: &e,
+                    batch_count: events.len(),
+                });
+                return Err(Box::new(e));
+            }
+        };
+
+        let non_log_count = events.len() - json_values.len();
+
+        if non_log_count > 0 {
+            warn!(
+                message = "Non-log events dropped by Parquet encoder ",
+                %non_log_count,
+                internal_log_rate_secs = 10,
+            );
+            self.events_dropped_handle.emit(Count(non_log_count))
+        }
+
+        if json_values.is_empty() {
+            return Ok(());
+        }
+
+        match self.schema_mode {
+            // In strict mode, check for extra top-level fields not in the schema.
+            ParquetSchemaMode::Strict => {
+                for event in &events {
+                    if let Some(log) = event.maybe_as_log()
+                        && let Some(object_map) = log.as_map()
+                    {
+                        for top_level in object_map.keys() {
+                            if !self.schema_field_names.contains(top_level.as_str()) {
+                                self.events_dropped_handle.emit(Count(events.len()));
+                                return Err(Box::new(ArrowEncodingError::SchemaFetchError {
+                                    message: format!(
+                                        "Strict schema mode: event contains field '{top_level}' not in schema",
+                                    ),
+                                }));
+                            }
+                        }
+                    }
+                }
+            }
+            ParquetSchemaMode::AutoInfer => {
+                let schema = ParquetSchemaGenerator::infer_schema(&json_values)?;
+                self.schema = Arc::new(ParquetSchemaGenerator::try_normalize_schema(
+                    &events, schema,
+                ));
+            }
+            ParquetSchemaMode::Relaxed => {}
+        }
+
+        let record_batch =
+            build_record_batch(Arc::clone(&self.schema), &json_values).map_err(Box::new)?;
+
+        self.write_record_batch(&record_batch, buffer, json_values.len())
+            .map_err(Box::new)?;
+
+        Ok(())
+    }
+}
+
+pub struct ParquetSchemaGenerator {}
+
+impl ParquetSchemaGenerator {
+    pub fn infer_schema(events: &[serde_json::Value]) -> Result<Schema, Error> {
+        let schema = infer_json_schema_from_iterator(events.iter().map(Ok::<_, ArrowError>))
+            .map_err(|e| {
+                emit(SchemaGenerationError {
+                    error: &e,
+                    batch_count: events.len(),
+                });
+                Error::new(ErrorKind::InvalidData, e.to_string())
+            })?;
+
+        Ok(schema)
+    }
+
+    /// Attempt to modify schema to set timestamp fields as Timestamp instead of Utf8.
+    /// Only works for top-level fields.
+    fn try_normalize_schema(events: &[Event], schema: Schema) -> Schema {
+        let mut ts_seen: HashSet<String> = HashSet::new();
+        let mut non_ts_seen: HashSet<String> = HashSet::new();
+
+        for event in events.iter().filter_map(Event::maybe_as_log) {
+            if let Some(object_map) = event.as_map() {
+                for (path, value) in object_map {
+                    if value.is_timestamp() {
+                        ts_seen.insert(path.to_string());
+                    } else if !value.is_null() {
+                        non_ts_seen.insert(path.to_string());
+                    }
+                }
+            }
+        }
+
+        let new_fields: Vec<Field> = schema
+            .fields()
+            .iter()
+            .map(|f| {
+                if ts_seen.contains(f.name()) && !non_ts_seen.contains(f.name()) {
+                    Field::new(
+                        f.name(),
+                        DataType::Timestamp(
+                            arrow::datatypes::TimeUnit::Microsecond,
+                            Some("UTC".into()),
+                        ),
+                        f.is_nullable(),
+                    )
+                } else {
+                    f.as_ref().clone()
+                }
+            })
+            .collect();
+
+        Schema::new_with_metadata(new_fields, schema.metadata().clone())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use bytes::Bytes;
+    use parquet::file::reader::{FileReader, SerializedFileReader};
+    use parquet::record::reader::RowIter;
+    use tokio_util::codec::Encoder;
+    use vector_core::event::LogEvent;
+
+    fn create_event<V>(fields: Vec<(&str, V)>) -> Event
+    where
+        V: Into<vector_core::event::Value>,
+    {
+        let mut log = LogEvent::default();
+        for (key, value) in fields {
+            log.insert(key, value.into());
+        }
+        Event::Log(log)
+    }
+
+    fn assert_parquet_magic(data: &[u8]) {
+        assert!(data.len() >= 4, "Output too short to be valid Parquet");
+        assert_eq!(&data[..4], b"PAR1", "Missing Parquet magic bytes");
+    }
+
+    fn parquet_row_count(data: &[u8]) -> usize {
+        let reader =
+            SerializedFileReader::new(Bytes::copy_from_slice(data)).expect("Invalid Parquet file");
+        let iter = RowIter::from_file_into(Box::new(reader));
+        iter.count()
+    }
+
+    fn parquet_column_names(data: &[u8]) -> Vec<String> {
+        let reader =
+            SerializedFileReader::new(Bytes::copy_from_slice(data)).expect("Invalid Parquet file");
+        let schema = reader.metadata().file_metadata().schema_descr();
+        schema
+            .columns()
+            .iter()
+            .map(|c| c.name().to_string())
+            .collect()
+    }
+
+    fn parse_timestamp(s: &str) -> chrono::DateTime<chrono::Utc> {
+        chrono::DateTime::parse_from_rfc3339(s)
+            .expect("invalid test timestamp")
+            .with_timezone(&chrono::Utc)
+    }
+
+    fn demo_log_event(
+        message: &str,
+        timestamp: chrono::DateTime<chrono::Utc>,
+        status_code: i64,
+        response_time_secs: f64,
+    ) -> Event {
+        use vector_core::event::Value;
+        let mut log = LogEvent::default();
+        log.insert("host", "localhost");
+        log.insert("message", message);
+        log.insert("service", "vector");
+        log.insert("source_type", "demo_logs");
+        log.insert("timestamp", Value::Timestamp(timestamp));
+        log.insert("random_time", Value::Timestamp(timestamp));
+        log.insert("status_code", Value::Integer(status_code));
+        log.insert("response_time_secs", response_time_secs);
+        Event::Log(log)
+    }
+
+    fn sample_events() -> Vec<Event> {
+        const EVENTS: [(&str, &str, i64, f64); 5] = [
+            (
+                "GET /api/v1/health HTTP/1.1",
+                "2026-03-05T20:49:08.037194Z",
+                200,
+                0.037,
+            ),
+            (
+                "POST /api/v1/ingest HTTP/1.1",
+                "2026-03-05T20:49:09.038051Z",
+                201,
+                0.013,
+            ),
+            (
+                "GET /metrics HTTP/1.1",
+                "2026-03-05T20:49:10.036612Z",
+                200,
+                0.022,
+            ),
+            (
+                "DELETE /api/v1/resource HTTP/1.1",
+                "2026-03-05T20:49:11.537131Z",
+                404,
+                0.005,
+            ),
+            (
+                "PATCH /api/v1/config HTTP/1.1",
+                "2026-03-05T20:49:12.037491Z",
+                500,
+                0.091,
+            ),
+        ];
+        EVENTS
+            .iter()
+            .map(|(msg, ts, status, rt)| demo_log_event(msg, parse_timestamp(ts), *status, *rt))
+            .collect()
+    }
+
+    fn encode_autoinfer_and_read_schema(
+        events: Vec<Event>,
+    ) -> (arrow::datatypes::SchemaRef, usize) {
+        use parquet::arrow::arrow_reader::ParquetRecordBatchReaderBuilder;
+
+        let mut serializer = ParquetSerializer::new(ParquetSerializerConfig {
+            schema_mode: ParquetSchemaMode::AutoInfer,
+            ..Default::default()
+        })
+        .expect("AutoInfer serializer should be created without a static schema");
+
+        let mut buffer = BytesMut::new();
+        serializer
+            .encode(events, &mut buffer)
+            .expect("encoding should succeed");
+
+        let data = buffer.freeze();
+        assert_parquet_magic(&data);
+
+        let builder = ParquetRecordBatchReaderBuilder::try_new(data)
+            .expect("should build ParquetRecordBatchReaderBuilder");
+        let schema = builder.schema().clone();
+        let num_rows: usize = builder
+            .build()
+            .expect("should build reader")
+            .map(|b| b.expect("batch read error").num_rows())
+            .sum();
+        (schema, num_rows)
+    }
+
+    /// Write a temporary Parquet schema file and return its path.
+    ///
+    /// `name` must be unique per test to avoid parallel-test races on the same file.
+    fn write_temp_schema(name: &str, content: &str) -> std::path::PathBuf {
+        use std::io::Write;
+        let path = std::env::temp_dir().join(format!(
+            "vector_parquet_test_{}_{}.schema",
+            std::process::id(),
+            name,
+        ));
+        let mut f = std::fs::File::create(&path).expect("Failed to create schema file");
+        write!(f, "{content}").expect("Failed to write schema");
+        path
+    }
+
+    // ── AutoInfer mode ───────────────────────────────────────────────────────
+
+    #[test]
+    fn encode_input_produces_parquet_output() {
+        let events = sample_events();
+        let n_events = events.len();
+        let (schema, num_rows) = encode_autoinfer_and_read_schema(events);
+
+        assert_eq!(num_rows, n_events, "row count should match event count");
+
+        for field_name in &["timestamp", "random_time"] {
+            let field = schema
+                .field_with_name(field_name)
+                .unwrap_or_else(|_| panic!("field '{field_name}' should exist in schema"));
+            assert!(
+                matches!(
+                    field.data_type(),
+                    DataType::Timestamp(arrow::datatypes::TimeUnit::Microsecond, Some(tz)) if tz.as_ref() == "UTC"
+                ),
+                "'{field_name}' should be Timestamp(Microsecond, UTC), got {:?}",
+                field.data_type()
+            );
+        }
+
+        let status_field = schema
+            .field_with_name("status_code")
+            .expect("status_code field should exist");
+        assert_eq!(status_field.data_type(), &DataType::Int64);
+
+        let rt_field = schema
+            .field_with_name("response_time_secs")
+            .expect("response_time_secs field should exist");
+        assert_eq!(rt_field.data_type(), &DataType::Float64);
+
+        for field_name in &["host", "message", "service", "source_type"] {
+            let field = schema
+                .field_with_name(field_name)
+                .unwrap_or_else(|_| panic!("field '{field_name}' should exist in schema"));
+            assert_eq!(field.data_type(), &DataType::Utf8);
+        }
+    }
+
+    #[test]
+    fn test_parquet_empty_events() {
+        let mut serializer = ParquetSerializer::new(ParquetSerializerConfig {
+            schema_mode: ParquetSchemaMode::AutoInfer,
+            ..Default::default()
+        })
+        .expect("AutoInfer serializer should succeed");
+
+        let events: Vec<Event> = vec![];
+        let mut buffer = BytesMut::new();
+        serializer
+            .encode(events, &mut buffer)
+            .expect("Empty events should succeed");
+
+        assert!(buffer.is_empty(), "Buffer should be empty for empty events");
+    }
+
+    #[test]
+    fn test_parquet_compression_variants() {
+        let events = vec![create_event(vec![("msg", "hello world")])];
+
+        let compressions = vec![
+            ParquetCompression::None,
+            ParquetCompression::Snappy,
+            ParquetCompression::Zstd { level: 1 },
+            ParquetCompression::Gzip { level: 1 },
+            ParquetCompression::Lz4,
+        ];
+
+        for compression in compressions {
+            let mut serializer = ParquetSerializer::new(ParquetSerializerConfig {
+                schema_mode: ParquetSchemaMode::AutoInfer,
+                compression,
+                ..Default::default()
+            })
+            .expect("Failed to create serializer");
+
+            let mut buffer = BytesMut::new();
+            serializer
+                .encode(events.clone(), &mut buffer)
+                .unwrap_or_else(|e| panic!("Encoding with {:?} failed: {}", compression, e));
+
+            let data = buffer.freeze();
+            assert_parquet_magic(&data);
+            assert_eq!(
+                parquet_row_count(&data),
+                1,
+                "Wrong row count for {:?}",
+                compression
+            );
+        }
+    }
+
+    #[test]
+    fn test_parquet_output_has_footer() {
+        let mut serializer = ParquetSerializer::new(ParquetSerializerConfig {
+            schema_mode: ParquetSchemaMode::AutoInfer,
+            ..Default::default()
+        })
+        .expect("AutoInfer serializer should succeed");
+
+        let events = vec![create_event(vec![("msg", "test")])];
+        let mut buffer = BytesMut::new();
+        serializer.encode(events, &mut buffer).unwrap();
+
+        let data = buffer.freeze();
+        let len = data.len();
+        assert!(len >= 8, "Parquet output too short");
+        assert_eq!(
+            &data[len - 4..],
+            b"PAR1",
+            "Parquet footer magic bytes missing"
+        );
+    }
+
+    #[test]
+    fn test_writer_props_arc_shared() {
+        let serializer = ParquetSerializer::new(ParquetSerializerConfig {
+            schema_mode: ParquetSchemaMode::AutoInfer,
+            ..Default::default()
+        })
+        .expect("AutoInfer serializer should succeed");
+        let cloned = serializer.clone();
+
+        assert_eq!(Arc::strong_count(&serializer.writer_props), 2);
+        drop(cloned);
+        assert_eq!(Arc::strong_count(&serializer.writer_props), 1);
+    }
+
+    #[test]
+    fn test_mixed_log_and_non_log_events() {
+        use vector_core::event::{Metric, MetricKind, MetricValue};
+
+        let mut serializer = ParquetSerializer::new(ParquetSerializerConfig {
+            schema_mode: ParquetSchemaMode::AutoInfer,
+            ..Default::default()
+        })
+        .expect("AutoInfer serializer should succeed");
+
+        let metric = Metric::new(
+            "cpu.usage",
+            MetricKind::Absolute,
+            MetricValue::Gauge { value: 42.0 },
+        );
+        let events = vec![
+            create_event(vec![("msg", "hello")]),
+            Event::Metric(metric),
+            create_event(vec![("msg", "world")]),
+        ];
+
+        let mut buffer = BytesMut::new();
+        serializer
+            .encode(events, &mut buffer)
+            .expect("Mixed batch should succeed (non-log events dropped)");
+
+        assert_parquet_magic(&buffer);
+        assert_eq!(parquet_row_count(&buffer), 2);
+    }
+
+    // ── Schema file mode ─────────────────────────────────────────────────────
+
+    #[test]
+    fn test_parquet_schema_file() {
+        let schema_path = write_temp_schema(
+            "schema_file",
+            "message logs {\n  required binary name (STRING);\n  optional int64 age;\n}",
+        );
+
+        let config: ParquetSerializerConfig = serde_json::from_value(serde_json::json!({
+            "schema_file": schema_path.to_str().unwrap()
+        }))
+        .expect("Config should deserialize");
+
+        let mut serializer =
+            ParquetSerializer::new(config).expect("Should create serializer from schema file");
+
+        let mut log = LogEvent::default();
+        log.insert("name", "alice");
+
+        let mut buffer = BytesMut::new();
+        serializer
+            .encode(vec![Event::Log(log)], &mut buffer)
+            .expect("Encoding with schema file should succeed");
+
+        let data = buffer.freeze();
+        assert_parquet_magic(&data);
+        assert_eq!(parquet_row_count(&data), 1);
+
+        let columns = parquet_column_names(&data);
+        assert_eq!(columns, vec!["name", "age"]);
+    }
+
+    #[test]
+    fn test_parquet_schema_file_not_found_error() {
+        let config: ParquetSerializerConfig = serde_json::from_value(serde_json::json!({
+            "schema_file": "/nonexistent/path/schema.parquet"
+        }))
+        .expect("Config should deserialize");
+
+        let result = ParquetSerializer::new(config);
+        assert!(result.is_err(), "Missing schema file should error");
+        assert!(
+            result.unwrap_err().to_string().contains("Failed to read"),
+            "Error should mention file read failure"
+        );
+    }
+
+    #[test]
+    fn test_parquet_schema_file_invalid_syntax_error() {
+        let schema_path = write_temp_schema(
+            "invalid_syntax",
+            "this is not valid parquet schema syntax !!!",
+        );
+
+        let config: ParquetSerializerConfig = serde_json::from_value(serde_json::json!({
+            "schema_file": schema_path.to_str().unwrap()
+        }))
+        .expect("Config should deserialize");
+
+        let result = ParquetSerializer::new(config);
+        assert!(result.is_err(), "Invalid Parquet schema should error");
+        assert!(
+            result
+                .unwrap_err()
+                .to_string()
+                .contains("Failed to parse Parquet schema"),
+            "Error should mention parsing failure"
+        );
+    }
+
+    #[test]
+    fn test_parquet_no_schema_error() {
+        let config = ParquetSerializerConfig::default();
+        let result = ParquetSerializer::new(config);
+        assert!(
+            result.is_err(),
+            "Should fail without schema_file or auto_infer"
+        );
+    }
+
+    // ── Schema mode: strict / relaxed ────────────────────────────────────────
+
+    #[test]
+    fn test_parquet_strict_mode_rejects_extra_fields() {
+        let schema_path = write_temp_schema(
+            "strict_rejects",
+            "message logs {\n  required binary name (STRING);\n}",
+        );
+
+        let mut serializer = ParquetSerializer::new(ParquetSerializerConfig {
+            schema_file: Some(schema_path),
+            schema_mode: ParquetSchemaMode::Strict,
+            ..Default::default()
+        })
+        .expect("Failed to create strict serializer");
+
+        let events = vec![create_event(vec![("name", "alice"), ("city", "paris")])];
+        let mut buffer = BytesMut::new();
+        let result = serializer.encode(events, &mut buffer);
+        assert!(result.is_err(), "Strict mode should reject extra fields");
+        assert!(result.unwrap_err().to_string().contains("city"));
+    }
+
+    #[test]
+    fn test_parquet_strict_mode_allows_schema_fields() {
+        let schema_path = write_temp_schema(
+            "strict_allows",
+            "message logs {\n  required binary name (STRING);\n  required binary level (STRING);\n}",
+        );
+
+        let mut serializer = ParquetSerializer::new(ParquetSerializerConfig {
+            schema_file: Some(schema_path),
+            schema_mode: ParquetSchemaMode::Strict,
+            ..Default::default()
+        })
+        .expect("Failed to create strict serializer");
+
+        let mut log = LogEvent::default();
+        log.insert("name", "test");
+        log.insert("level", "info");
+
+        let mut buffer = BytesMut::new();
+        assert!(
+            serializer
+                .encode(vec![Event::Log(log)], &mut buffer)
+                .is_ok(),
+            "Strict mode should pass when all fields match schema"
+        );
+    }
+
+    #[test]
+    fn test_parquet_relaxed_mode_drops_extra_fields() {
+        let schema_path = write_temp_schema(
+            "relaxed_drops",
+            "message logs {\n  required binary name (STRING);\n}",
+        );
+
+        let mut serializer = ParquetSerializer::new(ParquetSerializerConfig {
+            schema_file: Some(schema_path),
+            schema_mode: ParquetSchemaMode::Relaxed,
+            ..Default::default()
+        })
+        .expect("Failed to create relaxed serializer");
+
+        let events = vec![create_event(vec![("name", "alice"), ("city", "paris")])];
+        let mut buffer = BytesMut::new();
+        serializer
+            .encode(events, &mut buffer)
+            .expect("Relaxed mode should drop extra fields silently");
+
+        let data = buffer.freeze();
+        assert_parquet_magic(&data);
+        assert_eq!(parquet_row_count(&data), 1);
+        let columns = parquet_column_names(&data);
+        assert_eq!(columns, vec!["name"]);
+    }
+
+    #[test]
+    fn test_parquet_schema_file_binary_without_string_annotation_rejected() {
+        // Native Parquet "binary" without (STRING) annotation resolves to Arrow Binary,
+        // which is rejected at config time.
+        let schema_path = write_temp_schema(
+            "binary_rejected",
+            "message logs {\n  required binary name (STRING);\n  optional binary raw_data;\n}",
+        );
+
+        let config: ParquetSerializerConfig = serde_json::from_value(serde_json::json!({
+            "schema_file": schema_path.to_str().unwrap()
+        }))
+        .expect("Config should deserialize");
+
+        let result = ParquetSerializer::new(config);
+        assert!(
+            result.is_err(),
+            "Parquet binary without STRING annotation should be rejected"
+        );
+        assert!(
+            result.unwrap_err().to_string().contains("raw_data"),
+            "Error should name the offending field"
+        );
+    }
+}
diff --git a/lib/codecs/src/encoding/mod.rs b/lib/codecs/src/encoding/mod.rs
index 25f88406fbae9..a9f698f79153d 100644
--- a/lib/codecs/src/encoding/mod.rs
+++ b/lib/codecs/src/encoding/mod.rs
@@ -27,6 +27,10 @@ pub use format::{
 };
 #[cfg(feature = "opentelemetry")]
 pub use format::{OtlpSerializer, OtlpSerializerConfig};
+#[cfg(feature = "parquet")]
+pub use format::{
+    ParquetCompression, ParquetSchemaMode, ParquetSerializer, ParquetSerializerConfig,
+};
 #[cfg(feature = "syslog")]
 pub use format::{SyslogSerializer, SyslogSerializerConfig};
 pub use framing::{
diff --git a/lib/codecs/src/encoding/serializer.rs b/lib/codecs/src/encoding/serializer.rs
index 536f836ad8163..c6081e3e2f274 100644
--- a/lib/codecs/src/encoding/serializer.rs
+++ b/lib/codecs/src/encoding/serializer.rs
@@ -8,6 +8,8 @@ use vector_core::{config::DataType, event::Event, schema};
 use super::format::{ArrowStreamSerializer, ArrowStreamSerializerConfig};
 #[cfg(feature = "opentelemetry")]
 use super::format::{OtlpSerializer, OtlpSerializerConfig};
+#[cfg(feature = "parquet")]
+use super::format::{ParquetSerializer, ParquetSerializerConfig};
 #[cfg(feature = "syslog")]
 use super::format::{SyslogSerializer, SyslogSerializerConfig};
 use super::{
@@ -160,17 +162,29 @@ pub enum BatchSerializerConfig {
     #[cfg(feature = "arrow")]
     #[serde(rename = "arrow_stream")]
     ArrowStream(ArrowStreamSerializerConfig),
+    /// Encodes events in [Apache Parquet][apache_parquet] columnar format.
+    ///
+    /// [apache_parquet]: https://parquet.apache.org/
+    #[cfg(feature = "parquet")]
+    #[serde(rename = "parquet")]
+    Parquet(ParquetSerializerConfig),
 }
 
-#[cfg(feature = "arrow")]
+#[cfg(any(feature = "arrow", feature = "parquet"))]
 impl BatchSerializerConfig {
-    /// Build the `ArrowStreamSerializer` from this configuration.
-    pub fn build(
+    /// Build the batch serializer from this configuration.
+    pub fn build_batch_serializer(
         &self,
-    ) -> Result<ArrowStreamSerializer, Box<dyn std::error::Error + Send + Sync + 'static>> {
+    ) -> Result<super::BatchSerializer, Box<dyn std::error::Error + Send + Sync + 'static>> {
         match self {
             BatchSerializerConfig::ArrowStream(arrow_config) => {
-                Ok(ArrowStreamSerializer::new(arrow_config.clone())?)
+                let serializer = ArrowStreamSerializer::new(arrow_config.clone())?;
+                Ok(super::BatchSerializer::Arrow(serializer))
+            }
+            #[cfg(feature = "parquet")]
+            BatchSerializerConfig::Parquet(parquet_config) => {
+                let serializer = ParquetSerializer::new(parquet_config.clone())?;
+                Ok(super::BatchSerializer::Parquet(Box::new(serializer)))
             }
         }
     }
@@ -178,14 +192,20 @@ impl BatchSerializerConfig {
     /// The data type of events that are accepted by this batch serializer.
     pub fn input_type(&self) -> DataType {
         match self {
+            #[cfg(feature = "arrow")]
             BatchSerializerConfig::ArrowStream(arrow_config) => arrow_config.input_type(),
+            #[cfg(feature = "parquet")]
+            BatchSerializerConfig::Parquet(parquet_config) => parquet_config.input_type(),
         }
     }
 
     /// The schema required by the batch serializer.
     pub fn schema_requirement(&self) -> schema::Requirement {
         match self {
+            #[cfg(feature = "arrow")]
             BatchSerializerConfig::ArrowStream(arrow_config) => arrow_config.schema_requirement(),
+            #[cfg(feature = "parquet")]
+            BatchSerializerConfig::Parquet(parquet_config) => parquet_config.schema_requirement(),
         }
     }
 }
diff --git a/lib/codecs/src/internal_events.rs b/lib/codecs/src/internal_events.rs
index 134fee16ecf8b..0ed24719dd8bc 100644
--- a/lib/codecs/src/internal_events.rs
+++ b/lib/codecs/src/internal_events.rs
@@ -157,6 +157,8 @@ impl<E: std::fmt::Display> InternalEvent for EncoderWriteError<'_, E> {
 pub struct EncoderNullConstraintError<'a> {
     /// The schema constraint error that occurred.
     pub error: &'a vector_common::Error,
+    /// The number of events dropped due to the constraint violation.
+    pub count: usize,
 }
 
 #[cfg(feature = "arrow")]
@@ -178,7 +180,104 @@ impl InternalEvent for EncoderNullConstraintError<'_> {
         )
         .increment(1);
         emit(ComponentEventsDropped::<UNINTENTIONAL> {
-            count: 1,
+            count: self.count,
+            reason: CONSTRAINT_REASON,
+        });
+    }
+}
+
+#[cfg(feature = "parquet")]
+#[derive(NamedInternalEvent)]
+pub(crate) struct SchemaGenerationError<'a> {
+    pub error: &'a arrow::error::ArrowError,
+    pub batch_count: usize,
+}
+
+#[cfg(feature = "parquet")]
+impl InternalEvent for SchemaGenerationError<'_> {
+    fn emit(self) {
+        const REASON: &str = "Could not generate schema for batched events";
+        error!(
+            message = REASON,
+            error = %self.error,
+            error_code = "parquet_schema_generation_failed",
+            error_type = error_type::ENCODER_FAILED,
+            stage = error_stage::SENDING,
+            internal_log_rate_limit = false,
+        );
+        counter!(
+            "component_errors_total",
+            "error_code" => "parquet_schema_generation_failed",
+            "error_type" => error_type::ENCODER_FAILED,
+            "stage" => error_stage::SENDING,
+        )
+        .increment(1);
+        emit(ComponentEventsDropped::<UNINTENTIONAL> {
+            count: self.batch_count,
+            reason: REASON,
+        });
+    }
+}
+
+#[cfg(feature = "parquet")]
+#[derive(NamedInternalEvent)]
+pub(crate) struct ArrowWriterError<'a> {
+    pub error: &'a parquet::errors::ParquetError,
+    pub batch_count: usize,
+}
+
+#[cfg(feature = "parquet")]
+impl InternalEvent for ArrowWriterError<'_> {
+    fn emit(self) {
+        const REASON: &str = "Failed to write record batch with ArrowWriter.";
+        error!(
+            message = REASON,
+            error = %self.error,
+            error_code = "parquet_arrow_writer_failed",
+            error_type = error_type::ENCODER_FAILED,
+            stage = error_stage::SENDING,
+            internal_log_rate_limit = false,
+        );
+        counter!(
+            "component_errors_total",
+            "error_code" => "parquet_arrow_writer_failed",
+            "error_type" => error_type::ENCODER_FAILED,
+            "stage" => error_stage::SENDING,
+        )
+        .increment(1);
+        emit(ComponentEventsDropped::<UNINTENTIONAL> {
+            count: self.batch_count,
+            reason: REASON,
+        });
+    }
+}
+
+#[cfg(feature = "parquet")]
+#[derive(NamedInternalEvent)]
+pub(crate) struct JsonSerializationError<'a> {
+    pub error: &'a serde_json::Error,
+    pub batch_count: usize,
+}
+
+#[cfg(feature = "parquet")]
+impl InternalEvent for JsonSerializationError<'_> {
+    fn emit(self) {
+        const CONSTRAINT_REASON: &str = "Could not serialize event to JSON.";
+        error!(
+            message = CONSTRAINT_REASON,
+            error = %self.error,
+            error_type = error_type::ENCODER_FAILED,
+            stage = error_stage::SENDING,
+            internal_log_rate_limit = true,
+        );
+        counter!(
+            "component_errors_total",
+            "error_type" => error_type::ENCODER_FAILED,
+            "stage" => error_stage::SENDING,
+        )
+        .increment(1);
+        emit(ComponentEventsDropped::<UNINTENTIONAL> {
+            count: self.batch_count,
             reason: CONSTRAINT_REASON,
         });
     }
diff --git a/lib/vector-lib/Cargo.toml b/lib/vector-lib/Cargo.toml
index 6539c82dfaa80..6f42af4dbb627 100644
--- a/lib/vector-lib/Cargo.toml
+++ b/lib/vector-lib/Cargo.toml
@@ -27,6 +27,7 @@ vrl = { workspace = true, optional = true }
 allocation-tracing = ["vector-top?/allocation-tracing"]
 api-client = ["dep:vector-api-client"]
 arrow = ["codecs/arrow"]
+parquet = ["codecs/parquet"]
 api = ["vector-tap/api"]
 file-source = ["dep:file-source", "dep:file-source-common"]
 lua = ["vector-core/lua"]
diff --git a/src/sinks/aws_s3/config.rs b/src/sinks/aws_s3/config.rs
index 08ba92245d65c..61b82105a1211 100644
--- a/src/sinks/aws_s3/config.rs
+++ b/src/sinks/aws_s3/config.rs
@@ -1,9 +1,13 @@
 use aws_sdk_s3::Client as S3Client;
 use tower::ServiceBuilder;
+#[cfg(feature = "codecs-parquet")]
+use vector_lib::codecs::BatchEncoder;
+#[cfg(feature = "codecs-parquet")]
+use vector_lib::codecs::encoding::BatchSerializerConfig;
 use vector_lib::{
     TimeZone,
     codecs::{
-        TextSerializerConfig,
+        EncoderKind, TextSerializerConfig,
         encoding::{Framer, FramingConfig},
     },
     configurable::configurable_component,
@@ -105,6 +109,16 @@ pub struct S3SinkConfig {
     #[serde(flatten)]
     pub encoding: EncodingConfigWithFraming,
 
+    /// Batch encoding configuration for columnar formats.
+    ///
+    /// When set, events are encoded together as a batch in a columnar format (e.g., Parquet)
+    /// instead of the standard per-event framing-based encoding. The columnar format handles
+    /// its own internal compression, so the top-level `compression` setting is bypassed.
+    #[cfg(feature = "codecs-parquet")]
+    #[configurable(derived)]
+    #[serde(default)]
+    pub batch_encoding: Option<BatchSerializerConfig>,
+
     /// Compression configuration.
     ///
     /// All compression algorithms use the default compression level unless otherwise specified.
@@ -176,6 +190,8 @@ impl GenerateConfig for S3SinkConfig {
             options: S3Options::default(),
             region: RegionOrEndpoint::default(),
             encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
+            #[cfg(feature = "codecs-parquet")]
+            batch_encoding: None,
             compression: Compression::gzip_default(),
             batch: BatchConfig::default(),
             request: TowerRequestConfig::default(),
@@ -201,6 +217,10 @@ impl SinkConfig for S3SinkConfig {
     }
 
     fn input(&self) -> Input {
+        #[cfg(feature = "codecs-parquet")]
+        if let Some(batch_config) = &self.batch_encoding {
+            return Input::new(batch_config.input_type());
+        }
         Input::new(self.encoding.config().1.input_type())
     }
 
@@ -246,8 +266,62 @@ impl S3SinkConfig {
         let partitioner = S3KeyPartitioner::new(key_prefix, ssekms_key_id, None);
 
         let transformer = self.encoding.transformer();
+
+        // When batch_encoding is configured (e.g., Parquet), use batch mode
+        // with internal compression and appropriate file extension.
+        #[cfg(feature = "codecs-parquet")]
+        if let Some(batch_config) = &self.batch_encoding {
+            if !matches!(batch_config, BatchSerializerConfig::Parquet(_)) {
+                return Err(
+                    "batch_encoding only supports encoding with parquet format for amazon s3 sink"
+                        .into(),
+                );
+            }
+
+            let batch_serializer = batch_config.build_batch_serializer()?;
+            let batch_encoder = BatchEncoder::new(batch_serializer);
+
+            // Auto-detect Content-Type from batch format. Users can still
+            // override via `options.content_type`; we only set it when unset.
+            let mut api_options = self.options.clone();
+            if api_options.content_type.is_none() {
+                api_options.content_type = Some(batch_encoder.content_type().to_string());
+            }
+
+            let encoder = EncoderKind::Batch(batch_encoder);
+
+            // Auto-detect file extension from batch format
+            let filename_extension =
+                self.filename_extension
+                    .clone()
+                    .or_else(|| match batch_config {
+                        BatchSerializerConfig::Parquet(_) => Some("parquet".to_string()),
+                        #[allow(unreachable_patterns)]
+                        _ => None,
+                    });
+
+            if self.compression != Compression::None {
+                warn!("Top level compression setting ignored when batch_encoding set to parquet.")
+            }
+
+            let request_options = S3RequestOptions {
+                bucket: self.bucket.clone(),
+                api_options,
+                filename_extension,
+                filename_time_format: self.filename_time_format.clone(),
+                filename_append_uuid: self.filename_append_uuid,
+                encoder: (transformer, encoder),
+                // Batch formats handle their own compression internally
+                compression: Compression::None,
+                filename_tz_offset: offset,
+            };
+
+            let sink = S3Sink::new(service, request_options, partitioner, batch_settings);
+            return Ok(VectorSink::from_event_streamsink(sink));
+        }
+
         let (framer, serializer) = self.encoding.build(SinkType::MessageBased)?;
-        let encoder = Encoder::<Framer>::new(framer, serializer);
+        let encoder = EncoderKind::Framed(Box::new(Encoder::<Framer>::new(framer, serializer)));
 
         let request_options = S3RequestOptions {
             bucket: self.bucket.clone(),
@@ -289,4 +363,260 @@ mod tests {
     fn generate_config() {
         crate::test_util::test_generate_config::<S3SinkConfig>();
     }
+
+    /// Correct TOML shape: `batch_encoding.codec = "parquet"` with `schema_mode = "auto_infer"`.
+    #[cfg(feature = "codecs-parquet")]
+    #[test]
+    fn parquet_batch_encoding_correct_toml_shape() {
+        let config: S3SinkConfig = toml::from_str(
+            r#"
+            bucket = "test-bucket"
+            compression = "none"
+
+            [encoding]
+            codec = "text"
+
+            [batch_encoding]
+            schema_mode = "auto_infer"
+            codec = "parquet"
+
+            [batch_encoding.compression]
+            algorithm = "snappy"
+
+            "#,
+        )
+        .expect("correct batch_encoding shape should parse");
+
+        let batch_enc = config
+            .batch_encoding
+            .expect("batch_encoding should be Some");
+        match batch_enc {
+            vector_lib::codecs::encoding::BatchSerializerConfig::Parquet(ref p) => {
+                use vector_lib::codecs::encoding::format::{ParquetCompression, ParquetSchemaMode};
+                assert_eq!(p.schema_mode, ParquetSchemaMode::AutoInfer);
+                assert_eq!(p.compression, ParquetCompression::Snappy);
+            }
+            #[allow(unreachable_patterns)]
+            _ => panic!("expected Parquet variant"),
+        }
+    }
+
+    /// Content-Type must be auto-detected as `application/vnd.apache.parquet`
+    /// when `batch_encoding` is set and `content_type` is not explicitly provided.
+    #[cfg(feature = "codecs-parquet")]
+    #[test]
+    fn parquet_content_type_auto_detected() {
+        use vector_lib::codecs::encoding::format::{
+            ParquetCompression, ParquetSchemaMode, ParquetSerializerConfig,
+        };
+
+        use crate::sinks::s3_common::config::S3Options;
+        use crate::sinks::util::{BatchConfig, BulkSizeBasedDefaultBatchSettings, Compression};
+        use vector_lib::codecs::TextSerializerConfig;
+        use vector_lib::codecs::encoding::{BatchSerializerConfig, FramingConfig};
+
+        let parquet_config = ParquetSerializerConfig {
+            schema_mode: ParquetSchemaMode::AutoInfer,
+            compression: ParquetCompression::Snappy,
+            ..Default::default()
+        };
+
+        let config = S3SinkConfig {
+            bucket: "test".to_string(),
+            key_prefix: super::default_key_prefix(),
+            filename_time_format: super::default_filename_time_format(),
+            filename_append_uuid: true,
+            filename_extension: None,
+            options: S3Options::default(),
+            region: crate::aws::RegionOrEndpoint::with_both("us-east-1", "http://localhost:4566"),
+            encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
+            batch_encoding: Some(BatchSerializerConfig::Parquet(parquet_config)),
+            compression: Compression::None,
+            batch: BatchConfig::<BulkSizeBasedDefaultBatchSettings>::default(),
+            request: Default::default(),
+            tls: Default::default(),
+            auth: Default::default(),
+            acknowledgements: Default::default(),
+            timezone: Default::default(),
+            force_path_style: true,
+            retry_strategy: Default::default(),
+        };
+
+        let batch_config = config.batch_encoding.as_ref().unwrap();
+        let batch_serializer = batch_config.build_batch_serializer().unwrap();
+        let batch_encoder = vector_lib::codecs::BatchEncoder::new(batch_serializer);
+
+        let mut api_options = config.options.clone();
+        if api_options.content_type.is_none() {
+            api_options.content_type = Some(batch_encoder.content_type().to_string());
+        }
+
+        assert_eq!(
+            api_options.content_type.as_deref(),
+            Some("application/vnd.apache.parquet"),
+            "Content-Type must be auto-detected for Parquet"
+        );
+    }
+
+    /// When user explicitly sets `content_type`, the auto-detection must not override it.
+    #[cfg(feature = "codecs-parquet")]
+    #[test]
+    fn parquet_content_type_user_override_preserved() {
+        let config: S3SinkConfig = toml::from_str(
+            r#"
+            bucket = "test-bucket"
+            compression = "none"
+            content_type = "application/octet-stream"
+
+            [encoding]
+            codec = "text"
+
+            [batch_encoding]
+            codec = "parquet"
+            schema_mode = "auto_infer"
+
+            [batch_encoding.compression]
+            algorithm = "gzip"
+            level = 9
+            "#,
+        )
+        .unwrap();
+
+        let batch_config = config.batch_encoding.as_ref().unwrap();
+        let batch_serializer = batch_config.build_batch_serializer().unwrap();
+        let batch_encoder = vector_lib::codecs::BatchEncoder::new(batch_serializer);
+
+        let mut api_options = config.options.clone();
+        if api_options.content_type.is_none() {
+            api_options.content_type = Some(batch_encoder.content_type().to_string());
+        }
+
+        assert_eq!(
+            api_options.content_type.as_deref(),
+            Some("application/octet-stream"),
+            "User-specified Content-Type must not be overridden"
+        );
+    }
+
+    /// Parquet filename extension defaults to `.parquet` when not explicitly set.
+    #[cfg(feature = "codecs-parquet")]
+    #[test]
+    fn parquet_filename_extension_defaults_to_parquet() {
+        let config: S3SinkConfig = toml::from_str(
+            r#"
+            bucket = "test-bucket"
+            compression = "none"
+
+            [encoding]
+            codec = "text"
+
+            [batch_encoding]
+            codec = "parquet"
+            schema_mode = "auto_infer"
+            "#,
+        )
+        .unwrap();
+
+        assert!(
+            config.filename_extension.is_none(),
+            "fixture must not set filename_extension"
+        );
+
+        let batch_config = config.batch_encoding.as_ref().unwrap();
+        let extension = config
+            .filename_extension
+            .clone()
+            .or_else(|| match batch_config {
+                vector_lib::codecs::encoding::BatchSerializerConfig::Parquet(_) => {
+                    Some("parquet".to_string())
+                }
+                #[allow(unreachable_patterns)]
+                _ => None,
+            });
+
+        assert_eq!(extension.as_deref(), Some("parquet"));
+    }
+
+    /// Explicit filename_extension overrides the `.parquet` default.
+    #[cfg(feature = "codecs-parquet")]
+    #[test]
+    fn parquet_filename_extension_user_override() {
+        let config: S3SinkConfig = toml::from_str(
+            r#"
+            bucket = "test-bucket"
+            compression = "none"
+            filename_extension = "pq"
+
+            [encoding]
+            codec = "text"
+
+            [batch_encoding]
+            codec = "parquet"
+            schema_mode = "auto_infer"
+            "#,
+        )
+        .unwrap();
+
+        assert_eq!(config.filename_extension.as_deref(), Some("pq"));
+    }
+
+    /// `schema_mode` defaults to `relaxed` when not specified.
+    #[cfg(feature = "codecs-parquet")]
+    #[test]
+    fn parquet_schema_mode_defaults_to_relaxed() {
+        use vector_lib::codecs::encoding::format::ParquetSchemaMode;
+
+        let config: S3SinkConfig = toml::from_str(
+            r#"
+            bucket = "test-bucket"
+            compression = "none"
+
+            [encoding]
+            codec = "text"
+
+            [batch_encoding]
+            codec = "parquet"
+            "#,
+        )
+        .unwrap();
+
+        match config.batch_encoding.unwrap() {
+            vector_lib::codecs::encoding::BatchSerializerConfig::Parquet(p) => {
+                assert_eq!(p.schema_mode, ParquetSchemaMode::Relaxed);
+            }
+            #[allow(unreachable_patterns)]
+            _ => panic!("expected Parquet variant"),
+        }
+    }
+
+    /// Explicit `schema_mode = "strict"` is correctly parsed.
+    #[cfg(feature = "codecs-parquet")]
+    #[test]
+    fn parquet_schema_mode_strict_parsed() {
+        use vector_lib::codecs::encoding::format::ParquetSchemaMode;
+
+        let config: S3SinkConfig = toml::from_str(
+            r#"
+            bucket = "test-bucket"
+            compression = "none"
+
+            [encoding]
+            codec = "text"
+
+            [batch_encoding]
+            codec = "parquet"
+            schema_mode = "strict"
+            schema_file = "tmp/something.schema"
+            "#,
+        )
+        .unwrap();
+
+        match config.batch_encoding.unwrap() {
+            vector_lib::codecs::encoding::BatchSerializerConfig::Parquet(p) => {
+                assert_eq!(p.schema_mode, ParquetSchemaMode::Strict);
+            }
+            #[allow(unreachable_patterns)]
+            _ => panic!("expected Parquet variant"),
+        }
+    }
 }
diff --git a/src/sinks/aws_s3/integration_tests.rs b/src/sinks/aws_s3/integration_tests.rs
index 31907d70b5c0f..ff2e0e5a5146b 100644
--- a/src/sinks/aws_s3/integration_tests.rs
+++ b/src/sinks/aws_s3/integration_tests.rs
@@ -19,6 +19,8 @@ use flate2::read::MultiGzDecoder;
 use futures::{Stream, stream};
 use similar_asserts::assert_eq;
 use tokio_stream::StreamExt;
+#[cfg(feature = "codecs-parquet")]
+use vector_lib::codecs::encoding::BatchSerializerConfig;
 use vector_lib::{
     codecs::{TextSerializerConfig, encoding::FramingConfig},
     config::proxy::ProxyConfig,
@@ -433,6 +435,8 @@ async fn s3_flush_on_exhaustion() {
             options: S3Options::default(),
             region: RegionOrEndpoint::with_both("us-east-1", s3_address()),
             encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
+            #[cfg(feature = "codecs-parquet")]
+            batch_encoding: None,
             compression: Compression::None,
             batch,
             request: TowerRequestConfig::default(),
@@ -490,6 +494,106 @@ async fn s3_flush_on_exhaustion() {
     assert_eq!(lines, response_lines); // if all events are received, and lines.len() < batch size, then a flush was performed.
 }
 
+#[cfg(feature = "codecs-parquet")]
+#[tokio::test]
+async fn s3_parquet_insert_message() {
+    use vector_lib::codecs::encoding::format::{
+        ParquetCompression, ParquetSchemaMode, ParquetSerializerConfig,
+    };
+
+    let cx = SinkContext::default();
+    let bucket = uuid::Uuid::new_v4().to_string();
+    create_bucket(&bucket, false).await;
+
+    let parquet_config = ParquetSerializerConfig {
+        schema_mode: ParquetSchemaMode::AutoInfer,
+        compression: ParquetCompression::Snappy,
+        ..Default::default()
+    };
+
+    let mut batch = BatchConfig::default();
+    batch.max_events = Some(100);
+    batch.timeout_secs = Some(5.0);
+
+    let config = S3SinkConfig {
+        bucket: bucket.to_string(),
+        key_prefix: random_string(10) + "/date=%F",
+        filename_time_format: default_filename_time_format(),
+        filename_append_uuid: true,
+        filename_extension: None,
+        options: S3Options::default(),
+        region: RegionOrEndpoint::with_both("us-east-1", s3_address()),
+        encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
+        batch_encoding: Some(BatchSerializerConfig::Parquet(parquet_config)),
+        compression: Compression::None,
+        batch,
+        request: TowerRequestConfig::default(),
+        tls: Default::default(),
+        auth: Default::default(),
+        acknowledgements: Default::default(),
+        timezone: Default::default(),
+        force_path_style: true,
+        retry_strategy: Default::default(),
+    };
+
+    let prefix = config.key_prefix.clone();
+    let service = config.create_service(&cx.globals.proxy).await.unwrap();
+    let sink = config.build_processor(service, cx).unwrap();
+
+    let (batch_notifier, receiver) = BatchNotifier::new_with_receiver();
+    let events: Vec<Event> = (0..10)
+        .map(|i| {
+            let mut log = LogEvent::from(format!("message_{}", i));
+            log.insert("host", format!("host_{}", i % 3));
+            Event::from(log).with_batch_notifier(&batch_notifier)
+        })
+        .collect();
+
+    drop(batch_notifier);
+    run_and_assert_sink_compliance(sink, stream::iter(events), &AWS_SINK_TAGS).await;
+    assert_eq!(receiver.await, BatchStatus::Delivered);
+
+    let keys = get_keys(&bucket, prefix).await;
+    assert_eq!(keys.len(), 1);
+
+    let key = keys[0].clone();
+    assert!(
+        key.ends_with(".parquet"),
+        "Expected .parquet extension, got: {}",
+        key
+    );
+
+    // Download and validate Parquet file
+    let obj = get_object(&bucket, key).await;
+    assert_eq!(obj.content_encoding, None);
+
+    let body = obj.body.collect().await.unwrap().into_bytes();
+    assert!(body.len() >= 4, "Output too short to be valid Parquet");
+    assert_eq!(&body[..4], b"PAR1", "Missing Parquet magic bytes");
+
+    // Verify we can read rows from the Parquet file
+    use bytes::Bytes;
+    use parquet::file::reader::{FileReader, SerializedFileReader};
+    use parquet::record::reader::RowIter;
+
+    let reader =
+        SerializedFileReader::new(Bytes::copy_from_slice(&body)).expect("Invalid Parquet file");
+    let row_count = RowIter::from_file_into(Box::new(reader)).count();
+    assert_eq!(row_count, 10, "Expected 10 rows in Parquet file");
+
+    // Verify schema has our columns
+    let reader =
+        SerializedFileReader::new(Bytes::copy_from_slice(&body)).expect("Invalid Parquet file");
+    let schema = reader.metadata().file_metadata().schema_descr();
+    let columns: Vec<String> = schema
+        .columns()
+        .iter()
+        .map(|c| c.name().to_string())
+        .collect();
+    assert!(columns.contains(&"message".to_string()));
+    assert!(columns.contains(&"host".to_string()));
+}
+
 async fn client() -> S3Client {
     let auth = AwsAuthentication::test_auth();
     let region = RegionOrEndpoint::with_both("us-east-1", s3_address());
@@ -526,6 +630,8 @@ fn config(bucket: &str, batch_size: usize) -> S3SinkConfig {
         options: S3Options::default(),
         region: RegionOrEndpoint::with_both("us-east-1", s3_address()),
         encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
+        #[cfg(feature = "codecs-parquet")]
+        batch_encoding: None,
         compression: Compression::None,
         batch,
         request: TowerRequestConfig::default(),
diff --git a/src/sinks/aws_s3/sink.rs b/src/sinks/aws_s3/sink.rs
index 26d47cdb7039c..442e0beb544b6 100644
--- a/src/sinks/aws_s3/sink.rs
+++ b/src/sinks/aws_s3/sink.rs
@@ -3,10 +3,10 @@ use std::io;
 use bytes::Bytes;
 use chrono::{FixedOffset, Utc};
 use uuid::Uuid;
-use vector_lib::{codecs::encoding::Framer, event::Finalizable, request_metadata::RequestMetadata};
+use vector_lib::{codecs::EncoderKind, event::Finalizable, request_metadata::RequestMetadata};
 
 use crate::{
-    codecs::{Encoder, Transformer},
+    codecs::Transformer,
     event::Event,
     sinks::{
         s3_common::{
@@ -28,7 +28,7 @@ pub struct S3RequestOptions {
     pub filename_append_uuid: bool,
     pub filename_extension: Option<String>,
     pub api_options: S3Options,
-    pub encoder: (Transformer, Encoder<Framer>),
+    pub encoder: (Transformer, EncoderKind),
     pub compression: Compression,
     pub filename_tz_offset: Option<FixedOffset>,
 }
@@ -36,7 +36,7 @@ pub struct S3RequestOptions {
 impl RequestBuilder<(S3PartitionKey, Vec<Event>)> for S3RequestOptions {
     type Metadata = S3Metadata;
     type Events = Vec<Event>;
-    type Encoder = (Transformer, Encoder<Framer>);
+    type Encoder = (Transformer, EncoderKind);
     type Payload = Bytes;
     type Request = S3Request;
     type Error = io::Error; // TODO: this is ugly.
diff --git a/src/sinks/clickhouse/config.rs b/src/sinks/clickhouse/config.rs
index 58ed0a0ac3445..d7af3413c6b97 100644
--- a/src/sinks/clickhouse/config.rs
+++ b/src/sinks/clickhouse/config.rs
@@ -279,7 +279,7 @@ impl ClickhouseConfig {
         };
 
         if let Some(batch_encoding) = &self.batch_encoding {
-            use vector_lib::codecs::{BatchEncoder, BatchSerializer};
+            use vector_lib::codecs::BatchEncoder;
 
             // Validate that batch_encoding is only compatible with ArrowStream format
             if self.format != Format::ArrowStream {
@@ -292,6 +292,13 @@ impl ClickhouseConfig {
 
             let mut arrow_config = match batch_encoding {
                 BatchSerializerConfig::ArrowStream(config) => config.clone(),
+                #[cfg(feature = "codecs-parquet")]
+                BatchSerializerConfig::Parquet(_) => {
+                    return Err(
+                        "ClickHouse sink does not support Parquet batch encoding. Use 'arrow_stream' instead."
+                            .into(),
+                    );
+                }
             };
 
             self.resolve_arrow_schema(
@@ -304,8 +311,7 @@ impl ClickhouseConfig {
             .await?;
 
             let resolved_batch_config = BatchSerializerConfig::ArrowStream(arrow_config);
-            let arrow_serializer = resolved_batch_config.build()?;
-            let batch_serializer = BatchSerializer::Arrow(arrow_serializer);
+            let batch_serializer = resolved_batch_config.build_batch_serializer()?;
             let encoder = EncoderKind::Batch(BatchEncoder::new(batch_serializer));
 
             return Ok((Format::ArrowStream, encoder));
diff --git a/website/cue/reference/components/sinks/aws_s3.cue b/website/cue/reference/components/sinks/aws_s3.cue
index cec5a50e47f82..6f42d082959ba 100644
--- a/website/cue/reference/components/sinks/aws_s3.cue
+++ b/website/cue/reference/components/sinks/aws_s3.cue
@@ -214,6 +214,135 @@ components: sinks: aws_s3: components._aws & {
 				`storage_class` option.
 				"""
 		}
+
+		parquet_encoding: {
+			title: "Parquet Batch Encoding"
+			body: """
+				The S3 sink supports Apache Parquet batch encoding with the `batch_encoding`
+				option. When configured, events are encoded together as Parquet columnar files
+				instead of the default per-event JSON or text encoding. Parquet files are
+				optimized for analytical queries using Athena, Trino, Spark, and other columnar
+				query engines.
+
+				Parquet handles compression internally at the column page level, so the
+				top-level `compression` setting must be set to `"none"`.
+
+				Output files automatically use the `.parquet` extension.
+
+				This feature requires the `codecs-parquet` feature flag at compile time.
+
+				There are two ways to provide a schema: supply a `schema_file`, or set
+				`schema_mode` to `auto_infer` and let Vector derive the schema from each
+				incoming batch.
+
+				#### Option 1: Schema file
+
+				Load the schema from a native Parquet `.schema` file. The file must
+				contain a valid Parquet message type definition.
+
+				```toml
+				[sinks.s3_parquet]
+				type = "aws_s3"
+				inputs = ["my-source"]
+				bucket = "my-analytics-bucket"
+				key_prefix = "logs/date=%F"
+				compression = "none"
+
+				[sinks.s3_parquet.encoding]
+				codec = "text"
+
+				[sinks.s3_parquet.batch_encoding]
+				codec = "parquet"
+				schema_file = "/etc/vector/schemas/logs.schema"
+				schema_mode = "relaxed"
+
+				[sinks.s3_parquet.batch_encoding.compression]
+				algorithm = "snappy"
+				```
+
+				#### Option 2: Auto-infer schema
+
+				Vector infers the Arrow schema from the fields present in each batch.
+				`Value::Timestamp` fields are automatically promoted to
+				`Timestamp(Microsecond, UTC)`. No schema file is required.
+
+				```toml
+				[sinks.s3_parquet]
+				type = "aws_s3"
+				inputs = ["my-source"]
+				bucket = "my-analytics-bucket"
+				key_prefix = "logs/date=%F"
+				compression = "none"
+
+				[sinks.s3_parquet.encoding]
+				codec = "text"
+
+				[sinks.s3_parquet.batch_encoding]
+				codec = "parquet"
+				schema_mode = "auto_infer"
+
+				[sinks.s3_parquet.batch_encoding.compression]
+				algorithm = "snappy"
+				```
+
+				#### YAML example
+
+				```yaml
+				sinks:
+				  s3_parquet:
+				    type: aws_s3
+				    inputs:
+				      - my-source
+				    bucket: my-analytics-bucket
+				    key_prefix: "logs/date=%F"
+				    compression: none
+				    encoding:
+				      codec: text
+				    batch_encoding:
+				      codec: parquet
+				      schema_mode: auto_infer
+				      compression:
+				        algorithm: gzip
+				        level: 9
+				```
+
+				#### Configuration reference
+
+				| Field | Type | Required | Description |
+				|---|---|---|---|
+				| `codec` | string | yes | Must be `"parquet"` |
+				| `schema_file` | path | no | Path to a native Parquet `.schema` file. Required when `schema_mode` is `relaxed` or `strict`. |
+				| `schema_mode` | string | no | `relaxed` (default), `strict`, or `auto_infer`. See the section on schema_mode values. |
+				| `compression` | object | no | Column-level compression. See the section on compression options. |
+
+				#### `schema_mode` values
+
+				| Value | Description |
+				|---|---|
+				| `relaxed` (default) | Missing schema fields become null. Extra event fields are silently dropped. |
+				| `strict` | Missing schema fields become null. Extra event fields cause an encoding error. |
+				| `auto_infer` | Schema is inferred from each batch. No `schema_file` needed. `Value::Timestamp` fields are promoted to `Timestamp(Microsecond, UTC)`. |
+
+				#### Compression options
+
+				Compression is configured as a nested object with an `algorithm` key.
+				Algorithms that support levels accept an additional `level` key.
+
+				| Algorithm | Level range | Default |
+				|---|---|---|
+				| `snappy` | — | yes |
+				| `zstd` | 1–21 | — |
+				| `gzip` | 1–9 | — |
+				| `lz4` | — | — |
+				| `none` | — | — |
+
+				#### Unsupported types
+
+				Binary fields are rejected at config time because the internal Arrow JSON
+				encoder cannot materialize them. Use `utf8` with base64 or hex encoding
+				for binary data instead.
+				"""
+		}
 	}
 
 	permissions: iam: [

From 51121047d3201394c2958e4a66696f3aef2d3f11 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 15 Apr 2026 13:25:02 -0400
Subject: [PATCH 127/326] chore(deps): bump rsa from 0.9.3 to 0.9.10 (#25198)

* chore(deps): bump rsa from 0.9.3 to 0.9.10

* Update licenses
---
 Cargo.lock           | 17 +++++++++--------
 LICENSE-3rdparty.csv |  2 +-
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index ae4c753529775..d751a3e296d54 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3590,15 +3590,16 @@ dependencies = [
 
 [[package]]
 name = "ed25519-dalek"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7277392b266383ef8396db7fdeb1e77b6c52fed775f5df15bb24f35b72156980"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
  "serde",
  "sha2",
  "signature",
+ "subtle",
  "zeroize",
 ]
 
@@ -9323,9 +9324,9 @@ dependencies = [
 
 [[package]]
 name = "rsa"
-version = "0.9.3"
+version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86ef35bf3e7fe15a53c4ab08a998e42271eab13eb0db224126bc7bc4c4bad96d"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
  "const-oid",
  "digest",
@@ -10159,9 +10160,9 @@ dependencies = [
 
 [[package]]
 name = "signature"
-version = "2.0.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fe458c98333f9c8152221191a77e2a44e8325d0193484af2e9421a53019e57d"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest",
  "rand_core 0.6.4",
@@ -10398,9 +10399,9 @@ dependencies = [
 
 [[package]]
 name = "spki"
-version = "0.7.2"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d1e996ef02c474957d681f1b05213dfb0abab947b446a62d37770b23500184a"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
  "der",
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index ac6f8bc2acb4a..ed18e3c3c172b 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -242,7 +242,7 @@ dotenvy,https://github.com/allan2/dotenvy,MIT,"Noemi Lapresta <noemi.lapresta@gm
 dyn-clone,https://github.com/dtolnay/dyn-clone,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 ecdsa,https://github.com/RustCrypto/signatures/tree/master/ecdsa,Apache-2.0 OR MIT,RustCrypto Developers
 ed25519,https://github.com/RustCrypto/signatures/tree/master/ed25519,Apache-2.0 OR MIT,RustCrypto Developers
-ed25519-dalek,https://github.com/dalek-cryptography/ed25519-dalek,BSD-3-Clause,"isis lovecruft <isis@patternsinthevoid.net>, Tony Arcieri <bascule@gmail.com>, Michael Rosenberg <michael@mrosenberg.pub>"
+ed25519-dalek,https://github.com/dalek-cryptography/curve25519-dalek/tree/main/ed25519-dalek,BSD-3-Clause,"isis lovecruft <isis@patternsinthevoid.net>, Tony Arcieri <bascule@gmail.com>, Michael Rosenberg <michael@mrosenberg.pub>"
 educe,https://github.com/magiclen/educe,MIT,Magic Len <len@magiclen.org>
 either,https://github.com/bluss/either,MIT OR Apache-2.0,bluss
 elliptic-curve,https://github.com/RustCrypto/traits/tree/master/elliptic-curve,Apache-2.0 OR MIT,RustCrypto Developers

From dac7c31501defdf451f9422b6a569358fb5ec19e Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 15 Apr 2026 13:53:42 -0400
Subject: [PATCH 128/326] chore(deps): bump rustls-webpki 0.103.10 to 0.103.12
 (RUSTSEC-2026-0099) (#25200)

* chore(deps): bump rustls-webpki 0.103.10 to 0.103.12 (RUSTSEC-2026-0099)

* Add RUSTSEC-2026-0099 to deny.toml

* Add RUSTSEC-2026-0098 to deny.toml
---
 Cargo.lock | 6 +++---
 deny.toml  | 2 ++
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index d751a3e296d54..dc20d39632c7c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9492,7 +9492,7 @@ dependencies = [
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.10",
+ "rustls-webpki 0.103.12",
  "subtle",
  "zeroize",
 ]
@@ -9574,9 +9574,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.10"
+version = "0.103.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
+checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06"
 dependencies = [
  "ring",
  "rustls-pki-types",
diff --git a/deny.toml b/deny.toml
index c19b0a23f5ee6..ffc2f8b68f240 100644
--- a/deny.toml
+++ b/deny.toml
@@ -44,5 +44,7 @@ ignore = [
   { id = "RUSTSEC-2024-0388", reason = "derivative is unmaintained (https://github.com/vectordotdev/vector/issues/24940)" },
   { id = "RUSTSEC-2025-0134", reason = "rustls-pemfile is unmaintained - unpatched crate (https://github.com/bytebeamio/rumqtt/issues/1010) & tonic/reqwest upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
   { id = "RUSTSEC-2026-0049", reason = "rustls-webpki 0.102 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
+  { id = "RUSTSEC-2026-0098", reason = "rustls-webpki 0.102/0.101 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
+  { id = "RUSTSEC-2026-0099", reason = "rustls-webpki 0.102/0.101 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
   { id = "RUSTSEC-2024-0436", reason = "paste crate is unmaintained - transitive dependency via parquet v56.2.0, no safe upgrade available" },
 ]

From 6818b9c348cd4c3edd39f9f303f66362676e47a3 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 15 Apr 2026 14:22:40 -0400
Subject: [PATCH 129/326] feat(ci): add work-in-progress label workflow for
 docs PRs (#24950)

* feat(ci): add workflow to manage work-in-progress label on PRs

Automatically adds a "work in progress" label when a PR is opened or
reopened, and removes it when a member or owner approves the PR.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(ci): replace work-in-progress with under_review label for docs PRs

Target only PRs that touch docs-owned paths (matching CODEOWNERS) so the
docs team isn't pinged until a Vector team member approves. The label is
auto-added on open/reopen and auto-removed on first member approval.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(ci): fix prettier formatting

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(ci): use work-in-progress label instead of under_review

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(ci): split wip label into add/remove workflows with tested approach

- Split single workflow into add_wip_label.yml and remove_wip_label.yml
  to avoid paths filter affecting pull_request_review events
- Move association and label checks into github-script step instead of
  job if condition (GitHub Actions silently fails author_association
  checks in if expressions)
- Tested end-to-end in vectordotdev/ci-sandbox

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat(ci): trigger WIP label on synchronize to catch docs paths added later

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/CODEOWNERS                     |  1 +
 .github/workflows/add_wip_label.yml    | 22 +++++++++++++
 .github/workflows/remove_wip_label.yml | 45 ++++++++++++++++++++++++++
 3 files changed, 68 insertions(+)
 create mode 100644 .github/workflows/add_wip_label.yml
 create mode 100644 .github/workflows/remove_wip_label.yml

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ced3f0fb7bc07..ecd6fb374af9c 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -3,6 +3,7 @@
 .github/workflows/regression.yml @vectordotdev/vector @vectordotdev/single-machine-performance
 regression/config.yaml @vectordotdev/vector @vectordotdev/single-machine-performance
 
+# Keep documentation team paths in sync with .github/workflows/add_wip_label.yml
 docs/ @vectordotdev/vector @vectordotdev/documentation
 website/ @vectordotdev/vector
 website/content @vectordotdev/vector @vectordotdev/documentation
diff --git a/.github/workflows/add_wip_label.yml b/.github/workflows/add_wip_label.yml
new file mode 100644
index 0000000000000..a07f9ca0921fa
--- /dev/null
+++ b/.github/workflows/add_wip_label.yml
@@ -0,0 +1,22 @@
+name: Add Work In Progress Label
+
+permissions:
+  pull-requests: write
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+    # Keep these paths in sync with the documentation team entries in .github/CODEOWNERS
+    paths:
+      - "docs/**"
+      - "website/content/**"
+      - "website/cue/reference/**"
+
+jobs:
+  add_wip_label:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
+        with:
+          labels: "work in progress"
diff --git a/.github/workflows/remove_wip_label.yml b/.github/workflows/remove_wip_label.yml
new file mode 100644
index 0000000000000..46d6e79cf1ad8
--- /dev/null
+++ b/.github/workflows/remove_wip_label.yml
@@ -0,0 +1,45 @@
+name: Remove Work In Progress Label
+
+permissions:
+  pull-requests: write
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  remove_wip_label:
+    if: github.event.review.state == 'approved'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check association, label, and remove
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const association = context.payload.review.author_association;
+            core.info(`Author association: ${association}`);
+
+            const allowed = ['MEMBER', 'OWNER'];
+            if (!allowed.includes(association)) {
+              core.info(`Association "${association}" not in allowed list, skipping`);
+              return;
+            }
+
+            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+            });
+            const hasLabel = labels.some(l => l.name === 'work in progress');
+            if (!hasLabel) {
+              core.info('Label "work in progress" not found, skipping');
+              return;
+            }
+            await github.rest.issues.removeLabel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              name: 'work in progress',
+            });
+            core.info('Removed "work in progress" label');

From 2d14034bf8115764c52636a59ec298d7444a4d28 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 15 Apr 2026 14:52:21 -0400
Subject: [PATCH 130/326] fix(deps): override smol-toml to 1.6.1 for
 markdownlint-cli2 (#25202)

fix(deps): override smol-toml to 1.6.1 for markdownlint-cli2 (GHSA-v3rj-xjv7-4jmq)
---
 scripts/environment/npm-tools/package-lock.json | 6 +++---
 scripts/environment/npm-tools/package.json      | 5 +++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/scripts/environment/npm-tools/package-lock.json b/scripts/environment/npm-tools/package-lock.json
index d9e098652b6ad..ac93d1c99990a 100644
--- a/scripts/environment/npm-tools/package-lock.json
+++ b/scripts/environment/npm-tools/package-lock.json
@@ -1232,9 +1232,9 @@
       }
     },
     "node_modules/smol-toml": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.0.tgz",
-      "integrity": "sha512-4zemZi0HvTnYwLfrpk/CF9LOd9Lt87kAt50GnqhMpyF9U3poDAP2+iukq2bZsO/ufegbYehBkqINbsWxj4l4cw==",
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.1.tgz",
+      "integrity": "sha512-dWUG8F5sIIARXih1DTaQAX4SsiTXhInKf1buxdY9DIg4ZYPZK5nGM1VRIYmEbDbsHt7USo99xSLFu5Q1IqTmsg==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">= 18"
diff --git a/scripts/environment/npm-tools/package.json b/scripts/environment/npm-tools/package.json
index a40c7f7c3e2ae..fdffa6f8a2ac0 100644
--- a/scripts/environment/npm-tools/package.json
+++ b/scripts/environment/npm-tools/package.json
@@ -1,6 +1,11 @@
 {
   "private": true,
   "description": "Pinned npm tools for CI. Run 'npm ci' to install with exact versions from package-lock.json.",
+  "overrides": {
+    "markdownlint-cli2": {
+      "smol-toml": "1.6.1"
+    }
+  },
   "dependencies": {
     "@datadog/datadog-ci": "5.13.0",
     "markdownlint-cli2": "0.22.0",

From 08c9f1e6b54cf1b30e88d536f3545e74ff193c0f Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 15 Apr 2026 15:48:46 -0400
Subject: [PATCH 131/326] chore(deps): bump VRL and add feature for
 enable_crypto_functions (#25205)

---
 Cargo.toml | 1 +
 Makefile   | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index 6b233580143c8..84ded822b5790 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -533,6 +533,7 @@ tokio-console = ["dep:console-subscriber", "tokio/tracing"]
 vrl-functions-env = ["vrl/enable_env_functions"]
 vrl-functions-system = ["vrl/enable_system_functions"]
 vrl-functions-network = ["vrl/enable_network_functions"]
+vrl-functions-crypto = ["vrl/enable_crypto_functions"]
 
 # Enables the binary secret-backend-example
 secret-backend-example = ["transforms"]
diff --git a/Makefile b/Makefile
index 34da1302487d9..821ff961de4ac 100644
--- a/Makefile
+++ b/Makefile
@@ -373,7 +373,7 @@ test-behavior-config: ## Runs configuration related behavioral tests
 
 .PHONY: test-behavior-%
 test-behavior-%: ## Runs behavioral test for a given category
-	${MAYBE_ENVIRONMENT_EXEC} cargo run --no-default-features --features transforms,vrl-functions-env,vrl-functions-system,vrl-functions-network -- test tests/behavior/$*/*
+	${MAYBE_ENVIRONMENT_EXEC} cargo run --no-default-features --features transforms,vrl-functions-env,vrl-functions-system,vrl-functions-network,vrl-functions-crypto -- test tests/behavior/$*/*
 
 .PHONY: test-behavior
 test-behavior: ## Runs all behavioral tests

From a1469590bed6996b1eb7001248232b0aa48cd777 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 15 Apr 2026 16:06:08 -0400
Subject: [PATCH 132/326] chore(deps): bump rand 0.10.0 to 0.10.1 and 0.9.2 to
 0.9.4 (#25204)

* chore(deps): bump rand 0.10.0 to 0.10.1 (RUSTSEC-2026-0097)

* chore(deps): bump rand 0.9.2 to 0.9.4 (RUSTSEC-2026-0097)
---
 Cargo.lock | 64 +++++++++++++++++++++++++++---------------------------
 deny.toml  |  1 +
 2 files changed, 33 insertions(+), 32 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index dc20d39632c7c..aadbb2dd580a9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -271,7 +271,7 @@ dependencies = [
  "miniz_oxide",
  "num-bigint",
  "quad-rand",
- "rand 0.9.2",
+ "rand 0.9.4",
  "regex-lite",
  "serde",
  "serde_bytes",
@@ -2022,7 +2022,7 @@ dependencies = [
  "indexmap 2.12.0",
  "js-sys",
  "once_cell",
- "rand 0.9.2",
+ "rand 0.9.4",
  "serde",
  "serde_bytes",
  "serde_json",
@@ -2446,7 +2446,7 @@ dependencies = [
  "pin-project",
  "prost 0.12.6",
  "prost-reflect",
- "rand 0.9.2",
+ "rand 0.9.4",
  "regex",
  "rstest",
  "rust_decimal",
@@ -3910,7 +3910,7 @@ version = "0.1.0"
 dependencies = [
  "chrono",
  "fakedata_generator",
- "rand 0.9.2",
+ "rand 0.9.4",
 ]
 
 [[package]]
@@ -3920,7 +3920,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b42ec18312c068f0d6008ad66ad2fa289ab40a16d07a06406c200baa09eb1e7c"
 dependencies = [
  "passt",
- "rand 0.9.2",
+ "rand 0.9.4",
  "serde",
  "serde_json",
 ]
@@ -4412,7 +4412,7 @@ dependencies = [
  "nonzero_ext",
  "parking_lot",
  "portable-atomic",
- "rand 0.9.2",
+ "rand 0.9.4",
  "smallvec",
  "spinning_top",
  "web-time",
@@ -4445,7 +4445,7 @@ dependencies = [
  "greptime-proto",
  "parking_lot",
  "prost 0.12.6",
- "rand 0.9.2",
+ "rand 0.9.4",
  "snafu 0.8.9",
  "tokio",
  "tokio-stream",
@@ -4819,7 +4819,7 @@ dependencies = [
  "idna",
  "ipnet",
  "once_cell",
- "rand 0.9.2",
+ "rand 0.9.4",
  "ring",
  "rustls-pki-types",
  "thiserror 2.0.17",
@@ -4864,7 +4864,7 @@ dependencies = [
  "moka",
  "once_cell",
  "parking_lot",
- "rand 0.9.2",
+ "rand 0.9.4",
  "resolv-conf",
  "smallvec",
  "thiserror 2.0.17",
@@ -5794,7 +5794,7 @@ dependencies = [
  "indoc",
  "k8s-openapi",
  "k8s-test-framework",
- "rand 0.9.2",
+ "rand 0.9.4",
  "regex",
  "reqwest 0.11.26",
  "serde_json",
@@ -7942,7 +7942,7 @@ dependencies = [
  "hmac",
  "md-5",
  "memchr",
- "rand 0.9.2",
+ "rand 0.9.4",
  "sha2",
  "stringprep",
 ]
@@ -8172,7 +8172,7 @@ dependencies = [
  "bit-vec",
  "bitflags 2.10.0",
  "num-traits",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rand_chacha 0.9.0",
  "rand_xorshift",
  "regex-syntax",
@@ -8251,7 +8251,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22505a5c94da8e3b7c2996394d1c933236c4d743e81a410bcca4e6989fc066a4"
 dependencies = [
  "bytes",
- "heck 0.5.0",
+ "heck 0.4.1",
  "itertools 0.12.1",
  "log",
  "multimap",
@@ -8271,7 +8271,7 @@ version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
- "heck 0.5.0",
+ "heck 0.4.1",
  "itertools 0.14.0",
  "log",
  "multimap",
@@ -8528,7 +8528,7 @@ checksum = "95c589f335db0f6aaa168a7cd27b1fc6920f5e1470c804f814d9cd6e62a0f70b"
 dependencies = [
  "env_logger",
  "log",
- "rand 0.10.0",
+ "rand 0.10.1",
 ]
 
 [[package]]
@@ -8569,7 +8569,7 @@ dependencies = [
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
- "rand 0.9.2",
+ "rand 0.9.4",
  "ring",
  "rustc-hash",
  "rustls 0.23.37",
@@ -8660,9 +8660,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.2"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.0",
@@ -8670,9 +8670,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
  "chacha20 0.10.0",
  "getrandom 0.4.2",
@@ -8731,7 +8731,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8615d50dcf34fa31f7ab52692afec947c4dd0ab803cc87cb3b0b4570ff7463"
 dependencies = [
  "num-traits",
- "rand 0.9.2",
+ "rand 0.9.4",
 ]
 
 [[package]]
@@ -8900,7 +8900,7 @@ dependencies = [
  "num-bigint",
  "percent-encoding",
  "pin-project-lite",
- "rand 0.9.2",
+ "rand 0.9.4",
  "ryu",
  "socket2 0.6.0",
  "tokio",
@@ -9211,7 +9211,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46a4bd6027df676bcb752d3724db0ea3c0c5fc1dd0376fec51ac7dcaf9cc69be"
 dependencies = [
- "rand 0.9.2",
+ "rand 0.9.4",
 ]
 
 [[package]]
@@ -10323,7 +10323,7 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
- "heck 0.5.0",
+ "heck 0.4.1",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "syn 2.0.117",
@@ -10335,7 +10335,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54254b8531cafa275c5e096f62d48c81435d1015405a91198ddb11e967301d40"
 dependencies = [
- "heck 0.5.0",
+ "heck 0.4.1",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "syn 2.0.117",
@@ -11262,7 +11262,7 @@ dependencies = [
  "pin-project-lite",
  "postgres-protocol",
  "postgres-types",
- "rand 0.9.2",
+ "rand 0.9.4",
  "socket2 0.6.0",
  "tokio",
  "tokio-util",
@@ -11987,7 +11987,7 @@ dependencies = [
  "futures",
  "getrandom 0.3.4",
  "pin-project",
- "rand 0.9.2",
+ "rand 0.9.4",
  "reqwest 0.12.28",
  "serde",
  "serde_json",
@@ -12231,7 +12231,7 @@ checksum = "a68d3c8f01c0cfa54a75291d83601161799e4a89a39e0929f4b0354d88757a37"
 dependencies = [
  "getrandom 0.4.2",
  "js-sys",
- "rand 0.10.0",
+ "rand 0.10.1",
  "serde_core",
  "wasm-bindgen",
 ]
@@ -12428,7 +12428,7 @@ dependencies = [
  "quick-junit",
  "quick-xml 0.31.0",
  "quickcheck",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rand_distr",
  "rdkafka",
  "redis",
@@ -12549,7 +12549,7 @@ dependencies = [
  "pastey",
  "proptest",
  "quickcheck",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rkyv",
  "serde",
  "serde_yaml",
@@ -12698,7 +12698,7 @@ dependencies = [
  "quanta",
  "quickcheck",
  "quickcheck_macros",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rand_distr",
  "regex",
  "ryu",
@@ -12775,7 +12775,7 @@ dependencies = [
  "futures-util",
  "pin-project",
  "proptest",
- "rand 0.9.2",
+ "rand 0.9.4",
  "rand_distr",
  "tokio",
  "tokio-util",
diff --git a/deny.toml b/deny.toml
index ffc2f8b68f240..ac8e588fa1cbe 100644
--- a/deny.toml
+++ b/deny.toml
@@ -47,4 +47,5 @@ ignore = [
   { id = "RUSTSEC-2026-0098", reason = "rustls-webpki 0.102/0.101 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
   { id = "RUSTSEC-2026-0099", reason = "rustls-webpki 0.102/0.101 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
   { id = "RUSTSEC-2024-0436", reason = "paste crate is unmaintained - transitive dependency via parquet v56.2.0, no safe upgrade available" },
+  { id = "RUSTSEC-2026-0097", reason = "rand 0.8.5 unsound with custom logger - transitive dependency, upstream crates have not updated to rand 0.9+" },
 ]

From 5ba8405bf48cd64509bf02388c7901451bbe67f4 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 15 Apr 2026 16:20:05 -0400
Subject: [PATCH 133/326] chore(vdev): bump version to 0.3.1 (#25206)

---
 Cargo.lock      | 2 +-
 vdev/Cargo.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index aadbb2dd580a9..2d641cc2a2934 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -12260,7 +12260,7 @@ checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
 [[package]]
 name = "vdev"
-version = "0.3.0"
+version = "0.3.1"
 dependencies = [
  "anyhow",
  "cfg-if",
diff --git a/vdev/Cargo.toml b/vdev/Cargo.toml
index 7de3fc06d5a59..2a0f6169a160e 100644
--- a/vdev/Cargo.toml
+++ b/vdev/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "vdev"
-version = "0.3.0"
+version = "0.3.1"
 edition = "2024"
 authors = ["Vector Contributors <vector@datadoghq.com>"]
 license = "MPL-2.0"

From ce651754d4e2eb134ee9ab2fe85a8a3a5ed923a0 Mon Sep 17 00:00:00 2001
From: Yoenn Burban <62966490+gwenaskell@users.noreply.github.com>
Date: Thu, 16 Apr 2026 09:16:53 +0200
Subject: [PATCH 134/326] feat(sources): add source latency metric and fix
 source lag time on large batches (#24987)

* add send latency distribution to source sender

* add changelog

* use outputMetrics in the builder

* fix clippy

* apply suggestion

* only record the await point duration

* make sure metrics are updated if an error is returned

* add documentation for the added metrics

* fix source_lag_time_seconds measurement for large batches
---
 ...fix_source_lag_time_chunked_batches.fix.md |  3 +
 ...urce_sender_latency_metrics.enhancement.md |  5 ++
 lib/vector-core/src/source_sender/builder.rs  | 20 +++--
 lib/vector-core/src/source_sender/mod.rs      |  4 +-
 lib/vector-core/src/source_sender/output.rs   | 87 +++++++++++++++----
 lib/vector-core/src/source_sender/sender.rs   | 19 +++-
 .../components/sources/internal_metrics.cue   | 12 +++
 7 files changed, 122 insertions(+), 28 deletions(-)
 create mode 100644 changelog.d/fix_source_lag_time_chunked_batches.fix.md
 create mode 100644 changelog.d/source_sender_latency_metrics.enhancement.md

diff --git a/changelog.d/fix_source_lag_time_chunked_batches.fix.md b/changelog.d/fix_source_lag_time_chunked_batches.fix.md
new file mode 100644
index 0000000000000..6303ba10edd33
--- /dev/null
+++ b/changelog.d/fix_source_lag_time_chunked_batches.fix.md
@@ -0,0 +1,3 @@
+Fixed an incorrect source_lag_time_seconds measurement in sources that use `send_batch` with large event batches. When a batch was split into multiple chunks, the reference timestamp used to compute lag time was re-captured on each chunk send, causing the lag time for later chunks to be overstated by the amount of time spent waiting for the channel to accept earlier chunks. The reference timestamp is now captured once before iteration and shared across all chunks.
+
+authors: gwenaskell
diff --git a/changelog.d/source_sender_latency_metrics.enhancement.md b/changelog.d/source_sender_latency_metrics.enhancement.md
new file mode 100644
index 0000000000000..6876641a37764
--- /dev/null
+++ b/changelog.d/source_sender_latency_metrics.enhancement.md
@@ -0,0 +1,5 @@
+Sources now record the distribution metrics `source_send_latency_seconds` (measuring the time spent
+blocking on a single events chunk send operation on the output) and `source_send_batch_latency_seconds`
+(encompassing all chunks within a received events batch).
+
+authors: gwenaskell
diff --git a/lib/vector-core/src/source_sender/builder.rs b/lib/vector-core/src/source_sender/builder.rs
index ec16d54d482a9..f3051726a7f56 100644
--- a/lib/vector-core/src/source_sender/builder.rs
+++ b/lib/vector-core/src/source_sender/builder.rs
@@ -1,17 +1,20 @@
 use std::{collections::HashMap, time::Duration};
 
-use metrics::{Histogram, histogram};
+use metrics::histogram;
 use vector_buffers::topology::channel::LimitedReceiver;
 use vector_common::internal_event::DEFAULT_OUTPUT;
 
-use super::{CHUNK_SIZE, LAG_TIME_NAME, Output, SourceSender, SourceSenderItem};
+use super::{
+    CHUNK_SIZE, LAG_TIME_NAME, Output, OutputMetrics, SEND_BATCH_LATENCY_NAME, SEND_LATENCY_NAME,
+    SourceSender, SourceSenderItem,
+};
 use crate::config::{ComponentKey, OutputId, SourceOutput};
 
 pub struct Builder {
     buf_size: usize,
     default_output: Option<Output>,
     named_outputs: HashMap<String, Output>,
-    lag_time: Option<Histogram>,
+    output_metrics: OutputMetrics,
     timeout: Option<Duration>,
     ewma_half_life_seconds: Option<f64>,
 }
@@ -22,7 +25,11 @@ impl Default for Builder {
             buf_size: CHUNK_SIZE,
             default_output: None,
             named_outputs: Default::default(),
-            lag_time: Some(histogram!(LAG_TIME_NAME)),
+            output_metrics: OutputMetrics::new(
+                Some(histogram!(LAG_TIME_NAME)),
+                Some(histogram!(SEND_LATENCY_NAME)),
+                Some(histogram!(SEND_BATCH_LATENCY_NAME)),
+            ),
             timeout: None,
             ewma_half_life_seconds: None,
         }
@@ -53,7 +60,6 @@ impl Builder {
         output: SourceOutput,
         component_key: ComponentKey,
     ) -> LimitedReceiver<SourceSenderItem> {
-        let lag_time = self.lag_time.clone();
         let log_definition = output.schema_definition.clone();
         let output_id = OutputId {
             component: component_key,
@@ -64,7 +70,7 @@ impl Builder {
                 let (output, rx) = Output::new_with_buffer(
                     self.buf_size,
                     DEFAULT_OUTPUT.to_owned(),
-                    lag_time,
+                    self.output_metrics.clone(),
                     log_definition,
                     output_id,
                     self.timeout,
@@ -77,7 +83,7 @@ impl Builder {
                 let (output, rx) = Output::new_with_buffer(
                     self.buf_size,
                     name.clone(),
-                    lag_time,
+                    self.output_metrics.clone(),
                     log_definition,
                     output_id,
                     self.timeout,
diff --git a/lib/vector-core/src/source_sender/mod.rs b/lib/vector-core/src/source_sender/mod.rs
index c8af2db8bbf87..fc0cb417890a0 100644
--- a/lib/vector-core/src/source_sender/mod.rs
+++ b/lib/vector-core/src/source_sender/mod.rs
@@ -14,7 +14,7 @@ mod tests;
 
 pub use builder::Builder;
 pub use errors::SendError;
-use output::Output;
+use output::{Output, OutputMetrics};
 pub use sender::{SourceSender, SourceSenderItem};
 
 pub const CHUNK_SIZE: usize = 1000;
@@ -23,3 +23,5 @@ pub const CHUNK_SIZE: usize = 1000;
 const TEST_BUFFER_SIZE: usize = 100;
 
 const LAG_TIME_NAME: &str = "source_lag_time_seconds";
+const SEND_LATENCY_NAME: &str = "source_send_latency_seconds";
+const SEND_BATCH_LATENCY_NAME: &str = "source_send_batch_latency_seconds";
diff --git a/lib/vector-core/src/source_sender/output.rs b/lib/vector-core/src/source_sender/output.rs
index df0bee2a43da0..4a194cc3e1c1f 100644
--- a/lib/vector-core/src/source_sender/output.rs
+++ b/lib/vector-core/src/source_sender/output.rs
@@ -85,7 +85,7 @@ impl Drop for UnsentEventCount {
 #[derive(Clone)]
 pub(super) struct Output {
     sender: LimitedSender<SourceSenderItem>,
-    lag_time: Option<Histogram>,
+    metrics: OutputMetrics,
     events_sent: Registered<EventsSent>,
     /// The schema definition that will be attached to Log events sent through here
     log_definition: Option<Arc<Definition>>,
@@ -95,6 +95,27 @@ pub(super) struct Output {
     timeout: Option<Duration>,
 }
 
+#[derive(Clone, Default)]
+pub(super) struct OutputMetrics {
+    lag_time: Option<Histogram>,
+    send_latency: Option<Histogram>,
+    send_batch_latency: Option<Histogram>,
+}
+
+impl OutputMetrics {
+    pub(super) fn new(
+        lag_time: Option<Histogram>,
+        send_latency: Option<Histogram>,
+        send_batch_latency: Option<Histogram>,
+    ) -> Self {
+        Self {
+            lag_time,
+            send_latency,
+            send_batch_latency,
+        }
+    }
+}
+
 #[expect(clippy::missing_fields_in_debug)]
 impl fmt::Debug for Output {
     fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result {
@@ -111,19 +132,20 @@ impl Output {
     pub(super) fn new_with_buffer(
         n: usize,
         output: String,
-        lag_time: Option<Histogram>,
+        metrics: OutputMetrics,
         log_definition: Option<Arc<Definition>>,
         output_id: OutputId,
         timeout: Option<Duration>,
         ewma_half_life_seconds: Option<f64>,
     ) -> (Self, LimitedReceiver<SourceSenderItem>) {
         let limit = MemoryBufferSize::MaxEvents(NonZeroUsize::new(n).unwrap());
-        let metrics = ChannelMetricMetadata::new(UTILIZATION_METRIC_PREFIX, Some(output.clone()));
-        let (tx, rx) = channel::limited(limit, Some(metrics), ewma_half_life_seconds);
+        let channel_metrics =
+            ChannelMetricMetadata::new(UTILIZATION_METRIC_PREFIX, Some(output.clone()));
+        let (tx, rx) = channel::limited(limit, Some(channel_metrics), ewma_half_life_seconds);
         (
             Self {
                 sender: tx,
-                lag_time,
+                metrics,
                 events_sent: internal_event::register(EventsSent::from(internal_event::Output(
                     Some(output.into()),
                 ))),
@@ -136,12 +158,21 @@ impl Output {
     }
 
     pub(super) async fn send(
+        &mut self,
+        events: EventArray,
+        unsent_event_count: &mut UnsentEventCount,
+    ) -> Result<(), SendError> {
+        let reference = Utc::now().timestamp_millis();
+        self.send_inner(events, unsent_event_count, reference).await
+    }
+
+    async fn send_inner(
         &mut self,
         mut events: EventArray,
         unsent_event_count: &mut UnsentEventCount,
+        reference: i64,
     ) -> Result<(), SendError> {
         let send_reference = Instant::now();
-        let reference = Utc::now().timestamp_millis();
         events
             .iter_events()
             .for_each(|event| self.emit_lag_time(event, reference));
@@ -156,7 +187,17 @@ impl Output {
 
         let byte_size = events.estimated_json_encoded_size_of();
         let count = events.len();
-        self.send_with_timeout(events, send_reference).await?;
+
+        let send_start = Instant::now();
+
+        let send_result = self.send_with_timeout(events, send_reference).await;
+
+        if let Some(send_latency) = &self.metrics.send_latency {
+            send_latency.record(send_start.elapsed().as_secs_f64());
+        }
+
+        send_result?;
+
         self.events_sent.emit(CountByteSize(count, byte_size));
         unsent_event_count.decr(count);
         Ok(())
@@ -218,25 +259,39 @@ impl Output {
         I: IntoIterator<Item = E>,
         <I as IntoIterator>::IntoIter: ExactSizeIterator,
     {
+        // Capture a single reference timestamp for the entire batch so that lag time
+        // measurements are not inflated by channel-send latency for later chunks.
+        let reference = Utc::now().timestamp_millis();
+
         // It's possible that the caller stops polling this future while it is blocked waiting
         // on `self.send()`. When that happens, we use `UnsentEventCount` to correctly emit
         // `ComponentEventsDropped` events.
         let events = events.into_iter().map(Into::into);
         let mut unsent_event_count = UnsentEventCount::new(events.len());
+        let send_batch_start = Instant::now();
+
         for events in array::events_into_arrays(events, Some(CHUNK_SIZE)) {
-            self.send(events, &mut unsent_event_count)
+            self.send_inner(events, &mut unsent_event_count, reference)
                 .await
-                .inspect_err(|error| match error {
-                    SendError::Timeout => {
-                        unsent_event_count.timed_out();
+                .inspect_err(|error| {
+                    match error {
+                        SendError::Timeout => {
+                            unsent_event_count.timed_out();
+                        }
+                        SendError::Closed => {
+                            // The unsent event count is discarded here because the callee emits the
+                            // `StreamClosedError`.
+                            unsent_event_count.discard();
+                        }
                     }
-                    SendError::Closed => {
-                        // The unsent event count is discarded here because the callee emits the
-                        // `StreamClosedError`.
-                        unsent_event_count.discard();
+                    if let Some(send_batch_latency) = &self.metrics.send_batch_latency {
+                        send_batch_latency.record(send_batch_start.elapsed().as_secs_f64());
                     }
                 })?;
         }
+        if let Some(send_batch_latency) = &self.metrics.send_batch_latency {
+            send_batch_latency.record(send_batch_start.elapsed().as_secs_f64());
+        }
         Ok(())
     }
 
@@ -244,7 +299,7 @@ impl Output {
     /// timestamp stored in the given event reference, and emit the
     /// different, as expressed in milliseconds, as a histogram.
     pub(super) fn emit_lag_time(&self, event: EventRef<'_>, reference: i64) {
-        if let Some(lag_time_metric) = &self.lag_time {
+        if let Some(lag_time_metric) = &self.metrics.lag_time {
             let timestamp = match event {
                 EventRef::Log(log) => {
                     log_schema()
diff --git a/lib/vector-core/src/source_sender/sender.rs b/lib/vector-core/src/source_sender/sender.rs
index 88cb50172c70a..6041dad3dad9f 100644
--- a/lib/vector-core/src/source_sender/sender.rs
+++ b/lib/vector-core/src/source_sender/sender.rs
@@ -22,7 +22,9 @@ use vector_common::{
 
 use super::{Builder, Output, SendError};
 #[cfg(any(test, feature = "test"))]
-use super::{LAG_TIME_NAME, TEST_BUFFER_SIZE};
+use super::{
+    LAG_TIME_NAME, OutputMetrics, SEND_BATCH_LATENCY_NAME, SEND_LATENCY_NAME, TEST_BUFFER_SIZE,
+};
 use crate::{
     EstimatedJsonEncodedSizeOf,
     event::{Event, EventArray, EventContainer, array::EventArrayIntoIter},
@@ -108,6 +110,8 @@ impl SourceSender {
         timeout: Option<Duration>,
     ) -> (Self, LimitedReceiver<SourceSenderItem>) {
         let lag_time = Some(histogram!(LAG_TIME_NAME));
+        let send_latency = Some(histogram!(SEND_LATENCY_NAME));
+        let send_batch_latency = Some(histogram!(SEND_BATCH_LATENCY_NAME));
         let output_id = OutputId {
             component: "test".to_string().into(),
             port: None,
@@ -115,7 +119,7 @@ impl SourceSender {
         let (default_output, rx) = Output::new_with_buffer(
             n,
             DEFAULT_OUTPUT.to_owned(),
-            lag_time,
+            OutputMetrics::new(lag_time, send_latency, send_batch_latency),
             None,
             output_id,
             timeout,
@@ -192,8 +196,15 @@ impl SourceSender {
             component: "test".to_string().into(),
             port: Some(name.clone()),
         };
-        let (output, recv) =
-            Output::new_with_buffer(100, name.clone(), None, None, output_id, None, None);
+        let (output, recv) = Output::new_with_buffer(
+            100,
+            name.clone(),
+            OutputMetrics::default(),
+            None,
+            output_id,
+            None,
+            None,
+        );
         let recv = recv.into_stream().map(move |mut item| {
             item.events.iter_events_mut().for_each(|mut event| {
                 let metadata = event.metadata_mut();
diff --git a/website/cue/reference/components/sources/internal_metrics.cue b/website/cue/reference/components/sources/internal_metrics.cue
index 98ed1ffe025d7..1e990965638c6 100644
--- a/website/cue/reference/components/sources/internal_metrics.cue
+++ b/website/cue/reference/components/sources/internal_metrics.cue
@@ -774,6 +774,18 @@ components: sources: internal_metrics: {
 			default_namespace: "vector"
 			tags:              _component_tags
 		}
+		source_send_batch_latency_seconds: {
+			description:       "The time elapsed blocking on the downstream channel to accept an entire batch of events received at the source"
+			type:              "histogram"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
+		source_send_latency_seconds: {
+			description:       "The time elapsed blocking on the downstream channel to accept a single chunk from a batch of events received at the source"
+			type:              "histogram"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
 		source_buffer_max_byte_size: {
 			description:       "The maximum number of bytes the source buffer can hold. The outputs of the source send data to this buffer."
 			type:              "gauge"

From 8138c4593455dd284475ed4ed61fe55ee176bd34 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 16 Apr 2026 11:27:11 -0400
Subject: [PATCH 135/326] chore(website): update DD RUM/Logs config to cose
 site (#25213)

---
 website/assets/js/dd-browser-logs-rum.js | 6 ++++++
 website/config.toml                      | 5 +++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/website/assets/js/dd-browser-logs-rum.js b/website/assets/js/dd-browser-logs-rum.js
index fa9414b4099d2..3ec4e2a2fb085 100644
--- a/website/assets/js/dd-browser-logs-rum.js
+++ b/website/assets/js/dd-browser-logs-rum.js
@@ -12,10 +12,15 @@ if (datadogRum) {
     datadogRum.init({
       applicationId: '{{ $ddConfig.application_id }}',
       clientToken: '{{ $ddConfig.client_token }}',
+      site: '{{ $ddConfig.site }}',
       env,
       service: '{{ $ddConfig.service_name }}',
       version: '{{ $latest }}',
+      sessionSampleRate: 100,
+      sessionReplaySampleRate: 20,
+      trackResources: true,
       trackInteractions: true,
+      trackLongTasks: true,
       internalAnalyticsSubdomain: '8b61d74c'
     });
   }
@@ -25,6 +30,7 @@ if (datadogLogs) {
   if (env === 'preview' || env === 'production') {
     datadogLogs.init({
       clientToken: '{{ $ddConfig.client_token }}',
+      site: '{{ $ddConfig.site }}',
       forwardErrorsToLogs: true,
       env,
       service: '{{ $ddConfig.service_name }}',
diff --git a/website/config.toml b/website/config.toml
index f107186e280da..414451d38b57d 100644
--- a/website/config.toml
+++ b/website/config.toml
@@ -93,8 +93,9 @@ discord = "https://chat.vector.dev"
 
 # Datadog configuration
 [params.datadog_config]
-application_id = "0b95923b-b06d-445b-893f-a861e93d6ea3"
-client_token = "puba5f23a97d613091ae2ca8c0f4a135af4"
+application_id = "894af722-5919-4a62-97fc-33f49bc52803"
+client_token = "pubcee1dc56e7f5bd03397cc3624eb7961c"
+site = "cose.datadoghq.com"
 service_name = "vector"
 
 ## Menus

From 61b4563fc60211feba19dcbf9296872b8640ec94 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 16 Apr 2026 12:19:11 -0400
Subject: [PATCH 136/326] fix(ci): fix secrets in static analysis workflow
 (#25208)

fix(ci): use env context instead of secrets in workflow expression
---
 .github/workflows/static-analysis.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index 04ed6b19d9f25..9411f2844e264 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -13,14 +13,17 @@ permissions:
 jobs:
   static-analysis:
     runs-on: ubuntu-latest
+    env:
+      DD_API_KEY: ${{ secrets.DD_API_KEY }}
+      DD_APP_KEY: ${{ secrets.DD_APP_KEY }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Datadog Static Analyzer
-        if: ${{ secrets.DD_API_KEY != '' }}
+        if: ${{ env.DD_API_KEY != '' }}
         uses: DataDog/datadog-static-analyzer-github-action@8340f18875fcefca86844b5f947ce2431387e552 # v3.0.0
         with:
-          dd_api_key: ${{ secrets.DD_API_KEY }}
-          dd_app_key: ${{ secrets.DD_APP_KEY }}
+          dd_api_key: ${{ env.DD_API_KEY }}
+          dd_app_key: ${{ env.DD_APP_KEY }}
           dd_site: datadoghq.com
           secrets_enabled: true

From 467ef876a286df316ba273e4ad1779f1b08ba392 Mon Sep 17 00:00:00 2001
From: Vladimir Zhuk <vladimir.zhuk@datadoghq.com>
Date: Thu, 16 Apr 2026 19:18:13 +0200
Subject: [PATCH 137/326] fix(datadog_common sink): preserve site prefix when
 computing API endpoint (#25211)

* fix(common): preserve site prefix when computing API endpoint from intake endpoints

The `compute_api_endpoint` regex was stripping site prefixes (e.g. `us3.`,
`us5.`, `ap1.`) from Datadog domain names when deriving the API endpoint
from intake endpoints. This caused the sink healthcheck to call
`https://api.datadoghq.com` instead of the site-specific endpoint
(e.g. `https://api.us3.datadoghq.com`), resulting in unintended cross-site
egress traffic.

The fix moves the optional site prefix inside the regex capture group so it
is preserved in the rewritten API URL.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* add changelog fragment and fix formatting

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix changelog

* refactor test

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 changelog.d/fix_site_prefix_stripping.fix.md |  3 ++
 src/common/datadog.rs                        | 30 +++++++++++++++++++-
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/fix_site_prefix_stripping.fix.md

diff --git a/changelog.d/fix_site_prefix_stripping.fix.md b/changelog.d/fix_site_prefix_stripping.fix.md
new file mode 100644
index 0000000000000..8136664b5b2fd
--- /dev/null
+++ b/changelog.d/fix_site_prefix_stripping.fix.md
@@ -0,0 +1,3 @@
+Fixed the Datadog sink healthcheck endpoint computation to preserve site prefixes (e.g. `us3.`, `us5.`, `ap1.`) when deriving the API URL from intake endpoints. Previously, the healthcheck for site-specific endpoints like `https://http-intake.logs.us3.datadoghq.com` would incorrectly call `https://api.datadoghq.com` instead of `https://api.us3.datadoghq.com`, causing unintended cross-site egress traffic.
+
+authors: vladimir-dd
diff --git a/src/common/datadog.rs b/src/common/datadog.rs
index 9b84a2f8351dc..05638b474e940 100644
--- a/src/common/datadog.rs
+++ b/src/common/datadog.rs
@@ -105,7 +105,7 @@ fn compute_api_endpoint(endpoint: &str) -> String {
     // https://github.com/DataDog/datadog-agent/blob/cdcf0fc809b9ac1cd6e08057b4971c7dbb8dbe30/comp/forwarder/defaultforwarder/forwarder_health.go#L45-L47
     // https://github.com/DataDog/datadog-agent/blob/cdcf0fc809b9ac1cd6e08057b4971c7dbb8dbe30/comp/forwarder/defaultforwarder/forwarder_health.go#L188-L190
     static DOMAIN_REGEX: LazyLock<Regex> = LazyLock::new(|| {
-        Regex::new(r"(?:[a-z]{2}\d\.)?(datadoghq\.[a-z]+|ddog-gov\.com)/*$")
+        Regex::new(r"((?:[a-z]{2}\d\.)?(?:datadoghq\.[a-z]+|ddog-gov\.com))/*$")
             .expect("Could not build Datadog domain regex")
     });
 
@@ -175,6 +175,27 @@ mod tests {
         );
     }
 
+    #[test]
+    fn preserves_site_prefix_in_api_endpoint() {
+        for (prefix, tld) in [
+            ("us3", "com"),
+            ("us5", "com"),
+            ("ap1", "com"),
+            ("eu1", "eu"),
+        ] {
+            assert_eq!(
+                compute_api_endpoint(&format!(
+                    "https://http-intake.logs.{prefix}.datadoghq.{tld}"
+                )),
+                format!("https://api.{prefix}.datadoghq.{tld}")
+            );
+        }
+        assert_eq!(
+            compute_api_endpoint("https://1-2-3-observability-pipelines.agent.us3.datadoghq.com"),
+            "https://api.us3.datadoghq.com"
+        );
+    }
+
     #[test]
     fn gets_correct_api_base_endpoint() {
         assert_eq!(
@@ -189,5 +210,12 @@ mod tests {
             get_api_base_endpoint(Some("https://logs.datadoghq.eu"), DD_US_SITE),
             "https://api.datadoghq.eu"
         );
+        assert_eq!(
+            get_api_base_endpoint(
+                Some("https://http-intake.logs.us3.datadoghq.com"),
+                DD_US_SITE
+            ),
+            "https://api.us3.datadoghq.com"
+        );
     }
 }

From 9efe09d254fdad82f5d1239e3eae28348390ddfa Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 16 Apr 2026 20:34:41 -0400
Subject: [PATCH 138/326] fix(ci): modernize cross ubuntu bootstrap script
 (#25215)

* chore(cross): modernize ubuntu bootstrap script for cross-compilation

* Pin cross edge images

* Install libcurl dev headers for librdkafka build

* Configure cmake
---
 Makefile                          | 14 +++++++++++
 scripts/cross/Dockerfile          | 14 +++++++++--
 scripts/cross/bootstrap-ubuntu.sh | 39 ++++++++++++++-----------------
 3 files changed, 43 insertions(+), 24 deletions(-)

diff --git a/Makefile b/Makefile
index 821ff961de4ac..847a64069f61a 100644
--- a/Makefile
+++ b/Makefile
@@ -267,13 +267,27 @@ cross-enable: cargo-install-cross
 CARGO_HANDLES_FRESHNESS:
 	${EMPTY}
 
+# Pinned digests for ghcr.io/cross-rs/<target>:edge.
+# Source: cross-rs/cross @ f86fd03bb70b4c6802847c18087e21391498b0b4, built 2026-04-10 (Ubuntu 20.04 focal).
+# Refresh with: crane digest ghcr.io/cross-rs/<target>:edge
+CROSS_DIGEST_x86_64-unknown-linux-gnu       := sha256:13f7a68e55cb05a19e840bce65834fc785dc069e0c2218d12b8fdb8f8a1519d5
+CROSS_DIGEST_aarch64-unknown-linux-gnu      := sha256:3bf094d22fc4f73c9bdce45ddd7a8bbae349efdbd51b4d4b5ee1bedd8454466b
+CROSS_DIGEST_x86_64-unknown-linux-musl      := sha256:c59deede3efcd7cb6f6a57641241ba1c63cfe35b7965be09a851242b4209639d
+CROSS_DIGEST_aarch64-unknown-linux-musl     := sha256:dad492e0f040c6e712d4be9b970c9de5f3b8ef9cde6b9a2b437d56d1dabeb808
+CROSS_DIGEST_armv7-unknown-linux-gnueabihf  := sha256:73294ebb06e077e49bbbecfe8f17507e9e0b733a2a1ba23056abcd9c0ba617c9
+CROSS_DIGEST_armv7-unknown-linux-musleabihf := sha256:49bdc9a4cf2f1bcb385389c85be8f43c4399fa6d6fe22883702ef13eb921e443
+CROSS_DIGEST_arm-unknown-linux-gnueabi      := sha256:0c70b0e54724bd599dff00a2888f8ea176a5b6c85af47aad9ad25296f63e2967
+CROSS_DIGEST_arm-unknown-linux-musleabi     := sha256:0ca8f4afcc29fb5964aa63e482452e8869311a610c5868f22ded400c4e483328
+
 # GNU Make < 3.82 pattern matching priority depends on the definition order
 # so cross-image-% must be defined before cross-%
 .PHONY: cross-image-%
 cross-image-%: export TRIPLE =$($(strip @):cross-image-%=%)
 cross-image-%:
+	$(if $(CROSS_DIGEST_$*),,$(error No CROSS_DIGEST pinned for $*. Add it to the digest table in Makefile.))
 	$(CONTAINER_TOOL) build \
 		--build-arg TARGET=${TRIPLE} \
+		--build-arg CROSS_DIGEST=$(CROSS_DIGEST_$*) \
 		--file scripts/cross/Dockerfile \
 		--tag vector-cross-env:${TRIPLE} \
 		.
diff --git a/scripts/cross/Dockerfile b/scripts/cross/Dockerfile
index 80a75caba683c..3abe8cd8b2d11 100644
--- a/scripts/cross/Dockerfile
+++ b/scripts/cross/Dockerfile
@@ -1,13 +1,23 @@
-ARG CROSS_VERSION=0.2.5
 ARG TARGET=x86_64-unknown-linux-musl
+ARG CROSS_DIGEST
 
-FROM ghcr.io/cross-rs/${TARGET}:${CROSS_VERSION}
+FROM ghcr.io/cross-rs/${TARGET}@${CROSS_DIGEST}
 
 # Common steps for all targets
 COPY scripts/cross/bootstrap-ubuntu.sh /
 COPY scripts/environment/install-protoc.sh /
 RUN /bootstrap-ubuntu.sh && bash /install-protoc.sh
 
+# Allow cmake to find pre-built dependencies (e.g. curl from curl-sys) that
+# land in CMAKE_PREFIX_PATH rather than the cross sysroot.  The cross-rs
+# toolchain.cmake sets CMAKE_FIND_ROOT_PATH_MODE_{LIBRARY,INCLUDE} to ONLY,
+# which makes cmake ignore CMAKE_PREFIX_PATH entries outside the sysroot.
+# Switching to BOTH lets FindCURL (and similar modules) locate libraries that
+# Cargo crates like curl-sys build from source and expose via CMAKE_PREFIX_PATH.
+RUN if [ -f /opt/toolchain.cmake ]; then \
+      printf '\n# Allow finding pre-built cargo dependencies via CMAKE_PREFIX_PATH\nset(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY BOTH)\nset(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE BOTH)\n' >> /opt/toolchain.cmake; \
+    fi
+
 # Relocate libstdc++ for musl targets that need it (TODO: investigate if still required)
 RUN if [ "$TARGET" = "arm-unknown-linux-musleabi" ]; then \
       LIBSTDC=/usr/local/arm-linux-musleabi/lib/libstdc++.a; \
diff --git a/scripts/cross/bootstrap-ubuntu.sh b/scripts/cross/bootstrap-ubuntu.sh
index 8068d1bcd3eb5..d89ea85f37ca5 100755
--- a/scripts/cross/bootstrap-ubuntu.sh
+++ b/scripts/cross/bootstrap-ubuntu.sh
@@ -1,31 +1,26 @@
 #!/bin/sh
 set -o errexit
 
-echo 'Acquire::Retries "5";' > /etc/apt/apt.conf.d/80-retries
-
-apt-get update
-apt-get install -y \
-  apt-transport-https \
-  gnupg \
-  wget
-
-# we need LLVM >= 3.9 for onig_sys/bindgen
-
-cat <<-EOF > /etc/apt/sources.list.d/llvm.list
-deb http://apt.llvm.org/xenial/ llvm-toolchain-xenial-9 main
-deb-src http://apt.llvm.org/xenial/ llvm-toolchain-xenial-9 main
+export DEBIAN_FRONTEND=noninteractive
+export ACCEPT_EULA=Y
+
+# Configure apt for speed and efficiency
+cat > /etc/apt/apt.conf.d/90-vector-optimizations <<EOF
+Acquire::Retries "5";
+Acquire::Queue-Mode "host";
+Acquire::Languages "none";
+APT::Install-Recommends "false";
 EOF
 
-wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key| apt-key add -
 
 apt-get update
-
-# unzip is needed for protoc
-# clang/llvm is needed due to bindgen (zstd-sys/onig_sys)
 apt-get install -y \
-      libclang1-9 \
-      llvm-9 \
-      clang \
-      unzip \
-      libsasl2-dev
+  apt-transport-https \
+  gnupg \
+  wget \
+  libclang1 \
+  llvm \
+  clang \
+  unzip \
+  libsasl2-dev
 

From 8790fa07177e93242395746b8328e2cd2e88b440 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 17 Apr 2026 13:32:34 -0400
Subject: [PATCH 139/326] chore(dev): split VERSION-dependent packaging targets
 into Makefile.packaging (#25101)

* chore(build): split VERSION-dependent packaging targets into Makefile.packaging

* fix(build): unset TRIPLE before delegating to main Makefile in packaging targets
---
 Makefile           | 113 ++-------------------------------------
 Makefile.packaging | 130 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 135 insertions(+), 108 deletions(-)
 create mode 100644 Makefile.packaging

diff --git a/Makefile b/Makefile
index 847a64069f61a..5421a62eed83e 100644
--- a/Makefile
+++ b/Makefile
@@ -77,9 +77,6 @@ endif
 export AWS_ACCESS_KEY_ID ?= "dummy"
 export AWS_SECRET_ACCESS_KEY ?= "dummy"
 
-# Set version
-export VERSION ?= $(shell command -v cargo >/dev/null && $(VDEV) version || echo unknown)
-
 # Set if you are on the CI and actually want the things to happen. (Non-CI users should never set this.)
 export CI ?= false
 
@@ -571,117 +568,17 @@ build-rustdoc: ## Build Vector's Rustdocs
 	# This command is mostly intended for use by the build process in vectordotdev/vector-rustdoc
 	${MAYBE_ENVIRONMENT_EXEC} cargo doc --no-deps --workspace
 
-##@ Packaging
+##@ Packaging (forwarded to Makefile.packaging)
 
-# archives
-target/artifacts/vector-${VERSION}-%.tar.gz: export TRIPLE :=$(@:target/artifacts/vector-${VERSION}-%.tar.gz=%)
-target/artifacts/vector-${VERSION}-%.tar.gz: override PROFILE =release
-target/artifacts/vector-${VERSION}-%.tar.gz: target/%/release/vector.tar.gz
-	@echo "Built to ${<}, relocating to ${@}"
-	@mkdir -p target/artifacts/
-	@cp -v \
-		${<} \
-		${@}
+# Packaging targets that depend on VERSION live in Makefile.packaging to avoid
+# running `cargo vdev version` when invoking non-packaging targets.
 
 .PHONY: package
 package: build ## Build the Vector archive
 	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) package archive
 
-.PHONY: package-x86_64-unknown-linux-gnu-all
-package-x86_64-unknown-linux-gnu-all: package-x86_64-unknown-linux-gnu package-deb-x86_64-unknown-linux-gnu package-rpm-x86_64-unknown-linux-gnu # .tar.gz, .deb, .rpm
-
-.PHONY: package-x86_64-unknown-linux-musl-all
-package-x86_64-unknown-linux-musl-all: package-x86_64-unknown-linux-musl # .tar.gz
-
-.PHONY: package-aarch64-unknown-linux-musl-all
-package-aarch64-unknown-linux-musl-all: package-aarch64-unknown-linux-musl # .tar.gz
-
-.PHONY: package-aarch64-unknown-linux-gnu-all
-package-aarch64-unknown-linux-gnu-all: package-aarch64-unknown-linux-gnu package-deb-aarch64 package-rpm-aarch64 # .tar.gz, .deb, .rpm
-
-.PHONY: package-armv7-unknown-linux-gnueabihf-all
-package-armv7-unknown-linux-gnueabihf-all: package-armv7-unknown-linux-gnueabihf package-deb-armv7-gnu package-rpm-armv7hl-gnu # .tar.gz, .deb, .rpm
-
-.PHONY: package-armv7-unknown-linux-musleabihf-all
-package-armv7-unknown-linux-musleabihf-all: package-armv7-unknown-linux-musleabihf # .tar.gz
-
-.PHONY: package-arm-unknown-linux-gnueabi-all
-package-arm-unknown-linux-gnueabi-all: package-arm-unknown-linux-gnueabi package-deb-arm-gnu # .tar.gz, .deb
-
-.PHONY: package-arm-unknown-linux-musleabi-all
-package-arm-unknown-linux-musleabi-all: package-arm-unknown-linux-musleabi # .tar.gz
-
-.PHONY: package-x86_64-unknown-linux-gnu
-package-x86_64-unknown-linux-gnu: target/artifacts/vector-${VERSION}-x86_64-unknown-linux-gnu.tar.gz ## Build an archive suitable for the `x86_64-unknown-linux-gnu` triple.
-	@echo "Output to ${<}."
-
-.PHONY: package-x86_64-unknown-linux-musl
-package-x86_64-unknown-linux-musl: target/artifacts/vector-${VERSION}-x86_64-unknown-linux-musl.tar.gz ## Build an archive suitable for the `x86_64-unknown-linux-musl` triple.
-	@echo "Output to ${<}."
-
-.PHONY: package-aarch64-unknown-linux-musl
-package-aarch64-unknown-linux-musl: target/artifacts/vector-${VERSION}-aarch64-unknown-linux-musl.tar.gz ## Build an archive suitable for the `aarch64-unknown-linux-musl` triple.
-	@echo "Output to ${<}."
-
-.PHONY: package-aarch64-unknown-linux-gnu
-package-aarch64-unknown-linux-gnu: target/artifacts/vector-${VERSION}-aarch64-unknown-linux-gnu.tar.gz ## Build an archive suitable for the `aarch64-unknown-linux-gnu` triple.
-	@echo "Output to ${<}."
-
-.PHONY: package-armv7-unknown-linux-gnueabihf
-package-armv7-unknown-linux-gnueabihf: target/artifacts/vector-${VERSION}-armv7-unknown-linux-gnueabihf.tar.gz ## Build an archive suitable for the `armv7-unknown-linux-gnueabihf` triple.
-	@echo "Output to ${<}."
-
-.PHONY: package-armv7-unknown-linux-musleabihf
-package-armv7-unknown-linux-musleabihf: target/artifacts/vector-${VERSION}-armv7-unknown-linux-musleabihf.tar.gz ## Build an archive suitable for the `armv7-unknown-linux-musleabihf triple.
-	@echo "Output to ${<}."
-
-.PHONY: package-arm-unknown-linux-gnueabi
-package-arm-unknown-linux-gnueabi: target/artifacts/vector-${VERSION}-arm-unknown-linux-gnueabi.tar.gz ## Build an archive suitable for the `arm-unknown-linux-gnueabi` triple.
-	@echo "Output to ${<}."
-
-.PHONY: package-arm-unknown-linux-musleabi
-package-arm-unknown-linux-musleabi: target/artifacts/vector-${VERSION}-arm-unknown-linux-musleabi.tar.gz ## Build an archive suitable for the `arm-unknown-linux-musleabi` triple.
-	@echo "Output to ${<}."
-
-# debs
-
-.PHONY: package-deb-x86_64-unknown-linux-gnu
-package-deb-x86_64-unknown-linux-gnu: package-x86_64-unknown-linux-gnu ## Build the x86_64 GNU deb package
-	TARGET=x86_64-unknown-linux-gnu $(VDEV) package deb
-
-.PHONY: package-deb-x86_64-unknown-linux-musl
-package-deb-x86_64-unknown-linux-musl: package-x86_64-unknown-linux-musl ## Build the x86_64 GNU deb package
-	TARGET=x86_64-unknown-linux-musl $(VDEV) package deb
-
-.PHONY: package-deb-aarch64
-package-deb-aarch64: package-aarch64-unknown-linux-gnu ## Build the aarch64 deb package
-	TARGET=aarch64-unknown-linux-gnu $(VDEV) package deb
-
-.PHONY: package-deb-armv7-gnu
-package-deb-armv7-gnu: package-armv7-unknown-linux-gnueabihf ## Build the armv7-unknown-linux-gnueabihf deb package
-	TARGET=armv7-unknown-linux-gnueabihf $(VDEV) package deb
-
-.PHONY: package-deb-arm-gnu
-package-deb-arm-gnu: package-arm-unknown-linux-gnueabi ## Build the arm-unknown-linux-gnueabi deb package
-	TARGET=arm-unknown-linux-gnueabi $(VDEV) package deb
-
-# rpms
-
-.PHONY: package-rpm-x86_64-unknown-linux-gnu
-package-rpm-x86_64-unknown-linux-gnu: package-x86_64-unknown-linux-gnu ## Build the x86_64 rpm package
-	TARGET=x86_64-unknown-linux-gnu $(VDEV) package rpm
-
-.PHONY: package-rpm-x86_64-unknown-linux-musl
-package-rpm-x86_64-unknown-linux-musl: package-x86_64-unknown-linux-musl ## Build the x86_64 musl rpm package
-	TARGET=x86_64-unknown-linux-musl $(VDEV) package rpm
-
-.PHONY: package-rpm-aarch64
-package-rpm-aarch64: package-aarch64-unknown-linux-gnu ## Build the aarch64 rpm package
-	TARGET=aarch64-unknown-linux-gnu $(VDEV) package rpm
-
-.PHONY: package-rpm-armv7hl-gnu
-package-rpm-armv7hl-gnu: package-armv7-unknown-linux-gnueabihf ## Build the armv7hl-unknown-linux-gnueabihf rpm package
-	TARGET=armv7-unknown-linux-gnueabihf ARCH=armv7hl $(VDEV) package rpm
+package-%:
+	$(MAKE) -f Makefile.packaging $@
 
 ##@ Releasing
 
diff --git a/Makefile.packaging b/Makefile.packaging
new file mode 100644
index 0000000000000..032e334094d19
--- /dev/null
+++ b/Makefile.packaging
@@ -0,0 +1,130 @@
+# Makefile.packaging
+#
+# Packaging and release targets for Vector.
+# Separated from the main Makefile so that `cargo vdev version` (needed for
+# VERSION) is only executed when packaging/release targets are invoked.
+#
+# Usage:
+#   make -f Makefile.packaging <target>
+#
+# These targets are also accessible via the main Makefile, which forwards
+# packaging and release targets here automatically.
+
+VDEV := cargo vdev
+
+# Set version — only evaluated when this Makefile is loaded
+export VERSION ?= $(shell command -v cargo >/dev/null && $(VDEV) version || echo unknown)
+
+# Delegate cross-compilation prerequisites to the main Makefile
+target/%/release/vector.tar.gz:
+	unset TRIPLE && $(MAKE) $@
+
+##@ Packaging
+
+# archives
+target/artifacts/vector-${VERSION}-%.tar.gz: export TRIPLE :=$(@:target/artifacts/vector-${VERSION}-%.tar.gz=%)
+target/artifacts/vector-${VERSION}-%.tar.gz: override PROFILE =release
+target/artifacts/vector-${VERSION}-%.tar.gz: target/%/release/vector.tar.gz
+	@echo "Built to ${<}, relocating to ${@}"
+	@mkdir -p target/artifacts/
+	@cp -v \
+		${<} \
+		${@}
+
+.PHONY: package-x86_64-unknown-linux-gnu-all
+package-x86_64-unknown-linux-gnu-all: package-x86_64-unknown-linux-gnu package-deb-x86_64-unknown-linux-gnu package-rpm-x86_64-unknown-linux-gnu # .tar.gz, .deb, .rpm
+
+.PHONY: package-x86_64-unknown-linux-musl-all
+package-x86_64-unknown-linux-musl-all: package-x86_64-unknown-linux-musl # .tar.gz
+
+.PHONY: package-aarch64-unknown-linux-musl-all
+package-aarch64-unknown-linux-musl-all: package-aarch64-unknown-linux-musl # .tar.gz
+
+.PHONY: package-aarch64-unknown-linux-gnu-all
+package-aarch64-unknown-linux-gnu-all: package-aarch64-unknown-linux-gnu package-deb-aarch64 package-rpm-aarch64 # .tar.gz, .deb, .rpm
+
+.PHONY: package-armv7-unknown-linux-gnueabihf-all
+package-armv7-unknown-linux-gnueabihf-all: package-armv7-unknown-linux-gnueabihf package-deb-armv7-gnu package-rpm-armv7hl-gnu # .tar.gz, .deb, .rpm
+
+.PHONY: package-armv7-unknown-linux-musleabihf-all
+package-armv7-unknown-linux-musleabihf-all: package-armv7-unknown-linux-musleabihf # .tar.gz
+
+.PHONY: package-arm-unknown-linux-gnueabi-all
+package-arm-unknown-linux-gnueabi-all: package-arm-unknown-linux-gnueabi package-deb-arm-gnu # .tar.gz, .deb
+
+.PHONY: package-arm-unknown-linux-musleabi-all
+package-arm-unknown-linux-musleabi-all: package-arm-unknown-linux-musleabi # .tar.gz
+
+.PHONY: package-x86_64-unknown-linux-gnu
+package-x86_64-unknown-linux-gnu: target/artifacts/vector-${VERSION}-x86_64-unknown-linux-gnu.tar.gz ## Build an archive suitable for the `x86_64-unknown-linux-gnu` triple.
+	@echo "Output to ${<}."
+
+.PHONY: package-x86_64-unknown-linux-musl
+package-x86_64-unknown-linux-musl: target/artifacts/vector-${VERSION}-x86_64-unknown-linux-musl.tar.gz ## Build an archive suitable for the `x86_64-unknown-linux-musl` triple.
+	@echo "Output to ${<}."
+
+.PHONY: package-aarch64-unknown-linux-musl
+package-aarch64-unknown-linux-musl: target/artifacts/vector-${VERSION}-aarch64-unknown-linux-musl.tar.gz ## Build an archive suitable for the `aarch64-unknown-linux-musl` triple.
+	@echo "Output to ${<}."
+
+.PHONY: package-aarch64-unknown-linux-gnu
+package-aarch64-unknown-linux-gnu: target/artifacts/vector-${VERSION}-aarch64-unknown-linux-gnu.tar.gz ## Build an archive suitable for the `aarch64-unknown-linux-gnu` triple.
+	@echo "Output to ${<}."
+
+.PHONY: package-armv7-unknown-linux-gnueabihf
+package-armv7-unknown-linux-gnueabihf: target/artifacts/vector-${VERSION}-armv7-unknown-linux-gnueabihf.tar.gz ## Build an archive suitable for the `armv7-unknown-linux-gnueabihf` triple.
+	@echo "Output to ${<}."
+
+.PHONY: package-armv7-unknown-linux-musleabihf
+package-armv7-unknown-linux-musleabihf: target/artifacts/vector-${VERSION}-armv7-unknown-linux-musleabihf.tar.gz ## Build an archive suitable for the `armv7-unknown-linux-musleabihf triple.
+	@echo "Output to ${<}."
+
+.PHONY: package-arm-unknown-linux-gnueabi
+package-arm-unknown-linux-gnueabi: target/artifacts/vector-${VERSION}-arm-unknown-linux-gnueabi.tar.gz ## Build an archive suitable for the `arm-unknown-linux-gnueabi` triple.
+	@echo "Output to ${<}."
+
+.PHONY: package-arm-unknown-linux-musleabi
+package-arm-unknown-linux-musleabi: target/artifacts/vector-${VERSION}-arm-unknown-linux-musleabi.tar.gz ## Build an archive suitable for the `arm-unknown-linux-musleabi` triple.
+	@echo "Output to ${<}."
+
+# debs
+
+.PHONY: package-deb-x86_64-unknown-linux-gnu
+package-deb-x86_64-unknown-linux-gnu: package-x86_64-unknown-linux-gnu ## Build the x86_64 GNU deb package
+	TARGET=x86_64-unknown-linux-gnu $(VDEV) package deb
+
+.PHONY: package-deb-x86_64-unknown-linux-musl
+package-deb-x86_64-unknown-linux-musl: package-x86_64-unknown-linux-musl ## Build the x86_64 GNU deb package
+	TARGET=x86_64-unknown-linux-musl $(VDEV) package deb
+
+.PHONY: package-deb-aarch64
+package-deb-aarch64: package-aarch64-unknown-linux-gnu ## Build the aarch64 deb package
+	TARGET=aarch64-unknown-linux-gnu $(VDEV) package deb
+
+.PHONY: package-deb-armv7-gnu
+package-deb-armv7-gnu: package-armv7-unknown-linux-gnueabihf ## Build the armv7-unknown-linux-gnueabihf deb package
+	TARGET=armv7-unknown-linux-gnueabihf $(VDEV) package deb
+
+.PHONY: package-deb-arm-gnu
+package-deb-arm-gnu: package-arm-unknown-linux-gnueabi ## Build the arm-unknown-linux-gnueabi deb package
+	TARGET=arm-unknown-linux-gnueabi $(VDEV) package deb
+
+# rpms
+
+.PHONY: package-rpm-x86_64-unknown-linux-gnu
+package-rpm-x86_64-unknown-linux-gnu: package-x86_64-unknown-linux-gnu ## Build the x86_64 rpm package
+	TARGET=x86_64-unknown-linux-gnu $(VDEV) package rpm
+
+.PHONY: package-rpm-x86_64-unknown-linux-musl
+package-rpm-x86_64-unknown-linux-musl: package-x86_64-unknown-linux-musl ## Build the x86_64 musl rpm package
+	TARGET=x86_64-unknown-linux-musl $(VDEV) package rpm
+
+.PHONY: package-rpm-aarch64
+package-rpm-aarch64: package-aarch64-unknown-linux-gnu ## Build the aarch64 rpm package
+	TARGET=aarch64-unknown-linux-gnu $(VDEV) package rpm
+
+.PHONY: package-rpm-armv7hl-gnu
+package-rpm-armv7hl-gnu: package-armv7-unknown-linux-gnueabihf ## Build the armv7hl-unknown-linux-gnueabihf rpm package
+	TARGET=armv7-unknown-linux-gnueabihf ARCH=armv7hl $(VDEV) package rpm
+
+

From 35351b9cc9ae7dffdf1a461203137905f987a8b5 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 17 Apr 2026 17:22:12 -0400
Subject: [PATCH 140/326] chore(codecs): replace native encoding fixture patch
 files with cfg-gated code (#24971)

* cfg-gate fixture generating code

* Use generate-fixtures vrl branch

* Move fixture generation into its own binary and use a set SEED

* Gate from_size_and_seed behind generate-fixtures

* Remove vrl_generate_fixtures.patch

* Format

* Fix clippy warnings

* Fix markdown

* Format again

* fix(codecs): normalize -0.0 after rounding in fixture generation

* chore(deps): update vrl dependency to main branch

* Update VRL

* fix(ci): enable vrl-functions-crypto for http-client integration tests

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 Cargo.lock                                    |  19 +-
 Cargo.toml                                    |   2 +-
 .../tests/data/native_encoding/README.md      |  31 ++--
 .../vector_generate_fixtures.patch            | 163 ------------------
 .../vrl_generate_fixtures.patch               |  69 --------
 lib/vector-core/Cargo.toml                    |   7 +
 lib/vector-core/src/bin/generate_fixtures.rs  |  38 ++++
 .../{test/common.rs => arbitrary_impl.rs}     |  52 ++++--
 lib/vector-core/src/event/metric/tags.rs      |   4 +-
 lib/vector-core/src/event/mod.rs              |   3 +
 lib/vector-core/src/event/test/mod.rs         |   1 -
 .../src/event/test/serialization.rs           |   5 +-
 lib/vector-core/src/event/test/size_of.rs     |   3 +-
 lib/vector-core/src/metrics/ddsketch.rs       |  11 ++
 14 files changed, 130 insertions(+), 278 deletions(-)
 delete mode 100644 lib/codecs/tests/data/native_encoding/vector_generate_fixtures.patch
 delete mode 100644 lib/codecs/tests/data/native_encoding/vrl_generate_fixtures.patch
 create mode 100644 lib/vector-core/src/bin/generate_fixtures.rs
 rename lib/vector-core/src/event/{test/common.rs => arbitrary_impl.rs} (91%)

diff --git a/Cargo.lock b/Cargo.lock
index 2d641cc2a2934..3215e97f0fd44 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1781,7 +1781,7 @@ dependencies = [
  "bitflags 2.10.0",
  "cexpr",
  "clang-sys",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "regex",
@@ -8251,7 +8251,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22505a5c94da8e3b7c2996394d1c933236c4d743e81a410bcca4e6989fc066a4"
 dependencies = [
  "bytes",
- "heck 0.4.1",
+ "heck 0.5.0",
  "itertools 0.12.1",
  "log",
  "multimap",
@@ -8271,8 +8271,8 @@ version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
- "heck 0.4.1",
- "itertools 0.14.0",
+ "heck 0.5.0",
+ "itertools 0.10.5",
  "log",
  "multimap",
  "once_cell",
@@ -8318,7 +8318,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "syn 2.0.117",
@@ -10323,7 +10323,7 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
- "heck 0.4.1",
+ "heck 0.5.0",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "syn 2.0.117",
@@ -10335,7 +10335,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54254b8531cafa275c5e096f62d48c81435d1015405a91198ddb11e967301d40"
 dependencies = [
- "heck 0.4.1",
+ "heck 0.5.0",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "syn 2.0.117",
@@ -12932,7 +12932,7 @@ checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 [[package]]
 name = "vrl"
 version = "0.31.0"
-source = "git+https://github.com/vectordotdev/vrl.git?branch=main#d21e53192e6a3ed3d38ef6f32886f1cbf30d308c"
+source = "git+https://github.com/vectordotdev/vrl.git?branch=main#1357941d4481e84fb0323bd89c69cedf35c323f8"
 dependencies = [
  "aes",
  "aes-siv",
@@ -12966,6 +12966,7 @@ dependencies = [
  "exitcode",
  "fancy-regex",
  "flate2",
+ "getrandom 0.3.4",
  "grok",
  "hex",
  "hmac",
@@ -13005,7 +13006,7 @@ dependencies = [
  "publicsuffix",
  "quickcheck",
  "quoted_printable",
- "rand 0.8.5",
+ "rand 0.9.4",
  "regex",
  "relative-path 2.0.1",
  "reqwest 0.12.28",
diff --git a/Cargo.toml b/Cargo.toml
index 84ded822b5790..03aff35ec8c13 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1031,7 +1031,7 @@ gcp-integration-tests = ["sinks-gcp"]
 gcp-pubsub-integration-tests = ["sinks-gcp", "sources-gcp_pubsub"]
 greptimedb-integration-tests = ["sinks-greptimedb_metrics", "sinks-greptimedb_logs"]
 humio-integration-tests = ["sinks-humio"]
-http-client-integration-tests = ["sources-http_client"]
+http-client-integration-tests = ["sources-http_client", "vrl-functions-crypto"]
 influxdb-integration-tests = ["sinks-influxdb"]
 kafka-integration-tests = ["sinks-kafka", "sources-kafka"]
 logstash-integration-tests = ["docker", "sources-logstash"]
diff --git a/lib/codecs/tests/data/native_encoding/README.md b/lib/codecs/tests/data/native_encoding/README.md
index 0a84c98043c41..2cf2aaba974be 100644
--- a/lib/codecs/tests/data/native_encoding/README.md
+++ b/lib/codecs/tests/data/native_encoding/README.md
@@ -6,28 +6,23 @@ and we test that all the examples can be successfully parsed, parse the same
 across both formats, and match the current serialized format.
 
 In order to avoid small inherent serialization differences between JSON and
-protobuf (e.g. float handling), some changes were made to the `Arbitrary`
-implementation for `Event` to give simpler values. These are not changes we want
-in most property testing scenarios, but they are appropriate in this case where
-we only care about the overall structure of the events.
+protobuf (e.g. float handling), the `generate-fixtures` feature flag in
+`vector-core` activates a stricter `Arbitrary` implementation for `Event` that
+produces simpler, round-trip-safe f64 values and non-empty field names. These
+changes are intentionally scoped to fixture generation and not used in regular
+property testing.
 
-There is currently a multi-step procedure to re-generate the data files.
-There are two diffs committed to this directory:
-    - `vector_generate_fixtures.patch`
-    - `vrl_generate_fixtures.patch`
+## Re-generating fixtures
 
-The `vrl_` one must be applied to the vectordotdev/vrl repo.
-The `vector_` one must be applied to the vector repo (you are here).
+Both this repo and the VRL repo have a `generate-fixtures` feature flag that
+activates fixture-stable `Arbitrary` implementations. The vector-core
+`generate-fixtures` feature automatically enables `vrl/generate-fixtures`.
 
-Part of the vector patch file is a `roundtrip` unit test definition that needs
-to be evoked from `lib/vector-core`. Before invoking it, the `_json` and `_proto`
-directories need to be created.
+### Run the generator
 
 ```bash
-    $ cd lib/vector-core
-    $ mkdir _json/ proto/
-    $ cargo test event::test::serialization::roundtrip
+cargo run -p vector-core --features generate-fixtures --bin generate-fixtures
 ```
 
-That test case writes out the appropriate files into the dirs, which then need to be
-moved to their location here.
+The binary writes files directly into this directory's `json/` and `proto/`
+subdirectories, replacing the existing fixtures.
diff --git a/lib/codecs/tests/data/native_encoding/vector_generate_fixtures.patch b/lib/codecs/tests/data/native_encoding/vector_generate_fixtures.patch
deleted file mode 100644
index a0262928b3b3b..0000000000000
--- a/lib/codecs/tests/data/native_encoding/vector_generate_fixtures.patch
+++ /dev/null
@@ -1,163 +0,0 @@
-diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
-index 0f51fc830..aadf99841 100644
---- a/lib/vector-core/Cargo.toml
-+++ b/lib/vector-core/Cargo.toml
-@@ -95,7 +95,7 @@ rand = "0.8.5"
- rand_distr = "0.4.3"
- tracing-subscriber = { version = "0.3.17", default-features = false, features = ["env-filter", "fmt", "ansi", "registry"] }
- vector-common = { path = "../vector-common", default-features = false, features = ["test"] }
--vrl = { version = "0.9.0", features = ["cli", "test", "test_framework", "arbitrary"] }
-+vrl = { path = "../../../vrl", features = ["cli", "test", "test_framework", "arbitrary"] }
- 
- [features]
- api = ["dep:async-graphql"]
-diff --git a/lib/vector-core/src/event/test/common.rs b/lib/vector-core/src/event/test/common.rs
-index c7ccca952..f851288ce 100644
---- a/lib/vector-core/src/event/test/common.rs
-+++ b/lib/vector-core/src/event/test/common.rs
-@@ -26,6 +26,15 @@ const ALPHABET: [&str; 27] = [
-     "t", "u", "v", "w", "x", "y", "z", "_",
- ];
- 
-+fn make_simple_f64(g: &mut Gen) -> f64 {
-+    let mut value = f64::arbitrary(g) % MAX_F64_SIZE;
-+    while value.is_nan() || value == -0.0 {
-+        value = f64::arbitrary(g) % MAX_F64_SIZE;
-+    }
-+    value = (value * 10_000.0).round() / 10_000.0;
-+    value
-+}
-+
- #[derive(Debug, Clone)]
- pub struct Name {
-     inner: String,
-@@ -34,7 +43,7 @@ pub struct Name {
- impl Arbitrary for Name {
-     fn arbitrary(g: &mut Gen) -> Self {
-         let mut name = String::with_capacity(MAX_STR_SIZE);
--        for _ in 0..(g.size() % MAX_STR_SIZE) {
-+        for _ in 0..(usize::max(1, g.size() % MAX_STR_SIZE)) {
-             let idx: usize = usize::arbitrary(g) % ALPHABET.len();
-             name.push_str(ALPHABET[idx]);
-         }
-@@ -182,10 +191,10 @@ impl Arbitrary for MetricValue {
-         // here toward `MetricValue::Counter` and `MetricValue::Gauge`.
-         match u8::arbitrary(g) % 7 {
-             0 => MetricValue::Counter {
--                value: f64::arbitrary(g) % MAX_F64_SIZE,
-+                value: make_simple_f64(g),
-             },
-             1 => MetricValue::Gauge {
--                value: f64::arbitrary(g) % MAX_F64_SIZE,
-+                value: make_simple_f64(g),
-             },
-             2 => MetricValue::Set {
-                 values: BTreeSet::arbitrary(g),
-@@ -197,19 +206,20 @@ impl Arbitrary for MetricValue {
-             4 => MetricValue::AggregatedHistogram {
-                 buckets: Vec::arbitrary(g),
-                 count: u64::arbitrary(g),
--                sum: f64::arbitrary(g) % MAX_F64_SIZE,
-+                sum: make_simple_f64(g),
-             },
-             5 => MetricValue::AggregatedSummary {
-                 quantiles: Vec::arbitrary(g),
-                 count: u64::arbitrary(g),
--                sum: f64::arbitrary(g) % MAX_F64_SIZE,
-+                sum: make_simple_f64(g),
-             },
-             6 => {
-                 // We're working around quickcheck's limitations here, and
-                 // should really migrate the tests in question to use proptest
-                 let num_samples = u8::arbitrary(g);
-                 let samples = std::iter::repeat_with(|| loop {
--                    let f = f64::arbitrary(g);
-+                    // let f = f64::arbitrary(g);
-+                    let f = make_simple_f64(g);
-                     if f.is_normal() {
-                         return f;
-                     }
-@@ -219,6 +229,8 @@ impl Arbitrary for MetricValue {
- 
-                 let mut sketch = AgentDDSketch::with_agent_defaults();
-                 sketch.insert_many(&samples);
-+                sketch.sum = make_simple_f64(g);
-+                sketch.avg = make_simple_f64(g);
- 
-                 MetricValue::Sketch {
-                     sketch: MetricSketch::AgentDDSketch(sketch),
-@@ -368,7 +380,7 @@ impl Arbitrary for MetricValue {
- impl Arbitrary for Sample {
-     fn arbitrary(g: &mut Gen) -> Self {
-         Sample {
--            value: f64::arbitrary(g) % MAX_F64_SIZE,
-+            value: make_simple_f64(g),
-             rate: u32::arbitrary(g),
-         }
-     }
-@@ -398,8 +410,8 @@ impl Arbitrary for Sample {
- impl Arbitrary for Quantile {
-     fn arbitrary(g: &mut Gen) -> Self {
-         Quantile {
--            quantile: f64::arbitrary(g) % MAX_F64_SIZE,
--            value: f64::arbitrary(g) % MAX_F64_SIZE,
-+            quantile: make_simple_f64(g),
-+            value: make_simple_f64(g),
-         }
-     }
- 
-@@ -428,7 +440,7 @@ impl Arbitrary for Quantile {
- impl Arbitrary for Bucket {
-     fn arbitrary(g: &mut Gen) -> Self {
-         Bucket {
--            upper_limit: f64::arbitrary(g) % MAX_F64_SIZE,
-+            upper_limit: make_simple_f64(g),
-             count: u64::arbitrary(g),
-         }
-     }
-diff --git a/lib/vector-core/src/event/test/serialization.rs b/lib/vector-core/src/event/test/serialization.rs
-index aaab559da..5db6c0613 100644
---- a/lib/vector-core/src/event/test/serialization.rs
-+++ b/lib/vector-core/src/event/test/serialization.rs
-@@ -96,3 +96,24 @@ fn type_serialization() {
-     assert_eq!(map["bool"], json!(true));
-     assert_eq!(map["string"], json!("thisisastring"));
- }
-+
-+#[test]
-+fn roundtrip() {
-+    use prost::Message;
-+    use quickcheck::{Arbitrary, Gen};
-+    use std::{fs::File, io::Write};
-+
-+    let mut gen = Gen::new(128);
-+    for n in 0..1024 {
-+        let mut json_out = File::create(format!("_json/{n:04}.json")).unwrap();
-+        let mut proto_out = File::create(format!("_proto/{n:04}.pb")).unwrap();
-+        let event = Event::arbitrary(&mut gen);
-+        serde_json::to_writer(&mut json_out, &event).unwrap();
-+
-+        let array = EventArray::from(event);
-+        let proto = proto::EventArray::from(array);
-+        let mut buf = BytesMut::new();
-+        proto.encode(&mut buf).unwrap();
-+        proto_out.write_all(&buf).unwrap();
-+    }
-+}
-diff --git a/lib/vector-core/src/metrics/ddsketch.rs b/lib/vector-core/src/metrics/ddsketch.rs
-index 3d0f80bb5..fcc6bcc97 100644
---- a/lib/vector-core/src/metrics/ddsketch.rs
-+++ b/lib/vector-core/src/metrics/ddsketch.rs
-@@ -229,10 +229,10 @@ pub struct AgentDDSketch {
-     max: f64,
- 
-     /// The sum of all observations within the sketch.
--    sum: f64,
-+    pub sum: f64,
- 
-     /// The average value of all observations within the sketch.
--    avg: f64,
-+    pub avg: f64,
- }
- 
- impl AgentDDSketch {
diff --git a/lib/codecs/tests/data/native_encoding/vrl_generate_fixtures.patch b/lib/codecs/tests/data/native_encoding/vrl_generate_fixtures.patch
deleted file mode 100644
index 430b74abb8b66..0000000000000
--- a/lib/codecs/tests/data/native_encoding/vrl_generate_fixtures.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-diff --git a/src/lib.rs b/src/lib.rs
-index 29cad8dfc..0b166beb2 100644
---- a/src/lib.rs
-+++ b/src/lib.rs
-@@ -1,4 +1,4 @@
--#![deny(warnings)]
-+// #![deny(warnings)]
- #![deny(clippy::all)]
- #![deny(unused_allocation)]
- #![deny(unused_extern_crates)]
-diff --git a/src/value/value/arbitrary.rs b/src/value/value/arbitrary.rs
-index dde213281..33b2f2518 100644
---- a/src/value/value/arbitrary.rs
-+++ b/src/value/value/arbitrary.rs
-@@ -1,7 +1,6 @@
- use std::collections::BTreeMap;
- 
- use bytes::Bytes;
--use chrono::{DateTime, NaiveDateTime, Utc};
- use ordered_float::NotNan;
- use quickcheck::{Arbitrary, Gen};
- 
-@@ -11,16 +10,13 @@ const MAX_ARRAY_SIZE: usize = 4;
- const MAX_MAP_SIZE: usize = 4;
- const MAX_F64_SIZE: f64 = 1_000_000.0;
- 
--fn datetime(g: &mut Gen) -> DateTime<Utc> {
--    // `chrono` documents that there is an out-of-range for both second and
--    // nanosecond values but doesn't actually document what the valid ranges
--    // are. We just sort of arbitrarily restrict things.
--    let secs = i64::arbitrary(g) % 32_000;
--    let nanosecs = u32::arbitrary(g) % 32_000;
--    DateTime::<Utc>::from_utc(
--        NaiveDateTime::from_timestamp_opt(secs, nanosecs).expect("invalid timestamp"),
--        Utc,
--    )
-+fn make_simple_f64(g: &mut Gen) -> f64 {
-+    let mut value = f64::arbitrary(g) % MAX_F64_SIZE;
-+    while value.is_nan() || value == -0.0 {
-+        value = f64::arbitrary(g) % MAX_F64_SIZE;
-+    }
-+    value = (value * 10_000.0).round() / 10_000.0;
-+    value
- }
- 
- impl Arbitrary for Value {
-@@ -32,18 +28,18 @@ impl Arbitrary for Value {
-         // field picking.
-         match u8::arbitrary(g) % 8 {
-             0 => {
--                let bytes: Vec<u8> = Vec::arbitrary(g);
-+                let bytes = String::arbitrary(g);
-                 Self::Bytes(Bytes::from(bytes))
-             }
-             1 => Self::Integer(i64::arbitrary(g)),
-             2 => {
--                let f = f64::arbitrary(g) % MAX_F64_SIZE;
-+                //let f = f64::arbitrary(g) % MAX_F64_SIZE;
-+                let f = make_simple_f64(g);
-                 let not_nan = NotNan::new(f).unwrap_or_else(|_| NotNan::new(0.0).unwrap());
-                 Self::from(not_nan)
-             }
-             3 => Self::Boolean(bool::arbitrary(g)),
--            4 => Self::Timestamp(datetime(g)),
--            5 => {
-+            4 | 5 => {
-                 let mut gen = Gen::new(MAX_MAP_SIZE);
-                 Self::Object(BTreeMap::arbitrary(&mut gen))
-             }
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index 8a512884b2c32..7d2d8f8979266 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -65,6 +65,7 @@ vector-config = { path = "../vector-config" }
 vector-config-common = { path = "../vector-config-common" }
 vrl.workspace = true
 cfg-if.workspace = true
+quickcheck = { workspace = true, optional = true }
 
 [target.'cfg(target_os = "macos")'.dependencies]
 security-framework = "3.6.0"
@@ -100,6 +101,12 @@ default = []
 lua = ["dep:mlua", "dep:tokio-stream", "vrl/lua"]
 vrl = []
 test = ["vector-common/test", "proptest"]
+generate-fixtures = ["vrl/generate-fixtures", "dep:quickcheck"]
+
+[[bin]]
+name = "generate-fixtures"
+path = "src/bin/generate_fixtures.rs"
+required-features = ["generate-fixtures"]
 
 [[bench]]
 name = "event"
diff --git a/lib/vector-core/src/bin/generate_fixtures.rs b/lib/vector-core/src/bin/generate_fixtures.rs
new file mode 100644
index 0000000000000..9ab133757bbf8
--- /dev/null
+++ b/lib/vector-core/src/bin/generate_fixtures.rs
@@ -0,0 +1,38 @@
+use std::{fs::File, io::Write, path::PathBuf};
+
+use bytes::BytesMut;
+use prost::Message;
+use quickcheck::{Arbitrary as _, Gen};
+use vector_core::event::{Event, EventArray, proto};
+
+const SEED: u64 = 0;
+const GEN_SIZE: usize = 128;
+
+fn main() {
+    let fixture_dir =
+        PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../codecs/tests/data/native_encoding");
+    let json_dir = fixture_dir.join("json");
+    let proto_dir = fixture_dir.join("proto");
+    std::fs::create_dir_all(&json_dir).unwrap();
+    std::fs::create_dir_all(&proto_dir).unwrap();
+
+    let mut rng = Gen::from_size_and_seed(GEN_SIZE, SEED);
+    for n in 0..1024_usize {
+        let event = Event::arbitrary(&mut rng);
+
+        let mut json_out = File::create(json_dir.join(format!("{n:04}.json"))).unwrap();
+        serde_json::to_writer(&mut json_out, &event).unwrap();
+
+        let mut proto_out = File::create(proto_dir.join(format!("{n:04}.pb"))).unwrap();
+        let mut buf = BytesMut::new();
+        proto::EventArray::from(EventArray::from(event))
+            .encode(&mut buf)
+            .unwrap();
+        proto_out.write_all(&buf).unwrap();
+    }
+
+    #[allow(clippy::print_stdout)]
+    {
+        println!("Written 1024 fixtures to {}", fixture_dir.display());
+    }
+}
diff --git a/lib/vector-core/src/event/test/common.rs b/lib/vector-core/src/event/arbitrary_impl.rs
similarity index 91%
rename from lib/vector-core/src/event/test/common.rs
rename to lib/vector-core/src/event/arbitrary_impl.rs
index ab9460a7fa90f..fe02b846aa9b2 100644
--- a/lib/vector-core/src/event/test/common.rs
+++ b/lib/vector-core/src/event/arbitrary_impl.rs
@@ -4,7 +4,7 @@ use chrono::{DateTime, Utc};
 use quickcheck::{Arbitrary, Gen, empty_shrinker};
 use vrl::value::{ObjectMap, Value};
 
-use super::super::{
+use super::{
     Event, EventMetadata, LogEvent, Metric, MetricKind, MetricValue, StatisticKind, TraceEvent,
     metric::{
         Bucket, MetricData, MetricName, MetricSeries, MetricSketch, MetricTags, MetricTime,
@@ -21,6 +21,27 @@ const ALPHABET: [&str; 27] = [
     "t", "u", "v", "w", "x", "y", "z", "_",
 ];
 
+// When generating fixtures we need f64 values that survive a JSON round-trip
+// without any loss of precision or serialization ambiguity (NaN, -0.0).
+// Under the `generate-fixtures` feature the helper produces clean values;
+// otherwise it falls back to the standard quickcheck approach.
+fn f64_for_arbitrary(g: &mut Gen) -> f64 {
+    #[cfg(feature = "generate-fixtures")]
+    {
+        let mut value = f64::arbitrary(g) % MAX_F64_SIZE;
+        while value.is_nan() || value == -0.0 {
+            value = f64::arbitrary(g) % MAX_F64_SIZE;
+        }
+        let rounded = (value * 10_000.0).round() / 10_000.0;
+        // Rounding can produce -0.0 from small negatives; normalize to +0.0.
+        if rounded == -0.0_f64 { 0.0 } else { rounded }
+    }
+    #[cfg(not(feature = "generate-fixtures"))]
+    {
+        f64::arbitrary(g) % MAX_F64_SIZE
+    }
+}
+
 #[derive(Debug, Clone)]
 pub struct Name {
     inner: String,
@@ -29,7 +50,11 @@ pub struct Name {
 impl Arbitrary for Name {
     fn arbitrary(g: &mut Gen) -> Self {
         let mut name = String::with_capacity(MAX_STR_SIZE);
-        for _ in 0..(g.size() % MAX_STR_SIZE) {
+        #[cfg(feature = "generate-fixtures")]
+        let len = usize::max(1, g.size() % MAX_STR_SIZE);
+        #[cfg(not(feature = "generate-fixtures"))]
+        let len = g.size() % MAX_STR_SIZE;
+        for _ in 0..len {
             let idx: usize = usize::arbitrary(g) % ALPHABET.len();
             name.push_str(ALPHABET[idx]);
         }
@@ -76,6 +101,9 @@ impl Arbitrary for Event {
 
 impl Arbitrary for LogEvent {
     fn arbitrary(g: &mut Gen) -> Self {
+        #[cfg(feature = "generate-fixtures")]
+        let mut generator = Gen::from_size_and_seed(MAX_MAP_SIZE, u64::arbitrary(g));
+        #[cfg(not(feature = "generate-fixtures"))]
         let mut generator = Gen::new(MAX_MAP_SIZE);
         let map: ObjectMap = ObjectMap::arbitrary(&mut generator);
         let metadata: EventMetadata = EventMetadata::arbitrary(g);
@@ -175,10 +203,10 @@ impl Arbitrary for MetricValue {
         // here toward `MetricValue::Counter` and `MetricValue::Gauge`.
         match u8::arbitrary(g) % 7 {
             0 => MetricValue::Counter {
-                value: f64::arbitrary(g) % MAX_F64_SIZE,
+                value: f64_for_arbitrary(g),
             },
             1 => MetricValue::Gauge {
-                value: f64::arbitrary(g) % MAX_F64_SIZE,
+                value: f64_for_arbitrary(g),
             },
             2 => MetricValue::Set {
                 values: BTreeSet::arbitrary(g),
@@ -190,12 +218,12 @@ impl Arbitrary for MetricValue {
             4 => MetricValue::AggregatedHistogram {
                 buckets: Vec::arbitrary(g),
                 count: u64::arbitrary(g),
-                sum: f64::arbitrary(g) % MAX_F64_SIZE,
+                sum: f64_for_arbitrary(g),
             },
             5 => MetricValue::AggregatedSummary {
                 quantiles: Vec::arbitrary(g),
                 count: u64::arbitrary(g),
-                sum: f64::arbitrary(g) % MAX_F64_SIZE,
+                sum: f64_for_arbitrary(g),
             },
             6 => {
                 // We're working around quickcheck's limitations here, and
@@ -203,7 +231,7 @@ impl Arbitrary for MetricValue {
                 let num_samples = u8::arbitrary(g);
                 let samples = std::iter::repeat_with(|| {
                     loop {
-                        let f = f64::arbitrary(g);
+                        let f = f64_for_arbitrary(g);
                         if f.is_normal() {
                             return f;
                         }
@@ -214,6 +242,8 @@ impl Arbitrary for MetricValue {
 
                 let mut sketch = AgentDDSketch::with_agent_defaults();
                 sketch.insert_many(&samples);
+                #[cfg(feature = "generate-fixtures")]
+                sketch.set_sum_avg(f64_for_arbitrary(g), f64_for_arbitrary(g));
 
                 MetricValue::Sketch {
                     sketch: MetricSketch::AgentDDSketch(sketch),
@@ -363,7 +393,7 @@ impl Arbitrary for MetricValue {
 impl Arbitrary for Sample {
     fn arbitrary(g: &mut Gen) -> Self {
         Sample {
-            value: f64::arbitrary(g) % MAX_F64_SIZE,
+            value: f64_for_arbitrary(g),
             rate: u32::arbitrary(g),
         }
     }
@@ -393,8 +423,8 @@ impl Arbitrary for Sample {
 impl Arbitrary for Quantile {
     fn arbitrary(g: &mut Gen) -> Self {
         Quantile {
-            quantile: f64::arbitrary(g) % MAX_F64_SIZE,
-            value: f64::arbitrary(g) % MAX_F64_SIZE,
+            quantile: f64_for_arbitrary(g),
+            value: f64_for_arbitrary(g),
         }
     }
 
@@ -423,7 +453,7 @@ impl Arbitrary for Quantile {
 impl Arbitrary for Bucket {
     fn arbitrary(g: &mut Gen) -> Self {
         Bucket {
-            upper_limit: f64::arbitrary(g) % MAX_F64_SIZE,
+            upper_limit: f64_for_arbitrary(g),
             count: u64::arbitrary(g),
         }
     }
diff --git a/lib/vector-core/src/event/metric/tags.rs b/lib/vector-core/src/event/metric/tags.rs
index 416f239af5ab5..52c9a365d2534 100644
--- a/lib/vector-core/src/event/metric/tags.rs
+++ b/lib/vector-core/src/event/metric/tags.rs
@@ -603,13 +603,13 @@ impl ByteSizeOf for MetricTags {
     }
 }
 
-#[cfg(test)]
+#[cfg(any(test, feature = "generate-fixtures"))]
 mod test_support {
     use std::collections::HashSet;
 
     use quickcheck::{Arbitrary, Gen};
 
-    use super::*;
+    use super::{BTreeMap, MetricTags, TagValue, TagValueSet};
 
     impl Arbitrary for TagValue {
         fn arbitrary(g: &mut Gen) -> Self {
diff --git a/lib/vector-core/src/event/mod.rs b/lib/vector-core/src/event/mod.rs
index 9d72301e85804..e70ebc4335c9d 100644
--- a/lib/vector-core/src/event/mod.rs
+++ b/lib/vector-core/src/event/mod.rs
@@ -23,6 +23,8 @@ pub use vrl_target::{TargetEvents, VrlTarget};
 
 use crate::config::{LogNamespace, OutputId};
 
+#[cfg(any(test, feature = "generate-fixtures"))]
+pub(crate) mod arbitrary_impl;
 pub mod array;
 pub mod discriminant;
 mod estimated_json_encoded_size_of;
@@ -35,6 +37,7 @@ pub mod metric;
 pub mod proto;
 mod r#ref;
 mod ser;
+
 #[cfg(test)]
 mod test;
 mod trace;
diff --git a/lib/vector-core/src/event/test/mod.rs b/lib/vector-core/src/event/test/mod.rs
index 3762a53363602..8f9cbad4da2c4 100644
--- a/lib/vector-core/src/event/test/mod.rs
+++ b/lib/vector-core/src/event/test/mod.rs
@@ -1,4 +1,3 @@
-mod common;
 mod serialization;
 mod size_of;
 
diff --git a/lib/vector-core/src/event/test/serialization.rs b/lib/vector-core/src/event/test/serialization.rs
index 75304e3960d54..4bd7ac369e5c8 100644
--- a/lib/vector-core/src/event/test/serialization.rs
+++ b/lib/vector-core/src/event/test/serialization.rs
@@ -1,12 +1,11 @@
+use super::*;
+use crate::config::log_schema;
 use bytes::{Buf, BufMut, BytesMut};
 use quickcheck::{QuickCheck, TestResult};
 use regex::Regex;
 use similar_asserts::assert_eq;
 use vector_buffers::encoding::Encodable;
 
-use super::*;
-use crate::config::log_schema;
-
 fn encode_value<T: Encodable, B: BufMut>(value: T, buffer: &mut B) {
     value.encode(buffer).expect("encoding should not fail");
 }
diff --git a/lib/vector-core/src/event/test/size_of.rs b/lib/vector-core/src/event/test/size_of.rs
index 2428bc5ac6491..36bb1a0e23c4a 100644
--- a/lib/vector-core/src/event/test/size_of.rs
+++ b/lib/vector-core/src/event/test/size_of.rs
@@ -4,7 +4,8 @@ use lookup::{PathPrefix, path};
 use quickcheck::{Arbitrary, Gen, QuickCheck, TestResult};
 use vector_common::byte_size_of::ByteSizeOf;
 
-use super::{common::Name, *};
+use super::*;
+use crate::event::arbitrary_impl::Name;
 
 #[test]
 fn at_least_wrapper_size() {
diff --git a/lib/vector-core/src/metrics/ddsketch.rs b/lib/vector-core/src/metrics/ddsketch.rs
index b66f25ceb150b..886a5c190bf32 100644
--- a/lib/vector-core/src/metrics/ddsketch.rs
+++ b/lib/vector-core/src/metrics/ddsketch.rs
@@ -284,6 +284,17 @@ impl AgentDDSketch {
         })
     }
 
+    /// Overrides `sum` and `avg` with arbitrary values.
+    ///
+    /// Only available under the `generate-fixtures` feature, where we need to
+    /// produce sketches with independently-randomized summary statistics to
+    /// exercise round-trip serialization of those fields.
+    #[cfg(feature = "generate-fixtures")]
+    pub fn set_sum_avg(&mut self, sum: f64, avg: f64) {
+        self.sum = sum;
+        self.avg = avg;
+    }
+
     pub fn gamma(&self) -> f64 {
         self.config.gamma_v
     }

From 604866d560deea7a14cbfa767a8ca99eee07089a Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 20 Apr 2026 14:58:40 -0400
Subject: [PATCH 141/326] fix(website): use parent site for RUM to resolve
 intake host (#25224)

---
 website/config.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/config.toml b/website/config.toml
index 414451d38b57d..15cab204233af 100644
--- a/website/config.toml
+++ b/website/config.toml
@@ -95,7 +95,7 @@ discord = "https://chat.vector.dev"
 [params.datadog_config]
 application_id = "894af722-5919-4a62-97fc-33f49bc52803"
 client_token = "pubcee1dc56e7f5bd03397cc3624eb7961c"
-site = "cose.datadoghq.com"
+site = "datadoghq.com"
 service_name = "vector"
 
 ## Menus

From bdcf7476c55141ecf535cec6caafea7b2cc3d16d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Apr 2026 15:43:03 -0400
Subject: [PATCH 142/326] chore(ci): bump dorny/paths-filter from 3.0.2 to
 4.0.1 (#25105)

Bumps [dorny/paths-filter](https://github.com/dorny/paths-filter) from 3.0.2 to 4.0.1.
- [Release notes](https://github.com/dorny/paths-filter/releases)
- [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md)
- [Commits](https://github.com/dorny/paths-filter/compare/de90cc6fb38fc0963ad72b210f1f284cd68cea36...fbd0ab8f3e69293af611ebaee6363fc25e6d187d)

---
updated-dependencies:
- dependency-name: dorny/paths-filter
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/changes.yml                  | 6 +++---
 .github/workflows/check_generated_vrl_docs.yml | 2 +-
 .github/workflows/integration_windows.yml      | 2 +-
 .github/workflows/regression.yml               | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/changes.yml b/.github/workflows/changes.yml
index 999548111e9a7..f9cd9ce4ba5b9 100644
--- a/.github/workflows/changes.yml
+++ b/.github/workflows/changes.yml
@@ -189,7 +189,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
           base: ${{ env.BASE_SHA }}
@@ -360,7 +360,7 @@ jobs:
       - name: Create filter rules for integrations
         run: vdev int ci-paths > int_test_filters.yaml
 
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
           base: ${{ env.BASE_SHA }}
@@ -454,7 +454,7 @@ jobs:
       - name: Create filter rules for e2e tests
         run: vdev e2e ci-paths > int_test_filters.yaml
 
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
           base: ${{ env.BASE_SHA }}
diff --git a/.github/workflows/check_generated_vrl_docs.yml b/.github/workflows/check_generated_vrl_docs.yml
index c2a9852474461..867ffd7619379 100644
--- a/.github/workflows/check_generated_vrl_docs.yml
+++ b/.github/workflows/check_generated_vrl_docs.yml
@@ -28,7 +28,7 @@ jobs:
       docs: ${{ steps.filter.outputs.docs }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
           filters: |
diff --git a/.github/workflows/integration_windows.yml b/.github/workflows/integration_windows.yml
index 39289d786fd24..1074ba4a3b97b 100644
--- a/.github/workflows/integration_windows.yml
+++ b/.github/workflows/integration_windows.yml
@@ -16,7 +16,7 @@ jobs:
       windows: ${{ steps.filter.outputs.windows }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
           filters: |
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index cc1170a8aaa21..aaf71eb9687a4 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -124,7 +124,7 @@ jobs:
 
       - name: Collect file changes
         id: changes
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         with:
           base: ${{ needs.resolve-inputs.outputs.baseline-sha }}
           ref: ${{ needs.resolve-inputs.outputs.comparison-sha }}

From c2022541ee792988c465ca9a76b93a0f54ea4e00 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 20 Apr 2026 15:43:44 -0400
Subject: [PATCH 143/326] docs(deprecations): add greptimedb v0 support
 deprecation entry (#25226)

---
 docs/DEPRECATIONS.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/DEPRECATIONS.md b/docs/DEPRECATIONS.md
index cf3a9377bfe24..b57db75f736af 100644
--- a/docs/DEPRECATIONS.md
+++ b/docs/DEPRECATIONS.md
@@ -21,3 +21,5 @@ For example:
 ## To be migrated
 
 ## To be removed
+
+- `v0.56.0` | `greptimedb-v0-support` | The `greptimedb_metrics` and `greptimedb_logs` sinks drop support for GreptimeDB v0.x. Users must upgrade their GreptimeDB instance to v1.x before upgrading Vector.

From 0f7574ad33ce07243ab8f9d6399c5e6c2f451af1 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 20 Apr 2026 16:49:34 -0400
Subject: [PATCH 144/326] revert(observability): fix panic in allocation
 tracing dealloc path (#25222)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Revert "fix(observability): fix panic in allocation tracing dealloc path (#25…"

This reverts commit 43f620435a353b048c40661f59a2d2d18f2419ed.
---
 ...ix_allocation_tracing_dealloc_panic.fix.md |   3 -
 .../allocator/tracing_allocator.rs            | 202 ++----------------
 2 files changed, 13 insertions(+), 192 deletions(-)
 delete mode 100644 changelog.d/fix_allocation_tracing_dealloc_panic.fix.md

diff --git a/changelog.d/fix_allocation_tracing_dealloc_panic.fix.md b/changelog.d/fix_allocation_tracing_dealloc_panic.fix.md
deleted file mode 100644
index 732c836eac0e8..0000000000000
--- a/changelog.d/fix_allocation_tracing_dealloc_panic.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed a panic (abort) when running with `--allocation-tracing` in debug builds, caused by deallocating memory that was allocated before tracking was enabled. Also fixed per-group memory accounting skew for reentrant allocations whose tracing closure was skipped, which left the group ID header uninitialized and caused deallocations to be attributed to wrong groups.
-
-authors: pront
diff --git a/src/internal_telemetry/allocations/allocator/tracing_allocator.rs b/src/internal_telemetry/allocations/allocator/tracing_allocator.rs
index d0a2027eeb2e4..8d1eff3e36d4e 100644
--- a/src/internal_telemetry/allocations/allocator/tracing_allocator.rs
+++ b/src/internal_telemetry/allocations/allocator/tracing_allocator.rs
@@ -9,24 +9,8 @@ use super::{
 };
 use crate::internal_telemetry::allocations::TRACK_ALLOCATIONS;
 
-/// Header value for allocations made while tracking is disabled.
-/// On deallocation we free with the wrapped layout but skip tracing.
-const UNTRACKED: u8 = 0;
-
-/// Header value for allocations whose tracing closure was skipped due to
-/// reentrancy. `register()` never hands out `u8::MAX`, so this cannot
-/// collide with a real group ID. On deallocation we free with the wrapped
-/// layout but skip `trace_deallocation` to keep accounting balanced.
-const UNTRACED: u8 = u8::MAX;
-
 /// A tracing allocator that groups allocation events by groups.
 ///
-/// Every allocation made through this allocator uses the "wrapped" layout:
-/// the requested layout extended by one byte to store an allocation group
-/// ID. This byte is always present regardless of whether tracking is
-/// enabled, which guarantees that `dealloc` can always read a valid header
-/// and free with the correct (wrapped) layout.
-///
 /// This allocator can only be used when specified via `#[global_allocator]`.
 pub struct GroupedTraceableAllocator<A, T> {
     allocator: A,
@@ -45,6 +29,11 @@ unsafe impl<A: GlobalAlloc, T: Tracer> GlobalAlloc for GroupedTraceableAllocator
     #[inline]
     unsafe fn alloc(&self, object_layout: Layout) -> *mut u8 {
         unsafe {
+            if !TRACK_ALLOCATIONS.load(Ordering::Relaxed) {
+                return self.allocator.alloc(object_layout);
+            }
+
+            // Allocate our wrapped layout and make sure the allocation succeeded.
             let (actual_layout, offset_to_group_id) = get_wrapped_layout(object_layout);
             let actual_ptr = self.allocator.alloc(actual_layout);
             if actual_ptr.is_null() {
@@ -53,16 +42,6 @@ unsafe impl<A: GlobalAlloc, T: Tracer> GlobalAlloc for GroupedTraceableAllocator
 
             let group_id_ptr = actual_ptr.add(offset_to_group_id).cast::<u8>();
 
-            if !TRACK_ALLOCATIONS.load(Ordering::Relaxed) {
-                group_id_ptr.write(UNTRACKED);
-                return actual_ptr;
-            }
-
-            // Write the untraced sentinel so that `dealloc` always finds a
-            // valid header, even when the tracing closure below is skipped
-            // due to reentrancy.
-            group_id_ptr.write(UNTRACED);
-
             let object_size = object_layout.size();
 
             try_with_suspended_allocation_group(
@@ -79,19 +58,19 @@ unsafe impl<A: GlobalAlloc, T: Tracer> GlobalAlloc for GroupedTraceableAllocator
     #[inline]
     unsafe fn dealloc(&self, object_ptr: *mut u8, object_layout: Layout) {
         unsafe {
+            if !TRACK_ALLOCATIONS.load(Ordering::Relaxed) {
+                self.allocator.dealloc(object_ptr, object_layout);
+                return;
+            }
+            // Regenerate the wrapped layout so we know where we have to look, as the pointer we've given relates to the
+            // requested layout, not the wrapped layout that was actually allocated.
             let (wrapped_layout, offset_to_group_id) = get_wrapped_layout(object_layout);
+
             let raw_group_id = object_ptr.add(offset_to_group_id).cast::<u8>().read();
 
-            // Always free with the wrapped layout since all allocations
-            // (tracked or not) use it.
+            // Deallocate before tracking, just to make sure we're reclaiming memory as soon as possible.
             self.allocator.dealloc(object_ptr, wrapped_layout);
 
-            // Skip tracing for untracked (tracking was off) and untraced
-            // (reentrant, closure skipped) allocations.
-            if raw_group_id == UNTRACKED || raw_group_id == UNTRACED {
-                return;
-            }
-
             let object_size = object_layout.size();
             let source_group_id = AllocationGroupId::from_raw(raw_group_id);
 
@@ -117,158 +96,3 @@ fn get_wrapped_layout(object_layout: Layout) -> (Layout, usize) {
 
     (actual_layout.pad_to_align(), offset_to_group_id)
 }
-
-#[cfg(test)]
-mod tests {
-    use std::{
-        alloc::{GlobalAlloc, Layout, System},
-        sync::atomic::{AtomicUsize, Ordering},
-    };
-
-    use serial_test::serial;
-
-    use super::*;
-    use crate::internal_telemetry::allocations::allocator::{
-        token::AllocationGroupId, tracer::Tracer,
-    };
-
-    /// RAII guard that enables `TRACK_ALLOCATIONS` on creation and
-    /// restores it to `false` on drop, ensuring cleanup even if the
-    /// test panics.
-    struct TrackingGuard;
-
-    impl TrackingGuard {
-        fn enable() -> Self {
-            TRACK_ALLOCATIONS.store(true, Ordering::Release);
-            Self
-        }
-    }
-
-    impl Drop for TrackingGuard {
-        fn drop(&mut self) {
-            TRACK_ALLOCATIONS.store(false, Ordering::Release);
-        }
-    }
-
-    struct CountingTracer {
-        allocs: AtomicUsize,
-        deallocs: AtomicUsize,
-    }
-
-    impl CountingTracer {
-        const fn new() -> Self {
-            Self {
-                allocs: AtomicUsize::new(0),
-                deallocs: AtomicUsize::new(0),
-            }
-        }
-    }
-
-    impl Tracer for CountingTracer {
-        fn trace_allocation(&self, _size: usize, _group_id: AllocationGroupId) {
-            self.allocs.fetch_add(1, Ordering::Relaxed);
-        }
-
-        fn trace_deallocation(&self, _size: usize, _source_group_id: AllocationGroupId) {
-            self.deallocs.fetch_add(1, Ordering::Relaxed);
-        }
-    }
-
-    #[test]
-    fn sentinels_do_not_collide_with_root_id() {
-        assert_eq!(UNTRACED, u8::MAX);
-        assert_ne!(UNTRACED, AllocationGroupId::ROOT.as_raw());
-        assert_ne!(UNTRACKED, AllocationGroupId::ROOT.as_raw());
-    }
-
-    /// Allocations made while tracking is disabled get UNTRACKED (0) in the
-    /// header. Deallocating them (whether tracking is on or off) must use
-    /// the wrapped layout and skip tracing.
-    #[test]
-    #[serial]
-    fn untracked_alloc_dealloc_skips_tracing() {
-        let allocator = GroupedTraceableAllocator::new(System, CountingTracer::new());
-        let layout = Layout::from_size_align(64, 8).unwrap();
-
-        // Tracking starts off (default state). Allocate while disabled.
-        let ptr = unsafe { allocator.alloc(layout) };
-        assert!(!ptr.is_null());
-
-        // Header must be UNTRACKED.
-        let (_, offset) = get_wrapped_layout(layout);
-        let raw_id = unsafe { ptr.add(offset).cast::<u8>().read() };
-        assert_eq!(raw_id, UNTRACKED);
-
-        // Enable tracking, then dealloc -- must not panic, no trace events.
-        let _guard = TrackingGuard::enable();
-        unsafe { allocator.dealloc(ptr, layout) };
-
-        assert_eq!(allocator.tracer.allocs.load(Ordering::Relaxed), 0);
-        assert_eq!(allocator.tracer.deallocs.load(Ordering::Relaxed), 0);
-    }
-
-    /// Tracked allocation: header is a valid non-zero, non-sentinel group
-    /// ID, tracing fires for both alloc and dealloc, and dealloc completes
-    /// without panic.
-    #[test]
-    #[serial]
-    fn tracked_alloc_dealloc_does_not_panic() {
-        let allocator = GroupedTraceableAllocator::new(System, CountingTracer::new());
-        let layout = Layout::from_size_align(64, 8).unwrap();
-
-        let _guard = TrackingGuard::enable();
-        let ptr = unsafe { allocator.alloc(layout) };
-        assert!(!ptr.is_null());
-
-        let (_, offset) = get_wrapped_layout(layout);
-        let raw_id = unsafe { ptr.add(offset).cast::<u8>().read() };
-        assert_eq!(
-            raw_id,
-            AllocationGroupId::ROOT.as_raw(),
-            "header must be the ROOT group ID"
-        );
-        assert_eq!(allocator.tracer.allocs.load(Ordering::Relaxed), 1);
-
-        unsafe { allocator.dealloc(ptr, layout) };
-
-        assert_eq!(allocator.tracer.deallocs.load(Ordering::Relaxed), 1);
-    }
-
-    /// End-to-end reentrant allocation: hold a mutable borrow on the
-    /// thread-local group stack so `try_with_suspended_allocation_group`
-    /// skips the tracing closure. The header must be UNTRACED and both
-    /// trace counters must stay at zero through alloc + dealloc.
-    #[test]
-    #[serial]
-    fn reentrant_alloc_writes_untraced_and_skips_tracing() {
-        use crate::internal_telemetry::allocations::allocator::token::LOCAL_ALLOCATION_GROUP_STACK;
-
-        let allocator = GroupedTraceableAllocator::new(System, CountingTracer::new());
-        let layout = Layout::from_size_align(64, 8).unwrap();
-
-        let _guard = TrackingGuard::enable();
-
-        // Hold a mutable borrow to simulate reentrancy -- any nested
-        // `try_borrow_mut` inside `try_with_suspended_allocation_group`
-        // will fail, causing the tracing closure to be skipped.
-        LOCAL_ALLOCATION_GROUP_STACK.with(|group_stack| {
-            let _borrow = group_stack.borrow_mut();
-
-            let ptr = unsafe { allocator.alloc(layout) };
-            assert!(!ptr.is_null());
-
-            let (_, offset) = get_wrapped_layout(layout);
-            let raw_id = unsafe { ptr.add(offset).cast::<u8>().read() };
-            assert_eq!(
-                raw_id, UNTRACED,
-                "reentrant alloc must write UNTRACED sentinel"
-            );
-
-            assert_eq!(allocator.tracer.allocs.load(Ordering::Relaxed), 0);
-
-            unsafe { allocator.dealloc(ptr, layout) };
-
-            assert_eq!(allocator.tracer.deallocs.load(Ordering::Relaxed), 0);
-        });
-    }
-}

From 3ca3e61ec8b8cd89be836b47346343069b229398 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 20 Apr 2026 17:11:31 -0400
Subject: [PATCH 145/326] fix(ci): use CUE raw multi-line strings in release
 generator (#25228)

Fragment descriptions are embedded into CUE via `"""..."""`, where
backslashes are still interpreted as escape sequences. A fragment
containing e.g. a shell line continuation (`\<newline>`) produces
invalid CUE and breaks `cue export`, which is then used by the next
`cargo vdev release prepare` invocation.

Switch to raw multi-line strings (`#"""..."""#`) so backslashes are
literal and no escaping is needed on the description content.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 scripts/generate-release-cue.rb | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/scripts/generate-release-cue.rb b/scripts/generate-release-cue.rb
index 80a35c0683015..d11d9f8f02c8a 100755
--- a/scripts/generate-release-cue.rb
+++ b/scripts/generate-release-cue.rb
@@ -217,11 +217,14 @@ def generate_changelog!(new_version)
 
     # Note: `pr_numbers`, `scopes` and `breaking` are being omitted from the entries.
     #       These are currently not required for rendering in the website.
+    # Use CUE raw multi-line strings (#"""..."""#) so backslashes in the
+    # fragment (e.g. shell line continuations) are not interpreted as
+    # escape sequences.
     entry = "{\n" +
       "type: #{type.to_json}\n" +
-      "description: \"\"\"\n" +
+      "description: #\"\"\"\n" +
       "#{description}\n" +
-      "\"\"\"\n"
+      "\"\"\"#\n"
 
     if contributors.length() > 0
       entry += "contributors: #{contributors.to_json}\n"

From 1c70988b54156abf8d031538f0f81f28e7c0a0e4 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 21 Apr 2026 13:00:33 -0400
Subject: [PATCH 146/326] fix(api): restore HTTP GET /health endpoint (#25234)

* refactor(api): serve gRPC via hyper + axum router

Convert tonic's Server to an axum Router via into_router(), then serve
over the same TcpListener via hyper::Server. Enables HTTP/1.1 acceptance
so additional HTTP routes can be added alongside gRPC on the same port.
Behavior-preserving.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(api): restore HTTP GET /health endpoint

Re-expose the HTTP health endpoint that was removed as part of the
GraphQL-to-gRPC migration (#24364). The endpoint matches the pre-0.55
response shape: 200 with body {"ok": true} while serving and 503 with
body {"ok": false} after set_not_serving() is called during drain.
HEAD is also handled.

gRPC clients continue to use grpc.health.v1.Health/Check; both probes
now share the same serving state so they agree during shutdown.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(api): cover HTTP GET/HEAD /health endpoint

Adds two integration tests hitting the restored HTTP health endpoint
via reqwest:
- GET returns 200 with body {"ok":true}
- HEAD returns 200

Exposes harness.api_port() so tests can reach the API port directly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(api): document HTTP /health endpoint

Document the HTTP GET/HEAD /health endpoint served alongside the gRPC
API, framed as compatibility with Vector 0.54.0 and earlier. Updates
the reference endpoints schema to allow HEAD, adds HEAD/GET entries
for /health in api.cue with 200/503 responses, and adds a curl example
to the API reference page.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* style(api): apply cargo fmt

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/api/grpc_server.rs                   | 85 +++++++++++++++++++++---
 tests/vector_api/harness.rs              |  5 ++
 tests/vector_api/health.rs               | 44 +++++++++++-
 website/content/en/docs/reference/api.md | 13 ++++
 website/cue/reference.cue                |  1 +
 website/cue/reference/api.cue            | 25 ++++++-
 6 files changed, 162 insertions(+), 11 deletions(-)

diff --git a/src/api/grpc_server.rs b/src/api/grpc_server.rs
index ce33b0da3f7d5..715aeecad2b8e 100644
--- a/src/api/grpc_server.rs
+++ b/src/api/grpc_server.rs
@@ -1,6 +1,20 @@
-use std::{error::Error as StdError, net::SocketAddr};
+use std::{
+    error::Error as StdError,
+    net::SocketAddr,
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+};
+
+use axum::{
+    Router,
+    extract::State,
+    http::{StatusCode, header},
+    response::IntoResponse,
+    routing::get,
+};
 use tokio::sync::oneshot;
-use tokio_stream::wrappers::TcpListenerStream;
 use tonic::transport::Server as TonicServer;
 use tonic_health::server::{HealthReporter, health_reporter};
 use vector_lib::tap::topology::WatchRx;
@@ -8,10 +22,15 @@ use vector_lib::tap::topology::WatchRx;
 use super::grpc::ObservabilityService;
 use crate::{config::Config, proto::observability::Server as ObservabilityServer};
 
+/// Shared flag backing the HTTP `/health` endpoint. Mirrors the gRPC
+/// `HealthReporter` serving status so HTTP and gRPC probes agree.
+type ServingState = Arc<AtomicBool>;
+
 /// gRPC API server for Vector observability.
 pub struct GrpcServer {
     _shutdown: oneshot::Sender<()>,
     health_reporter: HealthReporter,
+    serving: ServingState,
     addr: SocketAddr,
 }
 
@@ -46,12 +65,22 @@ impl GrpcServer {
         // The empty service ("") is registered as SERVING by default.
         let (health_reporter, health_service) = health_reporter();
 
+        let serving: ServingState = Arc::new(AtomicBool::new(true));
+
         let (_shutdown, rx) = oneshot::channel();
 
+        // Convert the tokio TcpListener into a std listener for hyper's Server.
+        let std_listener = listener
+            .into_std()
+            .map_err(|e| crate::Error::from(format!("Failed to convert TCP listener: {}", e)))?;
+        std_listener.set_nonblocking(true).map_err(|e| {
+            crate::Error::from(format!("Failed to set TCP listener non-blocking: {}", e))
+        })?;
+
+        let router_serving = Arc::clone(&serving);
+
         // Spawn the server with the already-bound listener
         tokio::spawn(async move {
-            let incoming = TcpListenerStream::new(listener);
-
             // Build reflection service for tools like grpcurl
             let reflection_service = tonic_reflection::server::Builder::configure()
                 .register_encoded_file_descriptor_set(
@@ -61,11 +90,21 @@ impl GrpcServer {
                 .build()
                 .expect("Failed to build reflection service");
 
-            let result = TonicServer::builder()
+            // Build the tonic router (gRPC services) and merge with the HTTP router
+            // so both protocols share the same port. `accept_http1(true)` lets plain
+            // HTTP/1.1 requests reach the merged axum routes.
+            let router = TonicServer::builder()
+                .accept_http1(true)
                 .add_service(health_service)
                 .add_service(ObservabilityServer::new(service))
                 .add_service(reflection_service)
-                .serve_with_incoming_shutdown(incoming, async {
+                .into_router()
+                .merge(http_router(router_serving));
+
+            let result = hyper::Server::from_tcp(std_listener)
+                .expect("Failed to build HTTP server from TCP listener")
+                .serve(router.into_make_service())
+                .with_graceful_shutdown(async {
                     rx.await.ok();
                     info!("GRPC API server shutting down.");
                 })
@@ -86,6 +125,7 @@ impl GrpcServer {
         Ok(Self {
             _shutdown,
             health_reporter,
+            serving,
             addr: actual_addr,
         })
     }
@@ -93,9 +133,10 @@ impl GrpcServer {
     /// Signal that the server is no longer serving.
     ///
     /// Call this **before** draining the topology so that Kubernetes gRPC
-    /// readiness probes fail early and the pod is removed from endpoints
-    /// before the process exits.
+    /// readiness probes and HTTP `/health` probes fail early and the pod is
+    /// removed from endpoints before the process exits.
     pub async fn set_not_serving(&mut self) {
+        self.serving.store(false, Ordering::Relaxed);
         self.health_reporter
             .set_service_status("", tonic_health::ServingStatus::NotServing)
             .await;
@@ -106,3 +147,31 @@ impl GrpcServer {
         self.addr
     }
 }
+
+/// Axum router exposing `GET`/`HEAD /health`.
+///
+/// Returns `200 {"ok":true}` while the server is serving and
+/// `503 {"ok":false}` once [`GrpcServer::set_not_serving`] has been called.
+/// Matches the response shape of the pre-gRPC GraphQL-era endpoint so
+/// existing HTTP health probes (Kubernetes, load balancers) keep working.
+fn http_router(state: ServingState) -> Router {
+    Router::new()
+        .route("/health", get(health_handler).head(health_handler))
+        .with_state(state)
+}
+
+async fn health_handler(State(state): State<ServingState>) -> impl IntoResponse {
+    if state.load(Ordering::Relaxed) {
+        (
+            StatusCode::OK,
+            [(header::CONTENT_TYPE, "application/json")],
+            r#"{"ok":true}"#,
+        )
+    } else {
+        (
+            StatusCode::SERVICE_UNAVAILABLE,
+            [(header::CONTENT_TYPE, "application/json")],
+            r#"{"ok":false}"#,
+        )
+    }
+}
diff --git a/tests/vector_api/harness.rs b/tests/vector_api/harness.rs
index 274592fac5dae..ba79b521bba22 100644
--- a/tests/vector_api/harness.rs
+++ b/tests/vector_api/harness.rs
@@ -133,6 +133,11 @@ impl TestHarness {
         &mut self.api_client
     }
 
+    /// Returns the TCP port the API server is bound to
+    pub fn api_port(&self) -> u16 {
+        self.api_port
+    }
+
     /// Reloads Vector configuration by sending SIGHUP or using watch mode
     ///
     /// Polls Vector to detect crashes early and succeed fast when reload completes.
diff --git a/tests/vector_api/health.rs b/tests/vector_api/health.rs
index a17d16eecf913..1e88c5aa34ed0 100644
--- a/tests/vector_api/health.rs
+++ b/tests/vector_api/health.rs
@@ -1,4 +1,7 @@
-//! Integration tests for the standard gRPC health check on the observability API.
+//! Integration tests for the health endpoints on the observability API:
+//!
+//! * the standard gRPC health check (`grpc.health.v1.Health/Check`)
+//! * the HTTP `/health` endpoint served on the same port
 
 use super::{common::*, harness::*};
 
@@ -23,3 +26,42 @@ async fn health_check_reports_serving() {
 
     assert!(harness.check_running(), "Vector should still be running");
 }
+
+/// Verifies the HTTP `GET /health` endpoint returns 200 with `{"ok":true}` on a
+/// running Vector instance. This endpoint is load-balancer friendly and is
+/// shared with gRPC clients on the same API port.
+#[tokio::test]
+async fn http_health_endpoint_returns_200_when_serving() {
+    let config = single_source_config("demo", 1.0, None);
+    let harness = TestHarness::new(&config)
+        .await
+        .expect("Vector should start");
+
+    let url = format!("http://127.0.0.1:{}/health", harness.api_port());
+    let response = reqwest::get(&url)
+        .await
+        .expect("GET /health should succeed");
+
+    assert_eq!(response.status(), reqwest::StatusCode::OK);
+    let body = response.text().await.expect("body should be readable");
+    assert_eq!(body, r#"{"ok":true}"#);
+}
+
+/// Verifies HTTP `HEAD /health` returns 200 without a body. ALB/ELB style
+/// probes that prefer HEAD should work the same as GET.
+#[tokio::test]
+async fn http_health_endpoint_supports_head() {
+    let config = single_source_config("demo", 1.0, None);
+    let harness = TestHarness::new(&config)
+        .await
+        .expect("Vector should start");
+
+    let url = format!("http://127.0.0.1:{}/health", harness.api_port());
+    let response = reqwest::Client::new()
+        .head(&url)
+        .send()
+        .await
+        .expect("HEAD /health should succeed");
+
+    assert_eq!(response.status(), reqwest::StatusCode::OK);
+}
diff --git a/website/content/en/docs/reference/api.md b/website/content/en/docs/reference/api.md
index 949353241929b..9d49b863eb8ab 100644
--- a/website/content/en/docs/reference/api.md
+++ b/website/content/en/docs/reference/api.md
@@ -21,6 +21,12 @@ instance. This page covers how to configure and enable Vector's API.
 The API exposes a gRPC service defined in [`proto/vector/observability.proto`](https://github.com/vectordotdev/vector/blob/master/proto/vector/observability.proto).
 You can interact with it using any standard gRPC tooling.
 
+For compatibility with Vector 0.54.0 and earlier, the HTTP `GET /health`
+endpoint continues to be served on the same port as the gRPC API, so
+existing HTTP probes (for example AWS ALB health checks and Kubernetes
+HTTP liveness/readiness probes) keep working without changes. See the
+[Endpoints](#endpoints) section above for details.
+
 ### Example using grpcurl
 
 ```bash
@@ -35,3 +41,10 @@ grpcurl -plaintext \
   -d '{"outputs_patterns": ["*"], "limit": 100, "interval_ms": 500}' \
   localhost:8686 vector.observability.v1.ObservabilityService/StreamOutputEvents
 ```
+
+### Example using curl (HTTP health)
+
+```bash
+# 200 with body {"ok":true} while serving, 503 {"ok":false} during drain
+curl -i http://localhost:8686/health
+```
diff --git a/website/cue/reference.cue b/website/cue/reference.cue
index 05d22f27e1f1a..789e2e66bce82 100644
--- a/website/cue/reference.cue
+++ b/website/cue/reference.cue
@@ -68,6 +68,7 @@ _values: {
 #Endpoints: [Path=string]: {
 	DELETE?: #Endpoint
 	GET?:    #Endpoint
+	HEAD?:   #Endpoint
 	POST?:   #Endpoint
 	PUT?:    #Endpoint
 }
diff --git a/website/cue/reference/api.cue b/website/cue/reference/api.cue
index 38feeff331893..bb1e3baf129ba 100644
--- a/website/cue/reference/api.cue
+++ b/website/cue/reference/api.cue
@@ -24,13 +24,34 @@ api: {
 		"/health": {
 			GET: {
 				description: """
-					Healthcheck endpoint. Useful to verify that
-					Vector is up and running.
+					HTTP healthcheck endpoint served on the same port as the
+					gRPC API, preserved for compatibility with Vector 0.54.0
+					and earlier so existing HTTP probes (for example AWS ALB
+					and Kubernetes HTTP probes) keep working unchanged.
+					The response body is `{"ok": true}` while Vector is
+					serving and `{"ok": false}` once Vector begins draining.
 					"""
 				responses: {
 					"200": {
 						description: "Vector is initialized and running."
 					}
+					"503": {
+						description: "Vector is draining or shutting down and should be removed from the load balancer."
+					}
+				}
+			}
+			HEAD: {
+				description: """
+					Same semantics as `GET /health` but returns no body.
+					Intended for load balancer probes that prefer `HEAD`.
+					"""
+				responses: {
+					"200": {
+						description: "Vector is initialized and running."
+					}
+					"503": {
+						description: "Vector is draining or shutting down and should be removed from the load balancer."
+					}
 				}
 			}
 		}

From aafd4cb44f5649e692722b97d82973fea5509a41 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 21 Apr 2026 14:21:39 -0400
Subject: [PATCH 147/326] fix(demo_logs source): drop fakedata_generator, fix
 broken fake domains (#25236)

* fix(demo_logs source): drop fakedata_generator, fix broken fake domains

The fakedata_generator crate (v0.7.1) has an upstream bug: its
get_dataset() match table is missing a "tlds" arm, so gen_domain() falls
through to an empty JSON string. That fails to parse and the crate
prints "Failed getting dataset for tlds. EOF while parsing a value at
line 1 column 0" to stderr on every call, while gen_domain() returns
"<name>.Error: dataset not found" as the fake domain.

Drop the dependency (and its transitive passt dep) and inline the three
functions demo_logs actually used: gen_domain, gen_ipv4, gen_username.
Domains now look like "random.io" instead of "random.Error: dataset not
found", and stderr is quiet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(releasing): changelog fragment for demo_logs fakedata fix

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(demo_logs source): drop stale comment, allow TLDs/fakedata in spelling

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(demo_logs source): swap fake domain name list to unique entries

Replace the 8-word domain-name pool with fresh placeholder-style
entries so nothing in lib/fakedata derives from the fakedata_generator
crate's data.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/actions/spelling/allow.txt         |  2 +
 Cargo.lock                                 | 19 --------
 LICENSE-3rdparty.csv                       |  2 -
 changelog.d/drop_fakedata_generator.fix.md |  9 ++++
 lib/fakedata/Cargo.toml                    |  1 -
 lib/fakedata/src/logs.rs                   | 54 ++++++++++++++++++++--
 6 files changed, 61 insertions(+), 26 deletions(-)
 create mode 100644 changelog.d/drop_fakedata_generator.fix.md

diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index b43abdd6fba66..db6d30301dcd7 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -154,6 +154,7 @@ Evercoss
 exactlyonce
 Explay
 Fabro
+fakedata
 fakeintake
 FAQs
 fargate
@@ -509,6 +510,7 @@ timeseries
 timespan
 timestamped
 Tizen
+TLDs
 Tmobile
 tobz
 Tomtec
diff --git a/Cargo.lock b/Cargo.lock
index 3215e97f0fd44..2a7c05bd91410 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3909,22 +3909,9 @@ name = "fakedata"
 version = "0.1.0"
 dependencies = [
  "chrono",
- "fakedata_generator",
  "rand 0.9.4",
 ]
 
-[[package]]
-name = "fakedata_generator"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b42ec18312c068f0d6008ad66ad2fa289ab40a16d07a06406c200baa09eb1e7c"
-dependencies = [
- "passt",
- "rand 0.9.4",
- "serde",
- "serde_json",
-]
-
 [[package]]
 name = "fallible-iterator"
 version = "0.2.0"
@@ -7615,12 +7602,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "487f2ccd1e17ce8c1bfab3a65c89525af41cfad4c8659021a1e9a2aacd73b89b"
 
-[[package]]
-name = "passt"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13242a5ce97f39a8095d03c8b273e91d09f2690c0b7d69a2af844941115bab24"
-
 [[package]]
 name = "paste"
 version = "1.0.15"
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index ed18e3c3c172b..eb9e179e57c2b 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -270,7 +270,6 @@ event-listener-strategy,https://github.com/smol-rs/event-listener-strategy,Apach
 evmap,https://github.com/jonhoo/rust-evmap,MIT OR Apache-2.0,Jon Gjengset <jon@thesquareplanet.com>
 evmap-derive,https://github.com/jonhoo/rust-evmap,MIT OR Apache-2.0,Jon Gjengset <jon@thesquareplanet.com>
 exitcode,https://github.com/benwilber/exitcode,Apache-2.0,Ben Wilber <benwilber@gmail.com>
-fakedata_generator,https://github.com/KevinGimbel/fakedata_generator,MIT,Kevin Gimbel <kevin@gimbel.dev>
 fallible-iterator,https://github.com/sfackler/rust-fallible-iterator,MIT OR Apache-2.0,Steven Fackler <sfackler@gmail.com>
 fancy-regex,https://github.com/fancy-regex/fancy-regex,MIT,"Raph Levien <raph@google.com>, Robin Stocker <robin@nibor.org>, Keith Hall <keith.hall@available.systems>"
 fastrand,https://github.com/smol-rs/fastrand,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
@@ -536,7 +535,6 @@ parking_lot,https://github.com/Amanieu/parking_lot,MIT OR Apache-2.0,Amanieu d'A
 parking_lot_core,https://github.com/Amanieu/parking_lot,MIT OR Apache-2.0,Amanieu d'Antras <amanieu@gmail.com>
 parquet,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
 parse-size,https://github.com/kennytm/parse-size,MIT,kennytm <kennytm@gmail.com>
-passt,https://github.com/kevingimbel/passt,MIT OR Apache-2.0,Kevin Gimbel <hallo@kevingimbel.com>
 paste,https://github.com/dtolnay/paste,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 pastey,https://github.com/as1100k/pastey,MIT OR Apache-2.0,"Aditya Kumar <git@adityais.dev>, David Tolnay <dtolnay@gmail.com>"
 pbkdf2,https://github.com/RustCrypto/password-hashes/tree/master/pbkdf2,MIT OR Apache-2.0,RustCrypto Developers
diff --git a/changelog.d/drop_fakedata_generator.fix.md b/changelog.d/drop_fakedata_generator.fix.md
new file mode 100644
index 0000000000000..500e826bc3239
--- /dev/null
+++ b/changelog.d/drop_fakedata_generator.fix.md
@@ -0,0 +1,9 @@
+The text content generated by the `demo_logs` source has changed: the
+pool of fake usernames and the pool of fake domain TLDs are now both
+defined inside Vector rather than pulled from an external crate. The
+line formats (`apache_common`, `apache_error`, `json`, `syslog`,
+`bsd_syslog`) are unchanged. If any of your tests or downstream
+pipelines assert on specific generated usernames or TLDs, please
+update those expectations.
+
+authors: pront
diff --git a/lib/fakedata/Cargo.toml b/lib/fakedata/Cargo.toml
index 576ad22e96cad..52ba22387ef89 100644
--- a/lib/fakedata/Cargo.toml
+++ b/lib/fakedata/Cargo.toml
@@ -8,5 +8,4 @@ license = "MPL-2.0"
 
 [dependencies]
 chrono.workspace = true
-fakedata_generator = "0.7.1"
 rand.workspace = true
diff --git a/lib/fakedata/src/logs.rs b/lib/fakedata/src/logs.rs
index 1c3aa7683d2c4..768d67b06890d 100644
--- a/lib/fakedata/src/logs.rs
+++ b/lib/fakedata/src/logs.rs
@@ -3,9 +3,44 @@ use chrono::{
     format::{DelayedFormat, StrftimeItems},
     prelude::Local,
 };
-use fakedata_generator::{gen_domain, gen_ipv4, gen_username};
 use rand::{Rng, rng};
 
+static FAKE_USERNAMES: [&str; 20] = [
+    "log_whisperer",
+    "commit_conductor",
+    "cache_cowboy",
+    "compile_captain",
+    "latency_llama",
+    "yaml_yoda",
+    "regex_rider",
+    "semver_sage",
+    "kernel_keith",
+    "pixel_pilgrim",
+    "kubectl_kev",
+    "pipeline_pat",
+    "telemetry_tina",
+    "merge_maria",
+    "parser_pete",
+    "debug_duchess",
+    "nullable_nate",
+    "grep_greg",
+    "stderr_stan",
+    "segfault_sue",
+];
+
+static FAKE_DOMAIN_NAMES: [&str; 8] = [
+    "acme",
+    "contoso",
+    "widgets",
+    "example",
+    "placeholder",
+    "sample",
+    "foobar",
+    "testbench",
+];
+
+static FAKE_DOMAIN_TLDS: [&str; 8] = ["com", "net", "org", "io", "dev", "co", "app", "biz"];
+
 static APPLICATION_NAMES: [&str; 10] = [
     "auth", "data", "deploy", "etl", "scraper", "cron", "ingress", "egress", "alerter", "fwd",
 ];
@@ -156,7 +191,11 @@ fn application() -> &'static str {
 }
 
 fn domain() -> String {
-    gen_domain()
+    format!(
+        "{}.{}",
+        random_from_array(&FAKE_DOMAIN_NAMES),
+        random_from_array(&FAKE_DOMAIN_TLDS),
+    )
 }
 
 fn error_level() -> &'static str {
@@ -188,7 +227,14 @@ fn http_version() -> &'static str {
 }
 
 fn ipv4_address() -> String {
-    gen_ipv4()
+    let mut r = rng();
+    format!(
+        "{}.{}.{}.{}",
+        r.random_range(1..255),
+        r.random_range(1..255),
+        r.random_range(1..255),
+        r.random_range(1..255),
+    )
 }
 
 fn pid() -> usize {
@@ -208,7 +254,7 @@ fn referer() -> String {
 }
 
 fn username() -> String {
-    gen_username()
+    (*random_from_array(&FAKE_USERNAMES)).to_string()
 }
 
 fn syslog_version() -> usize {

From 8cf773df0e3b219e40537119aa2b95b916342df2 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 22 Apr 2026 14:31:21 -0400
Subject: [PATCH 148/326] chore(releasing): start 0.56.0 development cycle
 (#25242)

* chore(releasing): prepare v0.55.0 release (#25229)

* chore(releasing): Pinned VRL version to 0.32.0

* chore(releasing): Generated release CUE file

* chore(releasing): Updated website/cue/reference/administration/interfaces/kubectl.cue vector version to 0.55.0

* chore(releasing): Updated distribution/install.sh vector version to 0.55.0

* chore(releasing): Add 0.55.0 to versions.cue

* chore(releasing): Created release md file

* fix(api): restore HTTP GET /health endpoint (#25234)

* refactor(api): serve gRPC via hyper + axum router

Convert tonic's Server to an axum Router via into_router(), then serve
over the same TcpListener via hyper::Server. Enables HTTP/1.1 acceptance
so additional HTTP routes can be added alongside gRPC on the same port.
Behavior-preserving.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(api): restore HTTP GET /health endpoint

Re-expose the HTTP health endpoint that was removed as part of the
GraphQL-to-gRPC migration (#24364). The endpoint matches the pre-0.55
response shape: 200 with body {"ok": true} while serving and 503 with
body {"ok": false} after set_not_serving() is called during drain.
HEAD is also handled.

gRPC clients continue to use grpc.health.v1.Health/Check; both probes
now share the same serving state so they agree during shutdown.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(api): cover HTTP GET/HEAD /health endpoint

Adds two integration tests hitting the restored HTTP health endpoint
via reqwest:
- GET returns 200 with body {"ok":true}
- HEAD returns 200

Exposes harness.api_port() so tests can reach the API port directly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(api): document HTTP /health endpoint

Document the HTTP GET/HEAD /health endpoint served alongside the gRPC
API, framed as compatibility with Vector 0.54.0 and earlier. Updates
the reference endpoints schema to allow HEAD, adds HEAD/GET entries
for /health in api.cue with 200/503 responses, and adds a curl example
to the API reference page.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* style(api): apply cargo fmt

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(demo_logs source): drop fakedata_generator, fix broken fake domains (#25236)

* fix(demo_logs source): drop fakedata_generator, fix broken fake domains

The fakedata_generator crate (v0.7.1) has an upstream bug: its
get_dataset() match table is missing a "tlds" arm, so gen_domain() falls
through to an empty JSON string. That fails to parse and the crate
prints "Failed getting dataset for tlds. EOF while parsing a value at
line 1 column 0" to stderr on every call, while gen_domain() returns
"<name>.Error: dataset not found" as the fake domain.

Drop the dependency (and its transitive passt dep) and inline the three
functions demo_logs actually used: gen_domain, gen_ipv4, gen_username.
Domains now look like "random.io" instead of "random.Error: dataset not
found", and stderr is quiet.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(releasing): changelog fragment for demo_logs fakedata fix

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(demo_logs source): drop stale comment, allow TLDs/fakedata in spelling

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(demo_logs source): swap fake domain name list to unique entries

Replace the 8-word domain-name pool with fresh placeholder-style
entries so nothing in lib/fakedata derives from the fakedata_generator
crate's data.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(releasing): address Codex review feedback on 0.55 release cue

- Strip trailing whitespace on blank lines in `0.55.0.cue` so
  `make check-fmt` passes.
- Clarify that `azure_credential_kind` must live under the
  `azure_logs_ingestion` sink's `auth` block, not at the sink root,
  and link the 0.55 upgrade guide for a concrete example.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* update date

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(releasing): start 0.56.0 development cycle

Bump version to 0.56.0 and switch VRL back to tracking the
vectordotdev/vrl main branch after the 0.55.0 pin.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(releasing): regenerate Kubernetes manifests

Output of cargo vdev build manifests for the 0.56.0 development
cycle; picks up helm chart version 0.52.0.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(deps): address cargo deny advisories for 0.56.0

- Upgrade rustls-webpki 0.103.12 -> 0.103.13 to pick up the fix for
  RUSTSEC-2026-0104 (reachable panic in CRL parsing).
- Ignore RUSTSEC-2026-0104 for the still-reachable rustls-webpki 0.101
  and 0.102, which are blocked on the tonic upgrade tracked in #19179.
- Ignore RUSTSEC-2026-0105 (core2 unmaintained and yanked), reached
  transitively via libflate -> apache-avro; no safe upgrade available.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 Cargo.lock                                    |  18 +-
 Cargo.toml                                    |   2 +-
 .../23657-grpc-health-protocol.enhancement.md |   7 -
 .../24291_async_nats_websockets.feature.md    |   4 -
 .../24411_geoip_network_field.enhancement.md  |   3 -
 ..._source_per_signal_decoding.enhancement.md |  21 -
 .../24532_vector_stopped_log_ordering.fix.md  |   5 -
 ..._dnstap_parser_message_size.enhancement.md |   3 -
 .../24593_graph_edge_attributes.feature.md    |   3 -
 ...telemetry-header-enrichment.enhancement.md |   7 -
 ...9_kafka_sink_add_traces_support.feature.md |   3 -
 .../24641-task-transform-utilization.fix.md   |   5 -
 changelog.d/24708_log_error.fix.md            |   5 -
 ...24729_azure_blob_authentication.feature.md |   3 -
 .../24729_azure_logs_ingestion.breaking.md    |   3 -
 ...-buffer-utilization-metric-tracking.fix.md |   3 -
 ...3_aggregate_transform_reduce_memory.fix.md |   4 -
 .../24951_top_events_out_column.fix.md        |   3 -
 ...adog_metrics_zstd_series_v2.enhancement.md |   3 -
 ...fixed_high_cpu_usage_in_file_source.fix.md |   3 -
 .../aws_s3_parquet_encoding.feature.md        |  10 -
 .../bump_kube_k8s_openapi.enhancement.md      |   2 -
 ...ickhouse_arrow_uuid_support.enhancement.md |   3 -
 .../datadog_agent_source_device_tag_v2.fix.md |   5 -
 ...g_metrics_series_v2_default.enhancement.md |   5 -
 changelog.d/fix_site_prefix_stripping.fix.md  |   3 -
 ...fix_source_lag_time_chunked_batches.fix.md |   3 -
 changelog.d/graphql_to_grpc_api.breaking.md   |  42 --
 ...deprecated_http_headers_option.breaking.md |   4 -
 ...urce_sender_latency_metrics.enhancement.md |   5 -
 ...or_top_disabled_memory_used.enhancement.md |   3 -
 .../windows_event_log_source.feature.md       |   3 -
 .../windows_service_stop_state_wait.fix.md    |   3 -
 deny.toml                                     |   2 +
 distribution/install.sh                       |   2 +-
 .../kubernetes/vector-agent/README.md         |   2 +-
 .../kubernetes/vector-agent/configmap.yaml    |   5 +-
 .../kubernetes/vector-agent/daemonset.yaml    |   8 +-
 .../kubernetes/vector-agent/rbac.yaml         |   4 +-
 .../vector-agent/service-headless.yaml        |   2 +-
 .../vector-agent/serviceaccount.yaml          |   2 +-
 .../kubernetes/vector-aggregator/README.md    |   2 +-
 .../vector-aggregator/configmap.yaml          |   5 +-
 .../vector-aggregator/service-headless.yaml   |   2 +-
 .../kubernetes/vector-aggregator/service.yaml |   2 +-
 .../vector-aggregator/serviceaccount.yaml     |   2 +-
 .../vector-aggregator/statefulset.yaml        |   8 +-
 .../vector-stateless-aggregator/README.md     |   2 +-
 .../configmap.yaml                            |   5 +-
 .../deployment.yaml                           |   8 +-
 .../service-headless.yaml                     |   2 +-
 .../vector-stateless-aggregator/service.yaml  |   2 +-
 .../serviceaccount.yaml                       |   2 +-
 .../2026-04-20-0-55-0-upgrade-guide.md        | 139 +++++
 website/content/en/releases/0.55.0.md         |   4 +
 .../administration/interfaces/kubectl.cue     |   2 +-
 website/cue/reference/releases/0.55.0.cue     | 583 ++++++++++++++++++
 website/cue/reference/versions.cue            |   1 +
 website/layouts/releases/single.html          |  22 +-
 59 files changed, 786 insertions(+), 233 deletions(-)
 delete mode 100644 changelog.d/23657-grpc-health-protocol.enhancement.md
 delete mode 100644 changelog.d/24291_async_nats_websockets.feature.md
 delete mode 100644 changelog.d/24411_geoip_network_field.enhancement.md
 delete mode 100644 changelog.d/24455_otel_source_per_signal_decoding.enhancement.md
 delete mode 100644 changelog.d/24532_vector_stopped_log_ordering.fix.md
 delete mode 100644 changelog.d/24552_dnstap_parser_message_size.enhancement.md
 delete mode 100644 changelog.d/24593_graph_edge_attributes.feature.md
 delete mode 100644 changelog.d/24619-opentelemetry-header-enrichment.enhancement.md
 delete mode 100644 changelog.d/24639_kafka_sink_add_traces_support.feature.md
 delete mode 100644 changelog.d/24641-task-transform-utilization.fix.md
 delete mode 100644 changelog.d/24708_log_error.fix.md
 delete mode 100644 changelog.d/24729_azure_blob_authentication.feature.md
 delete mode 100644 changelog.d/24729_azure_logs_ingestion.breaking.md
 delete mode 100644 changelog.d/24911-buffer-utilization-metric-tracking.fix.md
 delete mode 100644 changelog.d/24943_aggregate_transform_reduce_memory.fix.md
 delete mode 100644 changelog.d/24951_top_events_out_column.fix.md
 delete mode 100644 changelog.d/24956_datadog_metrics_zstd_series_v2.enhancement.md
 delete mode 100644 changelog.d/25064_fixed_high_cpu_usage_in_file_source.fix.md
 delete mode 100644 changelog.d/aws_s3_parquet_encoding.feature.md
 delete mode 100644 changelog.d/bump_kube_k8s_openapi.enhancement.md
 delete mode 100644 changelog.d/clickhouse_arrow_uuid_support.enhancement.md
 delete mode 100644 changelog.d/datadog_agent_source_device_tag_v2.fix.md
 delete mode 100644 changelog.d/datadog_metrics_series_v2_default.enhancement.md
 delete mode 100644 changelog.d/fix_site_prefix_stripping.fix.md
 delete mode 100644 changelog.d/fix_source_lag_time_chunked_batches.fix.md
 delete mode 100644 changelog.d/graphql_to_grpc_api.breaking.md
 delete mode 100644 changelog.d/remove_deprecated_http_headers_option.breaking.md
 delete mode 100644 changelog.d/source_sender_latency_metrics.enhancement.md
 delete mode 100644 changelog.d/vector_top_disabled_memory_used.enhancement.md
 delete mode 100644 changelog.d/windows_event_log_source.feature.md
 delete mode 100644 changelog.d/windows_service_stop_state_wait.fix.md
 create mode 100644 website/content/en/highlights/2026-04-20-0-55-0-upgrade-guide.md
 create mode 100644 website/content/en/releases/0.55.0.md
 create mode 100644 website/cue/reference/releases/0.55.0.cue

diff --git a/Cargo.lock b/Cargo.lock
index 2a7c05bd91410..a39a96a6500b1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1781,7 +1781,7 @@ dependencies = [
  "bitflags 2.10.0",
  "cexpr",
  "clang-sys",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "regex",
@@ -8253,7 +8253,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
  "heck 0.5.0",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "log",
  "multimap",
  "once_cell",
@@ -8299,7 +8299,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "syn 2.0.117",
@@ -9473,7 +9473,7 @@ dependencies = [
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.12",
+ "rustls-webpki 0.103.13",
  "subtle",
  "zeroize",
 ]
@@ -9555,9 +9555,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.12"
+version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -12275,7 +12275,7 @@ dependencies = [
 
 [[package]]
 name = "vector"
-version = "0.55.0"
+version = "0.56.0"
 dependencies = [
  "apache-avro 0.16.0",
  "approx",
@@ -12912,8 +12912,8 @@ checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
 [[package]]
 name = "vrl"
-version = "0.31.0"
-source = "git+https://github.com/vectordotdev/vrl.git?branch=main#1357941d4481e84fb0323bd89c69cedf35c323f8"
+version = "0.32.0"
+source = "git+https://github.com/vectordotdev/vrl.git?branch=main#8a5b4711f37d0b3bd4d0d2ea8bbb500942bd8e98"
 dependencies = [
  "aes",
  "aes-siv",
diff --git a/Cargo.toml b/Cargo.toml
index 03aff35ec8c13..1045e07aae1a1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "vector"
-version = "0.55.0"
+version = "0.56.0"
 authors = ["Vector Contributors <vector@datadoghq.com>"]
 edition = "2024"
 description = "A lightweight and ultra-fast tool for building observability pipelines"
diff --git a/changelog.d/23657-grpc-health-protocol.enhancement.md b/changelog.d/23657-grpc-health-protocol.enhancement.md
deleted file mode 100644
index a26e9ebf42b2c..0000000000000
--- a/changelog.d/23657-grpc-health-protocol.enhancement.md
+++ /dev/null
@@ -1,7 +0,0 @@
-`vector` source: Implement standard gRPC health checking protocol (`grpc.health.v1.Health`)
-alongside the existing custom health check endpoint. This enables compatibility with standard
-tools like `grpc-health-probe` for Kubernetes and other orchestration systems.
-
-Issue: https://github.com/vectordotdev/vector/issues/23657
-
-authors: jpds
diff --git a/changelog.d/24291_async_nats_websockets.feature.md b/changelog.d/24291_async_nats_websockets.feature.md
deleted file mode 100644
index c11099ce6daf4..0000000000000
--- a/changelog.d/24291_async_nats_websockets.feature.md
+++ /dev/null
@@ -1,4 +0,0 @@
-Added websocket support to the `nats` source and sink. The `url` field now supports both `ws://` and
-`wss://` protocols.
-
-authors: gedemagt
diff --git a/changelog.d/24411_geoip_network_field.enhancement.md b/changelog.d/24411_geoip_network_field.enhancement.md
deleted file mode 100644
index 65d33f50f6b1b..0000000000000
--- a/changelog.d/24411_geoip_network_field.enhancement.md
+++ /dev/null
@@ -1,3 +0,0 @@
-The `geoip` enrichment table now includes a `network` field containing the CIDR network associated with the lookup result, available for all database types (City, ISP/ASN, Connection-Type, Anonymous-IP).
-
-authors: naa0yama
diff --git a/changelog.d/24455_otel_source_per_signal_decoding.enhancement.md b/changelog.d/24455_otel_source_per_signal_decoding.enhancement.md
deleted file mode 100644
index 79db8934df463..0000000000000
--- a/changelog.d/24455_otel_source_per_signal_decoding.enhancement.md
+++ /dev/null
@@ -1,21 +0,0 @@
-The `opentelemetry` source now supports independent configuration of OTLP decoding for logs, metrics, and traces. This allows more granular
-control over which signal types are decoded, while maintaining backward compatibility with the existing boolean configuration.
-
-## Simple boolean form (applies to all signals)
-
-```yaml
-use_otlp_decoding: true  # All signals preserve OTLP format
-# or
-use_otlp_decoding: false # All signals use Vector native format (default)
-```
-
-## Per-signal configuration
-
-```yaml
-use_otlp_decoding:
-  logs: false     # Convert to Vector native format
-  metrics: false  # Convert to Vector native format
-  traces: true    # Preserve OTLP format
-```
-
-authors: pront
diff --git a/changelog.d/24532_vector_stopped_log_ordering.fix.md b/changelog.d/24532_vector_stopped_log_ordering.fix.md
deleted file mode 100644
index c5e395c37ab6f..0000000000000
--- a/changelog.d/24532_vector_stopped_log_ordering.fix.md
+++ /dev/null
@@ -1,5 +0,0 @@
-Fixed log message ordering on shutdown where `Vector has stopped.` was logged before components had finished draining, causing confusing output interleaved with `Waiting on running components` messages.
-
-A new `VectorStopping` event was added in the place of the `VectorStopped` event.
-
-authors: tronboto
diff --git a/changelog.d/24552_dnstap_parser_message_size.enhancement.md b/changelog.d/24552_dnstap_parser_message_size.enhancement.md
deleted file mode 100644
index 9472bde7f3346..0000000000000
--- a/changelog.d/24552_dnstap_parser_message_size.enhancement.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Adds new fields to parsed dnstap data: `requestMessageSize` and `responseMessageSize`. It represents the size of the DNS message.
-
-authors: esensar Quad9DNS
diff --git a/changelog.d/24593_graph_edge_attributes.feature.md b/changelog.d/24593_graph_edge_attributes.feature.md
deleted file mode 100644
index 719cbc6b4635a..0000000000000
--- a/changelog.d/24593_graph_edge_attributes.feature.md
+++ /dev/null
@@ -1,3 +0,0 @@
-`graph.edge_attributes` can now be added to transforms and sinks to add attributes to edges in graphs generated using `vector graph`. Memory enrichment tables are also considered for graphs, because they can have inputs and outputs.
-
-authors: esensar Quad9DNS
diff --git a/changelog.d/24619-opentelemetry-header-enrichment.enhancement.md b/changelog.d/24619-opentelemetry-header-enrichment.enhancement.md
deleted file mode 100644
index e0b0b33a5caa3..0000000000000
--- a/changelog.d/24619-opentelemetry-header-enrichment.enhancement.md
+++ /dev/null
@@ -1,7 +0,0 @@
-`opentelemetry` source: Implemented header enrichment for OTLP metrics and traces. Unlike logs, which support enriching
-the event itself or its metadata, depending on `log_namespace` settings, for metrics and traces this setting is ignored
-and header values are added to the event metadata.
-
-Issue: https://github.com/vectordotdev/vector/issues/24619
-
-authors: ozanichkovsky
diff --git a/changelog.d/24639_kafka_sink_add_traces_support.feature.md b/changelog.d/24639_kafka_sink_add_traces_support.feature.md
deleted file mode 100644
index b89dff7437ff3..0000000000000
--- a/changelog.d/24639_kafka_sink_add_traces_support.feature.md
+++ /dev/null
@@ -1,3 +0,0 @@
-The `kafka` sink now supports trace events.
-
-authors: pstalmach
diff --git a/changelog.d/24641-task-transform-utilization.fix.md b/changelog.d/24641-task-transform-utilization.fix.md
deleted file mode 100644
index f59a9c8a8eddf..0000000000000
--- a/changelog.d/24641-task-transform-utilization.fix.md
+++ /dev/null
@@ -1,5 +0,0 @@
-Fixed utilization for task transforms to not account for time spent when downstream
-is not polling. If the transform is frequently blocked on downstream components,
-the reported utilization should be lower.
-
-authors: gwenaskell
diff --git a/changelog.d/24708_log_error.fix.md b/changelog.d/24708_log_error.fix.md
deleted file mode 100644
index d53626b09af05..0000000000000
--- a/changelog.d/24708_log_error.fix.md
+++ /dev/null
@@ -1,5 +0,0 @@
-The `opentelemetry` source now logs an error if it fails to start up or during runtime.
-This can happen when the configuration is invalid, for example trying to bind to the wrong
-IP or when hitting the open file limit.
-
-authors: fbs
diff --git a/changelog.d/24729_azure_blob_authentication.feature.md b/changelog.d/24729_azure_blob_authentication.feature.md
deleted file mode 100644
index 7b224172563b7..0000000000000
--- a/changelog.d/24729_azure_blob_authentication.feature.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Re-introduced Azure authentication support to `azure_blob`, including Azure CLI, Managed Identity, Workload Identity, and Managed Identity-based Client Assertion authentication types.
-
-authors: jlaundry
diff --git a/changelog.d/24729_azure_logs_ingestion.breaking.md b/changelog.d/24729_azure_logs_ingestion.breaking.md
deleted file mode 100644
index ce0230a352f38..0000000000000
--- a/changelog.d/24729_azure_logs_ingestion.breaking.md
+++ /dev/null
@@ -1,3 +0,0 @@
-If using the `azure_logs_ingestion` sink (added in Vector 0.54.0) with Client Secret credentials, add `azure_credential_kind = "client_secret_credential"` to your sink config (this was previously the default, and now must be explicitly configured).
-
-authors: jlaundry
diff --git a/changelog.d/24911-buffer-utilization-metric-tracking.fix.md b/changelog.d/24911-buffer-utilization-metric-tracking.fix.md
deleted file mode 100644
index fd1c23e5414b6..0000000000000
--- a/changelog.d/24911-buffer-utilization-metric-tracking.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed regression in buffer utilization metric tracking around underflow.
-
-authors: bruceg
diff --git a/changelog.d/24943_aggregate_transform_reduce_memory.fix.md b/changelog.d/24943_aggregate_transform_reduce_memory.fix.md
deleted file mode 100644
index 4f3be38504bcd..0000000000000
--- a/changelog.d/24943_aggregate_transform_reduce_memory.fix.md
+++ /dev/null
@@ -1,4 +0,0 @@
-Reduced the memory usage in the `aggregate` transform where previous values were being held
-even if `mode` was not set to `Diff`.
-
-authors: thomasqueirozb
diff --git a/changelog.d/24951_top_events_out_column.fix.md b/changelog.d/24951_top_events_out_column.fix.md
deleted file mode 100644
index e4191569cc205..0000000000000
--- a/changelog.d/24951_top_events_out_column.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed `vector top` displaying per-output sent events in the wrong column (Bytes In instead of Events Out) for components with multiple output ports.
-
-authors: pront
diff --git a/changelog.d/24956_datadog_metrics_zstd_series_v2.enhancement.md b/changelog.d/24956_datadog_metrics_zstd_series_v2.enhancement.md
deleted file mode 100644
index 1ecaef6b46b8c..0000000000000
--- a/changelog.d/24956_datadog_metrics_zstd_series_v2.enhancement.md
+++ /dev/null
@@ -1,3 +0,0 @@
-The `datadog_metrics` sink now uses zstd compression when submitting metrics to the Series v2 (`/api/v2/series`) and Sketches endpoints. Series v1 continues to use zlib (deflate).
-
-authors: vladimir-dd
diff --git a/changelog.d/25064_fixed_high_cpu_usage_in_file_source.fix.md b/changelog.d/25064_fixed_high_cpu_usage_in_file_source.fix.md
deleted file mode 100644
index 8d64593e51b5c..0000000000000
--- a/changelog.d/25064_fixed_high_cpu_usage_in_file_source.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed an issue in the `file`/`kubernetes_logs` source that could cause unexpectedly high CPU usage after the async file server migration.
-
-authors: fcfangcc
diff --git a/changelog.d/aws_s3_parquet_encoding.feature.md b/changelog.d/aws_s3_parquet_encoding.feature.md
deleted file mode 100644
index afaa01cc70c26..0000000000000
--- a/changelog.d/aws_s3_parquet_encoding.feature.md
+++ /dev/null
@@ -1,10 +0,0 @@
-Add Apache Parquet batch encoding support for the `aws_s3` sink with flexible schema definitions.
-
-Events can now be encoded as Parquet columnar files with multiple schema input options:
-
-- **Native Parquet schema** — automatically generate a schema or supply `.schema` file
-- **Configurable compression** - (Snappy, ZSTD, GZIP, LZ4, None).
-
-Enable the `codecs-parquet` feature and configure `batch_encoding` with `codec = "parquet"` in the S3 sink configuration.
-
-authors: szibis petere-datadog
diff --git a/changelog.d/bump_kube_k8s_openapi.enhancement.md b/changelog.d/bump_kube_k8s_openapi.enhancement.md
deleted file mode 100644
index 92b8fd24de684..0000000000000
--- a/changelog.d/bump_kube_k8s_openapi.enhancement.md
+++ /dev/null
@@ -1,2 +0,0 @@
-Bumped `kube` dependency from 0.93.0 to 3.0.1 and `k8s-openapi` from 0.22.0 to 0.27.0, adding support for Kubernetes API versions up to v1.35.
-authors: hligit
diff --git a/changelog.d/clickhouse_arrow_uuid_support.enhancement.md b/changelog.d/clickhouse_arrow_uuid_support.enhancement.md
deleted file mode 100644
index e6dfc806b6775..0000000000000
--- a/changelog.d/clickhouse_arrow_uuid_support.enhancement.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Added support for the ClickHouse `UUID` type in the ArrowStream format for the `clickhouse` sink. UUID columns are now automatically mapped to Arrow `Utf8` and cast by ClickHouse on insert.
-
-authors: benjamin-awd
diff --git a/changelog.d/datadog_agent_source_device_tag_v2.fix.md b/changelog.d/datadog_agent_source_device_tag_v2.fix.md
deleted file mode 100644
index 669d594f8c89f..0000000000000
--- a/changelog.d/datadog_agent_source_device_tag_v2.fix.md
+++ /dev/null
@@ -1,5 +0,0 @@
-`datadog_agent` source: Preserve `device` as a plain tag when decoding v2 series metrics,
-instead of incorrectly prefixing it as `resource.device`. This matches the v1 series behavior
-and fixes tag remapping for disk, SNMP, and other integrations that use the `device` resource type.
-
-authors: lisaqvu
diff --git a/changelog.d/datadog_metrics_series_v2_default.enhancement.md b/changelog.d/datadog_metrics_series_v2_default.enhancement.md
deleted file mode 100644
index 39e857b73f99d..0000000000000
--- a/changelog.d/datadog_metrics_series_v2_default.enhancement.md
+++ /dev/null
@@ -1,5 +0,0 @@
-The `datadog_metrics` sink now defaults to the Datadog series v2 endpoint (`/api/v2/series`) and
-exposes a new `series_api_version` configuration option (`v1` or `v2`) to control which endpoint is
-used. Set `series_api_version: v1` to fall back to the legacy v1 endpoint if needed.
-
-authors: vladimir-dd
diff --git a/changelog.d/fix_site_prefix_stripping.fix.md b/changelog.d/fix_site_prefix_stripping.fix.md
deleted file mode 100644
index 8136664b5b2fd..0000000000000
--- a/changelog.d/fix_site_prefix_stripping.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed the Datadog sink healthcheck endpoint computation to preserve site prefixes (e.g. `us3.`, `us5.`, `ap1.`) when deriving the API URL from intake endpoints. Previously, the healthcheck for site-specific endpoints like `https://http-intake.logs.us3.datadoghq.com` would incorrectly call `https://api.datadoghq.com` instead of `https://api.us3.datadoghq.com`, causing unintended cross-site egress traffic.
-
-authors: vladimir-dd
diff --git a/changelog.d/fix_source_lag_time_chunked_batches.fix.md b/changelog.d/fix_source_lag_time_chunked_batches.fix.md
deleted file mode 100644
index 6303ba10edd33..0000000000000
--- a/changelog.d/fix_source_lag_time_chunked_batches.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed an incorrect source_lag_time_seconds measurement in sources that use `send_batch` with large event batches. When a batch was split into multiple chunks, the reference timestamp used to compute lag time was re-captured on each chunk send, causing the lag time for later chunks to be overstated by the amount of time spent waiting for the channel to accept earlier chunks. The reference timestamp is now captured once before iteration and shared across all chunks.
-
-authors: gwenaskell
diff --git a/changelog.d/graphql_to_grpc_api.breaking.md b/changelog.d/graphql_to_grpc_api.breaking.md
deleted file mode 100644
index 2c9756ee16a89..0000000000000
--- a/changelog.d/graphql_to_grpc_api.breaking.md
+++ /dev/null
@@ -1,42 +0,0 @@
-The Vector observability API has been migrated from GraphQL to gRPC for improved
-performance, efficiency and maintainability. The `vector top` and `vector tap`
-commands continue to work as before, as they have been updated to use the new
-gRPC API internally. The gRPC service definition is available in
-[`proto/vector/observability.proto`](https://github.com/vectordotdev/vector/blob/master/proto/vector/observability.proto).
-
-Note: `vector top` and `vector tap` from version 0.55.0 or later are not
-compatible with Vector instances running earlier versions.
-
-- Remove the `api.graphql` and `api.playground` fields from your config. Vector
-  now rejects configs that contain them.
-
-- If you use `vector top` or `vector tap` with an explicit `--url`, remove the
-  `/graphql` path suffix:
-
-```bash
-# Old
-vector top --url http://localhost:8686/graphql
-
-# New (the gRPC API listens at the root)
-vector top --url http://localhost:8686
-```
-
-- The GraphQL API (HTTP endpoint `/graphql`, WebSocket subscriptions, and the
-  GraphQL Playground at `/playground`) has been removed. You can interact with
-  the new gRPC API using tools like
-  [grpcurl](https://github.com/fullstorydev/grpcurl):
-
-```bash
-# Check health (standard gRPC health check, compatible with Kubernetes gRPC probes)
-grpcurl -plaintext localhost:8686 grpc.health.v1.Health/Check
-
-# List components
-grpcurl -plaintext localhost:8686 vector.observability.v1.ObservabilityService/GetComponents
-
-# Stream events (tap) — limit and interval_ms are required and must be >= 1
-grpcurl -plaintext \
-  -d '{"outputs_patterns": ["*"], "limit": 100, "interval_ms": 500}' \
-  localhost:8686 vector.observability.v1.ObservabilityService/StreamOutputEvents
-```
-
-authors: pront
diff --git a/changelog.d/remove_deprecated_http_headers_option.breaking.md b/changelog.d/remove_deprecated_http_headers_option.breaking.md
deleted file mode 100644
index b2b1fd28b869e..0000000000000
--- a/changelog.d/remove_deprecated_http_headers_option.breaking.md
+++ /dev/null
@@ -1,4 +0,0 @@
-The `headers` option has been removed from the `http` and `opentelemetry` sinks.
-Use `request.headers` instead. This option has been deprecated since v0.33.0.
-
-authors: thomasqueirozb
diff --git a/changelog.d/source_sender_latency_metrics.enhancement.md b/changelog.d/source_sender_latency_metrics.enhancement.md
deleted file mode 100644
index 6876641a37764..0000000000000
--- a/changelog.d/source_sender_latency_metrics.enhancement.md
+++ /dev/null
@@ -1,5 +0,0 @@
-Sources now record the distribution metrics `source_send_latency_seconds` (measuring the time spent
-blocking on a single events chunk send operation on the output) and `source_send_batch_latency_seconds`
-(encompassing all chunks within a received events batch).
-
-authors: gwenaskell
diff --git a/changelog.d/vector_top_disabled_memory_used.enhancement.md b/changelog.d/vector_top_disabled_memory_used.enhancement.md
deleted file mode 100644
index e929a065019ef..0000000000000
--- a/changelog.d/vector_top_disabled_memory_used.enhancement.md
+++ /dev/null
@@ -1,3 +0,0 @@
-`vector top` terminal UI now shows `disabled` in the Memory Used column when the connected Vector instance was not started with `--allocation-tracing`, instead of displaying misleading zeros. A new `GetAllocationTracingStatus` gRPC endpoint is queried on connect to determine the status.
-
-authors: pront
diff --git a/changelog.d/windows_event_log_source.feature.md b/changelog.d/windows_event_log_source.feature.md
deleted file mode 100644
index 7f64f115a3391..0000000000000
--- a/changelog.d/windows_event_log_source.feature.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Added a new `windows_event_log` source that collects logs from Windows Event Log channels using the native Windows Event Log API with pull-mode subscriptions, bookmark-based checkpointing, and configurable field filtering.
-
-authors: tot19
diff --git a/changelog.d/windows_service_stop_state_wait.fix.md b/changelog.d/windows_service_stop_state_wait.fix.md
deleted file mode 100644
index 45b60f01ca5fa..0000000000000
--- a/changelog.d/windows_service_stop_state_wait.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed Windows service state checks in `vector service start`/`stop`, and made `vector service stop` wait until the service reaches `Stopped`. Added `--stop-timeout` to `vector service stop` and `vector service uninstall`.
-
-authors: iMithrellas
diff --git a/deny.toml b/deny.toml
index ac8e588fa1cbe..0d563622a509e 100644
--- a/deny.toml
+++ b/deny.toml
@@ -48,4 +48,6 @@ ignore = [
   { id = "RUSTSEC-2026-0099", reason = "rustls-webpki 0.102/0.101 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
   { id = "RUSTSEC-2024-0436", reason = "paste crate is unmaintained - transitive dependency via parquet v56.2.0, no safe upgrade available" },
   { id = "RUSTSEC-2026-0097", reason = "rand 0.8.5 unsound with custom logger - transitive dependency, upstream crates have not updated to rand 0.9+" },
+  { id = "RUSTSEC-2026-0104", reason = "rustls-webpki 0.102/0.101 CRL parsing panic - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179); 0.103 already patched to 0.103.13" },
+  { id = "RUSTSEC-2026-0105", reason = "core2 is unmaintained and all versions yanked - transitive dependency via libflate -> apache-avro, no safe upgrade available" },
 ]
diff --git a/distribution/install.sh b/distribution/install.sh
index ceeb50c253862..f2ab269e2fd01 100755
--- a/distribution/install.sh
+++ b/distribution/install.sh
@@ -13,7 +13,7 @@ set -u
 # If PACKAGE_ROOT is unset or empty, default it.
 PACKAGE_ROOT="${PACKAGE_ROOT:-"https://packages.timber.io/vector"}"
 # If VECTOR_VERSION is unset or empty, default it.
-VECTOR_VERSION="${VECTOR_VERSION:-"0.54.0"}"
+VECTOR_VERSION="${VECTOR_VERSION:-"0.55.0"}"
 _divider="--------------------------------------------------------------------------------"
 _prompt=">>>"
 _indent="   "
diff --git a/distribution/kubernetes/vector-agent/README.md b/distribution/kubernetes/vector-agent/README.md
index dfe0f05deb137..15dfbf6207643 100644
--- a/distribution/kubernetes/vector-agent/README.md
+++ b/distribution/kubernetes/vector-agent/README.md
@@ -1,6 +1,6 @@
 The kubernetes manifests found in this directory have been automatically generated
 from the [helm chart `vector/vector`](https://github.com/vectordotdev/helm-charts/tree/master/charts/vector)
-version 0.51.0 with the following `values.yaml`:
+version 0.52.0 with the following `values.yaml`:
 
 ```yaml
 role: Agent
diff --git a/distribution/kubernetes/vector-agent/configmap.yaml b/distribution/kubernetes/vector-agent/configmap.yaml
index e3d7499257236..99cb8d91f4345 100644
--- a/distribution/kubernetes/vector-agent/configmap.yaml
+++ b/distribution/kubernetes/vector-agent/configmap.yaml
@@ -9,14 +9,13 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
 data:
   agent.yaml: |
     data_dir: /vector-data-dir
     api:
       enabled: true
-      address: 127.0.0.1:8686
-      playground: false
+      address: 0.0.0.0:8686
     sources:
       kubernetes_logs:
         type: kubernetes_logs
diff --git a/distribution/kubernetes/vector-agent/daemonset.yaml b/distribution/kubernetes/vector-agent/daemonset.yaml
index 4c468b88989a7..8c74a70107dec 100644
--- a/distribution/kubernetes/vector-agent/daemonset.yaml
+++ b/distribution/kubernetes/vector-agent/daemonset.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
 spec:
   selector:
     matchLabels:
@@ -30,7 +30,7 @@ spec:
       dnsPolicy: ClusterFirst
       containers:
         - name: vector
-          image: "docker.io/timberio/vector:0.54.0-distroless-libc"
+          image: "docker.io/timberio/vector:0.55.0-distroless-libc"
           imagePullPolicy: IfNotPresent
           args:
             - --config-dir
@@ -58,6 +58,10 @@ spec:
             - name: prom-exporter
               containerPort: 9090
               protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8686
           volumeMounts:
             - name: data
               mountPath: "/vector-data-dir"
diff --git a/distribution/kubernetes/vector-agent/rbac.yaml b/distribution/kubernetes/vector-agent/rbac.yaml
index 93b151826e238..5cd8e99594981 100644
--- a/distribution/kubernetes/vector-agent/rbac.yaml
+++ b/distribution/kubernetes/vector-agent/rbac.yaml
@@ -10,7 +10,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
 rules:
   - apiGroups:
       - ""
@@ -31,7 +31,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/distribution/kubernetes/vector-agent/service-headless.yaml b/distribution/kubernetes/vector-agent/service-headless.yaml
index 2f3a72b2619fd..573c2e67310c4 100644
--- a/distribution/kubernetes/vector-agent/service-headless.yaml
+++ b/distribution/kubernetes/vector-agent/service-headless.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
   annotations:
 spec:
   clusterIP: None
diff --git a/distribution/kubernetes/vector-agent/serviceaccount.yaml b/distribution/kubernetes/vector-agent/serviceaccount.yaml
index 9db1dca796f94..c1b65be5aea95 100644
--- a/distribution/kubernetes/vector-agent/serviceaccount.yaml
+++ b/distribution/kubernetes/vector-agent/serviceaccount.yaml
@@ -9,5 +9,5 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
 automountServiceAccountToken: true
diff --git a/distribution/kubernetes/vector-aggregator/README.md b/distribution/kubernetes/vector-aggregator/README.md
index 213cd06790f2e..ab45515cdaf94 100644
--- a/distribution/kubernetes/vector-aggregator/README.md
+++ b/distribution/kubernetes/vector-aggregator/README.md
@@ -1,6 +1,6 @@
 The kubernetes manifests found in this directory have been automatically generated
 from the [helm chart `vector/vector`](https://github.com/vectordotdev/helm-charts/tree/master/charts/vector)
-version 0.51.0 with the following `values.yaml`:
+version 0.52.0 with the following `values.yaml`:
 
 ```yaml
 
diff --git a/distribution/kubernetes/vector-aggregator/configmap.yaml b/distribution/kubernetes/vector-aggregator/configmap.yaml
index 39fa1093bffa6..464539b0afd4d 100644
--- a/distribution/kubernetes/vector-aggregator/configmap.yaml
+++ b/distribution/kubernetes/vector-aggregator/configmap.yaml
@@ -9,14 +9,13 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Aggregator
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
 data:
   aggregator.yaml: |
     data_dir: /vector-data-dir
     api:
       enabled: true
-      address: 127.0.0.1:8686
-      playground: false
+      address: 0.0.0.0:8686
     sources:
       datadog_agent:
         address: 0.0.0.0:8282
diff --git a/distribution/kubernetes/vector-aggregator/service-headless.yaml b/distribution/kubernetes/vector-aggregator/service-headless.yaml
index 3170f1c3751cd..bd5a2c5cc8432 100644
--- a/distribution/kubernetes/vector-aggregator/service-headless.yaml
+++ b/distribution/kubernetes/vector-aggregator/service-headless.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Aggregator
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
   annotations:
 spec:
   clusterIP: None
diff --git a/distribution/kubernetes/vector-aggregator/service.yaml b/distribution/kubernetes/vector-aggregator/service.yaml
index 3c423d4590371..5277bea614bdf 100644
--- a/distribution/kubernetes/vector-aggregator/service.yaml
+++ b/distribution/kubernetes/vector-aggregator/service.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Aggregator
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
   annotations:
 spec:
   ports:
diff --git a/distribution/kubernetes/vector-aggregator/serviceaccount.yaml b/distribution/kubernetes/vector-aggregator/serviceaccount.yaml
index 4f97844c7fee1..8bc7b591147b7 100644
--- a/distribution/kubernetes/vector-aggregator/serviceaccount.yaml
+++ b/distribution/kubernetes/vector-aggregator/serviceaccount.yaml
@@ -9,5 +9,5 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Aggregator
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
 automountServiceAccountToken: true
diff --git a/distribution/kubernetes/vector-aggregator/statefulset.yaml b/distribution/kubernetes/vector-aggregator/statefulset.yaml
index d107f7d55cd91..e5ec9f1fcd1aa 100644
--- a/distribution/kubernetes/vector-aggregator/statefulset.yaml
+++ b/distribution/kubernetes/vector-aggregator/statefulset.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Aggregator
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
   annotations: {}
 spec:
   replicas: 1
@@ -34,7 +34,7 @@ spec:
       dnsPolicy: ClusterFirst
       containers:
         - name: vector
-          image: "docker.io/timberio/vector:0.54.0-distroless-libc"
+          image: "docker.io/timberio/vector:0.55.0-distroless-libc"
           imagePullPolicy: IfNotPresent
           args:
             - --config-dir
@@ -67,6 +67,10 @@ spec:
             - name: prom-exporter
               containerPort: 9090
               protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8686
           volumeMounts:
             - name: data
               mountPath: "/vector-data-dir"
diff --git a/distribution/kubernetes/vector-stateless-aggregator/README.md b/distribution/kubernetes/vector-stateless-aggregator/README.md
index d03fb7eb5250b..d3a701364d611 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/README.md
+++ b/distribution/kubernetes/vector-stateless-aggregator/README.md
@@ -1,6 +1,6 @@
 The kubernetes manifests found in this directory have been automatically generated
 from the [helm chart `vector/vector`](https://github.com/vectordotdev/helm-charts/tree/master/charts/vector)
-version 0.51.0 with the following `values.yaml`:
+version 0.52.0 with the following `values.yaml`:
 
 ```yaml
 role: Stateless-Aggregator
diff --git a/distribution/kubernetes/vector-stateless-aggregator/configmap.yaml b/distribution/kubernetes/vector-stateless-aggregator/configmap.yaml
index e13b42240886c..5fe8fa6d1a4ca 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/configmap.yaml
+++ b/distribution/kubernetes/vector-stateless-aggregator/configmap.yaml
@@ -9,14 +9,13 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Stateless-Aggregator
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
 data:
   aggregator.yaml: |
     data_dir: /vector-data-dir
     api:
       enabled: true
-      address: 127.0.0.1:8686
-      playground: false
+      address: 0.0.0.0:8686
     sources:
       datadog_agent:
         address: 0.0.0.0:8282
diff --git a/distribution/kubernetes/vector-stateless-aggregator/deployment.yaml b/distribution/kubernetes/vector-stateless-aggregator/deployment.yaml
index 60e585952669b..d7b31fd50a07c 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/deployment.yaml
+++ b/distribution/kubernetes/vector-stateless-aggregator/deployment.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Stateless-Aggregator
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
   annotations: {}
 spec:
   replicas: 1
@@ -32,7 +32,7 @@ spec:
       dnsPolicy: ClusterFirst
       containers:
         - name: vector
-          image: "docker.io/timberio/vector:0.54.0-distroless-libc"
+          image: "docker.io/timberio/vector:0.55.0-distroless-libc"
           imagePullPolicy: IfNotPresent
           args:
             - --config-dir
@@ -65,6 +65,10 @@ spec:
             - name: prom-exporter
               containerPort: 9090
               protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8686
           volumeMounts:
             - name: data
               mountPath: "/vector-data-dir"
diff --git a/distribution/kubernetes/vector-stateless-aggregator/service-headless.yaml b/distribution/kubernetes/vector-stateless-aggregator/service-headless.yaml
index bb2c35189c395..0c6143ee4074c 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/service-headless.yaml
+++ b/distribution/kubernetes/vector-stateless-aggregator/service-headless.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Stateless-Aggregator
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
   annotations:
 spec:
   clusterIP: None
diff --git a/distribution/kubernetes/vector-stateless-aggregator/service.yaml b/distribution/kubernetes/vector-stateless-aggregator/service.yaml
index b96e58ef1ea31..2f325ba8df63a 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/service.yaml
+++ b/distribution/kubernetes/vector-stateless-aggregator/service.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Stateless-Aggregator
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
   annotations:
 spec:
   ports:
diff --git a/distribution/kubernetes/vector-stateless-aggregator/serviceaccount.yaml b/distribution/kubernetes/vector-stateless-aggregator/serviceaccount.yaml
index 2636f02bed059..0a282a591d5e7 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/serviceaccount.yaml
+++ b/distribution/kubernetes/vector-stateless-aggregator/serviceaccount.yaml
@@ -9,5 +9,5 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Stateless-Aggregator
-    app.kubernetes.io/version: "0.54.0-distroless-libc"
+    app.kubernetes.io/version: "0.55.0-distroless-libc"
 automountServiceAccountToken: true
diff --git a/website/content/en/highlights/2026-04-20-0-55-0-upgrade-guide.md b/website/content/en/highlights/2026-04-20-0-55-0-upgrade-guide.md
new file mode 100644
index 0000000000000..ee06ab61b83fd
--- /dev/null
+++ b/website/content/en/highlights/2026-04-20-0-55-0-upgrade-guide.md
@@ -0,0 +1,139 @@
+---
+date: "2026-04-20"
+title: "0.55 Upgrade Guide"
+description: "An upgrade guide that addresses breaking changes in 0.55.0"
+authors: ["pront"]
+release: "0.55.0"
+hide_on_release_notes: false
+badges:
+  type: breaking change
+---
+
+
+## Vector breaking changes
+
+1. [Observability API migrated from GraphQL to gRPC](#graphql-to-grpc)
+2. [`headers` option removed from `http` and `opentelemetry` sinks](#http-headers-removed)
+3. [`azure_logs_ingestion` sink requires explicit `azure_credential_kind`](#azure-logs-ingestion-credential)
+
+## Vector upgrade guide
+
+### Observability API migrated from GraphQL to gRPC {#graphql-to-grpc}
+
+Vector's observability API has been rewritten from GraphQL to gRPC. The following HTTP endpoints have been removed:
+
+- `/graphql` (HTTP POST queries and WebSocket subscriptions)
+- `/playground` (the GraphQL Playground)
+
+The HTTP `GET /health` endpoint is unchanged and continues to serve Kubernetes HTTP liveness/readiness probes as before.
+
+Vector will now reject configs that contain `api.graphql` or `api.playground`.
+
+The gRPC service definition is available at [`proto/vector/observability.proto`](https://github.com/vectordotdev/vector/blob/master/proto/vector/observability.proto). A standard [gRPC Health Checking Protocol](https://grpc.io/docs/guides/health-checking/) service (`grpc.health.v1.Health`) is also exposed for tooling that prefers gRPC probes, such as [`grpc-health-probe`](https://github.com/grpc-ecosystem/grpc-health-probe) or native Kubernetes gRPC probes.
+
+Note: `vector top` and `vector tap` from version 0.55.0 or later are not compatible with Vector instances running earlier versions.
+
+#### Action needed
+
+1. Please remove the `api.graphql` and `api.playground` fields from your Vector configuration.
+
+2. If you invoke `vector top` or `vector tap` with an explicit `--url`, please drop the `/graphql` suffix:
+
+    ```bash
+    # Old
+    vector top --url http://localhost:8686/graphql
+
+    # New (the gRPC API listens at the root)
+    vector top --url http://localhost:8686
+    ```
+
+3. If you interact with the API from external tooling, please migrate to the gRPC service. For example, using [`grpcurl`](https://github.com/fullstorydev/grpcurl):
+
+    ```bash
+    # Check health (standard gRPC health check)
+    grpcurl -plaintext localhost:8686 grpc.health.v1.Health/Check
+
+    # List components
+    grpcurl -plaintext localhost:8686 vector.observability.v1.ObservabilityService/GetComponents
+
+    # Stream events (tap). Note: limit and interval_ms are required and must be >= 1
+    grpcurl -plaintext \
+      -d '{"outputs_patterns": ["*"], "limit": 100, "interval_ms": 500}' \
+      localhost:8686 vector.observability.v1.ObservabilityService/StreamOutputEvents
+    ```
+
+### `headers` option removed from `http` and `opentelemetry` sinks {#http-headers-removed}
+
+The top-level `headers` option on the `http` and `opentelemetry` sinks has been removed. It was deprecated in v0.33.0 in favor of `request.headers`.
+
+#### Action needed
+
+Please move any `headers` values under `request.headers`. The exact location differs between the two sinks.
+
+For the `http` sink, `request` lives at the sink root:
+
+```yaml
+# Old
+sinks:
+  my_http:
+    type: http
+    uri: https://example.com
+    headers:
+      X-Custom-Header: value
+
+# New
+sinks:
+  my_http:
+    type: http
+    uri: https://example.com
+    request:
+      headers:
+        X-Custom-Header: value
+```
+
+For the `opentelemetry` sink, `request` lives under the `protocol` block (because the sink wraps its transport under `protocol:`):
+
+```yaml
+# Old
+sinks:
+  my_otel:
+    type: opentelemetry
+    protocol:
+      type: http
+      uri: http://localhost:5318/v1/logs
+      headers:
+        X-Custom-Header: value
+
+# New
+sinks:
+  my_otel:
+    type: opentelemetry
+    protocol:
+      type: http
+      uri: http://localhost:5318/v1/logs
+      request:
+        headers:
+          X-Custom-Header: value
+```
+
+Note: placing `request` at the `opentelemetry` sink root will not error, but the headers will be silently ignored. Please place `request` under `protocol`.
+
+### `azure_logs_ingestion` sink requires explicit `azure_credential_kind` {#azure-logs-ingestion-credential}
+
+The `azure_logs_ingestion` sink (introduced in 0.54.0) previously used `client_secret_credential` as the implicit default when Client Secret credentials were provided. That implicit default has been removed; `azure_credential_kind` must now be set explicitly.
+
+#### Action needed
+
+If you are using `azure_logs_ingestion` with Client Secret credentials, please add `azure_credential_kind: client_secret_credential` under the sink's `auth` block (alongside `azure_tenant_id`, `azure_client_id`, and `azure_client_secret`):
+
+```yaml
+sinks:
+  my_azure_logs:
+    type: azure_logs_ingestion
+    # ... remaining config
+    auth:
+      azure_credential_kind: client_secret_credential
+      azure_tenant_id: "<tenant-id>"
+      azure_client_id: "<client-id>"
+      azure_client_secret: "<client-secret>"
+```
diff --git a/website/content/en/releases/0.55.0.md b/website/content/en/releases/0.55.0.md
new file mode 100644
index 0000000000000..55389520154a6
--- /dev/null
+++ b/website/content/en/releases/0.55.0.md
@@ -0,0 +1,4 @@
+---
+title: Vector v0.55.0 release notes
+weight: 34
+---
diff --git a/website/cue/reference/administration/interfaces/kubectl.cue b/website/cue/reference/administration/interfaces/kubectl.cue
index 32258dfb538b9..94d30ab6bedc2 100644
--- a/website/cue/reference/administration/interfaces/kubectl.cue
+++ b/website/cue/reference/administration/interfaces/kubectl.cue
@@ -19,7 +19,7 @@ administration: interfaces: kubectl: {
 	role_implementations: [Name=string]: {
 		commands: {
 			_deployment_variant:       string
-			_vector_version:           "0.54"
+			_vector_version:           "0.55"
 			_namespace:                string | *"vector"
 			_controller_resource_type: string
 			_controller_resource_name: string | *_deployment_variant
diff --git a/website/cue/reference/releases/0.55.0.cue b/website/cue/reference/releases/0.55.0.cue
new file mode 100644
index 0000000000000..1e022d2151a93
--- /dev/null
+++ b/website/cue/reference/releases/0.55.0.cue
@@ -0,0 +1,583 @@
+package metadata
+
+releases: "0.55.0": {
+	date:     "2026-04-22"
+	codename: ""
+
+	whats_next: []
+
+	description: """
+		The [COSE team](https://opensource.datadoghq.com/about/#the-community-open-source-engineering-team) is excited to announce version `0.55.0`!
+
+		## Release highlights
+
+		- New `windows_event_log` source that collects logs from Windows Event Log channels using the
+		  native Windows Event Log API, with pull-mode subscriptions, bookmark-based checkpointing, and
+		  configurable field filtering.
+		- The `aws_s3` sink now supports Apache Parquet batch encoding. Events can be written as
+		  Parquet columnar files with either an auto-generated native schema or a supplied `.schema`
+		  file, and configurable compression (Snappy, ZSTD, GZIP, LZ4, or none).
+		- The `azure_blob` sink re-gains first-class [Azure authentication](https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory):
+		  Azure CLI, Managed Identity, Workload Identity, and Managed Identity-based Client Assertion
+		  credential kinds are all supported again.
+		- The `datadog_metrics` sink now defaults to the Series v2 endpoint (`/api/v2/series`) and
+		  uses zstd compression for Series v2 and Sketches, which should yield smaller payloads
+		  and more efficient batching and intake. A new `series_api_version` option (`v1` or `v2`)
+		  is available to opt back to the legacy v1 endpoint; Series v1 continues to use zlib.
+		- `vector top` is more trustworthy: per-output events for components with multiple output
+		  ports are now shown in the correct `Events Out` column, and the `Memory Used` column
+		  now reports `disabled` when the target Vector instance was started without
+		  `--allocation-tracing` instead of a misleading `0`.
+		- Better internal metrics for capacity planning and alerting:
+		  - New source-send latency distributions (`source_send_latency_seconds`,
+		    `source_send_batch_latency_seconds`) surface backpressure close to the source.
+		  - Task-transform `utilization` no longer counts time spent waiting on downstream
+		    components, giving a more representative view of transform saturation.
+		  - Fixed a regression in buffer utilization metric tracking around underflow.
+		- Fixed a performance regression in the `file` and `kubernetes_logs` sources that could
+		  cause unexpectedly high CPU usage, introduced in 0.50.0.
+
+		## Breaking Changes
+
+		See the [0.55 upgrade guide](/highlights/2026-04-20-0-55-0-upgrade-guide/) for full details
+		and migration steps. At a glance, you are affected if you:
+
+		- query or tail the Vector observability API in any way: the API has moved from
+		  GraphQL to gRPC. This includes `vector top`, `vector tap`, and anything that talked to
+		  `/graphql` or the `/playground`. The HTTP `GET /health` endpoint is unchanged and continues
+		  to serve Kubernetes HTTP probes as before.
+		- set the top-level `headers` option on the `http` or `opentelemetry` sinks: it has been
+		  removed.
+		- use the `azure_logs_ingestion` sink with Client Secret credentials: `azure_credential_kind`
+		  must now be set explicitly.
+		"""
+
+	changelog: [
+		{
+			type: "enhancement"
+			description: #"""
+				`vector` source: Implement standard gRPC health checking protocol (`grpc.health.v1.Health`)
+				alongside the existing custom health check endpoint. This enables compatibility with standard
+				tools like `grpc-health-probe` for Kubernetes and other orchestration systems.
+
+				Issue: https://github.com/vectordotdev/vector/issues/23657
+				"""#
+			contributors: ["jpds"]
+		},
+		{
+			type: "feat"
+			description: #"""
+				Added websocket support to the `nats` source and sink. The `url` field now supports both `ws://` and
+				`wss://` protocols.
+				"""#
+			contributors: ["gedemagt"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				The `geoip` enrichment table now includes a `network` field containing the CIDR network associated with the lookup result, available for all database types (City, ISP/ASN, Connection-Type, Anonymous-IP).
+				"""#
+			contributors: ["naa0yama"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				The `opentelemetry` source now supports independent configuration of OTLP decoding for logs, metrics, and traces. This allows more granular
+				control over which signal types are decoded, while maintaining backward compatibility with the existing boolean configuration.
+
+				## Simple boolean form (applies to all signals)
+
+				```yaml
+				use_otlp_decoding: true  # All signals preserve OTLP format
+				# or
+				use_otlp_decoding: false # All signals use Vector native format (default)
+				```
+
+				## Per-signal configuration
+
+				```yaml
+				use_otlp_decoding:
+				  logs: false     # Convert to Vector native format
+				  metrics: false  # Convert to Vector native format
+				  traces: true    # Preserve OTLP format
+				```
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed log message ordering on shutdown where `Vector has stopped.` was logged before components had finished draining, causing confusing output interleaved with `Waiting on running components` messages.
+
+				A new `VectorStopping` event was added in the place of the `VectorStopped` event.
+				"""#
+			contributors: ["tronboto"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				Adds new fields to parsed dnstap data: `requestMessageSize` and `responseMessageSize`. It represents the size of the DNS message.
+				"""#
+			contributors: ["esensar", "Quad9DNS"]
+		},
+		{
+			type: "feat"
+			description: #"""
+				`graph.edge_attributes` can now be added to transforms and sinks to add attributes to edges in graphs generated using `vector graph`. Memory enrichment tables are also considered for graphs, because they can have inputs and outputs.
+				"""#
+			contributors: ["esensar", "Quad9DNS"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				`opentelemetry` source: Implemented header enrichment for OTLP metrics and traces. Unlike logs, which support enriching
+				the event itself or its metadata, depending on `log_namespace` settings, for metrics and traces this setting is ignored
+				and header values are added to the event metadata.
+
+				Issue: https://github.com/vectordotdev/vector/issues/24619
+				"""#
+			contributors: ["ozanichkovsky"]
+		},
+		{
+			type: "feat"
+			description: #"""
+				The `kafka` sink now supports trace events.
+				"""#
+			contributors: ["pstalmach"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed utilization for task transforms to not account for time spent when downstream
+				is not polling. If the transform is frequently blocked on downstream components,
+				the reported utilization should be lower.
+				"""#
+			contributors: ["gwenaskell"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				The `opentelemetry` source now logs an error if it fails to start up or during runtime.
+				This can happen when the configuration is invalid, for example trying to bind to the wrong
+				IP or when hitting the open file limit.
+				"""#
+			contributors: ["fbs"]
+		},
+		{
+			type: "feat"
+			description: #"""
+				Re-introduced Azure authentication support to `azure_blob`, including Azure CLI, Managed Identity, Workload Identity, and Managed Identity-based Client Assertion authentication types.
+				"""#
+			contributors: ["jlaundry"]
+		},
+		{
+			type: "chore"
+			description: #"""
+				If using the `azure_logs_ingestion` sink (added in Vector 0.54.0) with Client Secret credentials, add `azure_credential_kind = "client_secret_credential"` under the sink's `auth` block (alongside `azure_tenant_id`, `azure_client_id`, and `azure_client_secret`). This was previously the default, and now must be explicitly configured. See the [0.55 upgrade guide](/highlights/2026-04-20-0-55-0-upgrade-guide/) for an example.
+				"""#
+			contributors: ["jlaundry"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed regression in buffer utilization metric tracking around underflow.
+				"""#
+			contributors: ["bruceg"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Reduced the memory usage in the `aggregate` transform where previous values were being held
+				even if `mode` was not set to `Diff`.
+				"""#
+			contributors: ["thomasqueirozb"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed `vector top` displaying per-output sent events in the wrong column (Bytes In instead of Events Out) for components with multiple output ports.
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				The `datadog_metrics` sink now uses zstd compression when submitting metrics to the Series v2 (`/api/v2/series`) and Sketches endpoints. Series v1 continues to use zlib (deflate).
+				"""#
+			contributors: ["vladimir-dd"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed an issue in the `file`/`kubernetes_logs` source that could cause unexpectedly high CPU usage after the async file server migration.
+				"""#
+			contributors: ["fcfangcc"]
+		},
+		{
+			type: "feat"
+			description: #"""
+				Add Apache Parquet batch encoding support for the `aws_s3` sink with flexible schema definitions.
+
+				Events can now be encoded as Parquet columnar files with multiple schema input options:
+
+				- **Native Parquet schema** — automatically generate a schema or supply `.schema` file
+				- **Configurable compression** - (Snappy, ZSTD, GZIP, LZ4, None).
+
+				Enable the `codecs-parquet` feature and configure `batch_encoding` with `codec = "parquet"` in the S3 sink configuration.
+				"""#
+			contributors: ["szibis", "petere-datadog"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				Bumped `kube` dependency from 0.93.0 to 3.0.1 and `k8s-openapi` from 0.22.0 to 0.27.0, adding support for Kubernetes API versions up to v1.35.
+				"""#
+			contributors: ["hligit"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				Added support for the ClickHouse `UUID` type in the ArrowStream format for the `clickhouse` sink. UUID columns are now automatically mapped to Arrow `Utf8` and cast by ClickHouse on insert.
+				"""#
+			contributors: ["benjamin-awd"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				`datadog_agent` source: Preserve `device` as a plain tag when decoding v2 series metrics,
+				instead of incorrectly prefixing it as `resource.device`. This matches the v1 series behavior
+				and fixes tag remapping for disk, SNMP, and other integrations that use the `device` resource type.
+				"""#
+			contributors: ["lisaqvu"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				The `datadog_metrics` sink now defaults to the Datadog series v2 endpoint (`/api/v2/series`) and
+				exposes a new `series_api_version` configuration option (`v1` or `v2`) to control which endpoint is
+				used. Set `series_api_version: v1` to fall back to the legacy v1 endpoint if needed.
+				"""#
+			contributors: ["vladimir-dd"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed the Datadog sink healthcheck endpoint computation to preserve site prefixes (e.g. `us3.`, `us5.`, `ap1.`) when deriving the API URL from intake endpoints. Previously, the healthcheck for site-specific endpoints like `https://http-intake.logs.us3.datadoghq.com` would incorrectly call `https://api.datadoghq.com` instead of `https://api.us3.datadoghq.com`, causing unintended cross-site egress traffic.
+				"""#
+			contributors: ["vladimir-dd"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed an incorrect source_lag_time_seconds measurement in sources that use `send_batch` with large event batches. When a batch was split into multiple chunks, the reference timestamp used to compute lag time was re-captured on each chunk send, causing the lag time for later chunks to be overstated by the amount of time spent waiting for the channel to accept earlier chunks. The reference timestamp is now captured once before iteration and shared across all chunks.
+				"""#
+			contributors: ["gwenaskell"]
+		},
+		{
+			type: "chore"
+			description: #"""
+				The Vector observability API has been migrated from GraphQL to gRPC for improved
+				performance, efficiency and maintainability. The `vector top` and `vector tap`
+				commands continue to work as before, as they have been updated to use the new
+				gRPC API internally. The gRPC service definition is available in
+				[`proto/vector/observability.proto`](https://github.com/vectordotdev/vector/blob/master/proto/vector/observability.proto).
+
+				Note: `vector top` and `vector tap` from version 0.55.0 or later are not
+				compatible with Vector instances running earlier versions.
+
+				- Remove the `api.graphql` and `api.playground` fields from your config. Vector
+				  now rejects configs that contain them.
+
+				- If you use `vector top` or `vector tap` with an explicit `--url`, remove the
+				  `/graphql` path suffix:
+
+				```bash
+				# Old
+				vector top --url http://localhost:8686/graphql
+
+				# New (the gRPC API listens at the root)
+				vector top --url http://localhost:8686
+				```
+
+				- The GraphQL API (HTTP endpoint `/graphql`, WebSocket subscriptions, and the
+				  GraphQL Playground at `/playground`) has been removed. You can interact with
+				  the new gRPC API using tools like
+				  [grpcurl](https://github.com/fullstorydev/grpcurl):
+
+				```bash
+				# Check health (standard gRPC health check, compatible with Kubernetes gRPC probes)
+				grpcurl -plaintext localhost:8686 grpc.health.v1.Health/Check
+
+				# List components
+				grpcurl -plaintext localhost:8686 vector.observability.v1.ObservabilityService/GetComponents
+
+				# Stream events (tap) — limit and interval_ms are required and must be >= 1
+				grpcurl -plaintext \
+				  -d '{"outputs_patterns": ["*"], "limit": 100, "interval_ms": 500}' \
+				  localhost:8686 vector.observability.v1.ObservabilityService/StreamOutputEvents
+				```
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "chore"
+			description: #"""
+				The `headers` option has been removed from the `http` and `opentelemetry` sinks.
+				Use `request.headers` instead. On the `opentelemetry` sink, `request` is nested under
+				`protocol`; see the [0.55 upgrade guide](/highlights/2026-04-20-0-55-0-upgrade-guide/)
+				for examples. This option has been deprecated since v0.33.0.
+				"""#
+			contributors: ["thomasqueirozb"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				Sources now record the distribution metrics `source_send_latency_seconds` (measuring the time spent
+				blocking on a single events chunk send operation on the output) and `source_send_batch_latency_seconds`
+				(encompassing all chunks within a received events batch).
+				"""#
+			contributors: ["gwenaskell"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				`vector top` terminal UI now shows `disabled` in the Memory Used column when the connected Vector instance was not started with `--allocation-tracing`, instead of displaying misleading zeros. A new `GetAllocationTracingStatus` gRPC endpoint is queried on connect to determine the status.
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "feat"
+			description: #"""
+				Added a new `windows_event_log` source that collects logs from Windows Event Log channels using the native Windows Event Log API with pull-mode subscriptions, bookmark-based checkpointing, and configurable field filtering.
+				"""#
+			contributors: ["tot19"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed Windows service state checks in `vector service start`/`stop`, and made `vector service stop` wait until the service reaches `Stopped`. Added `--stop-timeout` to `vector service stop` and `vector service uninstall`.
+				"""#
+			contributors: ["iMithrellas"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				The text content generated by the `demo_logs` source has changed: the
+				pool of fake usernames and the pool of fake domain TLDs are now both
+				defined inside Vector rather than pulled from an external crate. The
+				line formats (`apache_common`, `apache_error`, `json`, `syslog`,
+				`bsd_syslog`) are unchanged. If any of your tests or downstream
+				pipelines assert on specific generated usernames or TLDs, please
+				update those expectations.
+				"""#
+			contributors: ["pront"]
+		},
+	]
+
+	vrl_changelog: """
+		### [0.32.0 (2026-04-16)]
+
+		#### New Features
+
+		- Added a new `encode_csv` function that encodes an array of values into a CSV-formatted string. This is the inverse of the existing `parse_csv` function and supports an optional single-byte delimiter (defaults to `,`).
+
+		authors: armleth (https://github.com/vectordotdev/vrl/pull/1649)
+		- Added `to_entries` and `from_entries` with jq-compatible behavior: `to_entries` supports both objects and arrays, and `from_entries` accepts `key`/`Key`/`name`/`Name` and `value`/`Value` aliases.
+
+		authors: close2code-palm (https://github.com/vectordotdev/vrl/pull/1653)
+
+		#### Enhancements
+
+		- Added `except` parameter to `flatten` function to exclude specific keys from being flattened.
+
+		authors: benjamin-awd (https://github.com/vectordotdev/vrl/pull/1682)
+
+		#### Fixes
+
+		- Fixed a bug where the REPL input validator was executing programs instead of only compiling them, causing functions with side effects (e.g. `http_request`) to run twice per submission.
+
+		authors: prontidis (https://github.com/vectordotdev/vrl/pull/1701)
+
+
+		### [0.31.0 (2026-03-05)]
+		"""
+
+	commits: [
+		{sha: "bc30368b01670480b4e83bebdd9eb09ec78bd2e3", date: "2026-03-10 01:08:29 UTC", description: "make build vrl-docs work with released VRL version", pr_number: 24877, scopes: ["vdev"], type: "fix", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 21, deletions_count: 19},
+		{sha: "3f98053f5105d0bedbd9b1cb0f15917b22819e36", date: "2026-03-10 01:42:09 UTC", description: "use cross-strip tools when packaging RPMs for non-x86_64 targets", pr_number: 24873, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 29, deletions_count: 4},
+		{sha: "0d462e06d4fd1088cd7054cd9ee7c49f91fe9b65", date: "2026-03-10 19:46:12 UTC", description: "increase timeouts for vdev compilation", pr_number: 24881, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 4, deletions_count: 4},
+		{sha: "e66270f937998848a439252d46a160ad085b17c6", date: "2026-03-10 19:52:15 UTC", description: "add retries to address choco intermittent failures", pr_number: 24880, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 26, deletions_count: 5},
+		{sha: "145d333fc0fc8a53a087c64c56775ff55612d4a8", date: "2026-03-10 20:36:38 UTC", description: "remove unused compilation timings workflow", pr_number: 24882, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 0, deletions_count: 77},
+		{sha: "685c31fff163575019ce315b4b88991b92e3a61f", date: "2026-03-10 18:09:30 UTC", description: "pin actions to sha", pr_number: 24884, scopes: ["ci"], type: "chore", breaking_change: false, author: "StepSecurity Bot", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "40143b32740e253be37b214cf9f860851f65e6e0", date: "2026-03-10 18:31:15 UTC", description: "pin image tags in Dockerfiles", pr_number: 24885, scopes: ["ci"], type: "chore", breaking_change: false, author: "StepSecurity Bot", files_count: 7, insertions_count: 11, deletions_count: 11},
+		{sha: "b1c7d7bf7133c43e472d15b4e4345e571043d63a", date: "2026-03-10 22:59:33 UTC", description: "fix broken links", pr_number: 24886, scopes: ["website"], type: "chore", breaking_change: false, author: "Thomas", files_count: 15, insertions_count: 18, deletions_count: 18},
+		{sha: "1cc1c25147bab5ead963ff8065086d3b5daa1b2f", date: "2026-03-11 00:13:05 UTC", description: "minor fixes to release template", pr_number: 24887, scopes: ["releasing"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 13, deletions_count: 13},
+		{sha: "e1ecad3d67361dd38f074e71da45d4d90b3578bb", date: "2026-03-11 00:37:56 UTC", description: "add docs::warnings macro support and warn about no auth", pr_number: 24866, scopes: ["website"], type: "feat", breaking_change: false, author: "Thomas", files_count: 3, insertions_count: 15, deletions_count: 1},
+		{sha: "909b08318dd309c8a59e1c40241be42f46e67db8", date: "2026-03-11 00:53:15 UTC", description: "0.54.0 post release steps", pr_number: 24888, scopes: ["releasing"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 51, insertions_count: 512, deletions_count: 144},
+		{sha: "df396d18b6101f1af5a75bbc918accb9291a7a74", date: "2026-03-11 18:01:29 UTC", description: "minor fixes to release changelog", pr_number: 24893, scopes: ["external docs"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 2, deletions_count: 4},
+		{sha: "356409dba6cc78cdaa0d070941efd9c0d52b1579", date: "2026-03-11 23:53:27 UTC", description: "test_udp_syslog can overflow default size receive buffer", pr_number: 24878, scopes: ["unit tests"], type: "fix", breaking_change: false, author: "strophy", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "901a571712d7714f5ad38defb60b01dbabe43617", date: "2026-03-11 19:11:14 UTC", description: "show top level api configuration in API reference page", pr_number: 24894, scopes: ["website"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 1, deletions_count: 3},
+		{sha: "202b65612ee4cc27a338fc16a94d880c01b8ace6", date: "2026-03-11 19:34:07 UTC", description: "fix docker warning when publishing", pr_number: 24895, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 0, deletions_count: 1},
+		{sha: "2958f982b221060b68dcb63837823837d4c0600a", date: "2026-03-11 22:57:01 UTC", description: "fetch full history in changelog workflow so origin/master is available", pr_number: 24898, scopes: ["ci"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 2, deletions_count: 0},
+		{sha: "d112a1b6826d0a35ff27be40d949d09ee66b6a7e", date: "2026-03-11 23:17:02 UTC", description: "Support per-signal OTLP decoding config", pr_number: 24822, scopes: ["opentelemetry source"], type: "feat", breaking_change: false, author: "Pavlos Rontidis", files_count: 5, insertions_count: 472, deletions_count: 24},
+		{sha: "ff7164a43992728f3490e38dbf72e5125b162f50", date: "2026-03-12 00:55:04 UTC", description: "bump protoc version", pr_number: 24902, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "71d597f894f59ff6190913b1091a1c568fedba63", date: "2026-03-12 17:15:23 UTC", description: "remove unused Hugo shortcodes", pr_number: 24903, scopes: ["website"], type: "chore", breaking_change: false, author: "Thomas", files_count: 8, insertions_count: 0, deletions_count: 296},
+		{sha: "40f94ee88a453a6a900a00606fc940d990c5143e", date: "2026-03-12 19:20:22 UTC", description: "bump VRL and resolve RUSTSEC-2021-0139", pr_number: 24908, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 11, insertions_count: 59, deletions_count: 94},
+		{sha: "478d7c4561a1a8b2390e97973ec9315963dd0dfb", date: "2026-03-13 10:54:17 UTC", description: "bump kube from 0.93.0 to 3.0.1 and k8s-openapi from 0.22.0 to 0.27.0", pr_number: 24787, scopes: ["deps"], type: "chore", breaking_change: false, author: "Haitao Li", files_count: 8, insertions_count: 146, deletions_count: 140},
+		{sha: "958ff6357a6ad700d592aabf53c6b161f5fbb9a0", date: "2026-03-12 21:54:25 UTC", description: "replace netlink-* crates with procfs", pr_number: 24765, scopes: ["deps"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 4, insertions_count: 148, deletions_count: 369},
+		{sha: "d141e60bfcc923a6d2df34c16f49db5fc0734e3c", date: "2026-03-12 23:40:12 UTC", description: "deprecate azure_monitor_logs sink", pr_number: 24910, scopes: ["external docs"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 1, deletions_count: 0},
+		{sha: "01c86e826a83175002b609b9a404325931f11cc1", date: "2026-03-13 21:24:47 UTC", description: "bump async-executor to 1.14.0", pr_number: 24919, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 8, deletions_count: 5},
+		{sha: "891643edcb177b9cc1e8db8fb753b36ad07f9182", date: "2026-03-14 10:54:10 UTC", description: "Add Windows Event Log source", pr_number: 24305, scopes: ["new source"], type: "feat", breaking_change: false, author: "tot19", files_count: 26, insertions_count: 10298, deletions_count: 14},
+		{sha: "4e958028e836a62080d70ac1099d7db635d5b739", date: "2026-03-14 02:38:46 UTC", description: "implement standard gRPC health checking protocol", pr_number: 24916, scopes: ["vector source"], type: "fix", breaking_change: false, author: "Jonathan Davies", files_count: 6, insertions_count: 139, deletions_count: 7},
+		{sha: "2064a15aa1029aec49dd2b4c8b3a09a4b76ff9e7", date: "2026-03-13 22:55:11 UTC", description: "update dd-rust-license-tool from 1.0.5 to 1.0.6", pr_number: 24920, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 6, deletions_count: 1},
+		{sha: "60cd0e1347d4ae680da806401a6c89be1a2c0536", date: "2026-03-14 00:09:55 UTC", description: "Bump rmp from 0.8.14 to 0.8.15 and resolve RUSTSEC-2024-0436", pr_number: 24922, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 3, insertions_count: 3, deletions_count: 13},
+		{sha: "da85874bd56ee88699778fb3ed3f4f847915581c", date: "2026-03-14 00:46:55 UTC", description: "bump aws crates and resolve RUSTSEC-2026-0002", pr_number: 24909, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 5, insertions_count: 277, deletions_count: 178},
+		{sha: "59f53e2bc72caae239970b355b4edab14176cd17", date: "2026-03-14 01:11:33 UTC", description: "fix typos in rustdoc comments", pr_number: 24923, scopes: ["external docs"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 4, insertions_count: 4, deletions_count: 4},
+		{sha: "89bc15fc1815572000d1fd2e9e20c4b98116d1b2", date: "2026-03-14 05:17:33 UTC", description: "Bump lapin from 2.5.3 to 4.3.0", pr_number: 23316, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 8, insertions_count: 183, deletions_count: 156},
+		{sha: "51aebc8445fece5e0e7daf62603bf004b9dfb8ce", date: "2026-03-16 22:18:15 UTC", description: "bump undici from 7.18.2 to 7.24.1 in /website", pr_number: 24925, scopes: ["website deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 3, deletions_count: 3},
+		{sha: "e3225205fa88d04c4d76d0e485f27dc771900693", date: "2026-03-17 06:31:01 UTC", description: "add UUID type support for ArrowStream", pr_number: 24856, scopes: ["clickhouse sink"], type: "enhancement", breaking_change: false, author: "Benjamin Dornel", files_count: 4, insertions_count: 43, deletions_count: 4},
+		{sha: "7390fe0bd4922b6f804b7c59e56dac36747af86d", date: "2026-03-16 19:08:19 UTC", description: "document Cargo feature placement rules", pr_number: 24933, scopes: ["external docs"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 25, deletions_count: 0},
+		{sha: "c27f6d6dd8acc01f57e93c53af4fad0138a07aa1", date: "2026-03-16 20:05:44 UTC", description: "update heim fork to remove unmaintained crates", pr_number: 24924, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 4, insertions_count: 71, deletions_count: 214},
+		{sha: "0d8bb9bea3418bd6993e08b456fc495050a42930", date: "2026-03-17 01:07:42 UTC", description: "bump pulsar from 6.3.1 to 6.7.0", pr_number: 24746, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 4, insertions_count: 24, deletions_count: 23},
+		{sha: "fd766a0738802e9dee2eae1e5d6f243ed9c69229", date: "2026-03-16 21:10:58 UTC", description: "make rdkafka use gssapi-vendored when publishing/testing", pr_number: 24912, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 4, insertions_count: 18, deletions_count: 10},
+		{sha: "d38425ad1302489d7420a9d24447224559a5a446", date: "2026-03-17 01:16:13 UTC", description: "bump regex from 1.11.2 to 1.12.3", pr_number: 24796, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 4, insertions_count: 13, deletions_count: 13},
+		{sha: "c2fc606306e10e02263d2982f20c8c17f69a143b", date: "2026-03-16 22:05:29 UTC", description: "check Cargo.lock for changes after cargo check/clippy", pr_number: 24935, scopes: ["vdev"], type: "feat", breaking_change: false, author: "Thomas", files_count: 6, insertions_count: 57, deletions_count: 12},
+		{sha: "0573297e8ffcc1ad7a096f50f012b2efd0518c27", date: "2026-03-17 03:54:36 UTC", description: "Added feature flag for websockets in async-nats", pr_number: 24291, scopes: ["nats source", "nats sink"], type: "feat", breaking_change: false, author: "Jesper", files_count: 3, insertions_count: 6, deletions_count: 1},
+		{sha: "3905b4f12067fb2508f0bcb031607da84623f17f", date: "2026-03-16 23:07:53 UTC", description: "Update README.md and cleanup unused commands", pr_number: 24936, scopes: ["vdev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 7, insertions_count: 43, deletions_count: 95},
+		{sha: "1eca246d5bf297afcc153b555c19ac5f9e9ff372", date: "2026-03-17 00:49:29 UTC", description: "replace derivative macro with standard Default derives on enums", pr_number: 24938, scopes: ["dev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 31, insertions_count: 74, deletions_count: 119},
+		{sha: "a8730894c366cd5232353530fef4a4970cd6c307", date: "2026-03-17 19:00:09 UTC", description: "bump lz4_flex from 0.11.5 to 0.11.6", pr_number: 24939, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "9dc3d3e9f7d486ce363975f21b1e1b3b537cb46d", date: "2026-03-17 19:11:36 UTC", description: "reduce memory when not in `Diff` mode", pr_number: 24943, scopes: ["aggregate transform"], type: "fix", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 89, deletions_count: 24},
+		{sha: "42b844e76882fa5cbf1fd5cfafcf653101dc9ad0", date: "2026-03-17 19:13:06 UTC", description: "remove unused fs package", pr_number: 24945, scopes: ["website deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 0, deletions_count: 6},
+		{sha: "218aa4d29b7b0922f604b7f6d8a3ebd0cc8e0931", date: "2026-03-17 20:01:18 UTC", description: "Add osv-scanner.toml and ignore MAL-2025-3174", pr_number: 24946, scopes: ["website"], type: "chore", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 3, deletions_count: 0},
+		{sha: "83bcf4cb297f85525f88a3cff1870ab8fbddd47b", date: "2026-03-17 20:23:49 UTC", description: "bump quinn-proto from 0.11.9 to 0.11.14", pr_number: 24926, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 12, deletions_count: 4},
+		{sha: "dc9d8de0c8f2ff7a04a7373820f1ef652ed30520", date: "2026-03-18 03:29:20 UTC", description: "switch to v2 endpoint", pr_number: 24842, scopes: ["datadog_metrics sink"], type: "chore", breaking_change: false, author: "Vladimir Zhuk", files_count: 32, insertions_count: 382, deletions_count: 98},
+		{sha: "1444b2bac009aa51343820dba7a36ce119dce56f", date: "2026-03-17 22:44:09 UTC", description: "Bump rdkafka from 0.38.0 to 0.39.0", pr_number: 24602, scopes: ["deps"], type: "chore", breaking_change: false, author: "zapdos26", files_count: 4, insertions_count: 22, deletions_count: 5},
+		{sha: "089db6775500eb6cbdfa5f4b7e6069185a8d61c5", date: "2026-03-18 11:45:28 UTC", description: "add `network` CIDR field to lookup results", pr_number: 24576, scopes: ["enrichment tables"], type: "feat", breaking_change: false, author: "Naoki Aoyama", files_count: 5, insertions_count: 40, deletions_count: 8},
+		{sha: "5011c5dfd20a0200c37a42a6c3001ae3df94ef4d", date: "2026-03-17 23:16:34 UTC", description: "bump docker/build-push-action from 6.18.0 to 6.19.2", pr_number: 24734, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 4, deletions_count: 4},
+		{sha: "6527346294203cec7fb0d8b86c7fc98b26c14ff0", date: "2026-03-18 03:17:07 UTC", description: "bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0", pr_number: 24733, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 6, deletions_count: 6},
+		{sha: "b1a43a4ba24b0e76e57736953a0f6f9d0ee58328", date: "2026-03-18 04:52:26 UTC", description: "bump sysinfo from 0.37.2 to 0.38.2", pr_number: 24816, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 61, deletions_count: 39},
+		{sha: "cfee4fb9d1853a5ae7db85e0bd5647ca7a7b57b0", date: "2026-03-18 00:54:19 UTC", description: "upgrade mold linker from 1.2.1/2.0.0 to 2.40.4", pr_number: 24947, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 3, insertions_count: 3, deletions_count: 3},
+		{sha: "fbb1e4b501d6081d72f864da891a98464e60d097", date: "2026-03-18 02:05:08 UTC", description: "Improve buffer utilization metric tracking", pr_number: 24911, scopes: ["buffers"], type: "fix", breaking_change: false, author: "Bruce Guenter", files_count: 2, insertions_count: 66, deletions_count: 95},
+		{sha: "95f439420ae1dea0df7fbd295e7f354b144360c8", date: "2026-03-18 18:25:48 UTC", description: "place per-output sent events in Events Out column", pr_number: 24951, scopes: ["api"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 3, insertions_count: 8, deletions_count: 3},
+		{sha: "30936678f92a03c827f9fd8506fa02693332f59b", date: "2026-03-19 03:34:43 UTC", description: "add support for edge_attributes in graph configuration", pr_number: 24593, scopes: ["cli"], type: "feat", breaking_change: false, author: "Ensar Sarajčić", files_count: 7, insertions_count: 505, deletions_count: 125},
+		{sha: "a8f3a9b45e6d2f6a897995bce85e3ad9a9a13442", date: "2026-03-19 03:39:25 UTC", description: "expose message size when parsing dnstap data", pr_number: 24552, scopes: ["dnstap source"], type: "enhancement", breaking_change: false, author: "Ensar Sarajčić", files_count: 4, insertions_count: 51, deletions_count: 0},
+		{sha: "f34e8d32140ab25024ff51863ed9b5038defdc80", date: "2026-03-19 17:13:57 UTC", description: "regenerate VRL docs with message size fields", pr_number: 24960, scopes: ["dnstap source"], type: "docs", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 2, deletions_count: 0},
+		{sha: "483db702e3745f4b823edac33e1d76bf7060f964", date: "2026-03-19 22:16:35 UTC", description: "add libsasl2-2 runtime dep to Debian-based images", pr_number: 24962, scopes: ["releasing"], type: "fix", breaking_change: false, author: "Vladimir Zhuk", files_count: 2, insertions_count: 2, deletions_count: 2},
+		{sha: "5f0f03e181a031ee51a71e2bd9fcf0698f073a5b", date: "2026-03-19 23:13:14 UTC", description: "bump fakedata_generator from 0.5.0 to 0.7.1", pr_number: 24800, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 3, insertions_count: 5, deletions_count: 5},
+		{sha: "3c69a8b8a668c6d20ea57d6883a3771803893648", date: "2026-03-19 19:43:24 UTC", description: "instruct agents to use PR template when creating PRs", pr_number: 24965, scopes: ["external docs"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 4, deletions_count: 0},
+		{sha: "f02424389cfa4abf8e1168b5b63fb227499c9bd4", date: "2026-03-19 19:54:48 UTC", description: "add Datadog static analysis workflow", pr_number: 24966, scopes: ["ci"], type: "feat", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 26, deletions_count: 0},
+		{sha: "a7fae1f7ad17b51e3960850300b45955ac0952e0", date: "2026-03-19 20:27:12 UTC", description: "add code coverage workflow with Datadog upload", pr_number: 24964, scopes: ["ci"], type: "feat", breaking_change: false, author: "Pavlos Rontidis", files_count: 3, insertions_count: 54, deletions_count: 2},
+		{sha: "37a48ae53eb0e5930f4f4506903eb5b10c613789", date: "2026-03-20 05:44:04 UTC", description: "bump cargo-lock from 10.1.0 to 11.0.1", pr_number: 24748, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 11, deletions_count: 37},
+		{sha: "97dfb6c6a870a162d07827706e85f5ee2fe3b3a9", date: "2026-03-20 17:53:12 UTC", description: "bump const-str from 1.0.0 to 1.1.0", pr_number: 24815, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 3, deletions_count: 3},
+		{sha: "18898e0149f43924a07554303cce3d0a4595eb5b", date: "2026-03-20 21:22:10 UTC", description: "bump quickcheck to 1.1.0 and use workspace dep", pr_number: 24970, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 8, insertions_count: 218, deletions_count: 31},
+		{sha: "2097fc35d7dc8d3caee9607d563165374e312e21", date: "2026-03-21 03:12:17 UTC", description: "bump criterion from 0.7.0 to 0.8.2", pr_number: 24803, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 6, insertions_count: 31, deletions_count: 9},
+		{sha: "2c334d223578ea17d7ca5bbbf305f21c9b68a7e2", date: "2026-03-21 05:07:16 UTC", description: "Add support for traces in kafka sink", pr_number: 24639, scopes: ["kafka sink"], type: "enhancement", breaking_change: false, author: "Piotr Stalmach", files_count: 4, insertions_count: 160, deletions_count: 12},
+		{sha: "c748d6f9e19632cb64f666058794aa2d9004926f", date: "2026-03-21 02:28:58 UTC", description: "use cargo nextest in coverage workflow to prevent test pollution", pr_number: 24973, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 4, deletions_count: 1},
+		{sha: "4d8ca64dbbbc2434bd4a69a3d46705c3fad6a56c", date: "2026-03-23 21:53:30 UTC", description: "pin localstack image to SHA256 digest", pr_number: 24988, scopes: ["dev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "6ef3752d12be1e8de38449df30f953f75301f64f", date: "2026-03-23 20:52:03 UTC", description: "remove futures features and resolve RUSTSEC-2026-0058", pr_number: 24975, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 3, insertions_count: 124, deletions_count: 166},
+		{sha: "415059f727929adee4d88801ca760be2ac0b967a", date: "2026-03-23 23:19:24 UTC", description: "bump async-nats from 0.42.0 to 0.46.0", pr_number: 24974, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 3, insertions_count: 6, deletions_count: 16},
+		{sha: "05f7b4338b06ef7c8731cd8f391ca4e62f875b43", date: "2026-03-23 20:45:40 UTC", description: "add missing Windows source files to integration_windows filter", pr_number: 24992, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 3, deletions_count: 0},
+		{sha: "f62a9ffa8729fb1e7e6d074d4d115c96f7f2740a", date: "2026-03-23 21:25:16 UTC", description: "ignore RUSTSEC-2026-0049 (rustls-webpki) until rustls can be upgraded", pr_number: 24986, scopes: ["deps"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 3, deletions_count: 0},
+		{sha: "aedd2a66cb27b26621fff2c6d7dbd53a199fe0fa", date: "2026-03-23 21:26:02 UTC", description: "add security warning to path template field", pr_number: 24983, scopes: ["file sink"], type: "docs", breaking_change: false, author: "Pavlos Rontidis", files_count: 2, insertions_count: 4, deletions_count: 0},
+		{sha: "93a9771b1824c848c8efdf7166638226f01f42d2", date: "2026-03-24 14:22:00 UTC", description: "replace GraphQL observability API with gRPC, remove async-graphql dependencies", pr_number: 24364, scopes: ["api"], type: "chore", breaking_change: true, author: "Pavlos Rontidis", files_count: 128, insertions_count: 3020, deletions_count: 16042},
+		{sha: "f1d8a93402168a2c5daf1eab2f4584aa5762bac4", date: "2026-03-25 00:52:15 UTC", description: "correct stop/start state checks and add configurable stop timeout", pr_number: 24772, scopes: ["windows platform"], type: "fix", breaking_change: false, author: "iMithrellas", files_count: 3, insertions_count: 100, deletions_count: 32},
+		{sha: "0122cf6ec8fe7cce20a2bb694db137e3d5a9038a", date: "2026-03-24 20:04:14 UTC", description: "remove deprecated `headers` option from http and opentelemetry sinks", pr_number: 24994, scopes: ["sinks"], type: "chore", breaking_change: true, author: "Thomas", files_count: 9, insertions_count: 5, deletions_count: 43},
+		{sha: "8bac1dbdcd27550444ea3b73e9dd4ef36172b2d4", date: "2026-03-24 23:00:40 UTC", description: "switch series v2 and sketches to zstd compression", pr_number: 24956, scopes: ["datadog_metrics sink"], type: "chore", breaking_change: false, author: "Vladimir Zhuk", files_count: 8, insertions_count: 629, deletions_count: 277},
+		{sha: "753cf9a7c03a5cef85a29f3561666d94e9084d8b", date: "2026-03-24 23:57:50 UTC", description: "consolidate reference documentation into detailed docs table in AGENTS.md", pr_number: 25036, scopes: ["internal docs"], type: "docs", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 15, deletions_count: 22},
+		{sha: "47b5b02b9fdd13b67294df65175e9eca99c4cd8b", date: "2026-03-25 00:36:30 UTC", description: "split deny check into optional (all) and required (licenses)", pr_number: 24990, scopes: ["ci"], type: "chore", breaking_change: false, author: "Thomas", files_count: 3, insertions_count: 38, deletions_count: 6},
+		{sha: "ca9b29bc52b7c7ba857c337b25278edbad1c5e66", date: "2026-03-25 21:17:07 UTC", description: "bump serial_test from 3.2.0 to 3.4.0", pr_number: 25022, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 7, deletions_count: 6},
+		{sha: "a2918e6ac4b874dc7c67b558a1e2bc9fd2b4ae81", date: "2026-03-25 21:58:38 UTC", description: "bump quick-junit from 0.5.2 to 0.6.0", pr_number: 25032, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 3, deletions_count: 3},
+		{sha: "209b252deed214144fd2a6d4ed6c5ea3a3e08821", date: "2026-03-25 23:11:04 UTC", description: "enforce and fix markdownlint rules", pr_number: 25038, scopes: ["dev"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 82, insertions_count: 415, deletions_count: 407},
+		{sha: "7dc3ce3f34de6b79c0f09b4e44fe0e9d87cc09c2", date: "2026-03-26 02:32:34 UTC", description: "add links to design issues", pr_number: 25046, scopes: ["dev"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 2, insertions_count: 3, deletions_count: 0},
+		{sha: "4fba57e9c4d6561c126851df8c4065221b44e992", date: "2026-03-26 07:51:02 UTC", description: "allow to add headers to metadata for OpenTelemetry metrics and traces", pr_number: 24942, scopes: ["opentelemetry source"], type: "feat", breaking_change: false, author: "Oleksandr Zanichkovskyi", files_count: 6, insertions_count: 463, deletions_count: 47},
+		{sha: "498d1daa38432a329d168a2eec97a212922e71bc", date: "2026-03-26 04:51:47 UTC", description: "improve CLA instructions", pr_number: 25039, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 12, deletions_count: 13},
+		{sha: "bc1e6bdde6b07f51efd4764c65d75c32d056499c", date: "2026-03-26 23:10:51 UTC", description: "bump uuid from 1.18.1 to 1.22.0", pr_number: 25025, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 3, insertions_count: 37, deletions_count: 15},
+		{sha: "072f6284c83279cd920177b32114f10f8fd5164c", date: "2026-03-26 23:15:29 UTC", description: "bump snafu from 0.8.9 to 0.9.0", pr_number: 25029, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 34, deletions_count: 13},
+		{sha: "041769359ba0a9d68017e10e6e84cb7a83b3df27", date: "2026-03-26 23:22:32 UTC", description: "bump picomatch from 2.3.1 to 2.3.2 in /website", pr_number: 25047, scopes: ["website deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 3, deletions_count: 3},
+		{sha: "d0c6cea89661577079d3eec790e4c054772de7d6", date: "2026-03-26 23:25:49 UTC", description: "bump yaml from 1.10.2 to 1.10.3 in /website", pr_number: 25043, scopes: ["website deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 3, deletions_count: 3},
+		{sha: "5fcf1516151f659b5832fc433a4e10a219e31c7b", date: "2026-03-26 23:26:25 UTC", description: "bump ipnet from 2.11.0 to 2.12.0", pr_number: 25030, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "09629f02d60614a38b20b49cb10acbce47a9f6cc", date: "2026-03-26 23:49:33 UTC", description: "bump docker/setup-buildx-action from 3.12.0 to 4.0.0", pr_number: 25003, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 3, insertions_count: 4, deletions_count: 4},
+		{sha: "3255b66b2e8a2fb7ec3412904b856a8349a236ab", date: "2026-03-26 23:49:57 UTC", description: "bump actions/cache from 5.0.3 to 5.0.4", pr_number: 25002, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "9337c80bb9d2491a8d617df408c20a88385d719a", date: "2026-03-26 23:50:14 UTC", description: "bump docker/login-action from 3.7.0 to 4.0.0", pr_number: 25001, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 4, insertions_count: 6, deletions_count: 6},
+		{sha: "84abc68df859d58b2a7681757e52aca7a8094ad2", date: "2026-03-27 04:24:22 UTC", description: "bump bollard from 0.19.2 to 0.20.2", pr_number: 25026, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 4, insertions_count: 9, deletions_count: 13},
+		{sha: "6267fcc78d8cd347f6405ab03ca100b97944a5ef", date: "2026-03-27 06:31:32 UTC", description: "log error", pr_number: 24708, scopes: ["opentelemetry source"], type: "fix", breaking_change: false, author: "bas smit", files_count: 2, insertions_count: 10, deletions_count: 2},
+		{sha: "e8526b2a3ef7ac257d0fb816f611cddbc494a478", date: "2026-03-27 06:32:43 UTC", description: "bump deadpool from 0.12.2 to 0.13.0", pr_number: 25014, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 3, insertions_count: 23, deletions_count: 6},
+		{sha: "af15a5a595f342038fd3368854fa75c74c31e932", date: "2026-03-27 05:09:12 UTC", description: "vanila `cargo build` should run on windows", pr_number: 24991, scopes: ["dev"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 4, insertions_count: 13, deletions_count: 7},
+		{sha: "4e6b49d6951b1f6ed9e2851aec674577ccc4c2b2", date: "2026-03-27 20:47:55 UTC", description: "deduct downstream utilization on task transforms", pr_number: 24731, scopes: ["metrics"], type: "fix", breaking_change: false, author: "Yoenn Burban", files_count: 3, insertions_count: 221, deletions_count: 18},
+		{sha: "a7450cdbba3eb86782d67bea39b81e5b641067d9", date: "2026-03-27 18:50:50 UTC", description: "bump tempfile from 3.23.0 to 3.27.0", pr_number: 25016, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 14, deletions_count: 14},
+		{sha: "7066adccecc24fe005f1fb7c934bbda4b557ea6c", date: "2026-03-27 18:51:39 UTC", description: "bump proptest from 1.10.0 to 1.11.0", pr_number: 25021, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 5, insertions_count: 7, deletions_count: 7},
+		{sha: "3ca3374c5b0359a3839f6c8091e2c3632faec719", date: "2026-03-27 23:02:57 UTC", description: "bump rust_decimal from 1.39.0 to 1.40.0", pr_number: 24799, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 3, deletions_count: 3},
+		{sha: "c1f34ef803fe5365a5be54f46877590bc8c91ba6", date: "2026-03-28 00:44:05 UTC", description: "bump brace-expansion from 1.1.12 to 1.1.13 in /website", pr_number: 25056, scopes: ["website deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 3, deletions_count: 3},
+		{sha: "d29a524ea05dcbb6f823121ffdff449ecd960673", date: "2026-03-28 00:49:17 UTC", description: "bump security-framework from 3.5.1 to 3.6.0", pr_number: 24763, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 7, deletions_count: 7},
+		{sha: "89e5c343c631e36090d2543106b88685d7a1c908", date: "2026-03-28 00:55:57 UTC", description: "bump juliangruber/read-file-action from 1.1.7 to 1.1.8", pr_number: 25000, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "55be10e5860afd47656a67a08335bb17a1d641c8", date: "2026-03-30 20:14:44 UTC", description: "add missing `contents: read` permission to integration review jobs", pr_number: 25067, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 3, deletions_count: 0},
+		{sha: "d906ba19487c0552be7557d49a3f1dbfcd2405d9", date: "2026-03-31 01:12:33 UTC", description: "upgrade rustls from 0.23.23 to 0.23.37", pr_number: 25075, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 25, deletions_count: 13},
+		{sha: "6a50bd50c9d482511f5a2a21466a3427dd752263", date: "2026-03-31 01:27:02 UTC", description: "update security policy structure and content", pr_number: 25074, scopes: ["internal docs"], type: "chore", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 43, deletions_count: 59},
+		{sha: "122cca4678172bbc0c067c65fcc909c6b7aa9ce6", date: "2026-03-31 01:51:55 UTC", description: "update GHCR cleanup workflow", pr_number: 25037, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 18, deletions_count: 14},
+		{sha: "87ed519cc40011224208914f1dd79b7240f7e1d7", date: "2026-03-31 17:36:52 UTC", description: "consolidate advisory ignores with issue links", pr_number: 25076, scopes: ["dev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 4, deletions_count: 12},
+		{sha: "84c7af2264deacb1afc0529671d53c8c6792bf88", date: "2026-03-31 17:41:49 UTC", description: "install vdev via setup action in ci-integration-review workflow", pr_number: 25077, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 10, deletions_count: 4},
+		{sha: "d732259aaa6b5e156b001672ccf0e59be5e84802", date: "2026-03-31 18:08:30 UTC", description: "pin GitHub actions to full sha", pr_number: 25080, scopes: ["ci"], type: "chore", breaking_change: false, author: "StepSecurity Bot", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "0943dd938f247b0a1963e6bcb1a464ae49392c5f", date: "2026-03-31 22:54:02 UTC", description: "migrate from markdownlint-cli to markdownlint-cli2", pr_number: 25081, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 6, insertions_count: 13, deletions_count: 19},
+		{sha: "50345d5929ecb45d74e1355e612f044c24ff4a93", date: "2026-03-31 22:27:15 UTC", description: "skip test runner pull, datadog-ci install, and checkout when int tests won't run", pr_number: 25068, scopes: ["ci"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 80, deletions_count: 74},
+		{sha: "24d8db42e01e28b590e5484fede9279908805901", date: "2026-04-01 02:04:57 UTC", description: "remove unused publish-homebrew workflow", pr_number: 25085, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 0, deletions_count: 36},
+		{sha: "df00c7eec91ecb35eb0a8db0249701562de7dc87", date: "2026-04-01 23:37:50 UTC", description: "pin Pulsar integration test image to 4.1.3", pr_number: 25097, scopes: ["ci"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 3, deletions_count: 1},
+		{sha: "639c924c733442bcc7443817d16ea0dd737ded54", date: "2026-04-02 04:24:01 UTC", description: "bump debian from `1d3c811` to `26f98cc` in /distribution/docker/debian in the docker-images group across 1 directory", pr_number: 24996, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "9dbdb0662b668867ac8db6e444ac710d4346a037", date: "2026-04-02 04:25:08 UTC", description: "bump distroless/static from `28efbe9` to `47b2d72` in /distribution/docker/distroless-static in the docker-images group across 1 directory", pr_number: 24998, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "3c879836d586695701e9cf60fed3e7ef4b408f2e", date: "2026-04-02 04:25:30 UTC", description: "bump debian from `1d3c811` to `26f98cc` in /distribution/docker/distroless-libc in the docker-images group across 1 directory", pr_number: 24997, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "9f484c2b9c1c219f44c2fd5289c40e3a4b63f6e3", date: "2026-04-02 03:26:12 UTC", description: "prevent script injection in integration review workflow", pr_number: 25106, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 18, deletions_count: 2},
+		{sha: "9055388bc0c89a56177f6df60de7a7e09fe74de1", date: "2026-04-02 17:48:09 UTC", description: "add repo-wide prettier config for YAML, JS, TS, and JSON", pr_number: 25082, scopes: ["dev"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 226, insertions_count: 4028, deletions_count: 2779},
+		{sha: "b59c9a25b899223b6633776eeafe2e67fe418640", date: "2026-04-02 19:32:25 UTC", description: "Add http_server source to semantic PR scope list", pr_number: 25078, scopes: ["ci"], type: "chore", breaking_change: false, author: "steveduan-IDME", files_count: 1, insertions_count: 1, deletions_count: 0},
+		{sha: "1a78c93520ab25377b7162c9aa5756f29492f433", date: "2026-04-02 21:57:21 UTC", description: "fix Pulsar TLS integration tests with latest image", pr_number: 25099, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 5, deletions_count: 3},
+		{sha: "dedb9667511691731c30c05235c319867d96580c", date: "2026-04-03 19:19:53 UTC", description: "pin npm transitive deps via package-lock.json and npm ci", pr_number: 25115, scopes: ["ci"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 5, insertions_count: 3449, deletions_count: 24},
+		{sha: "04f3b782e95f044fc7307fe4f6230dc48793800b", date: "2026-04-03 18:23:45 UTC", description: "Reverse performance regression in buffer metrics", pr_number: 24995, scopes: ["buffers"], type: "fix", breaking_change: false, author: "Bruce Guenter", files_count: 1, insertions_count: 215, deletions_count: 114},
+		{sha: "51030d2aade15deae23297a1ed1994cb36c530e9", date: "2026-04-03 20:36:36 UTC", description: "make file source tests not flaky", pr_number: 24957, scopes: ["dev"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 17, deletions_count: 6},
+		{sha: "2fe515ccd2dfc23d98b84300e4fd87bee27b35fa", date: "2026-04-03 22:13:12 UTC", description: "use helm-charts develop branch for K8s E2E tests", pr_number: 25118, scopes: ["ci"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 7, insertions_count: 44, deletions_count: 24},
+		{sha: "b428aba5dd4f26285ce907212acae648bdb6d8df", date: "2026-04-03 23:39:14 UTC", description: "resolve build.rs HEAD path in worktrees", pr_number: 25120, scopes: ["dev"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 18, deletions_count: 1},
+		{sha: "738c1d7758024a074f4fbe9ba9fa6d6110b316d7", date: "2026-04-04 05:14:48 UTC", description: "run K8s E2E suite on a weekly schedule", pr_number: 25119, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "703590bff3c2e49aa722c493329c753b1943c4ff", date: "2026-04-06 17:25:55 UTC", description: "Migrate smp regression workflow auth from static secrets to oidc", pr_number: 25112, scopes: ["ci"], type: "chore", breaking_change: false, author: "Caleb Metz", files_count: 1, insertions_count: 27, deletions_count: 12},
+		{sha: "2d6fea2dfe7536202c83305cff5021bfadc90442", date: "2026-04-07 09:29:11 UTC", description: "update check-spelling", pr_number: 25124, scopes: ["ci"], type: "chore", breaking_change: false, author: "Jed Laundry", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "1152614bc73e74df27986d1bff7864a376025544", date: "2026-04-06 17:32:37 UTC", description: "collect K8s diagnostics on E2E test failure", pr_number: 25114, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 32, deletions_count: 1},
+		{sha: "cab8fab16b2da5478d495cd37091b525f527d8ba", date: "2026-04-06 23:37:04 UTC", description: "bump the artifact group across 1 directory with 2 updates", pr_number: 24999, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 6, insertions_count: 17, deletions_count: 17},
+		{sha: "4b2353a35dd54b888cdee7d1ca70c8723e12873c", date: "2026-04-06 23:46:52 UTC", description: "bump nick-fields/retry from 3.0.2 to 4.0.0", pr_number: 25102, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 5, insertions_count: 7, deletions_count: 7},
+		{sha: "9e897388fbf772a23c48df93de923a05b2d3ecbe", date: "2026-04-07 04:05:11 UTC", description: "bump fast-xml-parser from 5.3.7 to 5.5.9 in /scripts/environment/npm-tools in the npm_and_yarn group across 1 directory", pr_number: 25127, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 113, deletions_count: 81},
+		{sha: "0c5fd58228bfab0dd9f6e81a1dc651da2ea8e670", date: "2026-04-07 20:14:58 UTC", description: "improve dashboard column layout", pr_number: 25135, scopes: ["api top"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 8, deletions_count: 8},
+		{sha: "02f281d6ad2786f8bbfad9ece820b8d9f4925571", date: "2026-04-07 23:38:29 UTC", description: "show \"disabled\" in Memory Used when allocation tracing is off", pr_number: 25138, scopes: ["api top"], type: "enhancement", breaking_change: false, author: "Pavlos Rontidis", files_count: 7, insertions_count: 65, deletions_count: 2},
+		{sha: "256db9c12951987ea235a0c5a4a88898d5187642", date: "2026-04-08 19:32:50 UTC", description: "avoid unused-mut warning on Windows builds", pr_number: 25142, scopes: ["api top"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 4, deletions_count: 3},
+		{sha: "711b039fe7a8ddac2296dfe1e78685bb901795e6", date: "2026-04-08 21:30:51 UTC", description: "bump lodash from 4.17.23 to 4.18.1 in /website", pr_number: 25113, scopes: ["website deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 3, deletions_count: 3},
+		{sha: "dcf98a7ccf54080a74626e9277ac5b2f8340ded8", date: "2026-04-08 21:37:57 UTC", description: "fix spell check CI failures", pr_number: 25144, scopes: [], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 3, insertions_count: 3, deletions_count: 3},
+		{sha: "30d9a58669556a9bc014ba0b2ea4f33f8e372d98", date: "2026-04-09 13:43:50 UTC", description: "Expand support for Azure authentication types", pr_number: 24729, scopes: ["azure_blob sink"], type: "feat", breaking_change: false, author: "Jed Laundry", files_count: 28, insertions_count: 1542, deletions_count: 342},
+		{sha: "985f669ffae07c1104ae9cec1b097e74130e0341", date: "2026-04-09 09:50:38 UTC", description: "high CPU usage after async file server migration", pr_number: 25064, scopes: ["file source"], type: "fix", breaking_change: false, author: "fcfangcc", files_count: 5, insertions_count: 212, deletions_count: 11},
+		{sha: "9c4abf31a91d888d0b4ca204643b0e6e1a559466", date: "2026-04-09 05:26:19 UTC", description: "emit VectorStopped after topology drains", pr_number: 25083, scopes: ["shutdown"], type: "fix", breaking_change: false, author: "tronboto", files_count: 3, insertions_count: 32, deletions_count: 10},
+		{sha: "26eef13087e1a463efa4bdcc9d3919b13936e06c", date: "2026-04-09 00:26:27 UTC", description: "preserve `device` tag from v2 series resources", pr_number: 25146, scopes: ["datadog_agent source"], type: "fix", breaking_change: false, author: "Lisa Vu", files_count: 3, insertions_count: 69, deletions_count: 0},
+		{sha: "b57d8b0ef0ec12a1645b556a6b1bf080dc66e50b", date: "2026-04-09 04:53:19 UTC", description: "bump basic-ftp from 5.2.0 to 5.2.1 in /scripts/environment/npm-tools in the npm_and_yarn group across 1 directory", pr_number: 25147, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 3, deletions_count: 3},
+		{sha: "51f6fce6d850dc4c6833d910013a189119068734", date: "2026-04-09 21:35:17 UTC", description: "fix typo in 24532 changelog fragment", pr_number: 25155, scopes: ["shutdown"], type: "chore", breaking_change: false, author: "Jonathan Davies", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "a7f6487c94b98766bdff802aac0cd1372b0311f6", date: "2026-04-13 21:07:40 UTC", description: "bump basic-ftp from 5.2.1 to 5.2.2 in /scripts/environment/npm-tools in the npm_and_yarn group across 1 directory", pr_number: 25170, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 3, deletions_count: 3},
+		{sha: "5ab0ba0d27392c70995a3d5e182a8307e65c641f", date: "2026-04-13 18:37:29 UTC", description: "bump axios from 1.13.5 to 1.15.0 in /website", pr_number: 25172, scopes: ["website deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 8, deletions_count: 8},
+		{sha: "480ca58f52a019454a36e9c9b754791224fcee57", date: "2026-04-13 19:22:13 UTC", description: "extract vector-vrl-doc-builder into unpublished crate", pr_number: 25034, scopes: ["vdev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 10, insertions_count: 114, deletions_count: 58},
+		{sha: "3112033384d47b0eae9fa36a1297dab32cac1f88", date: "2026-04-13 20:08:25 UTC", description: "convert TOML config examples to YAML", pr_number: 25163, scopes: ["website"], type: "docs", breaking_change: false, author: "Pavlos Rontidis", files_count: 68, insertions_count: 2096, deletions_count: 1829},
+		{sha: "43f620435a353b048c40661f59a2d2d18f2419ed", date: "2026-04-13 20:24:37 UTC", description: "fix panic in allocation tracing dealloc path", pr_number: 25136, scopes: ["observability"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 2, insertions_count: 192, deletions_count: 13},
+		{sha: "c6574fd66c328ef57fba27d2ad5422666c3e18eb", date: "2026-04-13 20:26:51 UTC", description: "replace custom Health RPC with standard gRPC health service", pr_number: 25139, scopes: ["api"], type: "enhancement", breaking_change: true, author: "Pavlos Rontidis", files_count: 16, insertions_count: 119, deletions_count: 77},
+		{sha: "44637c3056c8850752e6f1c6aef8ab5ead810b0f", date: "2026-04-14 19:04:29 UTC", description: "bump datadog-ci from 5.12.0 to 5.13.0", pr_number: 25187, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 145, deletions_count: 2278},
+		{sha: "16458a84ba60660bbdc4258e3245981102da2921", date: "2026-04-14 19:48:09 UTC", description: "bump follow-redirects from 1.15.11 to 1.16.0 in /website", pr_number: 25189, scopes: ["website deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 3, deletions_count: 3},
+		{sha: "e32661adb9138ff721d882f059f35eaf792d355c", date: "2026-04-15 02:53:04 UTC", description: "add Parquet encoder with schema_file and auto infer schema support", pr_number: 25156, scopes: ["aws_s3 sink"], type: "feat", breaking_change: false, author: "Peter Ehikhuemen", files_count: 21, insertions_count: 1818, deletions_count: 43},
+		{sha: "51121047d3201394c2958e4a66696f3aef2d3f11", date: "2026-04-15 21:25:02 UTC", description: "bump rsa from 0.9.3 to 0.9.10", pr_number: 25198, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 10, deletions_count: 9},
+		{sha: "dac7c31501defdf451f9422b6a569358fb5ec19e", date: "2026-04-15 21:53:42 UTC", description: "bump rustls-webpki 0.103.10 to 0.103.12 (RUSTSEC-2026-0099)", pr_number: 25200, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 5, deletions_count: 3},
+		{sha: "6818b9c348cd4c3edd39f9f303f66362676e47a3", date: "2026-04-15 22:22:40 UTC", description: "add work-in-progress label workflow for docs PRs", pr_number: 24950, scopes: ["ci"], type: "feat", breaking_change: false, author: "Pavlos Rontidis", files_count: 3, insertions_count: 68, deletions_count: 0},
+		{sha: "2d14034bf8115764c52636a59ec298d7444a4d28", date: "2026-04-15 22:52:21 UTC", description: "override smol-toml to 1.6.1 for markdownlint-cli2", pr_number: 25202, scopes: ["deps"], type: "fix", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 8, deletions_count: 3},
+		{sha: "08c9f1e6b54cf1b30e88d536f3545e74ff193c0f", date: "2026-04-15 23:48:46 UTC", description: "bump VRL and add feature for enable_crypto_functions", pr_number: 25205, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 2, deletions_count: 1},
+		{sha: "a1469590bed6996b1eb7001248232b0aa48cd777", date: "2026-04-16 00:06:08 UTC", description: "bump rand 0.10.0 to 0.10.1 and 0.9.2 to 0.9.4", pr_number: 25204, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 33, deletions_count: 32},
+		{sha: "5ba8405bf48cd64509bf02388c7901451bbe67f4", date: "2026-04-16 00:20:05 UTC", description: "bump version to 0.3.1", pr_number: 25206, scopes: ["vdev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 2, deletions_count: 2},
+		{sha: "ce651754d4e2eb134ee9ab2fe85a8a3a5ed923a0", date: "2026-04-16 17:16:53 UTC", description: "add source latency metric and fix source lag time on large batches", pr_number: 24987, scopes: ["sources"], type: "feat", breaking_change: false, author: "Yoenn Burban", files_count: 7, insertions_count: 122, deletions_count: 28},
+		{sha: "8138c4593455dd284475ed4ed61fe55ee176bd34", date: "2026-04-16 19:27:11 UTC", description: "update DD RUM/Logs config to cose site", pr_number: 25213, scopes: ["website"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 9, deletions_count: 2},
+		{sha: "61b4563fc60211feba19dcbf9296872b8640ec94", date: "2026-04-16 20:19:11 UTC", description: "fix secrets in static analysis workflow", pr_number: 25208, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 6, deletions_count: 3},
+		{sha: "467ef876a286df316ba273e4ad1779f1b08ba392", date: "2026-04-17 03:18:13 UTC", description: "preserve site prefix when computing API endpoint", pr_number: 25211, scopes: ["datadog_common sink"], type: "fix", breaking_change: false, author: "Vladimir Zhuk", files_count: 2, insertions_count: 32, deletions_count: 1},
+		{sha: "9efe09d254fdad82f5d1239e3eae28348390ddfa", date: "2026-04-17 04:34:41 UTC", description: "modernize cross ubuntu bootstrap script", pr_number: 25215, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 3, insertions_count: 43, deletions_count: 24},
+		{sha: "8790fa07177e93242395746b8328e2cd2e88b440", date: "2026-04-17 21:32:34 UTC", description: "split VERSION-dependent packaging targets into Makefile.packaging", pr_number: 25101, scopes: ["dev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 135, deletions_count: 108},
+		{sha: "35351b9cc9ae7dffdf1a461203137905f987a8b5", date: "2026-04-18 01:22:12 UTC", description: "replace native encoding fixture patch files with cfg-gated code", pr_number: 24971, scopes: ["codecs"], type: "chore", breaking_change: false, author: "Thomas", files_count: 14, insertions_count: 130, deletions_count: 278},
+		{sha: "604866d560deea7a14cbfa767a8ca99eee07089a", date: "2026-04-20 22:58:40 UTC", description: "use parent site for RUM to resolve intake host", pr_number: 25224, scopes: ["website"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "bdcf7476c55141ecf535cec6caafea7b2cc3d16d", date: "2026-04-20 23:43:03 UTC", description: "bump dorny/paths-filter from 3.0.2 to 4.0.1", pr_number: 25105, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 4, insertions_count: 6, deletions_count: 6},
+		{sha: "c2022541ee792988c465ca9a76b93a0f54ea4e00", date: "2026-04-20 23:43:44 UTC", description: "add greptimedb v0 support deprecation entry", pr_number: 25226, scopes: ["deprecations"], type: "docs", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 2, deletions_count: 0},
+		{sha: "0f7574ad33ce07243ab8f9d6399c5e6c2f451af1", date: "2026-04-21 00:49:34 UTC", description: "fix panic in allocation tracing dealloc path", pr_number: 25222, scopes: ["observability"], type: "revert", breaking_change: false, author: "Pavlos Rontidis", files_count: 2, insertions_count: 13, deletions_count: 192},
+		{sha: "3ca3e61ec8b8cd89be836b47346343069b229398", date: "2026-04-21 01:11:31 UTC", description: "use CUE raw multi-line strings in release generator", pr_number: 25228, scopes: ["ci"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 5, deletions_count: 2},
+	]
+}
diff --git a/website/cue/reference/versions.cue b/website/cue/reference/versions.cue
index ae51453c8f728..0ca3310065d7f 100644
--- a/website/cue/reference/versions.cue
+++ b/website/cue/reference/versions.cue
@@ -2,6 +2,7 @@ package metadata
 
 // This has to be maintained manually because there's currently no way to sort versions programmatically
 versions: [string, ...string] & [
+	"0.55.0",
 	"0.54.0",
 	"0.53.0",
 	"0.52.0",
diff --git a/website/layouts/releases/single.html b/website/layouts/releases/single.html
index fe4cb606aacdf..f83cb9e349122 100644
--- a/website/layouts/releases/single.html
+++ b/website/layouts/releases/single.html
@@ -31,6 +31,14 @@
       </p>
       {{ end }}
 
+      {{ with $highlights }}
+      <div class="mt-8 grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-3">
+        {{ range . }}
+        {{ .Render "li" }}
+        {{ end }}
+      </div>
+      {{ end }}
+
       {{ with $release.description }}
       <div class="mt-8 prose dark:prose-dark max-w-none">
         {{ . | markdownify }}
@@ -60,20 +68,6 @@
         </div>
       </div>
 
-      {{ with $highlights }}
-      <div class="mt-8">
-        <div class="prose dark:prose-dark">
-          {{ partial "heading.html" (dict "text" "Highlights" "level" 2) }}
-        </div>
-
-        <div class="mt-4 grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-3">
-          {{ range . }}
-          {{ .Render "li" }}
-          {{ end }}
-        </div>
-      </div>
-      {{ end }}
-
       {{ with $release.known_issues }}
       {{ if gt (len $release.known_issues) 0 }}
       <div class="mt-8">

From f36ed0e2cebf36efdc7392aed0ed52ae28a29101 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 22 Apr 2026 15:54:48 -0400
Subject: [PATCH 149/326] chore(website): render release date on per-version
 release page (#25244)

Mirror the pattern used by the highlights/guides content header and
render \$release.date below the hero on /releases/<version>/ pages.
The date already exists in each version's CUE (e.g. date: "2026-04-22"
in website/cue/reference/releases/0.55.0.cue) but was only surfaced
on the releases index (releases/li.html).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 website/layouts/releases/single.html | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/website/layouts/releases/single.html b/website/layouts/releases/single.html
index f83cb9e349122..c1708ea955a9c 100644
--- a/website/layouts/releases/single.html
+++ b/website/layouts/releases/single.html
@@ -18,6 +18,15 @@
       {{ partial "hero.html" . }}
     </div>
 
+    {{ with $release.date }}
+    {{ $date := . | dateFormat "January 2, 2006" }}
+    <div class="mt-3 flex items-center space-x-3 text-gray-500 dark:text-gray-300">
+      <time datetime="{{ $date }}" class="text-sm">
+        {{ $date }}
+      </time>
+    </div>
+    {{ end }}
+
     <div>
       {{ with $release.codename }}
       <p class="inline-flex space-x-4 border dark:border-gray-700 rounded-md py-2 px-3.5">

From 29b17aadc63fdd9a9bdc3b64bbd8f9c647844cdb Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 22 Apr 2026 16:30:30 -0400
Subject: [PATCH 150/326] fix(ci): skip re-adding WIP label on synchronize if
 already approved (#25246)

The add_wip_label workflow fires on synchronize to catch docs paths
added in later pushes. However, it also re-added the label after a
reviewer had already approved and remove_wip_label removed it.

Guard against that by checking the latest review state per member:
skip only when at least one member approved and none have a standing
changes-requested review. This preserves the "catch docs added later"
behavior while avoiding label churn after approval.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/add_wip_label.yml | 30 ++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/add_wip_label.yml b/.github/workflows/add_wip_label.yml
index a07f9ca0921fa..9a1260b693e81 100644
--- a/.github/workflows/add_wip_label.yml
+++ b/.github/workflows/add_wip_label.yml
@@ -17,6 +17,34 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
+      - name: Check member review state
+        id: check
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { data: reviews } = await github.rest.pulls.listReviews({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+            });
+
+            const allowed = ['MEMBER', 'OWNER'];
+            const latestByUser = new Map();
+            for (const r of reviews) {
+              if (!allowed.includes(r.author_association)) continue;
+              if (r.state === 'COMMENTED') continue;
+              latestByUser.set(r.user.id, r.state);
+            }
+
+            const states = [...latestByUser.values()];
+            const hasApproved = states.includes('APPROVED');
+            const hasChangesRequested = states.includes('CHANGES_REQUESTED');
+            const skip = hasApproved && !hasChangesRequested;
+
+            core.info(`Latest member review states: ${states.join(', ') || '(none)'}`);
+            core.info(`skip=${skip}`);
+            core.setOutput('skip', skip);
+      - if: steps.check.outputs.skip != 'true'
+        uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
         with:
           labels: "work in progress"

From d99899e2f9cb94c8d421270ada8688243402b5a1 Mon Sep 17 00:00:00 2001
From: "shalk(xiao kun)" <xshalk@outlook.com>
Date: Thu, 23 Apr 2026 04:41:08 +0800
Subject: [PATCH 151/326] fix(website): fix docs sidebar expand/collapse
 navigation (#25238)

- Use strings.HasPrefix to keep sections expanded when on any child page
  (the previous eq check only matched the section index, not child pages)
- Add @click="open = true" to section title links so clicking the title
  expands the group in addition to navigating, without requiring the chevron

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 website/layouts/partials/docs/sidebar.html | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/website/layouts/partials/docs/sidebar.html b/website/layouts/partials/docs/sidebar.html
index f9c81ed763cd8..e9b9af98de037 100644
--- a/website/layouts/partials/docs/sidebar.html
+++ b/website/layouts/partials/docs/sidebar.html
@@ -47,10 +47,13 @@
 {{ define "subsection-group" }}
 {{ $here := .here }}
 {{ $section := .section }}
-{{ $open := or (.ctx.IsAncestor $section) (eq .ctx.RelPermalink $here) }}
+{{ $open := or (.ctx.IsAncestor $section) (strings.HasPrefix $here .ctx.RelPermalink) }}
+{{ $isActive := eq .ctx.RelPermalink $here }}
 <div x-data="{ open: {{ $open }} }">
   <span class="flex justify-between items-center">
-    {{ template "link" (dict "here" $here "url" .ctx.RelPermalink "title" (.ctx.Params.short | default .ctx.Title)) }}
+    <a href="{{ .ctx.RelPermalink }}" @click="open = true" class="flex-1 text-gray-800 font-semibold tracking-tight dark:text-gray-400 dark:hover:text-purple-v hover:text-purple-v{{ if $isActive }} font-bold text-secondary dark:text-primary{{ end }}">
+      {{ .ctx.Params.short | default .ctx.Title }}
+    </a>
     {{ template "chevron-icon" }}
   </span>
 

From ecdaa50ac15e6a26e811bf21e3a6e33729bebb33 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 22 Apr 2026 19:23:12 -0400
Subject: [PATCH 152/326] fix(ci): verify choco package install after 5xx from
 feed (#25116)

* fix(ci): verify choco package install after 5xx from feed

* fix(ci): match package name in choco list output to verify install
---
 scripts/environment/bootstrap-windows-2025.ps1 | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/environment/bootstrap-windows-2025.ps1 b/scripts/environment/bootstrap-windows-2025.ps1
index 862efc554a187..9686811a97238 100644
--- a/scripts/environment/bootstrap-windows-2025.ps1
+++ b/scripts/environment/bootstrap-windows-2025.ps1
@@ -11,7 +11,10 @@ function Install-ChocoPackage {
 
     for ($attempt = 1; $attempt -le $MaxRetries; $attempt++) {
         choco install $Package --execution-timeout=7200 -y
-        if ($LASTEXITCODE -eq 0) {
+        # Both `choco install` and `choco list` can exit 0 even on 5xx errors
+        # from the feed, so verify install by matching a "name|version" line
+        # in the list output. --limit-output strips headers/warnings.
+        if ((choco list --limit-output -e $Package) -match "^$([regex]::Escape($Package))\|") {
             return
         }
 

From f1557d68c8e7f36feb8e2d0c7a04286817c6bf9f Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 23 Apr 2026 10:16:39 -0400
Subject: [PATCH 153/326] feat(unit tests): add `expected_event_count` field to
 test outputs (#25186)

* feat(unit tests): add `expected_event_count` field to test outputs

Add an optional `expected_event_count` field to the `TestOutput` config
struct, allowing users to assert on the number of events emitted by a
transform in unit tests. The count check is independent of conditions
and is verified first.

- Reject `expected_event_count: 0` with conditions at build time
- Error on conflicting counts when multiple outputs share extract_from
- Allow `expected_event_count: 0` to suppress the "no events received"
  error when zero events are genuinely expected

Closes #20278

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(unit tests): add missing authors line to changelog fragment

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(unit tests): reject zero-count outputs with conditions after merge

A config could bypass the zero-count/conditions validation by splitting
expected_event_count: 0 and conditions across two output entries sharing
the same extract_from. After merge the combined entry had count 0 with
non-empty conditions, causing conditions to pass vacuously against zero
events. Add a post-merge check to catch this.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix author

* chore(unit tests): replace output tuple with BuiltOutput struct

Addresses review feedback on PR #25186: the
`(Option<usize>, Vec<Vec<Condition>>)` tuple in `build_outputs` was too
opaque, so this introduces a `BuiltOutput` struct with named fields.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(unit tests): fix indoc indentation in expected_event_count tests

Addresses review nit on PR #25186: the YAML in
`expected_event_count_correct` and `expected_event_count_wrong` was
over-indented; align it with the other tests in the file.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../20278_expected_event_count.feature.md     |   3 +
 src/config/mod.rs                             |  16 +-
 src/config/unit_test/mod.rs                   |  58 ++++-
 src/config/unit_test/tests.rs                 | 235 ++++++++++++++++++
 src/config/unit_test/unit_test_components.rs  |  22 +-
 5 files changed, 323 insertions(+), 11 deletions(-)
 create mode 100644 changelog.d/20278_expected_event_count.feature.md

diff --git a/changelog.d/20278_expected_event_count.feature.md b/changelog.d/20278_expected_event_count.feature.md
new file mode 100644
index 0000000000000..23dac198ecdea
--- /dev/null
+++ b/changelog.d/20278_expected_event_count.feature.md
@@ -0,0 +1,3 @@
+Unit tests now support an optional `expected_event_count` field on test outputs, allowing assertions on the number of events emitted by a transform.
+
+authors: pront
diff --git a/src/config/mod.rs b/src/config/mod.rs
index dceade72d6eeb..4a24954926c13 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -446,11 +446,12 @@ impl TestDefinition<String> {
                 let TestOutput {
                     extract_from,
                     conditions,
+                    expected_event_count,
                 } = old;
 
-                (extract_from.to_vec(), conditions)
+                (extract_from.to_vec(), conditions, expected_event_count)
             })
-            .filter_map(|(extract_from, conditions)| {
+            .filter_map(|(extract_from, conditions, expected_event_count)| {
                 let mut outputs = Vec::new();
                 for from in extract_from {
                     if no_outputs_from.contains(&from) {
@@ -471,6 +472,7 @@ impl TestDefinition<String> {
                     Some(TestOutput {
                         extract_from: outputs.into(),
                         conditions,
+                        expected_event_count,
                     })
                 }
             })
@@ -525,6 +527,7 @@ impl TestDefinition<OutputId> {
                     .collect::<Vec<_>>()
                     .into(),
                 conditions: old.conditions,
+                expected_event_count: old.expected_event_count,
             })
             .collect();
 
@@ -596,6 +599,15 @@ pub struct TestOutput<T: 'static = OutputId> {
 
     /// The conditions to run against the output to validate that they were transformed as expected.
     pub conditions: Option<Vec<conditions::AnyCondition>>,
+
+    /// The expected number of events to be produced by the transform.
+    ///
+    /// If specified, the test will fail if the number of events emitted by the
+    /// transform does not match this value. This check is independent of
+    /// `conditions` -- the count is verified first, then each condition is
+    /// evaluated against the output events separately. This is useful for
+    /// transforms that may emit multiple events.
+    pub expected_event_count: Option<usize>,
 }
 
 #[cfg(all(test, feature = "sources-file", feature = "sinks-console"))]
diff --git a/src/config/unit_test/mod.rs b/src/config/unit_test/mod.rs
index 4d8c1fa97ad65..5020c0b506629 100644
--- a/src/config/unit_test/mod.rs
+++ b/src/config/unit_test/mod.rs
@@ -293,14 +293,17 @@ impl UnitTestBuildMetadata {
         let mut template_sinks = IndexMap::new();
         let mut test_result_rxs = Vec::new();
         // Add sinks with checks
-        for (ids, checks) in outputs {
+        for (ids, built) in outputs {
             let (tx, rx) = oneshot::channel();
             let sink_ids = ids.clone();
             let sink_config = UnitTestSinkConfig {
                 test_name: test_name.to_string(),
                 transform_ids: ids.iter().map(|id| id.to_string()).collect(),
                 result_tx: Arc::new(Mutex::new(Some(tx))),
-                check: UnitTestSinkCheck::Checks(checks),
+                check: UnitTestSinkCheck::Checks {
+                    conditions: built.conditions,
+                    expected_event_count: built.expected_event_count,
+                },
             };
 
             test_result_rxs.push(rx);
@@ -567,10 +570,16 @@ fn build_and_validate_inputs(
     }
 }
 
+#[derive(Default)]
+pub(super) struct BuiltOutput {
+    pub(super) expected_event_count: Option<usize>,
+    pub(super) conditions: Vec<Vec<Condition>>,
+}
+
 fn build_outputs(
     test_outputs: &[TestOutput],
-) -> Result<IndexMap<Vec<OutputId>, Vec<Vec<Condition>>>, Vec<String>> {
-    let mut outputs: IndexMap<Vec<OutputId>, Vec<Vec<Condition>>> = IndexMap::new();
+) -> Result<IndexMap<Vec<OutputId>, BuiltOutput>, Vec<String>> {
+    let mut outputs: IndexMap<Vec<OutputId>, BuiltOutput> = IndexMap::new();
     let mut errors = Vec::new();
 
     for output in test_outputs {
@@ -590,10 +599,47 @@ fn build_outputs(
             }
         }
 
+        let expected_event_count = output.expected_event_count;
+        if expected_event_count == Some(0) && !conditions.is_empty() {
+            errors.push(format!(
+                "output for {:?} has expected_event_count of 0 but also defines conditions; \
+                 conditions cannot be evaluated when no events are expected",
+                output.extract_from
+            ));
+        }
         outputs
             .entry(output.extract_from.clone().to_vec())
-            .and_modify(|existing_conditions| existing_conditions.push(conditions.clone()))
-            .or_insert(vec![conditions.clone()]);
+            .and_modify(|existing| {
+                if let (Some(prev), Some(new)) =
+                    (existing.expected_event_count, expected_event_count)
+                {
+                    if prev != new {
+                        errors.push(format!(
+                            "conflicting expected_event_count for extract_from {:?}: {} vs {}",
+                            output.extract_from, prev, new
+                        ));
+                    }
+                } else if existing.expected_event_count.is_none() {
+                    existing.expected_event_count = expected_event_count;
+                }
+                existing.conditions.push(conditions.clone());
+            })
+            .or_insert_with(|| BuiltOutput {
+                expected_event_count,
+                conditions: vec![conditions.clone()],
+            });
+    }
+
+    // Post-merge validation: after merging entries that share the same
+    // extract_from, reject any that ended up with expected_event_count of 0 and
+    // non-empty conditions (which would pass vacuously against zero events).
+    for (extract_from, built) in &outputs {
+        if built.expected_event_count == Some(0) && built.conditions.iter().any(|c| !c.is_empty()) {
+            errors.push(format!(
+                "output for {extract_from:?} has expected_event_count of 0 but also defines conditions; \
+                 conditions cannot be evaluated when no events are expected",
+            ));
+        }
     }
 
     if errors.is_empty() {
diff --git a/src/config/unit_test/tests.rs b/src/config/unit_test/tests.rs
index 938286ac9ba9f..6881ba6f75901 100644
--- a/src/config/unit_test/tests.rs
+++ b/src/config/unit_test/tests.rs
@@ -1298,3 +1298,238 @@ async fn test_glob_input() {
     let mut tests = build_unit_tests(config).await.unwrap();
     assert!(tests.remove(0).run().await.errors.is_empty());
 }
+
+#[tokio::test]
+async fn expected_event_count_correct() {
+    crate::test_util::trace_init();
+
+    let config: ConfigBuilder = crate::config::format::deserialize(
+        indoc! {r#"
+            transforms:
+              foo:
+                inputs:
+                  - ignored
+                type: remap
+                source: |
+                  . = [{"message": "one"}, {"message": "two"}, {"message": "three"}]
+            tests:
+              - name: event count check
+                inputs:
+                  - insert_at: foo
+                    value: doesnt matter
+                outputs:
+                  - extract_from: foo
+                    expected_event_count: 3
+                    conditions:
+                      - type: vrl
+                        source: |
+                          assert!(exists(.message), "message field must exist")
+        "#},
+        crate::config::Format::Yaml,
+    )
+    .unwrap();
+
+    let mut tests = build_unit_tests(config).await.unwrap();
+    assert!(tests.remove(0).run().await.errors.is_empty());
+}
+
+#[tokio::test]
+async fn expected_event_count_wrong() {
+    crate::test_util::trace_init();
+
+    let config: ConfigBuilder = crate::config::format::deserialize(
+        indoc! {r#"
+            transforms:
+              foo:
+                inputs:
+                  - ignored
+                type: remap
+                source: |
+                  . = [{"message": "one"}, {"message": "two"}, {"message": "three"}]
+            tests:
+              - name: wrong event count
+                inputs:
+                  - insert_at: foo
+                    value: doesnt matter
+                outputs:
+                  - extract_from: foo
+                    expected_event_count: 2
+                    conditions:
+                      - type: vrl
+                        source: |
+                          assert!(exists(.message), "message field must exist")
+        "#},
+        crate::config::Format::Yaml,
+    )
+    .unwrap();
+
+    let mut tests = build_unit_tests(config).await.unwrap();
+    let errors = tests.remove(0).run().await.errors;
+    assert!(!errors.is_empty());
+    assert!(
+        errors
+            .iter()
+            .any(|e| e.contains("expected 2 events") && e.contains("but received 3")),
+        "expected event count error, got: {errors:?}"
+    );
+}
+
+#[tokio::test]
+async fn expected_event_count_zero_no_conditions() {
+    crate::test_util::trace_init();
+
+    let config: ConfigBuilder = crate::config::format::deserialize(
+        indoc! {r#"
+            transforms:
+              foo:
+                inputs:
+                  - ignored
+                type: remap
+                source: |
+                  if .message == "drop me" {
+                    abort
+                  }
+            tests:
+              - name: zero events expected
+                inputs:
+                  - insert_at: foo
+                    value: "drop me"
+                outputs:
+                  - extract_from: foo
+                    expected_event_count: 0
+        "#},
+        crate::config::Format::Yaml,
+    )
+    .unwrap();
+
+    let mut tests = build_unit_tests(config).await.unwrap();
+    assert!(tests.remove(0).run().await.errors.is_empty());
+}
+
+#[tokio::test]
+async fn expected_event_count_zero_with_conditions_rejected() {
+    crate::test_util::trace_init();
+
+    let config: ConfigBuilder = crate::config::format::deserialize(
+        indoc! {r#"
+            transforms:
+              foo:
+                inputs:
+                  - ignored
+                type: remap
+                source: |
+                  if .message == "drop me" {
+                    abort
+                  }
+            tests:
+              - name: zero with conditions
+                inputs:
+                  - insert_at: foo
+                    value: "drop me"
+                outputs:
+                  - extract_from: foo
+                    expected_event_count: 0
+                    conditions:
+                      - type: vrl
+                        source: |
+                          assert!(exists(.message), "unreachable")
+        "#},
+        crate::config::Format::Yaml,
+    )
+    .unwrap();
+
+    let errs = build_unit_tests(config).await.err().unwrap();
+    assert!(
+        errs.iter()
+            .any(|e| e.contains("expected_event_count of 0") && e.contains("conditions")),
+        "expected config error about zero count with conditions, got: {errs:?}"
+    );
+}
+
+#[tokio::test]
+async fn expected_event_count_conflicting_values() {
+    crate::test_util::trace_init();
+
+    let config: ConfigBuilder = crate::config::format::deserialize(
+        indoc! {r#"
+            transforms:
+              foo:
+                inputs:
+                  - ignored
+                type: remap
+                source: |
+                  . = [{"message": "one"}, {"message": "two"}]
+            tests:
+              - name: conflicting counts
+                inputs:
+                  - insert_at: foo
+                    value: doesnt matter
+                outputs:
+                  - extract_from: foo
+                    expected_event_count: 2
+                    conditions:
+                      - type: vrl
+                        source: |
+                          assert!(exists(.message), "ok")
+                  - extract_from: foo
+                    expected_event_count: 5
+                    conditions:
+                      - type: vrl
+                        source: |
+                          assert!(exists(.message), "ok")
+        "#},
+        crate::config::Format::Yaml,
+    )
+    .unwrap();
+
+    let errs = build_unit_tests(config).await.err().unwrap();
+    assert!(
+        errs.iter()
+            .any(|e| e.contains("conflicting expected_event_count")),
+        "expected conflicting count error, got: {errs:?}"
+    );
+}
+
+#[tokio::test]
+async fn expected_event_count_zero_split_with_conditions_rejected() {
+    crate::test_util::trace_init();
+
+    // Splitting expected_event_count: 0 and conditions across two output
+    // entries that share the same extract_from must still be rejected after
+    // merge, otherwise the conditions would pass vacuously against zero events.
+    let config: ConfigBuilder = crate::config::format::deserialize(
+        indoc! {r#"
+            transforms:
+              foo:
+                inputs:
+                  - ignored
+                type: remap
+                source: |
+                  if .message == "drop me" {
+                    abort
+                  }
+            tests:
+              - name: split zero with conditions
+                inputs:
+                  - insert_at: foo
+                    value: "drop me"
+                outputs:
+                  - extract_from: foo
+                    expected_event_count: 0
+                  - extract_from: foo
+                    conditions:
+                      - type: vrl
+                        source: |
+                          assert!(false, "should never be evaluated")
+        "#},
+        crate::config::Format::Yaml,
+    )
+    .unwrap();
+
+    let errs = build_unit_tests(config).await.err().unwrap();
+    assert!(
+        errs.iter()
+            .any(|e| e.contains("expected_event_count of 0") && e.contains("conditions")),
+        "expected config error about zero count with conditions after merge, got: {errs:?}"
+    );
+}
diff --git a/src/config/unit_test/unit_test_components.rs b/src/config/unit_test/unit_test_components.rs
index 02808fb083ee7..b3f09098237da 100644
--- a/src/config/unit_test/unit_test_components.rs
+++ b/src/config/unit_test/unit_test_components.rs
@@ -117,7 +117,10 @@ impl SourceConfig for UnitTestStreamSourceConfig {
 #[derive(Clone, Default)]
 pub enum UnitTestSinkCheck {
     /// Check all events that are received against the list of conditions.
-    Checks(Vec<Vec<Condition>>),
+    Checks {
+        conditions: Vec<Vec<Condition>>,
+        expected_event_count: Option<usize>,
+    },
 
     /// Check that no events were received.
     NoOutputs,
@@ -203,8 +206,21 @@ impl StreamSink<Event> for UnitTestSink {
         }
 
         match self.check {
-            UnitTestSinkCheck::Checks(checks) => {
-                if output_events.is_empty() {
+            UnitTestSinkCheck::Checks {
+                conditions: checks,
+                expected_event_count,
+            } => {
+                if let Some(expected) = expected_event_count {
+                    let actual = output_events.len();
+                    if actual != expected {
+                        result.test_errors.push(format!(
+                            "expected {} events from transforms {:?}, but received {}",
+                            expected, self.transform_ids, actual
+                        ));
+                    }
+                }
+
+                if output_events.is_empty() && expected_event_count != Some(0) {
                     result
                         .test_errors
                         .push(format!("checks for transforms {:?} failed: no events received. Topology may be disconnected or transform is missing inputs.", self.transform_ids));

From cfb942bf7d1983b9eeaeb93ba2f843a816d1db5d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 23 Apr 2026 13:39:22 -0400
Subject: [PATCH 154/326] chore(deps): bump openssl from 0.10.75 to 0.10.78
 (#25250)

Bumps [openssl](https://github.com/rust-openssl/rust-openssl) from 0.10.75 to 0.10.78.
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.75...openssl-v0.10.78)

---
updated-dependencies:
- dependency-name: openssl
  dependency-version: 0.10.78
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock                 | 8 ++++----
 lib/vector-core/Cargo.toml | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a39a96a6500b1..57f9a916e8812 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7373,9 +7373,9 @@ dependencies = [
 
 [[package]]
 name = "openssl"
-version = "0.10.75"
+version = "0.10.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+checksum = "f38c4372413cdaaf3cc79dd92d29d7d9f5ab09b51b10dded508fb90bb70b9222"
 dependencies = [
  "bitflags 2.10.0",
  "cfg-if",
@@ -7414,9 +7414,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.111"
+version = "0.9.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+checksum = "13ce1245cd07fcc4cfdb438f7507b0c7e4f3849a69fd84d52374c66d83741bb6"
 dependencies = [
  "cc",
  "libc",
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index 7d2d8f8979266..c26953cb3590a 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -34,7 +34,7 @@ metrics-util.workspace = true
 mlua = { version = "0.10.5", default-features = false, features = ["lua54", "send", "vendored"], optional = true }
 no-proxy = { version = "0.3.6", default-features = false, features = ["serialize"] }
 ordered-float.workspace = true
-openssl = { version = "0.10.75", default-features = false, features = ["vendored"] }
+openssl = { version = "0.10.78", default-features = false, features = ["vendored"] }
 parking_lot = { version = "0.12.5", default-features = false }
 pin-project.workspace = true
 proptest = { workspace = true, optional = true }

From c0cdf2068f79176fd8af4dca9b27cabae5be3091 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 23 Apr 2026 13:52:07 -0400
Subject: [PATCH 155/326] chore(ci): extract unit tests into reusable workflow
 (#25247)

* chore(ci): extract unit tests into reusable workflow

* chore(ci): fix component-validation input and add OS-based FEATURES default

* chore(ci): pass Datadog credentials into reusable unit-tests workflow
---
 .github/workflows/changes.yml    |   1 +
 .github/workflows/test.yml       |  30 ++------
 .github/workflows/unit-tests.yml | 118 +++++++++++++++++++++++++++++++
 3 files changed, 125 insertions(+), 24 deletions(-)
 create mode 100644 .github/workflows/unit-tests.yml

diff --git a/.github/workflows/changes.yml b/.github/workflows/changes.yml
index f9cd9ce4ba5b9..b07447715d75f 100644
--- a/.github/workflows/changes.yml
+++ b/.github/workflows/changes.yml
@@ -280,6 +280,7 @@ jobs:
               - ".github/workflows/changes.yml"
             test-yml:
               - ".github/workflows/test.yml"
+              - ".github/workflows/unit-tests.yml"
               - ".github/workflows/changes.yml"
             integration-yml:
               - ".github/workflows/integration.yml"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 81ceef93ca5f1..84a4c31226b1f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -56,31 +56,13 @@ jobs:
       - run: make check-clippy
 
   test:
-    name: Unit and Component Validation tests - x86_64-unknown-linux-gnu
-    runs-on: ubuntu-24.04-8core
-    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true' }}
     needs: changes
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./.github/actions/setup
-        with:
-          rust: true
-          cargo-nextest: true
-          datadog-ci: true
-          protoc: true
-          libsasl2: true
-      - name: Unit Test
-        run: make test
-        env:
-          CARGO_BUILD_JOBS: 5
-
-      # Validates components for adherence to the Component Specification
-      - name: Check Component Spec
-        run: make test-component-validation
-
-      - name: Upload test results
-        run: scripts/upload-test-results.sh
-        if: always()
+    if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true' }}
+    uses: ./.github/workflows/unit-tests.yml
+    with:
+      default: true
+      component-validation: true
+    secrets: inherit
 
   check-scripts:
     name: Check scripts
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
new file mode 100644
index 0000000000000..e3b6501247858
--- /dev/null
+++ b/.github/workflows/unit-tests.yml
@@ -0,0 +1,118 @@
+# Reusable Workflow: Tests
+#
+# Runs test suites via the Makefile. By default runs unit tests and component
+# validation. Callers can enable additional suites (CLI, Vector API, behavior)
+# via boolean inputs.
+#
+# When `default` is true, all nextest-based suites run in a single `make test`
+# invocation with the relevant features enabled. When `default` is false, only
+# the explicitly enabled suites run, using a nextest filter expression to
+# select the matching tests.
+
+name: Tests
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref to checkout"
+        required: false
+        type: string
+      default:
+        description: "Run the full default unit test suite (--workspace with default features)"
+        required: true
+        type: boolean
+      component-validation:
+        description: "Include component validation tests"
+        required: false
+        type: boolean
+        default: true
+      cli:
+        description: "Include CLI tests"
+        required: false
+        type: boolean
+        default: false
+      vector-api:
+        description: "Include Vector API tests"
+        required: false
+        type: boolean
+        default: false
+      behavior:
+        description: "Include behavior tests"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+env:
+  CARGO_INCREMENTAL: "0"
+  CI: true
+  DD_ENV: "ci"
+  DD_API_KEY: ${{ secrets.DD_API_KEY }}
+
+jobs:
+  tests:
+    name: Tests
+    runs-on: ubuntu-24.04-8core
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref }}
+
+      - uses: ./.github/actions/setup
+        with:
+          rust: true
+          cargo-nextest: true
+          datadog-ci: true
+          protoc: true
+          libsasl2: true
+
+      - name: Run tests
+        run: |
+          add_suite() {
+            local enabled="$1" feature="$2" filter="$3"
+            [[ "${enabled}" != "true" ]] && return
+            FEATURES="${FEATURES:+$FEATURES,}${feature}"
+            if [[ "${{ inputs.default }}" != "true" ]]; then
+              SCOPE="${SCOPE:+$SCOPE | }${filter}"
+            fi
+          }
+
+          # Mirror the Makefile's OS-based default: `default-msvc` on Windows,
+          # `default` elsewhere. Keep in sync with the FEATURES defaults in Makefile.
+          if [[ "${RUNNER_OS}" == "Windows" ]]; then
+            DEFAULT_FEATURES="default-msvc"
+          else
+            DEFAULT_FEATURES="default"
+          fi
+
+          if [[ "${{ inputs.default }}" == "true" ]]; then
+            FEATURES="${DEFAULT_FEATURES}"
+          else
+            FEATURES=""
+          fi
+
+          add_suite "${{ inputs.component-validation }}" "component-validation-tests" "test(components::validation::tests)"
+          add_suite "${{ inputs.cli }}" "cli-tests" "package(vector) & binary(=integration)"
+          add_suite "${{ inputs.vector-api }}" "vector-api-tests" "binary(=vector_api)"
+
+          # Skip `make test` entirely if no nextest-based suite was selected
+          # (e.g. behavior-only runs). Running `make test` with empty FEATURES
+          # would otherwise execute the workspace-wide suite.
+          if [[ "${{ inputs.default }}" == "true" ]]; then
+            make test FEATURES="${FEATURES}"
+          elif [[ -n "${SCOPE}" ]]; then
+            make test FEATURES="${FEATURES}" SCOPE="-E '${SCOPE}'"
+          else
+            echo "No nextest suites selected; skipping 'make test'"
+          fi
+
+      - name: Behavior tests
+        if: ${{ inputs.behavior }}
+        run: make test-behavior
+
+      - name: Upload test results to Datadog
+        if: ${{ always() }}
+        run: scripts/upload-test-results.sh

From f56f4fa7234440345d790a2b81c7aa880be831d8 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 23 Apr 2026 16:29:50 -0400
Subject: [PATCH 156/326] chore(ci): remove Chocolatey from Windows bootstrap
 (#25254)

* chore(ci): remove Chocolatey from Windows bootstrap

Install protoc directly from the upstream GitHub release (matching the
pinned version used on Linux/macOS in scripts/environment/install-protoc.sh)
instead of going through Chocolatey. GNU make is already on the default
PATH of the windows-2025 runner image via C:\mingw64\bin, so no extra
install step is needed for it.

This eliminates the recurring "Chocolatey installed 0/0 packages"
failures caused by Chocolatey CDN blips, and pins the Windows build to
the same protoc version used on Linux/macOS.

Verified on the ci-sandbox repo:
- protoc resolves to $RUNNER_TEMP\protoc\bin\protoc.exe -> libprotoc 3.21.12
- make resolves to C:\mingw64\bin\make.exe -> GNU Make 4.4.1

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): share install-protoc.sh across platforms

Extend the existing Linux/macOS protoc installer with MINGW/MSYS
platform detection and .exe handling, and have bootstrap-windows-2025.ps1
delegate to it via Git Bash. This replaces the inline PowerShell
download introduced earlier and makes all three platforms pin the same
protoc version from the same upstream source.

Also adds curl --retry 5 --retry-delay 10 --retry-all-errors so
transient download blips are retried without extra scaffolding.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): drop curl --retry-all-errors for focal compatibility

The ghcr.io/cross-rs/* base images used by scripts/cross/Dockerfile are
Ubuntu 20.04 focal, which ships curl 7.68.x. --retry-all-errors was
added in curl 7.71.0, so it would be rejected as an unknown option and
break cross-target builds that run install-protoc.sh inside those
images.

Plain --retry 5 --retry-delay 10 still handles the transport-level
retries that cover the CDN blips we care about.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../environment/bootstrap-windows-2025.ps1    | 42 ++++++-------------
 scripts/environment/install-protoc.sh         | 37 +++++++++++-----
 2 files changed, 39 insertions(+), 40 deletions(-)

diff --git a/scripts/environment/bootstrap-windows-2025.ps1 b/scripts/environment/bootstrap-windows-2025.ps1
index 9686811a97238..7d73eeccbc32d 100644
--- a/scripts/environment/bootstrap-windows-2025.ps1
+++ b/scripts/environment/bootstrap-windows-2025.ps1
@@ -2,32 +2,6 @@
 $ErrorActionPreference = "Stop"
 Set-StrictMode -Version Latest
 
-# Helper function to install choco packages with exponential backoff retry
-function Install-ChocoPackage {
-    param(
-        [string]$Package,
-        [int]$MaxRetries = 5
-    )
-
-    for ($attempt = 1; $attempt -le $MaxRetries; $attempt++) {
-        choco install $Package --execution-timeout=7200 -y
-        # Both `choco install` and `choco list` can exit 0 even on 5xx errors
-        # from the feed, so verify install by matching a "name|version" line
-        # in the list output. --limit-output strips headers/warnings.
-        if ((choco list --limit-output -e $Package) -match "^$([regex]::Escape($Package))\|") {
-            return
-        }
-
-        if ($attempt -lt $MaxRetries) {
-            $delay = 5 * [math]::Pow(2, $attempt)  # Exponential: 10, 20, 40, 80 seconds
-            Write-Host "choco install $Package failed (attempt $attempt of $MaxRetries). Retrying in $delay seconds..."
-            Start-Sleep -Seconds $delay
-        } else {
-            throw "choco install $Package failed after $MaxRetries attempts"
-        }
-    }
-}
-
 # Set up our Cargo path so we can do Rust-y things.
 echo "$HOME\.cargo\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
 
@@ -37,9 +11,19 @@ if ($env:RELEASE_BUILDER -ne "true") {
     bash scripts/environment/prepare.sh --modules=rustup
 }
 
-# Install Chocolatey packages with exponential backoff retry
-Install-ChocoPackage "make"
-Install-ChocoPackage "protoc"
+# Install protoc via the shared cross-platform script. It pins the same version
+# used on Linux/macOS and downloads directly from the upstream GitHub release,
+# so we avoid the recurring Chocolatey CDN failures.
+$ProtocInstallDir = Join-Path $env:RUNNER_TEMP "protoc-bin"
+bash scripts/environment/install-protoc.sh "$ProtocInstallDir"
+if ($LASTEXITCODE -ne 0) {
+    throw "install-protoc.sh failed with exit code $LASTEXITCODE"
+}
+echo "$ProtocInstallDir" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+# GNU make is already on PATH on the windows-2025 runner image via the
+# pre-installed MinGW toolchain at C:\mingw64\bin, so no extra install is
+# needed here.
 
 # Set a specific override path for libclang.
 echo "LIBCLANG_PATH=$( (gcm clang).source -replace "clang.exe" )" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
diff --git a/scripts/environment/install-protoc.sh b/scripts/environment/install-protoc.sh
index 4d1debe6c3251..1e75279a3aec2 100755
--- a/scripts/environment/install-protoc.sh
+++ b/scripts/environment/install-protoc.sh
@@ -23,13 +23,12 @@ trap 'rm -rf "${TMP_DIR?}"' EXIT
 get_platform() {
   local os
   os=$(uname)
-  if [[ "${os}" == "Darwin" ]]; then
-    echo "osx"
-  elif [[ "${os}" == "Linux" ]]; then
-    echo "linux"
-  else
-    >&2 echo "unsupported os: ${os}" && exit 1
-  fi
+  case "${os}" in
+    Darwin) echo "osx" ;;
+    Linux) echo "linux" ;;
+    MINGW*|MSYS*|CYGWIN*) echo "win64" ;;
+    *) >&2 echo "unsupported os: ${os}" && exit 1 ;;
+  esac
 }
 
 get_arch() {
@@ -47,20 +46,36 @@ get_arch() {
   fi
 }
 
+get_bin_name() {
+  if [[ "$(get_platform)" == "win64" ]]; then
+    echo "protoc.exe"
+  else
+    echo "protoc"
+  fi
+}
+
 install_protoc() {
   local version=$1
   local install_path=$2
 
   local base_url="https://github.com/protocolbuffers/protobuf/releases/download"
   local url
-  url="${base_url}/v${version}/protoc-${version}-$(get_platform)-$(get_arch).zip"
+  if [[ "$(get_platform)" == "win64" ]]; then
+    # Windows release assets are named without an explicit arch suffix.
+    url="${base_url}/v${version}/protoc-${version}-win64.zip"
+  else
+    url="${base_url}/v${version}/protoc-${version}-$(get_platform)-$(get_arch).zip"
+  fi
   local download_path="${TMP_DIR}/protoc.zip"
 
   echo "Downloading ${url}"
-  curl -fsSL "${url}" -o "${download_path}"
+  # Stay compatible with the curl shipped by Ubuntu 20.04 focal (7.68.x) used
+  # in the ghcr.io/cross-rs/* base images: --retry-all-errors was only added
+  # in curl 7.71.0, so rely on the transport-level retry that --retry covers.
+  curl --retry 5 --retry-delay 10 -fsSL "${url}" -o "${download_path}"
 
   unzip -qq "${download_path}" -d "${TMP_DIR}"
-  mv -f -v "${TMP_DIR}/bin/protoc" "${install_path}"
+  mv -f -v "${TMP_DIR}/bin/$(get_bin_name)" "${install_path}"
 }
 
-install_protoc "21.12" "${INSTALL_PATH}/protoc"
+install_protoc "21.12" "${INSTALL_PATH}/$(get_bin_name)"

From 7428dc3f4b23c56f1f2eecf44b3f6b2532c28dac Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 24 Apr 2026 14:40:53 -0400
Subject: [PATCH 157/326] chore(ci): use dd-sts instead of DD_API_KEY (#25235)

* chore(ci): use dd-octo-sts instead of DD_API_KEY

* chore(ci): rename policy to public-vectordotdev-vector

* chore(ci): grant id-token: write to reusable workflow callers

* Format

* chore(ci): introduce dd-token composite action to federate Datadog credentials

* Fix policy name
---
 .github/actions/dd-token/action.yml         | 28 +++++++++++++++++++++
 .github/workflows/ci-integration-review.yml |  9 ++++++-
 .github/workflows/ci-review-trigger.yml     |  1 +
 .github/workflows/coverage.yml              |  6 ++++-
 .github/workflows/integration-test.yml      |  6 ++++-
 .github/workflows/integration.yml           | 13 +++++++++-
 .github/workflows/master_merge_queue.yml    |  2 +-
 .github/workflows/static-analysis.yml       | 12 ++++++---
 .github/workflows/test-make-command.yml     |  7 +++++-
 .github/workflows/test.yml                  |  4 ++-
 .github/workflows/unit-tests.yml            |  6 ++++-
 11 files changed, 82 insertions(+), 12 deletions(-)
 create mode 100644 .github/actions/dd-token/action.yml

diff --git a/.github/actions/dd-token/action.yml b/.github/actions/dd-token/action.yml
new file mode 100644
index 0000000000000..8ea92dc1c2dd5
--- /dev/null
+++ b/.github/actions/dd-token/action.yml
@@ -0,0 +1,28 @@
+name: "Datadog Short-Lived Token"
+description: "Federate a short-lived Datadog token via dd-sts-action and export DD_API_KEY (and DD_APP_KEY when available) to the job environment."
+
+inputs:
+  policy:
+    required: false
+    default: public-vectordotdev-vector
+    description: "dd-sts policy to federate against."
+
+runs:
+  using: "composite"
+  steps:
+    - name: Federate Datadog token
+      id: dd-sts
+      uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75
+      with:
+        policy: ${{ inputs.policy }}
+
+    - name: Export Datadog credentials to environment
+      shell: bash
+      env:
+        DD_STS_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+        DD_STS_APP_KEY: ${{ steps.dd-sts.outputs.app_key }}
+      run: |
+        echo "DD_API_KEY=${DD_STS_API_KEY}" >> "$GITHUB_ENV"
+        if [ -n "${DD_STS_APP_KEY}" ]; then
+          echo "DD_APP_KEY=${DD_STS_APP_KEY}" >> "$GITHUB_ENV"
+        fi
diff --git a/.github/workflows/ci-integration-review.yml b/.github/workflows/ci-integration-review.yml
index 77b20b347e318..b042a76eb8ba9 100644
--- a/.github/workflows/ci-integration-review.yml
+++ b/.github/workflows/ci-integration-review.yml
@@ -41,7 +41,6 @@ env:
   TEST_DATADOG_API_KEY: ${{ secrets.CI_TEST_DATADOG_API_KEY }}
   CONTAINER_TOOL: "docker"
   DD_ENV: "ci"
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   RUST_BACKTRACE: full
   VECTOR_LOG: vector=debug
   VERBOSE: true
@@ -100,6 +99,7 @@ jobs:
     timeout-minutes: 90
     permissions:
       contents: read
+      id-token: write
       packages: read # Required to pull test runner image from GHCR
     strategy:
       fail-fast: false
@@ -160,6 +160,9 @@ jobs:
           submodules: "recursive"
           ref: ${{ github.event.review.commit_id }}
 
+      - uses: ./.github/actions/dd-token
+        if: steps.run_condition.outputs.should_run == 'true'
+
       - uses: ./.github/actions/setup
         with:
           vdev: true
@@ -191,6 +194,7 @@ jobs:
     permissions:
       contents: read
       packages: read # Required to pull test runner image from GHCR
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -214,6 +218,9 @@ jobs:
           submodules: "recursive"
           ref: ${{ github.event.review.commit_id }}
 
+      - uses: ./.github/actions/dd-token
+        if: steps.run_condition.outputs.should_run == 'true'
+
       - uses: ./.github/actions/setup
         with:
           vdev: true
diff --git a/.github/workflows/ci-review-trigger.yml b/.github/workflows/ci-review-trigger.yml
index 8a2eb206efdcd..9cd2a1d67e3f5 100644
--- a/.github/workflows/ci-review-trigger.yml
+++ b/.github/workflows/ci-review-trigger.yml
@@ -31,6 +31,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 env:
   DD_ENV: "ci"
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index db19d27ffd582..8ca10e1127a0d 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -16,6 +16,9 @@ env:
 jobs:
   coverage:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -31,9 +34,10 @@ jobs:
       - name: "Generate code coverage"
         run: cargo llvm-cov nextest --workspace --lcov --output-path lcov.info
 
+      - uses: ./.github/actions/dd-token
+
       - name: "Upload coverage to Datadog"
         env:
-          DD_API_KEY: ${{ secrets.DD_API_KEY }}
           DD_SITE: datadoghq.com
           DD_ENV: ci
         run: datadog-ci coverage upload lcov.info
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index 74b782aa7d336..641f9ceb96d4b 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -23,7 +23,6 @@ env:
   TEST_APPSIGNAL_PUSH_API_KEY: ${{ secrets.TEST_APPSIGNAL_PUSH_API_KEY }}
   CONTAINER_TOOL: "docker"
   DD_ENV: "ci"
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   RUST_BACKTRACE: full
   VECTOR_LOG: vector=debug
   VERBOSE: true
@@ -34,6 +33,9 @@ jobs:
   test-integration:
     runs-on: ubuntu-24.04
     timeout-minutes: 40
+    permissions:
+      contents: read
+      id-token: write
     if: inputs.if || github.event_name == 'workflow_dispatch'
     steps:
       - name: (PR comment) Get PR branch
@@ -51,6 +53,8 @@ jobs:
         if: ${{ github.event_name != 'issue_comment' }}
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - uses: ./.github/actions/dd-token
+
       - run: bash scripts/environment/prepare.sh --modules=rustup,datadog-ci
 
       - run: make test-integration-${{ inputs.test_name }}
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 2c1e91c57a8e7..833a7ae13d5de 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -23,7 +23,6 @@ permissions:
 env:
   CONTAINER_TOOL: "docker"
   DD_ENV: "ci"
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   TEST_DATADOG_API_KEY: ${{ secrets.CI_TEST_DATADOG_API_KEY }}
   TEST_APPSIGNAL_PUSH_API_KEY: ${{ secrets.TEST_APPSIGNAL_PUSH_API_KEY }}
   AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }}
@@ -65,6 +64,9 @@ jobs:
 
   integration-tests:
     runs-on: ubuntu-24.04-8core
+    permissions:
+      contents: read
+      id-token: write
     needs:
       - changes
       - build-test-runner
@@ -141,6 +143,9 @@ jobs:
         with:
           submodules: "recursive"
 
+      - uses: ./.github/actions/dd-token
+        if: steps.check.outputs.should_run == 'true'
+
       - uses: ./.github/actions/setup
         if: steps.check.outputs.should_run == 'true'
         with:
@@ -167,6 +172,9 @@ jobs:
 
   e2e-tests:
     runs-on: ubuntu-24.04-8core
+    permissions:
+      contents: read
+      id-token: write
     needs:
       - changes
       - build-test-runner
@@ -205,6 +213,9 @@ jobs:
         with:
           submodules: "recursive"
 
+      - uses: ./.github/actions/dd-token
+        if: steps.check.outputs.should_run == 'true'
+
       - uses: ./.github/actions/setup
         if: steps.check.outputs.should_run == 'true'
         with:
diff --git a/.github/workflows/master_merge_queue.yml b/.github/workflows/master_merge_queue.yml
index 8f6866f42dfe2..3eaffecfdb2cd 100644
--- a/.github/workflows/master_merge_queue.yml
+++ b/.github/workflows/master_merge_queue.yml
@@ -21,6 +21,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 concurrency:
   # `github.ref` is unique for MQ runs and PRs
@@ -30,7 +31,6 @@ concurrency:
 env:
   CONTAINER_TOOL: "docker"
   DD_ENV: "ci"
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   RUST_BACKTRACE: full
   VECTOR_LOG: vector=debug
   VERBOSE: true
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index 9411f2844e264..f74c6681d8ea5 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -13,14 +13,18 @@ permissions:
 jobs:
   static-analysis:
     runs-on: ubuntu-latest
-    env:
-      DD_API_KEY: ${{ secrets.DD_API_KEY }}
-      DD_APP_KEY: ${{ secrets.DD_APP_KEY }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - id: dd-token
+        uses: ./.github/actions/dd-token
+        with:
+          policy: public-vectordotdev-vector-static-analysis
+
       - name: Datadog Static Analyzer
-        if: ${{ env.DD_API_KEY != '' }}
         uses: DataDog/datadog-static-analyzer-github-action@8340f18875fcefca86844b5f947ce2431387e552 # v3.0.0
         with:
           dd_api_key: ${{ env.DD_API_KEY }}
diff --git a/.github/workflows/test-make-command.yml b/.github/workflows/test-make-command.yml
index 79c27d54792f4..2a93f9016fcd1 100644
--- a/.github/workflows/test-make-command.yml
+++ b/.github/workflows/test-make-command.yml
@@ -32,17 +32,22 @@ permissions:
 jobs:
   run-make-command:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
     timeout-minutes: 90
     env:
       CARGO_INCREMENTAL: 0
       DD_ENV: "ci"
-      DD_API_KEY: ${{ secrets.DD_API_KEY }}
     steps:
       - name: Checkout branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.ref }}
 
+      - uses: ./.github/actions/dd-token
+        if: ${{ inputs.upload_test_results }}
+
       - uses: ./.github/actions/setup
         with:
           rust: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 84a4c31226b1f..7e5c28aec476c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -17,7 +17,6 @@ concurrency:
 env:
   CONTAINER_TOOL: "docker"
   DD_ENV: "ci"
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   VECTOR_LOG: vector=debug
   VERBOSE: true
   CI: true
@@ -57,6 +56,9 @@ jobs:
 
   test:
     needs: changes
+    permissions:
+      contents: read
+      id-token: write
     if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true' }}
     uses: ./.github/workflows/unit-tests.yml
     with:
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index e3b6501247858..63c9de7d19351 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -50,17 +50,21 @@ env:
   CARGO_INCREMENTAL: "0"
   CI: true
   DD_ENV: "ci"
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
 
 jobs:
   tests:
     name: Tests
     runs-on: ubuntu-24.04-8core
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.ref }}
 
+      - uses: ./.github/actions/dd-token
+
       - uses: ./.github/actions/setup
         with:
           rust: true

From 7815f26ef4f357c7e3e90048e4287728c9506423 Mon Sep 17 00:00:00 2001
From: "shalk(xiao kun)" <xshalk@outlook.com>
Date: Sat, 25 Apr 2026 02:43:56 +0800
Subject: [PATCH 158/326] chore(website): add Docker support for local
 development (#25237)

* feat(website): add Docker support for local development

Adds Dockerfile, docker-compose.yml, and README instructions so the
Vector website can be previewed locally without installing Hugo, CUE,
or Node.js. The image detects host architecture via uname -m to support
both amd64 and arm64. VRL function docs still require a one-time
`make generate-vrl-docs` on the host (needs Rust/vdev).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Update website/Dockerfile

Co-authored-by: Thomas <thomasqueirozb@gmail.com>

* docs(website): note Docker setup is experimental and not CI-enforced

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Thomas <thomasqueirozb@gmail.com>
---
 website/Dockerfile         | 44 ++++++++++++++++++++++++++++++++++++++
 website/README.md          | 24 +++++++++++++++++++++
 website/docker-compose.yml | 15 +++++++++++++
 3 files changed, 83 insertions(+)
 create mode 100644 website/Dockerfile
 create mode 100644 website/docker-compose.yml

diff --git a/website/Dockerfile b/website/Dockerfile
new file mode 100644
index 0000000000000..e9946941bb459
--- /dev/null
+++ b/website/Dockerfile
@@ -0,0 +1,44 @@
+FROM debian:bookworm-slim
+
+ARG HUGO_VERSION=0.154.5
+ARG CUE_VERSION=0.10.0
+ARG NODE_VERSION=24
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl ca-certificates git make \
+    && rm -rf /var/lib/apt/lists/*
+
+# Hugo extended (required for Sass/PostCSS processing)
+# uname -m: x86_64 -> amd64, aarch64 -> arm64
+RUN ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') && \
+    curl -fsSL https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_extended_${HUGO_VERSION}_linux-${ARCH}.tar.gz \
+    | tar -xz -C /usr/local/bin hugo
+
+# CUE CLI
+RUN ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') && \
+    curl -fsSL https://github.com/cue-lang/cue/releases/download/v${CUE_VERSION}/cue_v${CUE_VERSION}_linux_${ARCH}.tar.gz \
+    | tar -xz -C /usr/local/bin cue
+
+# Node.js + Yarn
+RUN curl -fsSL https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && npm install -g yarn \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app/website
+
+EXPOSE 1313
+
+# generate-vrl-docs (requires Rust/vdev) must be run on the host first.
+# Call cue directly instead of scripts/cue.sh to avoid its `git rev-parse` dependency.
+ENTRYPOINT ["/bin/sh", "-c", \
+  "if [ -z \"$(find cue/reference/remap/functions -name '*.cue' 2>/dev/null | head -1)\" ]; then \
+     echo 'ERROR: cue/reference/remap/functions/ is empty.'; \
+     echo 'Run on the host first: make generate-vrl-docs'; \
+     exit 1; \
+   fi && \
+   yarn && \
+   cp -f /app/Cargo.lock data/cargo-lock.toml && \
+   rm -f data/docs.json && find cue -name '*.cue' | xargs cue export --all-errors --outfile data/docs.json && \
+   yarn config-examples && \
+   hugo server --bind 0.0.0.0 --port 1313 --buildDrafts --buildFuture --environment development"]
diff --git a/website/README.md b/website/README.md
index 47475945dbf9d..79a565b89fb7b 100644
--- a/website/README.md
+++ b/website/README.md
@@ -136,6 +136,30 @@ This builds all the necessary [prereqs](#prerequisites) for the site and starts
 
 When you make changes to the Markdown sources, Sass/CSS, or JavaScript, the site re-builds and Hugo automatically reloads the page that you're on. If you make changes to the [structured data](#structured-data) sources, however, you need to stop the server and run `make serve` again.
 
+### Run the site with Docker
+
+If you don't want to install Hugo, CUE, or Node.js locally, you can use Docker instead. You still need Rust and [vdev] on the host for one step.
+
+> **Note:** This Docker setup is experimental and not currently enforced by CI. It may break as dependencies or the build process evolve.
+
+**Step 1:** Generate VRL function docs (required once; only re-run when VRL function signatures change):
+
+```shell
+make generate-vrl-docs
+```
+
+This generates CUE files into `cue/reference/remap/functions/` from the Rust source. These files are gitignored and must exist before the site can build.
+
+**Step 2:** Build and start the site:
+
+```shell
+cd website
+docker compose build
+docker compose up
+```
+
+Navigate to http://localhost:1313. The site source is mounted as a volume so Hugo's live-reload works for Markdown, CSS, and JavaScript changes. If you modify [structured data](#structured-data) sources, restart the container.
+
 ### Add a new version of Vector
 
 1. Add the new version to the `versions` list in [`cue/reference/versions.cue`](./cue/reference/versions.cue). Make sure to preserve reverse ordering.
diff --git a/website/docker-compose.yml b/website/docker-compose.yml
new file mode 100644
index 0000000000000..2f58c9a12c815
--- /dev/null
+++ b/website/docker-compose.yml
@@ -0,0 +1,15 @@
+services:
+  website:
+    build: .
+    ports:
+      - "1313:1313"
+    volumes:
+      - .:/app/website
+      - ../Cargo.lock:/app/Cargo.lock:ro
+      - ../scripts:/app/scripts:ro
+      - website_node_modules:/app/website/node_modules
+    environment:
+      - CI=false
+
+volumes:
+  website_node_modules:

From 74574a360112a4bb212915b896471320fb157b96 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 24 Apr 2026 14:50:53 -0400
Subject: [PATCH 159/326] chore(vdev): add linux arm64 to publish matrix and
 bump to 0.3.2 (#25260)

---
 .github/workflows/vdev_publish.yml | 2 ++
 Cargo.lock                         | 2 +-
 scripts/environment/prepare.sh     | 2 +-
 vdev/Cargo.toml                    | 2 +-
 4 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/vdev_publish.yml b/.github/workflows/vdev_publish.yml
index 3a46822098beb..80200d395f6ca 100644
--- a/.github/workflows/vdev_publish.yml
+++ b/.github/workflows/vdev_publish.yml
@@ -18,6 +18,8 @@ jobs:
             target: aarch64-apple-darwin
           - os: ubuntu-24.04
             target: x86_64-unknown-linux-gnu
+          - os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
 
     steps:
       - name: Checkout Vector
diff --git a/Cargo.lock b/Cargo.lock
index 57f9a916e8812..16d4bb553fbce 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -12241,7 +12241,7 @@ checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
 [[package]]
 name = "vdev"
-version = "0.3.1"
+version = "0.3.2"
 dependencies = [
  "anyhow",
  "cfg-if",
diff --git a/scripts/environment/prepare.sh b/scripts/environment/prepare.sh
index 02e100999c8de..b5c63c02f9d69 100755
--- a/scripts/environment/prepare.sh
+++ b/scripts/environment/prepare.sh
@@ -39,7 +39,7 @@ CARGO_LLVM_COV_VERSION="0.8.4"
 WASM_PACK_VERSION="0.13.1"
 # npm tool versions are defined in scripts/environment/npm-tools/package.json
 # and pinned (including transitive deps) in npm-tools/package-lock.json.
-VDEV_VERSION="0.3.0"
+VDEV_VERSION="0.3.2"
 
 ALL_MODULES=(
   rustup
diff --git a/vdev/Cargo.toml b/vdev/Cargo.toml
index 2a0f6169a160e..ff0265fddfc3e 100644
--- a/vdev/Cargo.toml
+++ b/vdev/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "vdev"
-version = "0.3.1"
+version = "0.3.2"
 edition = "2024"
 authors = ["Vector Contributors <vector@datadoghq.com>"]
 license = "MPL-2.0"

From 3b043d33b95670ef1cbd2f5af274fa25ebb1db84 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 24 Apr 2026 14:55:51 -0400
Subject: [PATCH 160/326] feat(greptimedb sink)!: add support for GreptimeDB
 v1.0.0 (#25178)

* feat(greptimedb sink)!: upgrade greptimedb-ingester to published crate v0.16.0

* test(greptimedb): add latest to integration test version matrix

* fix(greptimedb sink): reject unsupported gRPC compression types

* refactor(greptimedb sink): make grpc_compression a typed enum

* Format

* Update licenses

* Update generated docs

* fix(greptimedb sink): fail early when TLS paths are missing

* fix(greptimedb sink): handle partial TLS configs gracefully and document gzip removal

* Update greptimedb-ingester and add back gzip support

* Reject incomplete TLS configs rather than falling back to non-TLS

* Match on all TlsConfig entries to emit warning log

* Update generated docs
---
 Cargo.lock                                    | 700 +++++++++++++-----
 Cargo.toml                                    |   2 +-
 LICENSE-3rdparty.csv                          |   4 +
 .../greptimedb_ingester_crate.breaking.md     |   3 +
 src/sinks/greptimedb/metrics/config.rs        |   8 +-
 src/sinks/greptimedb/metrics/request.rs       |   3 +-
 .../greptimedb/metrics/request_builder.rs     |   6 +-
 src/sinks/greptimedb/metrics/service.rs       | 116 +--
 src/sinks/greptimedb/mod.rs                   |  14 +
 tests/integration/greptimedb/config/test.yaml |   4 +-
 .../components/sinks/generated/greptimedb.cue |  18 +-
 .../sinks/generated/greptimedb_metrics.cue    |  18 +-
 12 files changed, 623 insertions(+), 273 deletions(-)
 create mode 100644 changelog.d/greptimedb_ingester_crate.breaking.md

diff --git a/Cargo.lock b/Cargo.lock
index 16d4bb553fbce..0ad2d1635d855 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -343,18 +343,39 @@ version = "56.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e833808ff2d94ed40d9379848a950d995043c7fb3e81a30b383f4c6033821cc"
 dependencies = [
- "arrow-arith",
- "arrow-array",
- "arrow-buffer",
- "arrow-cast",
- "arrow-data",
- "arrow-ipc",
- "arrow-json",
- "arrow-ord",
- "arrow-row",
- "arrow-schema",
- "arrow-select",
- "arrow-string",
+ "arrow-arith 56.2.0",
+ "arrow-array 56.2.0",
+ "arrow-buffer 56.2.0",
+ "arrow-cast 56.2.0",
+ "arrow-data 56.2.0",
+ "arrow-ipc 56.2.0",
+ "arrow-json 56.2.0",
+ "arrow-ord 56.2.0",
+ "arrow-row 56.2.0",
+ "arrow-schema 56.2.0",
+ "arrow-select 56.2.0",
+ "arrow-string 56.2.0",
+]
+
+[[package]]
+name = "arrow"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d441fdda254b65f3e9025910eb2c2066b6295d9c8ed409522b8d2ace1ff8574c"
+dependencies = [
+ "arrow-arith 58.1.0",
+ "arrow-array 58.1.0",
+ "arrow-buffer 58.1.0",
+ "arrow-cast 58.1.0",
+ "arrow-csv",
+ "arrow-data 58.1.0",
+ "arrow-ipc 58.1.0",
+ "arrow-json 58.1.0",
+ "arrow-ord 58.1.0",
+ "arrow-row 58.1.0",
+ "arrow-schema 58.1.0",
+ "arrow-select 58.1.0",
+ "arrow-string 58.1.0",
 ]
 
 [[package]]
@@ -363,14 +384,28 @@ version = "56.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad08897b81588f60ba983e3ca39bda2b179bdd84dced378e7df81a5313802ef8"
 dependencies = [
- "arrow-array",
- "arrow-buffer",
- "arrow-data",
- "arrow-schema",
+ "arrow-array 56.2.0",
+ "arrow-buffer 56.2.0",
+ "arrow-data 56.2.0",
+ "arrow-schema 56.2.0",
  "chrono",
  "num",
 ]
 
+[[package]]
+name = "arrow-arith"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ced5406f8b720cc0bc3aa9cf5758f93e8593cda5490677aa194e4b4b383f9a59"
+dependencies = [
+ "arrow-array 58.1.0",
+ "arrow-buffer 58.1.0",
+ "arrow-data 58.1.0",
+ "arrow-schema 58.1.0",
+ "chrono",
+ "num-traits",
+]
+
 [[package]]
 name = "arrow-array"
 version = "56.2.0"
@@ -378,9 +413,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8548ca7c070d8db9ce7aa43f37393e4bfcf3f2d3681df278490772fd1673d08d"
 dependencies = [
  "ahash 0.8.11",
- "arrow-buffer",
- "arrow-data",
- "arrow-schema",
+ "arrow-buffer 56.2.0",
+ "arrow-data 56.2.0",
+ "arrow-schema 56.2.0",
  "chrono",
  "chrono-tz",
  "half",
@@ -388,6 +423,25 @@ dependencies = [
  "num",
 ]
 
+[[package]]
+name = "arrow-array"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "772bd34cacdda8baec9418d80d23d0fb4d50ef0735685bd45158b83dfeb6e62d"
+dependencies = [
+ "ahash 0.8.11",
+ "arrow-buffer 58.1.0",
+ "arrow-data 58.1.0",
+ "arrow-schema 58.1.0",
+ "chrono",
+ "chrono-tz",
+ "half",
+ "hashbrown 0.16.0",
+ "num-complex",
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "arrow-buffer"
 version = "56.2.0"
@@ -399,17 +453,29 @@ dependencies = [
  "num",
 ]
 
+[[package]]
+name = "arrow-buffer"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "898f4cf1e9598fdb77f356fdf2134feedfd0ee8d5a4e0a5f573e7d0aec16baa4"
+dependencies = [
+ "bytes",
+ "half",
+ "num-bigint",
+ "num-traits",
+]
+
 [[package]]
 name = "arrow-cast"
 version = "56.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "919418a0681298d3a77d1a315f625916cb5678ad0d74b9c60108eb15fd083023"
 dependencies = [
- "arrow-array",
- "arrow-buffer",
- "arrow-data",
- "arrow-schema",
- "arrow-select",
+ "arrow-array 56.2.0",
+ "arrow-buffer 56.2.0",
+ "arrow-data 56.2.0",
+ "arrow-schema 56.2.0",
+ "arrow-select 56.2.0",
  "atoi",
  "base64 0.22.1",
  "chrono",
@@ -419,30 +485,116 @@ dependencies = [
  "ryu",
 ]
 
+[[package]]
+name = "arrow-cast"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0127816c96533d20fc938729f48c52d3e48f99717e7a0b5ade77d742510736d"
+dependencies = [
+ "arrow-array 58.1.0",
+ "arrow-buffer 58.1.0",
+ "arrow-data 58.1.0",
+ "arrow-ord 58.1.0",
+ "arrow-schema 58.1.0",
+ "arrow-select 58.1.0",
+ "atoi",
+ "base64 0.22.1",
+ "chrono",
+ "comfy-table",
+ "half",
+ "lexical-core",
+ "num-traits",
+ "ryu",
+]
+
+[[package]]
+name = "arrow-csv"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca025bd0f38eeecb57c2153c0123b960494138e6a957bbda10da2b25415209fe"
+dependencies = [
+ "arrow-array 58.1.0",
+ "arrow-cast 58.1.0",
+ "arrow-schema 58.1.0",
+ "chrono",
+ "csv",
+ "csv-core",
+ "regex",
+]
+
 [[package]]
 name = "arrow-data"
 version = "56.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a5c64fff1d142f833d78897a772f2e5b55b36cb3e6320376f0961ab0db7bd6d0"
 dependencies = [
- "arrow-buffer",
- "arrow-schema",
+ "arrow-buffer 56.2.0",
+ "arrow-schema 56.2.0",
  "half",
  "num",
 ]
 
+[[package]]
+name = "arrow-data"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42d10beeab2b1c3bb0b53a00f7c944a178b622173a5c7bcabc3cb45d90238df4"
+dependencies = [
+ "arrow-buffer 58.1.0",
+ "arrow-schema 58.1.0",
+ "half",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "arrow-flight"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "302b2e036335f3f04d65dad3f74ff1f2aae6dc671d6aa04dc6b61193761e16fb"
+dependencies = [
+ "arrow-array 58.1.0",
+ "arrow-buffer 58.1.0",
+ "arrow-cast 58.1.0",
+ "arrow-ipc 58.1.0",
+ "arrow-schema 58.1.0",
+ "base64 0.22.1",
+ "bytes",
+ "futures",
+ "prost 0.14.3",
+ "prost-types 0.14.3",
+ "tonic 0.14.5",
+ "tonic-prost",
+]
+
 [[package]]
 name = "arrow-ipc"
 version = "56.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d3594dcddccc7f20fd069bc8e9828ce37220372680ff638c5e00dea427d88f5"
 dependencies = [
- "arrow-array",
- "arrow-buffer",
- "arrow-data",
- "arrow-schema",
- "arrow-select",
- "flatbuffers",
+ "arrow-array 56.2.0",
+ "arrow-buffer 56.2.0",
+ "arrow-data 56.2.0",
+ "arrow-schema 56.2.0",
+ "arrow-select 56.2.0",
+ "flatbuffers 25.9.23",
+]
+
+[[package]]
+name = "arrow-ipc"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "609a441080e338147a84e8e6904b6da482cefb957c5cdc0f3398872f69a315d0"
+dependencies = [
+ "arrow-array 58.1.0",
+ "arrow-buffer 58.1.0",
+ "arrow-data 58.1.0",
+ "arrow-schema 58.1.0",
+ "arrow-select 58.1.0",
+ "flatbuffers 25.9.23",
+ "lz4_flex 0.13.0",
+ "zstd",
 ]
 
 [[package]]
@@ -451,11 +603,11 @@ version = "56.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "88cf36502b64a127dc659e3b305f1d993a544eab0d48cce704424e62074dc04b"
 dependencies = [
- "arrow-array",
- "arrow-buffer",
- "arrow-cast",
- "arrow-data",
- "arrow-schema",
+ "arrow-array 56.2.0",
+ "arrow-buffer 56.2.0",
+ "arrow-cast 56.2.0",
+ "arrow-data 56.2.0",
+ "arrow-schema 56.2.0",
  "chrono",
  "half",
  "indexmap 2.12.0",
@@ -467,17 +619,54 @@ dependencies = [
  "simdutf8",
 ]
 
+[[package]]
+name = "arrow-json"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ead0914e4861a531be48fe05858265cf854a4880b9ed12618b1d08cba9bebc8"
+dependencies = [
+ "arrow-array 58.1.0",
+ "arrow-buffer 58.1.0",
+ "arrow-cast 58.1.0",
+ "arrow-data 58.1.0",
+ "arrow-schema 58.1.0",
+ "chrono",
+ "half",
+ "indexmap 2.12.0",
+ "itoa",
+ "lexical-core",
+ "memchr",
+ "num-traits",
+ "ryu",
+ "serde_core",
+ "serde_json",
+ "simdutf8",
+]
+
 [[package]]
 name = "arrow-ord"
 version = "56.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c8f82583eb4f8d84d4ee55fd1cb306720cddead7596edce95b50ee418edf66f"
 dependencies = [
- "arrow-array",
- "arrow-buffer",
- "arrow-data",
- "arrow-schema",
- "arrow-select",
+ "arrow-array 56.2.0",
+ "arrow-buffer 56.2.0",
+ "arrow-data 56.2.0",
+ "arrow-schema 56.2.0",
+ "arrow-select 56.2.0",
+]
+
+[[package]]
+name = "arrow-ord"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "763a7ba279b20b52dad300e68cfc37c17efa65e68623169076855b3a9e941ca5"
+dependencies = [
+ "arrow-array 58.1.0",
+ "arrow-buffer 58.1.0",
+ "arrow-data 58.1.0",
+ "arrow-schema 58.1.0",
+ "arrow-select 58.1.0",
 ]
 
 [[package]]
@@ -486,10 +675,23 @@ version = "56.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d07ba24522229d9085031df6b94605e0f4b26e099fb7cdeec37abd941a73753"
 dependencies = [
- "arrow-array",
- "arrow-buffer",
- "arrow-data",
- "arrow-schema",
+ "arrow-array 56.2.0",
+ "arrow-buffer 56.2.0",
+ "arrow-data 56.2.0",
+ "arrow-schema 56.2.0",
+ "half",
+]
+
+[[package]]
+name = "arrow-row"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14fe367802f16d7668163ff647830258e6e0aeea9a4d79aaedf273af3bdcd3e"
+dependencies = [
+ "arrow-array 58.1.0",
+ "arrow-buffer 58.1.0",
+ "arrow-data 58.1.0",
+ "arrow-schema 58.1.0",
  "half",
 ]
 
@@ -499,6 +701,16 @@ version = "56.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b3aa9e59c611ebc291c28582077ef25c97f1975383f1479b12f3b9ffee2ffabe"
 
+[[package]]
+name = "arrow-schema"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c30a1365d7a7dc50cc847e54154e6af49e4c4b0fddc9f607b687f29212082743"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
 [[package]]
 name = "arrow-select"
 version = "56.2.0"
@@ -506,30 +718,61 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8c41dbbd1e97bfcaee4fcb30e29105fb2c75e4d82ae4de70b792a5d3f66b2e7a"
 dependencies = [
  "ahash 0.8.11",
- "arrow-array",
- "arrow-buffer",
- "arrow-data",
- "arrow-schema",
+ "arrow-array 56.2.0",
+ "arrow-buffer 56.2.0",
+ "arrow-data 56.2.0",
+ "arrow-schema 56.2.0",
  "num",
 ]
 
+[[package]]
+name = "arrow-select"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78694888660a9e8ac949853db393af2a8b8fc82c19ce333132dfa2e72cc1a7fe"
+dependencies = [
+ "ahash 0.8.11",
+ "arrow-array 58.1.0",
+ "arrow-buffer 58.1.0",
+ "arrow-data 58.1.0",
+ "arrow-schema 58.1.0",
+ "num-traits",
+]
+
 [[package]]
 name = "arrow-string"
 version = "56.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53f5183c150fbc619eede22b861ea7c0eebed8eaac0333eaa7f6da5205fd504d"
 dependencies = [
- "arrow-array",
- "arrow-buffer",
- "arrow-data",
- "arrow-schema",
- "arrow-select",
+ "arrow-array 56.2.0",
+ "arrow-buffer 56.2.0",
+ "arrow-data 56.2.0",
+ "arrow-schema 56.2.0",
+ "arrow-select 56.2.0",
  "memchr",
  "num",
  "regex",
  "regex-syntax",
 ]
 
+[[package]]
+name = "arrow-string"
+version = "58.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61e04a01f8bb73ce54437514c5fd3ee2aa3e8abe4c777ee5cc55853b1652f79e"
+dependencies = [
+ "arrow-array 58.1.0",
+ "arrow-buffer 58.1.0",
+ "arrow-data 58.1.0",
+ "arrow-schema 58.1.0",
+ "arrow-select 58.1.0",
+ "memchr",
+ "num-traits",
+ "regex",
+ "regex-syntax",
+]
+
 [[package]]
 name = "ascii-canvas"
 version = "4.0.0"
@@ -1548,7 +1791,7 @@ dependencies = [
  "http-body 0.4.6",
  "hyper 0.14.32",
  "itoa",
- "matchit",
+ "matchit 0.7.3",
  "memchr",
  "mime",
  "percent-encoding",
@@ -1576,19 +1819,44 @@ dependencies = [
  "http-body 1.0.1",
  "http-body-util",
  "itoa",
- "matchit",
+ "matchit 0.7.3",
  "memchr",
  "mime",
  "percent-encoding",
  "pin-project-lite",
  "rustversion",
  "serde",
- "sync_wrapper 1.0.1",
+ "sync_wrapper 1.0.2",
  "tower 0.4.13",
  "tower-layer",
  "tower-service",
 ]
 
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core 0.5.6",
+ "bytes",
+ "futures-util",
+ "http 1.3.1",
+ "http-body 1.0.1",
+ "http-body-util",
+ "itoa",
+ "matchit 0.8.4",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "sync_wrapper 1.0.2",
+ "tower 0.5.3",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "axum-core"
 version = "0.3.4"
@@ -1621,7 +1889,25 @@ dependencies = [
  "mime",
  "pin-project-lite",
  "rustversion",
- "sync_wrapper 1.0.1",
+ "sync_wrapper 1.0.2",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http 1.3.1",
+ "http-body 1.0.1",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper 1.0.2",
  "tower-layer",
  "tower-service",
 ]
@@ -1950,7 +2236,7 @@ checksum = "77e9d642a7e3a318e37c2c9427b5a6a48aa1ad55dcd986f3034ab2239045a645"
 dependencies = [
  "darling 0.21.3",
  "ident_case",
- "prettyplease 0.2.37",
+ "prettyplease",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "rustversion",
@@ -2425,7 +2711,7 @@ name = "codecs"
 version = "0.1.0"
 dependencies = [
  "apache-avro 0.20.0",
- "arrow",
+ "arrow 56.2.0",
  "async-trait",
  "bytes",
  "chrono",
@@ -2515,6 +2801,16 @@ dependencies = [
  "tokio-util",
 ]
 
+[[package]]
+name = "comfy-table"
+version = "7.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "958c5d6ecf1f214b4c2bbbbf6ab9523a864bd136dcf71a7e8904799acfe1ad47"
+dependencies = [
+ "unicode-segmentation",
+ "unicode-width 0.2.0",
+]
+
 [[package]]
 name = "community-id"
 version = "0.2.3"
@@ -2553,8 +2849,8 @@ dependencies = [
  "compression-core",
  "flate2",
  "memchr",
- "zstd 0.13.2",
- "zstd-safe 7.2.1",
+ "zstd",
+ "zstd-safe",
 ]
 
 [[package]]
@@ -4008,6 +4304,16 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
 
+[[package]]
+name = "flatbuffers"
+version = "24.12.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f1baf0dbf96932ec9a3038d57900329c015b0bfb7b63d904f3bc27e2b02a096"
+dependencies = [
+ "bitflags 1.3.2",
+ "rustc_version",
+]
+
 [[package]]
 name = "flatbuffers"
 version = "25.9.23"
@@ -4408,37 +4714,54 @@ dependencies = [
 [[package]]
 name = "greptime-proto"
 version = "0.1.0"
-source = "git+https://github.com/GreptimeTeam/greptime-proto.git?tag=v0.9.0#396206c2801b5a3ec51bfe8984c66b686da910e6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25fc58f8ba94c488192d5928f24caf16c503fb83f4784f617e83febe08647b08"
 dependencies = [
- "prost 0.12.6",
+ "prost 0.14.3",
+ "prost-types 0.14.3",
  "serde",
  "serde_json",
  "strum 0.25.0",
  "strum_macros 0.25.3",
- "tonic 0.11.0",
- "tonic-build 0.11.0",
+ "tonic 0.14.5",
+ "tonic-prost",
 ]
 
 [[package]]
 name = "greptimedb-ingester"
-version = "0.1.0"
-source = "git+https://github.com/GreptimeTeam/greptimedb-ingester-rust?rev=f7243393808640f5123b0d5b7b798da591a4df6e#f7243393808640f5123b0d5b7b798da591a4df6e"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5ee8f8f967c2b8183136920bdb0a36d06618cc9402f901495c0da66cb2cc74b"
 dependencies = [
+ "arrow 58.1.0",
+ "arrow-array 58.1.0",
+ "arrow-flight",
+ "arrow-ipc 58.1.0",
+ "arrow-schema 58.1.0",
+ "async-stream",
+ "async-trait",
+ "base64 0.22.1",
  "dashmap",
  "derive_builder",
  "enum_dispatch",
+ "flatbuffers 24.12.23",
  "futures",
  "futures-util",
  "greptime-proto",
+ "hyper 1.7.0",
+ "lazy_static",
  "parking_lot",
- "prost 0.12.6",
+ "prost 0.14.3",
  "rand 0.9.4",
+ "serde",
+ "serde_json",
  "snafu 0.8.9",
  "tokio",
  "tokio-stream",
- "tonic 0.11.0",
- "tonic-build 0.9.2",
- "tower 0.4.13",
+ "tokio-util",
+ "toml",
+ "tonic 0.14.5",
+ "tower 0.5.3",
 ]
 
 [[package]]
@@ -6309,7 +6632,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "823ec7bedb1819b11633bd583ae981b0082db08492b0c3396412b85dd329ffee"
 dependencies = [
  "cc",
- "which 5.0.0",
+ "which",
 ]
 
 [[package]]
@@ -6340,6 +6663,15 @@ dependencies = [
  "twox-hash",
 ]
 
+[[package]]
+name = "lz4_flex"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db9a0d582c2874f68138a16ce1867e0ffde6c0bb0a0df85e1f36d04146db488a"
+dependencies = [
+ "twox-hash",
+]
+
 [[package]]
 name = "macaddr"
 version = "1.0.1"
@@ -6433,6 +6765,12 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
 
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
 [[package]]
 name = "matrixmultiply"
 version = "0.3.8"
@@ -7065,9 +7403,9 @@ checksum = "63335b2e2c34fae2fb0aa2cecfd9f0832a1e24b3b32ecec612c3426d46dc8aaa"
 
 [[package]]
 name = "num-complex"
-version = "0.4.4"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ba157ca0885411de85d6ca030ba7e2a83a28636056c7c699b07c8b6f7383214"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
 dependencies = [
  "num-traits",
 ]
@@ -7437,7 +7775,7 @@ dependencies = [
  "prost 0.12.6",
  "prost-build 0.12.6",
  "tonic 0.11.0",
- "tonic-build 0.11.0",
+ "tonic-build",
  "vector-core",
  "vector-lookup",
  "vrl",
@@ -7572,20 +7910,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0dbd48ad52d7dccf8ea1b90a3ddbfaea4f69878dd7683e51c507d4bc52b5b27"
 dependencies = [
  "ahash 0.8.11",
- "arrow-array",
- "arrow-buffer",
- "arrow-cast",
- "arrow-data",
- "arrow-ipc",
- "arrow-schema",
- "arrow-select",
+ "arrow-array 56.2.0",
+ "arrow-buffer 56.2.0",
+ "arrow-cast 56.2.0",
+ "arrow-data 56.2.0",
+ "arrow-ipc 56.2.0",
+ "arrow-schema 56.2.0",
+ "arrow-select 56.2.0",
  "base64 0.22.1",
  "bytes",
  "chrono",
  "flate2",
  "half",
  "hashbrown 0.16.0",
- "lz4_flex",
+ "lz4_flex 0.11.6",
  "num",
  "num-bigint",
  "paste",
@@ -7593,7 +7931,7 @@ dependencies = [
  "snap",
  "thrift",
  "twox-hash",
- "zstd 0.13.2",
+ "zstd",
 ]
 
 [[package]]
@@ -7996,16 +8334,6 @@ dependencies = [
  "pad",
 ]
 
-[[package]]
-name = "prettyplease"
-version = "0.1.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8646e95016a7a6c4adea95bafa8a16baab64b583356217f2c85db4a39d9a86"
-dependencies = [
- "proc-macro2 1.0.106",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -8173,16 +8501,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "prost"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b82eaa1d779e9a4bc1c3217db8ffbeabaae1dca241bf70183242128d48681cd"
-dependencies = [
- "bytes",
- "prost-derive 0.11.9",
-]
-
 [[package]]
 name = "prost"
 version = "0.12.6"
@@ -8204,25 +8522,13 @@ dependencies = [
 ]
 
 [[package]]
-name = "prost-build"
-version = "0.11.9"
+name = "prost"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "119533552c9a7ffacc21e099c24a0ac8bb19c2a2a3f363de84cd9b844feab270"
+checksum = "d2ea70524a2f82d518bce41317d0fae74151505651af45faf1ffbd6fd33f0568"
 dependencies = [
  "bytes",
- "heck 0.4.1",
- "itertools 0.10.5",
- "lazy_static",
- "log",
- "multimap",
- "petgraph",
- "prettyplease 0.1.25",
- "prost 0.11.9",
- "prost-types 0.11.9",
- "regex",
- "syn 1.0.109",
- "tempfile",
- "which 4.4.2",
+ "prost-derive 0.14.3",
 ]
 
 [[package]]
@@ -8238,7 +8544,7 @@ dependencies = [
  "multimap",
  "once_cell",
  "petgraph",
- "prettyplease 0.2.37",
+ "prettyplease",
  "prost 0.12.6",
  "prost-types 0.12.6",
  "regex",
@@ -8258,7 +8564,7 @@ dependencies = [
  "multimap",
  "once_cell",
  "petgraph",
- "prettyplease 0.2.37",
+ "prettyplease",
  "prost 0.13.5",
  "prost-types 0.13.5",
  "regex",
@@ -8268,25 +8574,25 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.11.9"
+version = "0.12.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5d2d8d10f3c6ded6da8b05b5fb3b8a5082514344d56c9f871412d29b4e075b4"
+checksum = "81bddcdb20abf9501610992b6759a4c888aef7d1a7247ef75e2404275ac24af1"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.12.1",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
- "syn 1.0.109",
+ "syn 2.0.117",
 ]
 
 [[package]]
 name = "prost-derive"
-version = "0.12.6"
+version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81bddcdb20abf9501610992b6759a4c888aef7d1a7247ef75e2404275ac24af1"
+checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.12.1",
+ "itertools 0.14.0",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "syn 2.0.117",
@@ -8294,9 +8600,9 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.13.5"
+version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
+checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -8319,15 +8625,6 @@ dependencies = [
  "serde-value",
 ]
 
-[[package]]
-name = "prost-types"
-version = "0.11.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "213622a1460818959ac1181aaeb2dc9c7f63df720db7d788b3e24eacd1983e13"
-dependencies = [
- "prost 0.11.9",
-]
-
 [[package]]
 name = "prost-types"
 version = "0.12.6"
@@ -8346,6 +8643,15 @@ dependencies = [
  "prost 0.13.5",
 ]
 
+[[package]]
+name = "prost-types"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8991c4cbdb8bc5b11f0b074ffe286c30e523de90fee5ba8132f1399f23cb3dd7"
+dependencies = [
+ "prost 0.14.3",
+]
+
 [[package]]
 name = "psl"
 version = "2.1.22"
@@ -8426,7 +8732,7 @@ dependencies = [
  "tokio-util",
  "url",
  "uuid",
- "zstd 0.13.2",
+ "zstd",
 ]
 
 [[package]]
@@ -9129,7 +9435,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper 1.0.1",
+ "sync_wrapper 1.0.2",
  "tokio",
  "tokio-native-tls",
  "tokio-rustls 0.26.2",
@@ -10790,9 +11096,9 @@ checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
 [[package]]
 name = "sync_wrapper"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7065abeca94b6a8a577f9bd45aa0867a2238b74e8eb67cf10d492bc39351394"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
 dependencies = [
  "futures-core",
 ]
@@ -11480,7 +11786,6 @@ dependencies = [
  "tower-layer",
  "tower-service",
  "tracing 0.1.44",
- "zstd 0.12.4",
 ]
 
 [[package]]
@@ -11514,16 +11819,35 @@ dependencies = [
 ]
 
 [[package]]
-name = "tonic-build"
-version = "0.9.2"
+name = "tonic"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6fdaae4c2c638bb70fe42803a26fbd6fc6ac8c72f5c59f67ecc2a2dcabf4b07"
+checksum = "fec7c61a0695dc1887c1b53952990f3ad2e3a31453e1f49f10e75424943a93ec"
 dependencies = [
- "prettyplease 0.1.25",
- "proc-macro2 1.0.106",
- "prost-build 0.11.9",
- "quote 1.0.44",
- "syn 1.0.109",
+ "async-trait",
+ "axum 0.8.9",
+ "base64 0.22.1",
+ "bytes",
+ "flate2",
+ "h2 0.4.13",
+ "http 1.3.1",
+ "http-body 1.0.1",
+ "http-body-util",
+ "hyper 1.7.0",
+ "hyper-timeout 0.5.1",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "socket2 0.6.0",
+ "sync_wrapper 1.0.2",
+ "tokio",
+ "tokio-rustls 0.26.2",
+ "tokio-stream",
+ "tower 0.5.3",
+ "tower-layer",
+ "tower-service",
+ "tracing 0.1.44",
+ "zstd",
 ]
 
 [[package]]
@@ -11532,7 +11856,7 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be4ef6dd70a610078cb4e338a0f79d06bc759ff1b22d2120c2ff02ae264ba9c2"
 dependencies = [
- "prettyplease 0.2.37",
+ "prettyplease",
  "proc-macro2 1.0.106",
  "prost-build 0.12.6",
  "quote 1.0.44",
@@ -11552,6 +11876,17 @@ dependencies = [
  "tonic 0.11.0",
 ]
 
+[[package]]
+name = "tonic-prost"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55376a0bbaa4975a3f10d009ad763d8f4108f067c7c2e74f3001fb49778d309"
+dependencies = [
+ "bytes",
+ "prost 0.14.3",
+ "tonic 0.14.5",
+]
+
 [[package]]
 name = "tonic-reflection"
 version = "0.11.0"
@@ -11596,7 +11931,7 @@ dependencies = [
  "indexmap 2.12.0",
  "pin-project-lite",
  "slab",
- "sync_wrapper 1.0.1",
+ "sync_wrapper 1.0.2",
  "tokio",
  "tokio-util",
  "tower-layer",
@@ -12281,8 +12616,8 @@ dependencies = [
  "approx",
  "arc-swap",
  "arr_macro",
- "arrow",
- "arrow-schema",
+ "arrow 56.2.0",
+ "arrow-schema 56.2.0",
  "assert_cmd",
  "async-compression",
  "async-nats",
@@ -12455,7 +12790,7 @@ dependencies = [
  "tokio-util",
  "toml",
  "tonic 0.11.0",
- "tonic-build 0.11.0",
+ "tonic-build",
  "tonic-health",
  "tonic-reflection",
  "tower 0.5.3",
@@ -12482,7 +12817,7 @@ dependencies = [
  "windows 0.58.0",
  "windows-service",
  "wiremock",
- "zstd 0.13.2",
+ "zstd",
 ]
 
 [[package]]
@@ -12498,7 +12833,7 @@ dependencies = [
  "tokio",
  "tokio-stream",
  "tonic 0.11.0",
- "tonic-build 0.11.0",
+ "tonic-build",
  "tonic-health",
 ]
 
@@ -12962,7 +13297,7 @@ dependencies = [
  "jsonschema",
  "lalrpop",
  "lalrpop-util",
- "lz4_flex",
+ "lz4_flex 0.11.6",
  "md-5",
  "mlua",
  "nom 8.0.0",
@@ -13023,7 +13358,7 @@ dependencies = [
  "webbrowser",
  "woothee",
  "xxhash-rust",
- "zstd 0.13.2",
+ "zstd",
 ]
 
 [[package]]
@@ -13299,18 +13634,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "which"
-version = "4.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
-dependencies = [
- "either",
- "home",
- "once_cell",
- "rustix 0.38.40",
-]
-
 [[package]]
 name = "which"
 version = "5.0.0"
@@ -13981,7 +14304,7 @@ dependencies = [
  "anyhow",
  "heck 0.5.0",
  "indexmap 2.12.0",
- "prettyplease 0.2.37",
+ "prettyplease",
  "syn 2.0.117",
  "wasm-metadata",
  "wit-bindgen-core",
@@ -13995,7 +14318,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
 dependencies = [
  "anyhow",
- "prettyplease 0.2.37",
+ "prettyplease",
  "proc-macro2 1.0.106",
  "quote 1.0.44",
  "syn 2.0.117",
@@ -14202,32 +14525,13 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7948af682ccbc3342b6e9420e8c51c1fe5d7bf7756002b4a3c6cabfe96a7e3c"
 
-[[package]]
-name = "zstd"
-version = "0.12.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a27595e173641171fc74a1232b7b1c7a7cb6e18222c11e9dfb9888fa424c53c"
-dependencies = [
- "zstd-safe 6.0.6",
-]
-
 [[package]]
 name = "zstd"
 version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fcf2b778a664581e31e389454a7072dab1647606d44f7feea22cd5abb9c9f3f9"
 dependencies = [
- "zstd-safe 7.2.1",
-]
-
-[[package]]
-name = "zstd-safe"
-version = "6.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee98ffd0b48ee95e6c5168188e44a54550b1564d9d530ee21d5f0eaed1069581"
-dependencies = [
- "libc",
- "zstd-sys",
+ "zstd-safe",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 1045e07aae1a1..70f9fc12a8acc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -345,7 +345,7 @@ deadpool = { version = "0.13.0", default-features = false, features = ["managed"
 hex = { version = "0.4.3", default-features = false, optional = true }
 
 # GreptimeDB
-greptimedb-ingester = { git = "https://github.com/GreptimeTeam/greptimedb-ingester-rust", rev = "f7243393808640f5123b0d5b7b798da591a4df6e", optional = true }
+greptimedb-ingester = { version = "0.17.0", default-features = false, optional = true }
 
 # External libs
 arc-swap = { workspace = true, default-features = false, optional = true }
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index eb9e179e57c2b..ea2ff8e85d12e 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -32,7 +32,9 @@ arrow-arith,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arro
 arrow-array,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
 arrow-buffer,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
 arrow-cast,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
+arrow-csv,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
 arrow-data,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
+arrow-flight,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
 arrow-ipc,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
 arrow-json,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
 arrow-ord,https://github.com/apache/arrow-rs,Apache-2.0,Apache Arrow <dev@arrow.apache.org>
@@ -165,6 +167,7 @@ codespan-reporting,https://github.com/brendanzab/codespan,Apache-2.0,Brendan Zab
 colorchoice,https://github.com/rust-cli/anstyle,MIT OR Apache-2.0,The colorchoice Authors
 colored,https://github.com/mackwic/colored,MPL-2.0,Thomas Wickham <mackwic@gmail.com>
 combine,https://github.com/Marwes/combine,MIT,Markus Westerlind <marwes91@gmail.com>
+comfy-table,https://github.com/nukesor/comfy-table,MIT,Arne Beer <contact@arne.beer>
 community-id,https://github.com/traceflight/rs-community-id,MIT OR Apache-2.0,Julian Wang <traceflight@outlook.com>
 compact_str,https://github.com/ParkMyCar/compact_str,MIT,Parker Timmerman <parker@parkertimmerman.com>
 compression-codecs,https://github.com/Nullus157/async-compression,MIT OR Apache-2.0,"Wim Looman <wim@nemo157.com>, Allen Bui <fairingrey@gmail.com>"
@@ -789,6 +792,7 @@ toml_write,https://github.com/toml-rs/toml,MIT OR Apache-2.0,The toml_write Auth
 toml_writer,https://github.com/toml-rs/toml,MIT OR Apache-2.0,The toml_writer Authors
 tonic,https://github.com/hyperium/tonic,MIT,Lucio Franco <luciofranco14@gmail.com>
 tonic-health,https://github.com/hyperium/tonic,MIT,James Nugent <james@jen20.com>
+tonic-prost,https://github.com/hyperium/tonic,MIT,Lucio Franco <luciofranco14@gmail.com>
 tonic-reflection,https://github.com/hyperium/tonic,MIT,"James Nugent <james@jen20.com>, Samani G. Gikandi <samani@gojulas.com>"
 tower,https://github.com/tower-rs/tower,MIT,Tower Maintainers <team@tower-rs.com>
 tower-http,https://github.com/tower-rs/tower-http,MIT,Tower Maintainers <team@tower-rs.com>
diff --git a/changelog.d/greptimedb_ingester_crate.breaking.md b/changelog.d/greptimedb_ingester_crate.breaking.md
new file mode 100644
index 0000000000000..79984693ef8e1
--- /dev/null
+++ b/changelog.d/greptimedb_ingester_crate.breaking.md
@@ -0,0 +1,3 @@
+The `greptimedb_metrics` and `greptimedb_logs` sinks now require GreptimeDB v1.x. Users running GreptimeDB v0.x must upgrade their GreptimeDB instance before upgrading Vector.
+
+authors: thomasqueirozb
diff --git a/src/sinks/greptimedb/metrics/config.rs b/src/sinks/greptimedb/metrics/config.rs
index 4261486a05706..8f91392325698 100644
--- a/src/sinks/greptimedb/metrics/config.rs
+++ b/src/sinks/greptimedb/metrics/config.rs
@@ -2,7 +2,7 @@ use vector_lib::{configurable::configurable_component, sensitive_string::Sensiti
 
 use crate::sinks::{
     greptimedb::{
-        GreptimeDBDefaultBatchSettings, default_dbname,
+        GreptimeDBDefaultBatchSettings, GrpcCompression, default_dbname,
         metrics::{
             request::GreptimeDBGrpcRetryLogic,
             request_builder::RequestBuilderOptions,
@@ -85,11 +85,9 @@ pub struct GreptimeDBMetricsConfig {
     #[configurable(metadata(docs::examples = "password"))]
     #[serde(default)]
     pub password: Option<SensitiveString>,
-    /// Set gRPC compression encoding for the request
-    /// Default to none, `gzip` or `zstd` is supported.
-    #[configurable(metadata(docs::examples = "gzip"))]
+    /// Set gRPC compression encoding for the request.
     #[serde(default)]
-    pub grpc_compression: Option<String>,
+    pub grpc_compression: GrpcCompression,
 
     #[configurable(derived)]
     #[serde(default)]
diff --git a/src/sinks/greptimedb/metrics/request.rs b/src/sinks/greptimedb/metrics/request.rs
index eedfc6f26f2d8..68767844412dc 100644
--- a/src/sinks/greptimedb/metrics/request.rs
+++ b/src/sinks/greptimedb/metrics/request.rs
@@ -1,6 +1,7 @@
 use std::num::NonZeroUsize;
 
-use greptimedb_ingester::{Error as GreptimeError, api::v1::*};
+use greptimedb_ingester::Error as GreptimeError;
+use greptimedb_ingester::api::v1::RowInsertRequests;
 use vector_lib::event::Metric;
 
 use crate::sinks::{
diff --git a/src/sinks/greptimedb/metrics/request_builder.rs b/src/sinks/greptimedb/metrics/request_builder.rs
index 1980d67e6a78c..e596ae06e0cee 100644
--- a/src/sinks/greptimedb/metrics/request_builder.rs
+++ b/src/sinks/greptimedb/metrics/request_builder.rs
@@ -1,5 +1,8 @@
 use chrono::Utc;
-use greptimedb_ingester::{api::v1::*, helpers::values::*};
+use greptimedb_ingester::api::v1::{
+    ColumnDataType, ColumnSchema, Row, RowInsertRequest, Rows, SemanticType, Value,
+};
+use greptimedb_ingester::helpers::values::{f64_value, string_value, timestamp_millisecond_value};
 use vector_lib::{
     event::{
         Metric, MetricValue,
@@ -238,6 +241,7 @@ fn tag_column(name: &str) -> ColumnSchema {
 #[cfg(test)]
 mod tests {
 
+    use greptimedb_ingester::api::v1::value;
     use similar_asserts::assert_eq;
 
     use super::*;
diff --git a/src/sinks/greptimedb/metrics/service.rs b/src/sinks/greptimedb/metrics/service.rs
index 77ac61593302a..e3bdc4a07b1b6 100644
--- a/src/sinks/greptimedb/metrics/service.rs
+++ b/src/sinks/greptimedb/metrics/service.rs
@@ -1,16 +1,22 @@
 use std::{sync::Arc, task::Poll};
 
 use greptimedb_ingester::{
-    Client, ClientBuilder, Compression, Database, Error as GreptimeError,
-    api::v1::{auth_header::AuthScheme, *},
-    channel_manager::*,
+    Error as GreptimeError, GrpcCompression as IngesterGrpcCompression,
+    api::v1::Basic,
+    api::v1::auth_header::AuthScheme,
+    channel_manager::{ChannelConfig, ChannelManager, ClientTlsOption},
+    client::Client,
+    database::Database,
 };
 use vector_lib::sensitive_string::SensitiveString;
 
 use crate::sinks::{
-    greptimedb::metrics::{
-        config::GreptimeDBMetricsConfig,
-        request::{GreptimeDBGrpcBatchOutput, GreptimeDBGrpcRequest},
+    greptimedb::{
+        GrpcCompression,
+        metrics::{
+            config::GreptimeDBMetricsConfig,
+            request::{GreptimeDBGrpcBatchOutput, GreptimeDBGrpcRequest},
+        },
     },
     prelude::*,
 };
@@ -22,49 +28,63 @@ pub struct GreptimeDBGrpcService {
 }
 
 fn new_client_from_config(config: &GreptimeDBGrpcServiceConfig) -> crate::Result<Client> {
-    let mut builder = ClientBuilder::default().peers(vec![&config.endpoint]);
+    let send_compression_encoding = match config.compression {
+        GrpcCompression::None => None,
+        GrpcCompression::Gzip => Some(IngesterGrpcCompression::Gzip),
+        GrpcCompression::Zstd => Some(IngesterGrpcCompression::Zstd),
+    };
+
+    let mut channel_config = ChannelConfig {
+        send_compression_encoding,
+        ..Default::default()
+    };
+
+    let channel_manager = if let Some(tls_config) = &config.tls {
+        let TlsConfig {
+            verify_certificate,
+            verify_hostname,
+            alpn_protocols,
+            ca_file,
+            crt_file,
+            key_file,
+            key_pass,
+            server_name,
+        } = tls_config;
+
+        if verify_certificate.is_some()
+            || verify_hostname.is_some()
+            || alpn_protocols.is_some()
+            || key_pass.is_some()
+            || server_name.is_some()
+        {
+            warn!(
+                message = "TlsConfig: verify_certificate, verify_hostname, alpn_protocols, key_pass and server_name are not supported by greptimedb client at the moment."
+            );
+        }
 
-    if let Some(compression) = config.compression.as_ref() {
-        let compression = match compression.as_str() {
-            "gzip" => Compression::Gzip,
-            "zstd" => Compression::Zstd,
+        // The greptimedb ingester requires all three TLS paths (ca_file, crt_file,
+        // key_file) to be set. Refuse a partial config rather than downgrading to plaintext.
+        match (ca_file, crt_file, key_file) {
+            (Some(ca), Some(crt), Some(key)) => {
+                channel_config.client_tls = Some(ClientTlsOption {
+                    server_ca_cert_path: ca.to_string_lossy().into_owned(),
+                    client_cert_path: crt.to_string_lossy().into_owned(),
+                    client_key_path: key.to_string_lossy().into_owned(),
+                });
+                ChannelManager::with_tls_config(channel_config).map_err(Box::new)?
+            }
             _ => {
-                warn!(message = "Unknown gRPC compression type: {compression}, disabled.");
-                Compression::None
+                return Err(
+                    "GreptimeDB TLS requires ca_file, crt_file, and key_file to all be set.".into(),
+                );
             }
-        };
-        builder = builder.compression(compression);
-    }
-
-    if let Some(tls_config) = &config.tls {
-        let channel_config = ChannelConfig {
-            client_tls: Some(try_from_tls_config(tls_config)?),
-            ..Default::default()
-        };
-
-        builder = builder
-            .channel_manager(ChannelManager::with_tls_config(channel_config).map_err(Box::new)?);
-    }
-
-    Ok(builder.build())
-}
-
-fn try_from_tls_config(tls_config: &TlsConfig) -> crate::Result<ClientTlsOption> {
-    if tls_config.key_pass.is_some()
-        || tls_config.alpn_protocols.is_some()
-        || tls_config.verify_certificate.is_some()
-        || tls_config.verify_hostname.is_some()
-    {
-        warn!(
-            message = "TlsConfig: key_pass, alpn_protocols, verify_certificate and verify_hostname are not supported by greptimedb client at the moment."
-        );
-    }
+        }
+    } else {
+        ChannelManager::with_config(channel_config)
+    };
+    let client = Client::with_manager_and_urls(channel_manager, vec![&config.endpoint]);
 
-    Ok(ClientTlsOption {
-        server_ca_cert_path: tls_config.ca_file.clone(),
-        client_cert_path: tls_config.crt_file.clone(),
-        client_key_path: tls_config.key_file.clone(),
-    })
+    Ok(client)
 }
 
 impl GreptimeDBGrpcService {
@@ -103,7 +123,7 @@ impl Service<GreptimeDBGrpcRequest> for GreptimeDBGrpcService {
 
         Box::pin(async move {
             let metadata = req.metadata;
-            let result = client.row_insert(req.items).await?;
+            let result = client.insert(req.items).await?;
 
             Ok(GreptimeDBGrpcBatchOutput {
                 _item_count: result,
@@ -119,7 +139,7 @@ pub(super) struct GreptimeDBGrpcServiceConfig {
     dbname: String,
     username: Option<String>,
     password: Option<SensitiveString>,
-    compression: Option<String>,
+    compression: GrpcCompression,
     tls: Option<TlsConfig>,
 }
 
@@ -130,7 +150,7 @@ impl From<&GreptimeDBMetricsConfig> for GreptimeDBGrpcServiceConfig {
             dbname: val.dbname.clone(),
             username: val.username.clone(),
             password: val.password.clone(),
-            compression: val.grpc_compression.clone(),
+            compression: val.grpc_compression,
             tls: val.tls.clone(),
         }
     }
diff --git a/src/sinks/greptimedb/mod.rs b/src/sinks/greptimedb/mod.rs
index 8116681652dc2..5369992e21c46 100644
--- a/src/sinks/greptimedb/mod.rs
+++ b/src/sinks/greptimedb/mod.rs
@@ -4,6 +4,20 @@ use crate::sinks::prelude::*;
 mod logs;
 mod metrics;
 
+/// Compression algorithm for gRPC requests to GreptimeDB.
+#[configurable_component]
+#[derive(Clone, Copy, Debug, Default)]
+#[serde(rename_all = "lowercase")]
+enum GrpcCompression {
+    /// No compression.
+    #[default]
+    None,
+    /// Gzip compression.
+    Gzip,
+    /// Zstandard compression.
+    Zstd,
+}
+
 fn default_dbname() -> String {
     greptimedb_ingester::DEFAULT_SCHEMA_NAME.to_string()
 }
diff --git a/tests/integration/greptimedb/config/test.yaml b/tests/integration/greptimedb/config/test.yaml
index 2ec3984938617..8a79569ac06fa 100644
--- a/tests/integration/greptimedb/config/test.yaml
+++ b/tests/integration/greptimedb/config/test.yaml
@@ -10,9 +10,7 @@ runner:
     no_proxy: greptimedb
 
 matrix:
-  # Temporarily pegging to the latest known stable release
-  # since using `latest` is failing consistently.
-  version: [v0.13.2]
+  version: [v1.0.0, latest]
 
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
diff --git a/website/cue/reference/components/sinks/generated/greptimedb.cue b/website/cue/reference/components/sinks/generated/greptimedb.cue
index 90cbf9c459d62..27abfd61e2960 100644
--- a/website/cue/reference/components/sinks/generated/greptimedb.cue
+++ b/website/cue/reference/components/sinks/generated/greptimedb.cue
@@ -92,14 +92,16 @@ generated: components: sinks: greptimedb: configuration: {
 		type: string: examples: ["example.com:4001"]
 	}
 	grpc_compression: {
-		description: """
-			Set gRPC compression encoding for the request
-			Default to none, `gzip` or `zstd` is supported.
-			"""
-		required: false
-		type: string: examples: [
-			"gzip",
-		]
+		description: "Set gRPC compression encoding for the request."
+		required:    false
+		type: string: {
+			default: "none"
+			enum: {
+				gzip: "Gzip compression."
+				none: "No compression."
+				zstd: "Zstandard compression."
+			}
+		}
 	}
 	new_naming: {
 		description: """
diff --git a/website/cue/reference/components/sinks/generated/greptimedb_metrics.cue b/website/cue/reference/components/sinks/generated/greptimedb_metrics.cue
index aea1d76a0eb46..eb262d81fbea5 100644
--- a/website/cue/reference/components/sinks/generated/greptimedb_metrics.cue
+++ b/website/cue/reference/components/sinks/generated/greptimedb_metrics.cue
@@ -92,14 +92,16 @@ generated: components: sinks: greptimedb_metrics: configuration: {
 		type: string: examples: ["example.com:4001"]
 	}
 	grpc_compression: {
-		description: """
-			Set gRPC compression encoding for the request
-			Default to none, `gzip` or `zstd` is supported.
-			"""
-		required: false
-		type: string: examples: [
-			"gzip",
-		]
+		description: "Set gRPC compression encoding for the request."
+		required:    false
+		type: string: {
+			default: "none"
+			enum: {
+				gzip: "Gzip compression."
+				none: "No compression."
+				zstd: "Zstandard compression."
+			}
+		}
 	}
 	new_naming: {
 		description: """

From 61cc4d84d2966e7552a308d5df5a0f03305d7eed Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 27 Apr 2026 09:40:18 -0400
Subject: [PATCH 161/326] fix(ci): make publish-s3 wait for generate-sha256sum
 (#25265)

---
 .github/workflows/publish.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d5093f229017c..5ccb5ea82c968 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -382,6 +382,7 @@ jobs:
       - deb-verify
       - rpm-verify
       - macos-verify
+      - generate-sha256sum
     env:
       VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
       CHANNEL: ${{ needs.generate-publish-metadata.outputs.vector_release_channel }}

From 454b096abcfd609b4e317b83fa4ec1ec79af5da8 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 27 Apr 2026 10:14:28 -0400
Subject: [PATCH 162/326] docs(deprecations): add datadog_metrics series v1
 deprecation entry (#25271)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 docs/DEPRECATIONS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/DEPRECATIONS.md b/docs/DEPRECATIONS.md
index b57db75f736af..9c36ff3eb7859 100644
--- a/docs/DEPRECATIONS.md
+++ b/docs/DEPRECATIONS.md
@@ -17,6 +17,7 @@ For example:
 - `v0.50.0` | `http-server-encoding` | The `encoding` field will be removed. Use `decoding` and `framing` instead.
 - `v0.53.0` | `buffer-bytes-events-metrics` | The `buffer_byte_size` and `buffer_events` gauges are deprecated in favor of the `buffer_size_bytes`/`buffer_size_events` metrics described in `docs/specs/buffer.md`.
 - `v0.58.0` | `azure-monitor-logs-sink` | The `azure_monitor_logs` sink is deprecated in favor of the new `azure_logs_ingestion` sink, which uses the Azure Monitor Logs Ingestion API. Users should migrate before Microsoft ends support for the old Data Collector API (scheduled for September 2026).
+- `v0.58.0` | `datadog-metrics-series-v1` | The `series_api_version: v1` option on the `datadog_metrics` sink is deprecated in favor of `v2` (the default). The v1 series endpoint (`/api/v1/series`) is a legacy endpoint; users should remove `series_api_version: v1` from their configuration or set it to `v2`.
 
 ## To be migrated
 

From aa9265d6026f7d5998cada6a50e9c66790fbf054 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 27 Apr 2026 10:47:04 -0400
Subject: [PATCH 163/326] chore(deps): add dependabot config for
 scripts/environment/npm-tools (#25175)

* chore(deps): add dependabot config for scripts/environment/npm-tools

* Set open-pull-requests-limit: 0
---
 .github/dependabot.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 609da972baa98..ade867f95145f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -176,3 +176,19 @@ updates:
       npm_and_yarn:
         patterns:
           - "*"
+  - package-ecosystem: "npm"
+    directory: "/scripts/environment/npm-tools"
+    schedule:
+      interval: "monthly"
+      time: "05:00" # UTC
+    labels:
+      - "domain: deps"
+      - "no-changelog"
+    commit-message:
+      prefix: "chore(deps)"
+    # Disable version updates; security updates bypass this limit
+    open-pull-requests-limit: 0
+    groups:
+      npm_and_yarn:
+        patterns:
+          - "*"

From 69fd3b6f7e544a3f4bbba1d6d7e882a67387b081 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 10:56:51 -0400
Subject: [PATCH 164/326] chore(ci): bump github/codeql-action from 4.32.4 to
 4.35.2 (#25280)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.4 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/89a39a4e59826350b863aa6b6252a07ad50cf83e...95e58e9a2cdfd71adc6e0353d5c52f41a045d225)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 7a8fd8c9a7d47..391406f824e27 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
         with:
           sarif_file: results.sarif

From 413caac10f64475b509687000317e06e55de55e0 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 27 Apr 2026 11:18:47 -0400
Subject: [PATCH 165/326] fix(ci): allow dd-token federation to fail on fork
 PRs (#25284)

---
 .github/actions/dd-token/action.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/actions/dd-token/action.yml b/.github/actions/dd-token/action.yml
index 8ea92dc1c2dd5..f2b6b32eb0a16 100644
--- a/.github/actions/dd-token/action.yml
+++ b/.github/actions/dd-token/action.yml
@@ -10,8 +10,11 @@ inputs:
 runs:
   using: "composite"
   steps:
+    # Fork PRs don't get `id-token: write`, so federation cannot succeed.
+    # Allow the step to fail and let downstream steps run without DD credentials.
     - name: Federate Datadog token
       id: dd-sts
+      continue-on-error: true
       uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75
       with:
         policy: ${{ inputs.policy }}
@@ -22,7 +25,9 @@ runs:
         DD_STS_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
         DD_STS_APP_KEY: ${{ steps.dd-sts.outputs.app_key }}
       run: |
-        echo "DD_API_KEY=${DD_STS_API_KEY}" >> "$GITHUB_ENV"
+        if [ -n "${DD_STS_API_KEY}" ]; then
+          echo "DD_API_KEY=${DD_STS_API_KEY}" >> "$GITHUB_ENV"
+        fi
         if [ -n "${DD_STS_APP_KEY}" ]; then
           echo "DD_APP_KEY=${DD_STS_APP_KEY}" >> "$GITHUB_ENV"
         fi

From ba84da5d8965aef1d5eb5455dc9f4d723177e914 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 11:01:24 -0400
Subject: [PATCH 166/326] chore(ci): bump actions/github-script from 7 to 9
 (#25278)

* chore(ci): bump actions/github-script from 7 to 9

Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 9.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v9)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Use pinned github-script sha

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 .github/workflows/add_wip_label.yml                    |  2 +-
 .github/workflows/check_generated_vrl_docs_comment.yml |  2 +-
 .github/workflows/create_preview_sites.yml             | 10 +++++-----
 .github/workflows/k8s_e2e.yml                          |  2 +-
 .github/workflows/preview_site_trigger.yml             |  2 +-
 .github/workflows/remove_wip_label.yml                 |  2 +-
 6 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/add_wip_label.yml b/.github/workflows/add_wip_label.yml
index 9a1260b693e81..7924d4fade926 100644
--- a/.github/workflows/add_wip_label.yml
+++ b/.github/workflows/add_wip_label.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: Check member review state
         id: check
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const { data: reviews } = await github.rest.pulls.listReviews({
diff --git a/.github/workflows/check_generated_vrl_docs_comment.yml b/.github/workflows/check_generated_vrl_docs_comment.yml
index e455203f75a6b..faa429af4de9b 100644
--- a/.github/workflows/check_generated_vrl_docs_comment.yml
+++ b/.github/workflows/check_generated_vrl_docs_comment.yml
@@ -26,7 +26,7 @@ jobs:
           github-token: ${{ github.token }}
 
       - name: Comment on PR
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/create_preview_sites.yml b/.github/workflows/create_preview_sites.yml
index 6cd7edf89bdb9..282a012192400 100644
--- a/.github/workflows/create_preview_sites.yml
+++ b/.github/workflows/create_preview_sites.yml
@@ -38,7 +38,7 @@ jobs:
     steps:
       # Get the artifacts with the PR number and branch name
       - name: Download artifact
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
@@ -58,7 +58,7 @@ jobs:
 
       # Extract the info from the artifact and set variables
       - name: Extract PR info from artifact
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
@@ -85,7 +85,7 @@ jobs:
 
       # Validate the integrity of the artifact
       - name: Validate Artifact Integrity
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const crypto = require('crypto');
@@ -104,7 +104,7 @@ jobs:
 
       # Kick off the job in amplify
       - name: Deploy Site
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           APP_ID: ${{ inputs.APP_ID }}
           APP_NAME: ${{ inputs.APP_NAME }}
@@ -171,7 +171,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APP_ID: ${{ inputs.APP_ID }}
           APP_NAME: ${{ inputs.APP_NAME }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index 3b35ec0b7b9dc..08aea2e9c3c09 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -116,7 +116,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         id: set-matrix
         with:
           script: |
diff --git a/.github/workflows/preview_site_trigger.yml b/.github/workflows/preview_site_trigger.yml
index 98c5a6a2df720..fb506c89ead29 100644
--- a/.github/workflows/preview_site_trigger.yml
+++ b/.github/workflows/preview_site_trigger.yml
@@ -32,7 +32,7 @@ jobs:
       # Save PR information (only if branch is valid)
       - name: Validate and save PR information
         if: steps.validate.outputs.valid == 'true'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs').promises;
diff --git a/.github/workflows/remove_wip_label.yml b/.github/workflows/remove_wip_label.yml
index 46d6e79cf1ad8..7c30ee892a949 100644
--- a/.github/workflows/remove_wip_label.yml
+++ b/.github/workflows/remove_wip_label.yml
@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Check association, label, and remove
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const association = context.payload.review.author_association;

From a4ea6de53b829e6ec66fadaddd78317f099207b9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 11:34:31 -0400
Subject: [PATCH 167/326] chore(ci): bump actions/upload-artifact from 7.0.0 to
 7.0.1 in the artifact group across 1 directory (#25276)

chore(ci): bump actions/upload-artifact

Bumps the artifact group with 1 update in the / directory: [actions/upload-artifact](https://github.com/actions/upload-artifact).


Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: artifact
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/changes.yml                  | 4 ++--
 .github/workflows/check_generated_vrl_docs.yml | 2 +-
 .github/workflows/cross.yml                    | 2 +-
 .github/workflows/k8s_e2e.yml                  | 2 +-
 .github/workflows/preview_site_trigger.yml     | 2 +-
 .github/workflows/publish.yml                  | 8 ++++----
 .github/workflows/regression.yml               | 8 ++++----
 .github/workflows/scorecard.yml                | 2 +-
 8 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/changes.yml b/.github/workflows/changes.yml
index b07447715d75f..710932c694bc2 100644
--- a/.github/workflows/changes.yml
+++ b/.github/workflows/changes.yml
@@ -422,7 +422,7 @@ jobs:
           echo "any=$any_changed" >> $GITHUB_OUTPUT
 
       - name: Upload JSON artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: int_tests_changes
           path: int_tests_changes.json
@@ -484,7 +484,7 @@ jobs:
           echo "any=$any_changed" >> $GITHUB_OUTPUT
 
       - name: Upload JSON artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: e2e_tests_changes
           path: e2e_tests_changes.json
diff --git a/.github/workflows/check_generated_vrl_docs.yml b/.github/workflows/check_generated_vrl_docs.yml
index 867ffd7619379..4d30b4f8d5bd2 100644
--- a/.github/workflows/check_generated_vrl_docs.yml
+++ b/.github/workflows/check_generated_vrl_docs.yml
@@ -114,7 +114,7 @@ jobs:
           && steps.last-commit.outputs.is-auto != 'true'
           && github.event_name == 'pull_request'
           && steps.push.outcome != 'success'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vrl-docs-check-pr
           path: /tmp/docs-check/pr-number
diff --git a/.github/workflows/cross.yml b/.github/workflows/cross.yml
index b554a45d45c09..bc2b2b559503b 100644
--- a/.github/workflows/cross.yml
+++ b/.github/workflows/cross.yml
@@ -55,7 +55,7 @@ jobs:
       # aarch64 and musl in particular are notoriously hard to link.
       # While it may be tempting to slot a `check` in here for quickness, please don't.
       - run: make cross-build-${{ matrix.target }}
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: "vector-debug-${{ matrix.target }}"
           path: "./target/${{ matrix.target }}/debug/vector"
diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index 08aea2e9c3c09..6b65985cc6eb6 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -95,7 +95,7 @@ jobs:
 
       - run: VECTOR_VERSION="$(vdev version)" make package-deb-x86_64-unknown-linux-gnu
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: e2e-test-deb-package
           path: target/artifacts/*
diff --git a/.github/workflows/preview_site_trigger.yml b/.github/workflows/preview_site_trigger.yml
index fb506c89ead29..db74832c36d60 100644
--- a/.github/workflows/preview_site_trigger.yml
+++ b/.github/workflows/preview_site_trigger.yml
@@ -54,7 +54,7 @@ jobs:
       # Upload the artifact using latest version (only if branch is valid)
       - name: Upload PR information artifact
         if: steps.validate.outputs.valid == 'true'
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: pr
           path: pr/
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5ccb5ea82c968..4f82bd06e3894 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -81,7 +81,7 @@ jobs:
       - name: Build Vector
         run: make package-${{ matrix.target }}-all
       - name: Stage package artifacts for publish
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vector-${{ env.VECTOR_VERSION }}-${{ matrix.target }}
           path: target/artifacts/vector*
@@ -129,7 +129,7 @@ jobs:
           export PATH="$HOME/.cargo/bin:$PATH"
           make package
       - name: Stage package artifacts for publish
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vector-${{ env.VECTOR_VERSION }}-${{ matrix.architecture }}-apple-darwin
           path: target/artifacts/vector*
@@ -176,7 +176,7 @@ jobs:
           export PATH="/c/wix:$PATH"
           ./scripts/package-msi.sh
       - name: Stage package artifacts for publish
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vector-${{ env.VECTOR_VERSION }}-x86_64-pc-windows-msvc
           path: target/artifacts/vector*
@@ -470,7 +470,7 @@ jobs:
       - name: Generate SHA256 checksums for artifacts
         run: make sha256sum
       - name: Stage checksum for publish
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vector-${{ env.VECTOR_VERSION }}-SHA256SUMS
           path: target/artifacts/vector-${{ env.VECTOR_VERSION }}-SHA256SUMS
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index aaf71eb9687a4..94b47333a8ed8 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -223,7 +223,7 @@ jobs:
             vector:${{ needs.resolve-inputs.outputs.baseline-tag }}
 
       - name: Upload image as artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: baseline-image
           path: "${{ runner.temp }}/baseline-image.tar"
@@ -266,7 +266,7 @@ jobs:
             vector:${{ needs.resolve-inputs.outputs.comparison-tag }}
 
       - name: Upload image as artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: comparison-image
           path: "${{ runner.temp }}/comparison-image.tar"
@@ -433,7 +433,7 @@ jobs:
             --submission-metadata ${{ runner.temp }}/submission-metadata \
             --replicas ${{ env.SMP_REPLICAS }}
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: vector-submission-metadata
           path: ${{ runner.temp }}/submission-metadata
@@ -557,7 +557,7 @@ jobs:
           path: ${{ runner.temp }}/outputs/report.md
 
       - name: Upload regression report to artifacts
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: capture-artifacts
           path: ${{ runner.temp }}/outputs/*
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 391406f824e27..9e64b64ccfabd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -59,7 +59,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif

From 1d4b6c2122b82997b808bba0527ec60dbb37a3ba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Josu=C3=A9=20AGBEKODO?= <josue.agbekodo@datadoghq.com>
Date: Mon, 27 Apr 2026 17:36:38 +0200
Subject: [PATCH 168/326] fix(splunk_hec source): Emit warn on unauthenticated
 request (#25230)

* fix(splunk_hec source): Emit warn on unauthenticated request

* add changelog

* Address comments

* fix(splunk_hec source): use authentication_failed error type for unauthenticated requests

Add a new `authentication_failed` error_type constant so consumers can
filter auth failures from other request errors in `component_errors_total`.

* Update changelog.md

---------

Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 ...plunk_hec_source_specify_wrong_auth.fix.md |  3 ++
 .../src/internal_event/prelude.rs             |  2 +
 src/internal_events/splunk_hec.rs             | 42 +++++++++++++------
 3 files changed, 35 insertions(+), 12 deletions(-)
 create mode 100644 changelog.d/25230_splunk_hec_source_specify_wrong_auth.fix.md

diff --git a/changelog.d/25230_splunk_hec_source_specify_wrong_auth.fix.md b/changelog.d/25230_splunk_hec_source_specify_wrong_auth.fix.md
new file mode 100644
index 0000000000000..8c2af5dd212e4
--- /dev/null
+++ b/changelog.d/25230_splunk_hec_source_specify_wrong_auth.fix.md
@@ -0,0 +1,3 @@
+The error log + metric that `splunk_hec` source emit on missing/invalid auth header now specifies "authentication_failed" as error_type.
+
+authors: 20agbekodo
diff --git a/lib/vector-common/src/internal_event/prelude.rs b/lib/vector-common/src/internal_event/prelude.rs
index 92aa160fe509e..bcc68aef26c6b 100644
--- a/lib/vector-common/src/internal_event/prelude.rs
+++ b/lib/vector-common/src/internal_event/prelude.rs
@@ -15,6 +15,8 @@ pub mod error_type {
     // When a condition for the event to be valid failed.
     // This is used for example when a field is missing or should be a string.
     pub const CONDITION_FAILED: &str = "condition_failed";
+    // When the component received a request with missing or invalid authentication credentials.
+    pub const AUTHENTICATION_FAILED: &str = "authentication_failed";
     // When the component or the service on which it depends is not configured properly.
     pub const CONFIGURATION_FAILED: &str = "configuration_failed";
     // When the component failed to connect to an external service.
diff --git a/src/internal_events/splunk_hec.rs b/src/internal_events/splunk_hec.rs
index ea090684ed85d..6dcd63084d8e6 100644
--- a/src/internal_events/splunk_hec.rs
+++ b/src/internal_events/splunk_hec.rs
@@ -234,18 +234,36 @@ mod source {
 
     impl InternalEvent for SplunkHecRequestError {
         fn emit(self) {
-            error!(
-                message = "Error processing request.",
-                error = ?self.error,
-                error_type = error_type::REQUEST_FAILED,
-                stage = error_stage::RECEIVING
-            );
-            counter!(
-                "component_errors_total",
-                "error_type" => error_type::REQUEST_FAILED,
-                "stage" => error_stage::RECEIVING,
-            )
-            .increment(1);
+            match self.error {
+                ApiError::InvalidAuthorization | ApiError::MissingAuthorization => {
+                    error!(
+                        message = "Unauthenticated request.",
+                        error = ?self.error,
+                        error_type = error_type::AUTHENTICATION_FAILED,
+                        stage = error_stage::RECEIVING
+                    );
+                    counter!(
+                        "component_errors_total",
+                        "error_type" => error_type::AUTHENTICATION_FAILED,
+                        "stage" => error_stage::RECEIVING,
+                    )
+                    .increment(1);
+                }
+                _ => {
+                    error!(
+                        message = "Error processing request.",
+                        error = ?self.error,
+                        error_type = error_type::REQUEST_FAILED,
+                        stage = error_stage::RECEIVING
+                    );
+                    counter!(
+                        "component_errors_total",
+                        "error_type" => error_type::REQUEST_FAILED,
+                        "stage" => error_stage::RECEIVING,
+                    )
+                    .increment(1);
+                }
+            }
         }
     }
 }

From 156b832637c2f18b4d32fbb347e0e5f0919407d3 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 27 Apr 2026 14:33:20 -0400
Subject: [PATCH 169/326] fix(website): include page title in docs search query
 fields (#25255)

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 website/typesense.config.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/typesense.config.json b/website/typesense.config.json
index 249a303dc895e..9ea772c4c5c12 100644
--- a/website/typesense.config.json
+++ b/website/typesense.config.json
@@ -143,7 +143,7 @@
           "name": "vector_docs_search",
           "search_parameters": {
             "sort_by": "level:desc,ranking:desc,_text_match:desc",
-            "query_by": "content,hierarchy,title,tags"
+            "query_by": "pageTitle,title,hierarchy,content,tags"
           }
         }
       ]

From a843435f9677fe45f482ff4604bfe92b8a3d57c7 Mon Sep 17 00:00:00 2001
From: Rob Blafford <robert.blafford@datadoghq.com>
Date: Mon, 27 Apr 2026 16:16:32 -0400
Subject: [PATCH 170/326] fix(topology): Fix for issue causing stalling on
 shutdown for sinks configured w/ disk buffers (#24949)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(buffers): prevent reload stall when disk buffer config changes

- Changing a disk buffer's configuration (e.g. `max_size`) during a
live config reload would stall indefinitely or fail with a `buffer.lock` error.
This was caused by two issues:
    1. The sink's detach trigger was only cancelled for buffer-reuse
cases, so sinks with changed disk buffer configs never had their input
stream terminated — disk buffer readers do not return `None` when the
writer disconnects, causing the old sink task to hang forever.
    2. The source output pump only processed fanout control messages
(Remove/Pause) during active sends, so idle sources would never drop their
`BufferSender` clone, keeping the `Arc<Ledger>` file lock alive even after the
sink task completed.
  - Cancel the detach trigger for changed disk buffer sinks so the old
sink task can complete.
  - Make the source output pump `select!` on both events and fanout
control messages, so Remove/Pause is processed promptly even when the source
is idle.
  - Add a retry loop (30s timeout) when acquiring the disk buffer lock
to handle the small race window between the sink task completing and the
fanout releasing the writer.
  - Add `BufferConfig::has_disk_stage()` helper for identifying disk
buffer configurations.

* Add unit tests for reload when disk buffer config modified

* Add changelog fragment

* Integration test exercising full disk buffer path w/ s3 sink

- This test sets up a pipeline that sends using the s3 sinks with disk
buffers enabled.

- Data is sent through the disk buffer before and after configuration
reload.

* Clean-up changelog fragment

* Fix spelling issues

* Fix merge error and cleanup use of config()

- Make consistent use of the config() method in all tests within this
file

* Simplify set of control_channel_open status

* Remove unnecessary mutable modifiers

* Prefer tempDir to just writing to /tmp

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 .../24929_fix_stall_on_disk_shutdown.fix.md   |   6 +
 lib/vector-buffers/src/config.rs              |   7 +
 lib/vector-core/src/fanout.rs                 |  14 ++
 src/sinks/aws_s3/integration_tests.rs         | 235 ++++++++++++------
 src/topology/builder.rs                       |  62 +++--
 src/topology/running.rs                       |  46 ++--
 src/topology/test/reload.rs                   | 137 +++++++++-
 7 files changed, 396 insertions(+), 111 deletions(-)
 create mode 100644 changelog.d/24929_fix_stall_on_disk_shutdown.fix.md

diff --git a/changelog.d/24929_fix_stall_on_disk_shutdown.fix.md b/changelog.d/24929_fix_stall_on_disk_shutdown.fix.md
new file mode 100644
index 0000000000000..2c7633caef857
--- /dev/null
+++ b/changelog.d/24929_fix_stall_on_disk_shutdown.fix.md
@@ -0,0 +1,6 @@
+Fixed issue during in place reload of a sink with a disk buffer configured, where
+the component would stall for batch.timeout_sec before gracefully reloading.
+This fix also resolves issues Vector had where it would ignore SIGINT during
+cases where the pipeline stall had occurred.
+
+authors: graphcareful
diff --git a/lib/vector-buffers/src/config.rs b/lib/vector-buffers/src/config.rs
index ea51bfce3cb57..0cc9d77cd29d1 100644
--- a/lib/vector-buffers/src/config.rs
+++ b/lib/vector-buffers/src/config.rs
@@ -371,6 +371,13 @@ impl Default for BufferConfig {
 }
 
 impl BufferConfig {
+    /// Returns true if any stage in this buffer configuration uses disk-based storage.
+    pub fn has_disk_stage(&self) -> bool {
+        self.stages()
+            .iter()
+            .any(|stage| matches!(stage, BufferType::DiskV2 { .. }))
+    }
+
     /// Gets all of the configured stages for this buffer.
     pub fn stages(&self) -> &[BufferType] {
         match self {
diff --git a/lib/vector-core/src/fanout.rs b/lib/vector-core/src/fanout.rs
index 0fd5cb034b703..97e21bcc8db17 100644
--- a/lib/vector-core/src/fanout.rs
+++ b/lib/vector-core/src/fanout.rs
@@ -108,6 +108,20 @@ impl Fanout {
         }
     }
 
+    /// Waits for the next control message and applies it.
+    ///
+    /// Returns `true` if a message was processed, `false` if the control
+    /// channel was closed.
+    pub async fn recv_control_message(&mut self) -> bool {
+        match self.control_channel.recv().await {
+            Some(msg) => {
+                self.apply_control_message(msg);
+                true
+            }
+            None => false,
+        }
+    }
+
     /// Apply a control message directly against this instance.
     ///
     /// This method should not be used if there is an active `SendGroup` being processed.
diff --git a/src/sinks/aws_s3/integration_tests.rs b/src/sinks/aws_s3/integration_tests.rs
index ff2e0e5a5146b..a1a2c10af2201 100644
--- a/src/sinks/aws_s3/integration_tests.rs
+++ b/src/sinks/aws_s3/integration_tests.rs
@@ -1,7 +1,9 @@
 #![cfg(all(test, feature = "aws-s3-integration-tests"))]
 
 use std::{
+    collections::HashSet,
     io::{BufRead, BufReader},
+    num::NonZeroU64,
     time::Duration,
 };
 
@@ -18,12 +20,14 @@ use bytes::Buf;
 use flate2::read::MultiGzDecoder;
 use futures::{Stream, stream};
 use similar_asserts::assert_eq;
+use tempfile::TempDir;
 use tokio_stream::StreamExt;
 #[cfg(feature = "codecs-parquet")]
 use vector_lib::codecs::encoding::BatchSerializerConfig;
 use vector_lib::{
+    buffers::{BufferConfig, BufferType, WhenFull},
     codecs::{TextSerializerConfig, encoding::FramingConfig},
-    config::proxy::ProxyConfig,
+    config::{ComponentKey, proxy::ProxyConfig},
     event::{BatchNotifier, BatchStatus, BatchStatusReceiver, Event, EventArray, LogEvent},
 };
 
@@ -31,18 +35,20 @@ use super::S3SinkConfig;
 use crate::{
     aws::{AwsAuthentication, RegionOrEndpoint, create_client},
     common::s3::S3ClientBuilder,
-    config::SinkContext,
+    config::{Config, SinkContext},
     sinks::{
         aws_s3::config::default_filename_time_format,
         s3_common::config::{S3Options, S3ServerSideEncryption},
         util::{BatchConfig, Compression, TowerRequestConfig},
     },
     test_util::{
+        self,
         components::{
             AWS_SINK_TAGS, COMPONENT_ERROR_TAGS, run_and_assert_sink_compliance,
             run_and_assert_sink_error,
         },
-        random_lines_with_stream, random_string,
+        mock::basic_source,
+        random_lines_with_stream, random_string, start_topology,
     },
 };
 
@@ -58,8 +64,10 @@ async fn s3_insert_message_into_with_flat_key_prefix() {
 
     create_bucket(&bucket, false).await;
 
-    let mut config = config(&bucket, 1000000);
-    config.key_prefix = "test-prefix".to_string();
+    let config = S3SinkConfig {
+        key_prefix: "test-prefix".to_string(),
+        ..config(&bucket, 1000000, 5.0)
+    };
     let prefix = config.key_prefix.clone();
     let service = config.create_service(&cx.globals.proxy).await.unwrap();
     let sink = config.build_processor(service, cx).unwrap();
@@ -92,8 +100,10 @@ async fn s3_insert_message_into_with_folder_key_prefix() {
 
     create_bucket(&bucket, false).await;
 
-    let mut config = config(&bucket, 1000000);
-    config.key_prefix = "test-prefix/".to_string();
+    let config = S3SinkConfig {
+        key_prefix: "test-prefix/".to_string(),
+        ..config(&bucket, 1000000, 5.0)
+    };
     let prefix = config.key_prefix.clone();
     let service = config.create_service(&cx.globals.proxy).await.unwrap();
     let sink = config.build_processor(service, cx).unwrap();
@@ -126,11 +136,16 @@ async fn s3_insert_message_into_with_ssekms_key_id() {
 
     create_bucket(&bucket, false).await;
 
-    let mut config = config(&bucket, 1000000);
-    config.key_prefix = "test-prefix".to_string();
+    let config = S3SinkConfig {
+        key_prefix: "test-prefix".to_string(),
+        options: S3Options {
+            server_side_encryption: Some(S3ServerSideEncryption::AwsKms),
+            ssekms_key_id: Some("alias/aws/s3".to_string()),
+            ..S3Options::default()
+        },
+        ..config(&bucket, 1000000, 5.0)
+    };
     let prefix = config.key_prefix.clone();
-    config.options.server_side_encryption = Some(S3ServerSideEncryption::AwsKms);
-    config.options.ssekms_key_id = Some("alias/aws/s3".to_string());
 
     let service = config.create_service(&cx.globals.proxy).await.unwrap();
     let sink = config.build_processor(service, cx).unwrap();
@@ -167,7 +182,7 @@ async fn s3_rotate_files_after_the_buffer_size_is_reached() {
         key_prefix: format!("{}/{}", random_string(10), "{{i}}"),
         filename_time_format: "waitsforfullbatch".into(),
         filename_append_uuid: false,
-        ..config(&bucket, 10)
+        ..config(&bucket, 10, 5.0)
     };
     let prefix = config.key_prefix.clone();
     let service = config.create_service(&cx.globals.proxy).await.unwrap();
@@ -225,7 +240,7 @@ async fn s3_gzip() {
     let config = S3SinkConfig {
         compression: Compression::gzip_default(),
         filename_time_format: "%s%f".into(),
-        ..config(&bucket, batch_size)
+        ..config(&bucket, batch_size, 5.0)
     };
 
     let prefix = config.key_prefix.clone();
@@ -270,7 +285,7 @@ async fn s3_zstd() {
     let config = S3SinkConfig {
         compression: Compression::zstd_default(),
         filename_time_format: "%s%f".into(),
-        ..config(&bucket, batch_size)
+        ..config(&bucket, batch_size, 5.0)
     };
 
     let prefix = config.key_prefix.clone();
@@ -334,7 +349,7 @@ async fn s3_insert_message_into_object_lock() {
         .await
         .unwrap();
 
-    let config = config(&bucket, 1000000);
+    let config = config(&bucket, 1000000, 5.0);
     let prefix = config.key_prefix.clone();
     let service = config.create_service(&cx.globals.proxy).await.unwrap();
     let sink = config.build_processor(service, cx).unwrap();
@@ -364,9 +379,10 @@ async fn acknowledges_failures() {
 
     create_bucket(&bucket, false).await;
 
-    let mut config = config(&bucket, 1);
-    // Break the bucket name
-    config.bucket = format!("BREAK{}IT", config.bucket);
+    let config = S3SinkConfig {
+        bucket: format!("BREAK{}IT", &bucket), // Break the bucket name
+        ..config(&bucket, 1, 5.0)
+    };
     let prefix = config.key_prefix.clone();
     let service = config.create_service(&cx.globals.proxy).await.unwrap();
     let sink = config.build_processor(service, cx).unwrap();
@@ -385,7 +401,7 @@ async fn s3_healthchecks() {
 
     create_bucket(&bucket, false).await;
 
-    let config = config(&bucket, 1);
+    let config = config(&bucket, 1, 5.0);
     let service = config
         .create_service(&ProxyConfig::from_env())
         .await
@@ -399,7 +415,7 @@ async fn s3_healthchecks() {
 
 #[tokio::test]
 async fn s3_healthchecks_invalid_bucket() {
-    let config = config("s3_healthchecks_invalid_bucket", 1);
+    let config = config("s3_healthchecks_invalid_bucket", 1, 5.0);
     let service = config
         .create_service(&ProxyConfig::from_env())
         .await
@@ -421,33 +437,7 @@ async fn s3_flush_on_exhaustion() {
     create_bucket(&bucket, false).await;
 
     // batch size of ten events, timeout of ten seconds
-    let config = {
-        let mut batch = BatchConfig::default();
-        batch.max_events = Some(10);
-        batch.timeout_secs = Some(10.0);
-
-        S3SinkConfig {
-            bucket: bucket.to_string(),
-            key_prefix: random_string(10) + "/date=%F",
-            filename_time_format: default_filename_time_format(),
-            filename_append_uuid: true,
-            filename_extension: None,
-            options: S3Options::default(),
-            region: RegionOrEndpoint::with_both("us-east-1", s3_address()),
-            encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
-            #[cfg(feature = "codecs-parquet")]
-            batch_encoding: None,
-            compression: Compression::None,
-            batch,
-            request: TowerRequestConfig::default(),
-            tls: Default::default(),
-            auth: Default::default(),
-            acknowledgements: Default::default(),
-            timezone: Default::default(),
-            force_path_style: true,
-            retry_strategy: Default::default(),
-        }
-    };
+    let config = config(&bucket, 10, 10.0);
     let prefix = config.key_prefix.clone();
     let service = config.create_service(&cx.globals.proxy).await.unwrap();
     let sink = config.build_processor(service, cx).unwrap();
@@ -511,29 +501,9 @@ async fn s3_parquet_insert_message() {
         ..Default::default()
     };
 
-    let mut batch = BatchConfig::default();
-    batch.max_events = Some(100);
-    batch.timeout_secs = Some(5.0);
-
     let config = S3SinkConfig {
-        bucket: bucket.to_string(),
-        key_prefix: random_string(10) + "/date=%F",
-        filename_time_format: default_filename_time_format(),
-        filename_append_uuid: true,
-        filename_extension: None,
-        options: S3Options::default(),
-        region: RegionOrEndpoint::with_both("us-east-1", s3_address()),
-        encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
         batch_encoding: Some(BatchSerializerConfig::Parquet(parquet_config)),
-        compression: Compression::None,
-        batch,
-        request: TowerRequestConfig::default(),
-        tls: Default::default(),
-        auth: Default::default(),
-        acknowledgements: Default::default(),
-        timezone: Default::default(),
-        force_path_style: true,
-        retry_strategy: Default::default(),
+        ..config(&bucket, 100, 5.0)
     };
 
     let prefix = config.key_prefix.clone();
@@ -594,6 +564,131 @@ async fn s3_parquet_insert_message() {
     assert!(columns.contains(&"host".to_string()));
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn s3_disk_buffer_reload_delivers_all_events() {
+    test_util::trace_init();
+
+    let bucket = uuid::Uuid::new_v4().to_string();
+    create_bucket(&bucket, false).await;
+
+    let data_dir = TempDir::new().expect("Could not create tempdir");
+
+    // batch.timeout_secs is deliberately large (300 s) so that the test would
+    // hang if the reload waited for the batch timer instead of cancelling it.
+    let s3_config = config(&bucket, 10, 300.0);
+    let prefix = s3_config.key_prefix.clone();
+
+    // Build topology
+    let (mut source_tx, source_config) = basic_source();
+
+    let mut old_config = Config::builder();
+    old_config.global.data_dir = Some(data_dir.path().to_path_buf());
+    old_config.add_source("in", source_config);
+    old_config.add_sink("out", &["in"], s3_config);
+
+    let sink_key = ComponentKey::from("out");
+    old_config.sinks[&sink_key].buffer = BufferConfig::Single(BufferType::DiskV2 {
+        max_size: NonZeroU64::new(268435488).unwrap(),
+        when_full: WhenFull::Block,
+    });
+
+    // Clone config before building so we can create the reload config.
+    let mut new_config = old_config.clone();
+    new_config.sinks[&sink_key].buffer = BufferConfig::Single(BufferType::DiskV2 {
+        max_size: NonZeroU64::new(536870912).unwrap(),
+        when_full: WhenFull::Block,
+    });
+
+    // 1. Start topology with initial disk buffer config.
+    let (mut topology, _crash) = start_topology(old_config.build().unwrap(), false).await;
+
+    // 2. Send first batch of events (enough to trigger batch.max_events flush).
+    let (pre_lines, pre_events, pre_receiver) = make_events_batch(100, 10);
+    for event in pre_events.collect::<Vec<EventArray>>().await {
+        source_tx.send_event(event).await.unwrap();
+    }
+
+    // 3. Wait for events to appear in S3.
+    let deadline = tokio::time::Instant::now() + Duration::from_secs(30);
+    loop {
+        let keys = get_keys(&bucket, prefix.clone()).await;
+        let count: usize = futures::future::join_all(
+            keys.into_iter()
+                .map(|key| async { get_lines(get_object(&bucket, key).await).await.len() }),
+        )
+        .await
+        .into_iter()
+        .sum();
+        if count >= pre_lines.len() {
+            break;
+        }
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "Timed out waiting for pre-reload events in S3 (found {count}/{})",
+            pre_lines.len()
+        );
+        tokio::time::sleep(Duration::from_millis(500)).await;
+    }
+    assert_eq!(pre_receiver.await, BatchStatus::Delivered);
+
+    // 4. Reload config with a different disk buffer max_size.
+    //    Simulate what the `-w` file watcher does: mark the changed sink so its
+    //    buffer is rebuilt rather than reused.
+    topology.extend_reload_set(HashSet::from_iter(vec![sink_key]));
+
+    let reload_result = tokio::time::timeout(
+        Duration::from_secs(5),
+        topology.reload_config_and_respawn(new_config.build().unwrap(), Default::default()),
+    )
+    .await;
+
+    assert!(
+        reload_result.is_ok(),
+        "Reload timed out: disk buffer config change should not stall the reload"
+    );
+    reload_result.unwrap().unwrap();
+
+    // Give the new sink a moment to initialise.
+    tokio::time::sleep(Duration::from_secs(1)).await;
+
+    // 5. Send more events post-reload.
+    let (post_lines, post_events, post_receiver) = make_events_batch(100, 10);
+    for event in post_events.collect::<Vec<EventArray>>().await {
+        source_tx.send_event(event).await.unwrap();
+    }
+
+    // 6. Assert all events (pre- and post-reload) are present in S3.
+    let mut all_expected: Vec<String> = pre_lines;
+    all_expected.extend(post_lines);
+
+    let deadline = tokio::time::Instant::now() + Duration::from_secs(30);
+    let mut all_actual: Vec<String>;
+    loop {
+        all_actual = Vec::new();
+        let keys = get_keys(&bucket, prefix.clone()).await;
+        for key in keys {
+            all_actual.extend(get_lines(get_object(&bucket, key).await).await);
+        }
+        if all_actual.len() >= all_expected.len() {
+            break;
+        }
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "Timed out waiting for all events in S3 (found {}/{})",
+            all_actual.len(),
+            all_expected.len()
+        );
+        tokio::time::sleep(Duration::from_millis(500)).await;
+    }
+    assert_eq!(post_receiver.await, BatchStatus::Delivered);
+
+    all_expected.sort();
+    all_actual.sort();
+    assert_eq!(all_expected, all_actual);
+
+    topology.stop().await;
+}
+
 async fn client() -> S3Client {
     let auth = AwsAuthentication::test_auth();
     let region = RegionOrEndpoint::with_both("us-east-1", s3_address());
@@ -616,10 +711,10 @@ async fn client() -> S3Client {
     .unwrap()
 }
 
-fn config(bucket: &str, batch_size: usize) -> S3SinkConfig {
+fn config(bucket: &str, batch_size: usize, timeout_secs: f64) -> S3SinkConfig {
     let mut batch = BatchConfig::default();
     batch.max_events = Some(batch_size);
-    batch.timeout_secs = Some(5.0);
+    batch.timeout_secs = Some(timeout_secs);
 
     S3SinkConfig {
         bucket: bucket.to_string(),
diff --git a/src/topology/builder.rs b/src/topology/builder.rs
index 8048b7a6073ed..8948109fa7fb7 100644
--- a/src/topology/builder.rs
+++ b/src/topology/builder.rs
@@ -884,30 +884,44 @@ async fn run_source_output_pump(
 ) -> TaskResult {
     debug!("Source pump starting.");
 
-    while let Some(SourceSenderItem {
-        events: mut array,
-        send_reference,
-    }) = rx.next().await
-    {
-        // Even though we have a `send_reference` timestamp above, that reference time is when
-        // the events were enqueued in the `SourceSender`, not when they were pulled out of the
-        // `rx` stream on this end. Since those times can be quite different (due to blocking
-        // inherent to the fanout send operation), we set the `last_transform_timestamp` to the
-        // current time instead to get an accurate reference for when the events started waiting
-        // for the first transform.
-        let now = Instant::now();
-        array.for_each_metadata_mut(|metadata| {
-            metadata.set_source_id(Arc::clone(&source));
-            metadata.set_source_type(source_type);
-            metadata.set_last_transform_timestamp(now);
-        });
-        fanout
-            .send(array, Some(send_reference))
-            .await
-            .map_err(|e| {
-                debug!("Source pump finished with an error.");
-                TaskError::wrapped(e)
-            })?;
+    let mut control_channel_open = true;
+    loop {
+        tokio::select! {
+            biased;
+            // Process control messages (e.g. Remove/Pause) even when the source
+            // is idle, so that config reloads can proceed without waiting for the
+            // next event.
+            alive = fanout.recv_control_message(), if control_channel_open => {
+                control_channel_open = alive;
+            }
+            item = rx.next() => {
+                match item {
+                    Some(SourceSenderItem { events: mut array, send_reference }) => {
+                        // Even though we have a `send_reference` timestamp above, that reference
+                        // time is when the events were enqueued in the `SourceSender`, not when
+                        // they were pulled out of the `rx` stream on this end. Since those times
+                        // can be quite different (due to blocking inherent to the fanout send
+                        // operation), we set the `last_transform_timestamp` to the current time
+                        // instead to get an accurate reference for when the events started
+                        // waiting for the first transform.
+                        let now = Instant::now();
+                        array.for_each_metadata_mut(|metadata| {
+                            metadata.set_source_id(Arc::clone(&source));
+                            metadata.set_source_type(source_type);
+                            metadata.set_last_transform_timestamp(now);
+                        });
+                        fanout
+                            .send(array, Some(send_reference))
+                            .await
+                            .map_err(|e| {
+                                debug!("Source pump finished with an error.");
+                                TaskError::wrapped(e)
+                            })?;
+                    }
+                    None => break,
+                }
+            }
+        }
     }
 
     debug!("Source pump finished normally.");
diff --git a/src/topology/running.rs b/src/topology/running.rs
index a1ecf7278ae89..97e309ec0d0b8 100644
--- a/src/topology/running.rs
+++ b/src/topology/running.rs
@@ -583,10 +583,26 @@ impl RunningTopology {
             .collect::<HashSet<_>>();
 
         // For any existing sink that has a conflicting resource dependency with a changed/added
-        // sink, or for any sink that we want to reuse their buffer, we need to explicit wait for
-        // them to finish processing so we can reclaim ownership of those resources/buffers.
+        // sink, for any sink that we want to reuse their buffer, or for any changed sink with
+        // a disk buffer that is not being reused, we need to explicitly wait for them to finish
+        // processing so we can reclaim ownership of those resources/buffers.
+        let changed_disk_buffer_sinks = diff
+            .sinks
+            .to_change
+            .iter()
+            .filter(|key| {
+                !reuse_buffers.contains(*key)
+                    && self
+                        .config
+                        .sink(key)
+                        .is_some_and(|s| s.buffer.has_disk_stage())
+            })
+            .cloned()
+            .collect::<HashSet<_>>();
+
         let wait_for_sinks = conflicting_sinks
             .chain(reuse_buffers.iter().cloned())
+            .chain(changed_disk_buffer_sinks.iter().cloned())
             .collect::<HashSet<_>>();
 
         // First, we remove any inputs to removed sinks so they can naturally shut down.
@@ -628,24 +644,26 @@ impl RunningTopology {
 
         for key in &sinks_to_change {
             debug!(component_id = %key, "Changing sink.");
-            if reuse_buffers.contains(key) {
+            if reuse_buffers.contains(key) || changed_disk_buffer_sinks.contains(key) {
                 self.detach_triggers
                     .remove(key)
                     .unwrap()
                     .into_inner()
                     .cancel();
 
-                // We explicitly clone the input side of the buffer and store it so we don't lose
-                // it when we remove the inputs below.
-                //
-                // We clone instead of removing here because otherwise the input will be missing for
-                // the rest of the reload process, which violates the assumption that all previous
-                // inputs for components not being removed are still available. It's simpler to
-                // allow the "old" input to stick around and be replaced (even though that's
-                // basically a no-op since we're reusing the same buffer) than it is to pass around
-                // info about which sinks are having their buffers reused and treat them differently
-                // at other stages.
-                buffer_tx.insert((*key).clone(), self.inputs.get(key).unwrap().clone());
+                if reuse_buffers.contains(key) {
+                    // We explicitly clone the input side of the buffer and store it so we don't lose
+                    // it when we remove the inputs below.
+                    //
+                    // We clone instead of removing here because otherwise the input will be missing for
+                    // the rest of the reload process, which violates the assumption that all previous
+                    // inputs for components not being removed are still available. It's simpler to
+                    // allow the "old" input to stick around and be replaced (even though that's
+                    // basically a no-op since we're reusing the same buffer) than it is to pass around
+                    // info about which sinks are having their buffers reused and treat them differently
+                    // at other stages.
+                    buffer_tx.insert((*key).clone(), self.inputs.get(key).unwrap().clone());
+                }
             }
             self.remove_inputs(key, diff, new_config).await;
         }
diff --git a/src/topology/test/reload.rs b/src/topology/test/reload.rs
index 907be19f6ec0f..7b2db20d4f337 100644
--- a/src/topology/test/reload.rs
+++ b/src/topology/test/reload.rs
@@ -1,7 +1,7 @@
 use std::{
     collections::HashSet,
     net::{SocketAddr, TcpListener},
-    num::NonZeroU64,
+    num::{NonZeroU64, NonZeroUsize},
     time::Duration,
 };
 
@@ -9,7 +9,7 @@ use futures::StreamExt;
 use tokio::time::sleep;
 use tokio_stream::wrappers::UnboundedReceiverStream;
 use vector_lib::{
-    buffers::{BufferConfig, BufferType, WhenFull},
+    buffers::{BufferConfig, BufferType, MemoryBufferSize, WhenFull},
     config::ComponentKey,
 };
 
@@ -293,7 +293,6 @@ async fn topology_readd_input() {
 #[tokio::test]
 async fn topology_reload_component() {
     test_util::trace_init();
-
     let (_guard, address_0) = next_addr();
 
     let mut old_config = Config::builder();
@@ -320,6 +319,138 @@ async fn topology_reload_component() {
     }
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn topology_disk_buffer_config_change_does_not_stall() {
+    // Changing a disk buffer's configuration on a running sink (e.g. via in-situ
+    // config edit) must not stall the reload. Previously, the detach trigger was
+    // only cancelled for sinks whose buffers were being reused, so sinks with
+    // changed disk buffer configs would never have their input stream terminated,
+    // causing the reload to hang indefinitely.
+    test_util::trace_init();
+
+    let (_guard, address) = next_addr();
+
+    let data_dir = temp_dir();
+    std::fs::create_dir(&data_dir).unwrap();
+
+    let mut old_config = Config::builder();
+    old_config.global.data_dir = Some(data_dir);
+    old_config.add_source("in", internal_metrics_source());
+    old_config.add_sink("out", &["in"], prom_exporter_sink(address, 1));
+
+    let sink_key = ComponentKey::from("out");
+    old_config.sinks[&sink_key].buffer = BufferConfig::Single(BufferType::DiskV2 {
+        max_size: NonZeroU64::new(268435488).unwrap(),
+        when_full: WhenFull::Block,
+    });
+
+    // Change only the disk buffer's max_size.
+    let mut new_config = old_config.clone();
+    new_config.sinks[&sink_key].buffer = BufferConfig::Single(BufferType::DiskV2 {
+        max_size: NonZeroU64::new(536870912).unwrap(),
+        when_full: WhenFull::Block,
+    });
+
+    let (mut topology, crash) = start_topology(old_config.build().unwrap(), true).await;
+    let mut crash_stream = UnboundedReceiverStream::new(crash);
+
+    tokio::select! {
+        _ = wait_for_tcp(address) => {},
+        _ = crash_stream.next() => panic!("topology crashed before reload"),
+    }
+
+    // Simulate an in-situ config edit: the config watcher would put the changed
+    // sink into components_to_reload, which excludes it from reuse_buffers.
+    topology.extend_reload_set(HashSet::from_iter(vec![sink_key]));
+
+    let reload_result = tokio::time::timeout(
+        Duration::from_secs(5),
+        topology.reload_config_and_respawn(new_config.build().unwrap(), Default::default()),
+    )
+    .await;
+
+    assert!(
+        reload_result.is_ok(),
+        "Reload stalled: changing a disk buffer config should not cause the reload to hang"
+    );
+    reload_result.unwrap().unwrap();
+
+    // Verify the new sink is running.
+    tokio::select! {
+        _ = wait_for_tcp(address) => {},
+        _ = crash_stream.next() => panic!("topology crashed after reload"),
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn topology_disk_buffer_config_change_chained_does_not_stall() {
+    // Same as above but with a chained memory → disk overflow buffer to verify
+    // that the writer-drop notification is collected from overflow stages too.
+    test_util::trace_init();
+
+    let (_guard, address) = next_addr();
+
+    let data_dir = temp_dir();
+    std::fs::create_dir(&data_dir).unwrap();
+
+    let memory_stage = BufferType::Memory {
+        size: MemoryBufferSize::MaxEvents(NonZeroUsize::new(100).unwrap()),
+        when_full: WhenFull::Overflow,
+    };
+
+    let mut old_config = Config::builder();
+    old_config.global.data_dir = Some(data_dir);
+    old_config.add_source("in", internal_metrics_source());
+    old_config.add_sink("out", &["in"], prom_exporter_sink(address, 1));
+
+    let sink_key = ComponentKey::from("out");
+    old_config.sinks[&sink_key].buffer = BufferConfig::Chained(vec![
+        memory_stage,
+        BufferType::DiskV2 {
+            max_size: NonZeroU64::new(268435488).unwrap(),
+            when_full: WhenFull::Block,
+        },
+    ]);
+
+    // Change only the disk overflow stage's max_size.
+    let mut new_config = old_config.clone();
+    new_config.sinks[&sink_key].buffer = BufferConfig::Chained(vec![
+        memory_stage,
+        BufferType::DiskV2 {
+            max_size: NonZeroU64::new(536870912).unwrap(),
+            when_full: WhenFull::Block,
+        },
+    ]);
+
+    let (mut topology, crash) = start_topology(old_config.build().unwrap(), true).await;
+    let mut crash_stream = UnboundedReceiverStream::new(crash);
+
+    tokio::select! {
+        _ = wait_for_tcp(address) => {},
+        _ = crash_stream.next() => panic!("topology crashed before reload"),
+    }
+
+    topology.extend_reload_set(HashSet::from_iter(vec![sink_key]));
+
+    let reload_result = tokio::time::timeout(
+        Duration::from_secs(5),
+        topology.reload_config_and_respawn(new_config.build().unwrap(), Default::default()),
+    )
+    .await;
+
+    assert!(
+        reload_result.is_ok(),
+        "Reload stalled: changing a chained disk buffer config should not cause the reload to hang"
+    );
+    reload_result.unwrap().unwrap();
+
+    // Verify the new sink is running.
+    tokio::select! {
+        _ = wait_for_tcp(address) => {},
+        _ = crash_stream.next() => panic!("topology crashed after reload"),
+    }
+}
+
 async fn reload_sink_test(
     old_config: Config,
     new_config: Config,

From ff4754ab10da5838f68cc143e507087090518f91 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 28 Apr 2026 10:04:28 -0400
Subject: [PATCH 171/326] chore(ci): make nightly S3 verify resilient to CDN
 staleness (#25259)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* chore(ci): remove dead nightly artifact-redirect loop

The loop referenced an undefined $i (copy-paste from the release branch
where $i iterates over version tags). Under set -u the subshell errored,
the for loop received empty input, and the body never ran — so this has
been a no-op since it was added.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): retry verify_artifact on CDN cache staleness

packages.timber.io is fronted by a CDN; after `aws s3 rm --recursive` +
`cp --recursive` on nightly/latest, the edge can keep serving stale
bytes for longer than the existing 30s VERIFY_TIMEOUT, failing `cmp`
and the whole job. wget's --retry-on-http-error=404 only retries 404s,
not a 200 with stale content.

Wrap the compare in an exponential-backoff retry loop
(1, 2, 4, 8, 16, 32s; 7 attempts, ~63s of total sleep) so a transient
stale-cache hit no longer fails the release.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 scripts/release-s3.sh | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/scripts/release-s3.sh b/scripts/release-s3.sh
index 9889fa556e4eb..8f6c51de08669 100755
--- a/scripts/release-s3.sh
+++ b/scripts/release-s3.sh
@@ -36,11 +36,27 @@ ls "$td_nightly"
 #
 # A helper function for verifying a published artifact.
 #
+# Retries a content mismatch as well as a 404, since packages.timber.io is
+# fronted by a CDN and an object we just overwrote via `aws s3 rm` + `cp` can
+# serve stale bytes at the edge for a while.
 verify_artifact() {
   local URL="$1"
   local FILENAME="$2"
+  local attempts=7
+  local delay=1
   echo "Verifying $URL"
-  cmp <(wget -qO- --retry-on-http-error=404 --wait 10 --tries "$VERIFY_RETRIES" "$URL") "$FILENAME"
+  for ((attempt = 1; attempt <= attempts; attempt++)); do
+    if cmp <(wget -qO- --retry-on-http-error=404 --wait 10 --tries "$VERIFY_RETRIES" "$URL") "$FILENAME"; then
+      return 0
+    fi
+    if (( attempt < attempts )); then
+      echo "Attempt $attempt/$attempts did not match (likely stale CDN cache); retrying in ${delay}s"
+      sleep "$delay"
+      delay=$((delay * 2))
+    fi
+  done
+  echo "Verification of $URL failed after $attempts attempts"
+  return 1
 }
 
 #
@@ -59,15 +75,6 @@ if [[ "$CHANNEL" == "nightly" ]]; then
   aws s3 cp "$td_nightly" "s3://packages.timber.io/vector/nightly/latest" --recursive --sse --acl public-read
   echo "Uploaded archives"
 
-  echo "Redirecting old artifact names"
-  for file in $(aws s3api list-objects-v2 --bucket packages.timber.io --prefix "vector/$i/" --query 'Contents[*].Key' --output text  | tr "\t" "\n" | grep '\-nightly'); do
-    file=$(basename "$file")
-    # vector-nightly-amd64.deb -> vector-amd64.deb
-    echo -n "" | aws s3 cp - "s3://packages.timber.io/vector/nightly/$DATE/${file/-nightly/}" --website-redirect "/vector/nightly/$DATE/$file" --acl public-read
-    echo -n "" | aws s3 cp - "s3://packages.timber.io/vector/nightly/latest/${file/-nightly/}" --website-redirect "/vector/nightly/latest/$file" --acl public-read
-  done
-  echo "Redirected old artifact names"
-
   # Verify that the files exist and can be downloaded
   echo "Waiting for $VERIFY_TIMEOUT seconds before running the verifications"
   sleep "$VERIFY_TIMEOUT"

From 6f3857906d3a54d9c05aa5d3aaa8b132ac8f5e6e Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 28 Apr 2026 11:12:07 -0400
Subject: [PATCH 172/326] fix(vrl): restore stdlib functions in CLI and
 playground (#25310)

---
 changelog.d/25267_vrl_get_env_var_playground.fix.md | 2 ++
 lib/vector-vrl/cli/Cargo.toml                       | 4 ++++
 lib/vector-vrl/web-playground/Cargo.toml            | 4 ++++
 3 files changed, 10 insertions(+)
 create mode 100644 changelog.d/25267_vrl_get_env_var_playground.fix.md

diff --git a/changelog.d/25267_vrl_get_env_var_playground.fix.md b/changelog.d/25267_vrl_get_env_var_playground.fix.md
new file mode 100644
index 0000000000000..29de5d36fe6a5
--- /dev/null
+++ b/changelog.d/25267_vrl_get_env_var_playground.fix.md
@@ -0,0 +1,2 @@
+Restored the full VRL stdlib, including `get_env_var`, in the standalone VRL CLI and web playground by default.
+authors: pront
diff --git a/lib/vector-vrl/cli/Cargo.toml b/lib/vector-vrl/cli/Cargo.toml
index 32f0b8ccce166..8e3c78597de8b 100644
--- a/lib/vector-vrl/cli/Cargo.toml
+++ b/lib/vector-vrl/cli/Cargo.toml
@@ -6,6 +6,10 @@ edition = "2024"
 publish = false
 license = "MPL-2.0"
 
+[features]
+# Enable the full VRL stdlib, which includes all available VRL functions.
+default = ["vrl/stdlib"]
+
 [dependencies]
 clap.workspace = true
 vector-vrl-functions.workspace = true
diff --git a/lib/vector-vrl/web-playground/Cargo.toml b/lib/vector-vrl/web-playground/Cargo.toml
index 9b3fbd6392576..59db0427b3698 100644
--- a/lib/vector-vrl/web-playground/Cargo.toml
+++ b/lib/vector-vrl/web-playground/Cargo.toml
@@ -11,6 +11,10 @@ license = "MPL-2.0"
 [lib]
 crate-type = ["cdylib"]
 
+[features]
+# Enable the full VRL stdlib, which includes all available VRL functions.
+default = ["vrl/stdlib"]
+
 [dependencies]
 wasm-bindgen = "0.2"
 vrl.workspace = true

From 23016adf7d87f41a3d887d587b21d3409e71e3fe Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 28 Apr 2026 11:52:16 -0400
Subject: [PATCH 173/326] chore(internal docs): fix release issue templates
 (#25318)

- Fetch and fast-forward the release branch before inspecting HEAD so
  `git show --stat HEAD` reflects origin, not a stale local tip.
- Use `git push --force-with-lease` when resetting the `website` branch
  to the release branch's HEAD; a plain `git push` is rejected as
  non-fast-forward, which is the expected outcome of `reset --hard` to
  a different branch.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/ISSUE_TEMPLATE/minor-release.md | 5 +++--
 .github/ISSUE_TEMPLATE/patch-release.md | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/minor-release.md b/.github/ISSUE_TEMPLATE/minor-release.md
index 7ab406601e4cb..f295a03555512 100644
--- a/.github/ISSUE_TEMPLATE/minor-release.md
+++ b/.github/ISSUE_TEMPLATE/minor-release.md
@@ -71,7 +71,8 @@ Automated steps include:
 # On the day of release
 
 - [ ] Make sure the release branch is in sync with origin/master and has only one squashed commit with all commits from the prepare branch. If you made a PR from the prepare branch into the release branch this should already be the case.
-  - [ ] `git checkout "${RELEASE_BRANCH}"`
+  - [ ] `git fetch origin`
+  - [ ] `git checkout "${RELEASE_BRANCH}" && git pull --ff-only origin "${RELEASE_BRANCH}"`
   - [ ] `git show --stat HEAD` - This should show the squashed prepare commit.
   - [ ] Ensure release date in `website/cue/reference/releases/0.XX.Y.cue` matches current date.
     - If this needs to be updated commit and squash it in the release branch.
@@ -88,7 +89,7 @@ Automated steps include:
 - [ ] Wait for release workflow to complete.
   - Discoverable via [release.yml](https://github.com/vectordotdev/vector/actions/workflows/release.yml)
 - [ ] Reset the `website` branch to the `HEAD` of the release branch to update https://vector.dev
-  - [ ] `git switch website && git reset --hard origin/"${RELEASE_BRANCH}" && git push`
+  - [ ] `git fetch origin && git switch website && git reset --hard origin/"${RELEASE_BRANCH}" && git push --force-with-lease`
   - [ ] Confirm that the release changelog was published to https://vector.dev/releases/
     - Refer to the internal releasing doc to monitor the deployment.
 - [ ] Release Linux packages. Refer to the internal releasing doc.
diff --git a/.github/ISSUE_TEMPLATE/patch-release.md b/.github/ISSUE_TEMPLATE/patch-release.md
index afc5d8d826423..4a36f7255e36b 100644
--- a/.github/ISSUE_TEMPLATE/patch-release.md
+++ b/.github/ISSUE_TEMPLATE/patch-release.md
@@ -62,5 +62,5 @@ export PREP_BRANCH=prepare-v-0-"${CURRENT_MINOR_VERSION}"-"${NEW_PATCH_VERSION}"
   - Follow the [instructions at the top of the mirror.yaml file](https://github.com/DataDog/images/blob/fbf12868e90d52e513ebca0389610dea8a3c7e1a/mirror.yaml#L33-L49).
 - [ ] Cherry-pick any release commits from the release branch that are not on `master`, to `master`
 - [ ] Reset the `website` branch to the `HEAD` of the release branch to update https://vector.dev
-  - [ ] `git checkout website && git reset --hard origin/"${RELEASE_BRANCH}" && git push`
+  - [ ] `git fetch origin && git checkout website && git reset --hard origin/"${RELEASE_BRANCH}" && git push --force-with-lease`
 - [ ] Kick-off post-mortems for any regressions resolved by the release

From 96ad9edc5bd894029af95961ea205e0d89b17bf0 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 28 Apr 2026 14:17:38 -0400
Subject: [PATCH 174/326] fix(website): improve docs search ranking for
 component pages (#25319)

---
 website/typesense.config.json | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/website/typesense.config.json b/website/typesense.config.json
index 9ea772c4c5c12..f0543b9133c8b 100644
--- a/website/typesense.config.json
+++ b/website/typesense.config.json
@@ -5,6 +5,7 @@
       "file_path": "./public/search.json",
       "synonyms": [],
       "schema": {
+        "token_separators": ["_", "-"],
         "fields": [
           {
             "facet": false,
@@ -142,8 +143,10 @@
         {
           "name": "vector_docs_search",
           "search_parameters": {
-            "sort_by": "level:desc,ranking:desc,_text_match:desc",
-            "query_by": "pageTitle,title,hierarchy,content,tags"
+            "sort_by": "_text_match:desc,ranking:desc,level:desc",
+            "query_by": "pageTitle,title,hierarchy,content,tags",
+            "query_by_weights": "4,3,2,1,2",
+            "text_match_type": "sum_score"
           }
         }
       ]

From ce6ca439caf80bd2af10864a84e949ef244e2163 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 28 Apr 2026 15:40:29 -0400
Subject: [PATCH 175/326] chore(codecs): centralize `events_dropped` emission
 for batch encoding errors (#25199)

* fix(codecs): centralize events_dropped emission for batch encoding errors

Move events_dropped emission from individual internal events inside
serializers to a single wrapper in (Transformer, BatchEncoder)::encode_input.
This ensures all batch encoding error paths (Arrow IPC and Parquet) consistently
emit events_dropped without requiring each new error path to remember to add it.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: fix formatting

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* test(codecs): add unit test for type mismatch in Parquet encoding

Covers the build_record_batch ArrowJsonDecode error path where a schema
expects int64 but the event contains a string value.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(codecs): emit ComponentEventsDropped directly to avoid double-counting

Replace EncoderWriteError with a direct ComponentEventsDropped emission
in the batch encode wrapper. EncoderWriteError was incrementing
component_errors_total and logging "Failed writing bytes." which
double-counted errors (codec-specific events already increment
component_errors_total) and was misleading (the failure was encoding,
not writing).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: clarify comment about error counting and overcount edge case

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(codecs): guard batch-drop imports behind codecs-arrow feature

Move ComponentEventsDropped and UNINTENTIONAL imports inside the
cfg(feature = "codecs-arrow") impl block to avoid unused import
errors when the feature is disabled.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: clarify overcount edge case is a misconfiguration scenario

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(codecs): emit codec event for build_record_batch failures

The new EncoderRecordBatchError fires from build_record_batch's
RecordBatchCreation and ArrowJsonDecode paths, so type-mismatch and
decoder-build failures emit a granular component_errors_total counter at
stage="sending" with a specific error_code, instead of relying solely on
the downstream SinkRequestBuildError at stage="processing".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(codecs): add changelog fragment for batch encoding event coverage

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(codecs): assert EncoderRecordBatchError fires on Arrow type mismatch

Drives (Transformer, BatchEncoder)::encode_input through ArrowStreamSerializer
with an Int64 schema field and a string-valued event to trigger the
ArrowJsonDecode path in build_record_batch. Asserts both EncoderRecordBatchError
and ComponentEventsDropped are recorded so a regression in either emission
fails the test.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 ...25199_batch_encoding_events_dropped.fix.md |  3 +
 lib/codecs/src/encoding/format/arrow.rs       | 23 ++++++-
 lib/codecs/src/encoding/format/parquet.rs     | 63 +++++++++---------
 lib/codecs/src/internal_events.rs             | 64 ++++++++++---------
 src/sinks/util/encoding.rs                    | 61 +++++++++++++++++-
 5 files changed, 153 insertions(+), 61 deletions(-)
 create mode 100644 changelog.d/25199_batch_encoding_events_dropped.fix.md

diff --git a/changelog.d/25199_batch_encoding_events_dropped.fix.md b/changelog.d/25199_batch_encoding_events_dropped.fix.md
new file mode 100644
index 0000000000000..214aad79a528c
--- /dev/null
+++ b/changelog.d/25199_batch_encoding_events_dropped.fix.md
@@ -0,0 +1,3 @@
+Sinks using batch encoding (Parquet, Arrow IPC) now consistently emit `ComponentEventsDropped` for every encode failure path. Previously some `build_record_batch` failures (notably type mismatches) dropped events silently. A new `EncoderRecordBatchError` internal event also reports `component_errors_total` with `error_code="arrow_json_decode"` or `"arrow_record_batch_creation"` at `stage="sending"` for granular alerting.
+
+authors: pront
diff --git a/lib/codecs/src/encoding/format/arrow.rs b/lib/codecs/src/encoding/format/arrow.rs
index b8c86239ddb6a..6c600b3777d18 100644
--- a/lib/codecs/src/encoding/format/arrow.rs
+++ b/lib/codecs/src/encoding/format/arrow.rs
@@ -322,7 +322,6 @@ pub(crate) fn build_record_batch(
         });
         vector_common::internal_event::emit(crate::internal_events::EncoderNullConstraintError {
             error: &error,
-            count: values.len(),
         });
         return Err(ArrowEncodingError::NullConstraint {
             field_name: missing.join(", "),
@@ -331,12 +330,32 @@ pub(crate) fn build_record_batch(
 
     let mut decoder = ReaderBuilder::new(schema)
         .build_decoder()
+        .inspect_err(|e| {
+            vector_common::internal_event::emit(crate::internal_events::EncoderRecordBatchError {
+                error: e,
+                error_code: "arrow_record_batch_creation",
+            });
+        })
         .context(RecordBatchCreationSnafu)?;
 
-    decoder.serialize(values).context(ArrowJsonDecodeSnafu)?;
+    decoder
+        .serialize(values)
+        .inspect_err(|e| {
+            vector_common::internal_event::emit(crate::internal_events::EncoderRecordBatchError {
+                error: e,
+                error_code: "arrow_json_decode",
+            });
+        })
+        .context(ArrowJsonDecodeSnafu)?;
 
     decoder
         .flush()
+        .inspect_err(|e| {
+            vector_common::internal_event::emit(crate::internal_events::EncoderRecordBatchError {
+                error: e,
+                error_code: "arrow_json_decode",
+            });
+        })
         .context(ArrowJsonDecodeSnafu)?
         .ok_or(ArrowEncodingError::NoEvents)
 }
diff --git a/lib/codecs/src/encoding/format/parquet.rs b/lib/codecs/src/encoding/format/parquet.rs
index 7349119371a5b..adb5b4082749b 100644
--- a/lib/codecs/src/encoding/format/parquet.rs
+++ b/lib/codecs/src/encoding/format/parquet.rs
@@ -276,39 +276,29 @@ impl ParquetSerializer {
 
     /// Writes `record_batch` into `buffer` as a complete Parquet file.
     ///
-    /// On failure, emits an [`ArrowWriterError`] internal event (which also
-    /// increments `component_errors_total` and emits the events-dropped metric)
-    /// before returning the error.
+    /// On failure, emits an [`ArrowWriterError`] internal event (which
+    /// increments `component_errors_total`) before returning the error.
+    /// The caller is responsible for emitting `events_dropped`.
     fn write_record_batch(
-        &self,
         record_batch: &RecordBatch,
         buffer: &mut BytesMut,
-        event_count: usize,
+        writer_props: &WriterProperties,
     ) -> Result<(), parquet::errors::ParquetError> {
         let mut writer = ArrowWriter::try_new(
             buffer.writer(),
             Arc::clone(record_batch.schema_ref()),
-            Some((*self.writer_props).clone()),
+            Some(writer_props.clone()),
         )
         .inspect_err(|e| {
-            emit(ArrowWriterError {
-                error: e,
-                batch_count: event_count,
-            });
+            emit(ArrowWriterError { error: e });
         })?;
 
         writer.write(record_batch).inspect_err(|e| {
-            emit(ArrowWriterError {
-                error: e,
-                batch_count: event_count,
-            });
+            emit(ArrowWriterError { error: e });
         })?;
 
         writer.close().inspect_err(|e| {
-            emit(ArrowWriterError {
-                error: e,
-                batch_count: event_count,
-            });
+            emit(ArrowWriterError { error: e });
         })?;
 
         Ok(())
@@ -326,10 +316,7 @@ impl tokio_util::codec::Encoder<Vec<Event>> for ParquetSerializer {
         let json_values = match vector_log_events_to_json_values(&events) {
             Ok(values) => values,
             Err(e) => {
-                emit(JsonSerializationError {
-                    error: &e,
-                    batch_count: events.len(),
-                });
+                emit(JsonSerializationError { error: &e });
                 return Err(Box::new(e));
             }
         };
@@ -358,7 +345,6 @@ impl tokio_util::codec::Encoder<Vec<Event>> for ParquetSerializer {
                     {
                         for top_level in object_map.keys() {
                             if !self.schema_field_names.contains(top_level.as_str()) {
-                                self.events_dropped_handle.emit(Count(events.len()));
                                 return Err(Box::new(ArrowEncodingError::SchemaFetchError {
                                     message: format!(
                                         "Strict schema mode: event contains field '{top_level}' not in schema",
@@ -381,8 +367,7 @@ impl tokio_util::codec::Encoder<Vec<Event>> for ParquetSerializer {
         let record_batch =
             build_record_batch(Arc::clone(&self.schema), &json_values).map_err(Box::new)?;
 
-        self.write_record_batch(&record_batch, buffer, json_values.len())
-            .map_err(Box::new)?;
+        Self::write_record_batch(&record_batch, buffer, &self.writer_props).map_err(Box::new)?;
 
         Ok(())
     }
@@ -394,10 +379,7 @@ impl ParquetSchemaGenerator {
     pub fn infer_schema(events: &[serde_json::Value]) -> Result<Schema, Error> {
         let schema = infer_json_schema_from_iterator(events.iter().map(Ok::<_, ArrowError>))
             .map_err(|e| {
-                emit(SchemaGenerationError {
-                    error: &e,
-                    batch_count: events.len(),
-                });
+                emit(SchemaGenerationError { error: &e });
                 Error::new(ErrorKind::InvalidData, e.to_string())
             })?;
 
@@ -916,6 +898,29 @@ mod tests {
         assert_eq!(columns, vec!["name"]);
     }
 
+    #[test]
+    fn test_parquet_type_mismatch_returns_error() {
+        let schema_path =
+            write_temp_schema("type_mismatch", "message logs {\n  required int64 name;\n}");
+
+        let mut serializer = ParquetSerializer::new(ParquetSerializerConfig {
+            schema_file: Some(schema_path),
+            schema_mode: ParquetSchemaMode::Relaxed,
+            ..Default::default()
+        })
+        .expect("Failed to create serializer");
+
+        let events = vec![create_event(vec![("name", "not_an_integer")])];
+        let mut buffer = BytesMut::new();
+        let result = serializer.encode(events, &mut buffer);
+        assert!(result.is_err(), "Type mismatch should return an error");
+        let err = result.unwrap_err().to_string();
+        assert!(
+            err.contains("Int64"),
+            "Error should mention the expected type, got: {err}"
+        );
+    }
+
     #[test]
     fn test_parquet_schema_file_binary_without_string_annotation_rejected() {
         // Native Parquet "binary" without (STRING) annotation resolves to Arrow Binary,
diff --git a/lib/codecs/src/internal_events.rs b/lib/codecs/src/internal_events.rs
index 0ed24719dd8bc..d21119419887d 100644
--- a/lib/codecs/src/internal_events.rs
+++ b/lib/codecs/src/internal_events.rs
@@ -157,16 +157,13 @@ impl<E: std::fmt::Display> InternalEvent for EncoderWriteError<'_, E> {
 pub struct EncoderNullConstraintError<'a> {
     /// The schema constraint error that occurred.
     pub error: &'a vector_common::Error,
-    /// The number of events dropped due to the constraint violation.
-    pub count: usize,
 }
 
 #[cfg(feature = "arrow")]
 impl InternalEvent for EncoderNullConstraintError<'_> {
     fn emit(self) {
-        const CONSTRAINT_REASON: &str = "Schema constraint violation.";
         error!(
-            message = CONSTRAINT_REASON,
+            message = "Schema constraint violation.",
             error = %self.error,
             error_code = "encoding_null_constraint",
             error_type = error_type::ENCODER_FAILED,
@@ -179,10 +176,37 @@ impl InternalEvent for EncoderNullConstraintError<'_> {
             "stage" => error_stage::SENDING,
         )
         .increment(1);
-        emit(ComponentEventsDropped::<UNINTENTIONAL> {
-            count: self.count,
-            reason: CONSTRAINT_REASON,
-        });
+    }
+}
+
+#[cfg(feature = "arrow")]
+#[derive(Debug, NamedInternalEvent)]
+/// Emitted when Arrow record batch construction fails (e.g. schema decoder build,
+/// JSON-to-Arrow decoding such as type mismatches).
+pub struct EncoderRecordBatchError<'a, E> {
+    /// The encoding error that occurred.
+    pub error: &'a E,
+    /// Stable error code identifying the failure mode.
+    pub error_code: &'static str,
+}
+
+#[cfg(feature = "arrow")]
+impl<E: std::fmt::Display> InternalEvent for EncoderRecordBatchError<'_, E> {
+    fn emit(self) {
+        error!(
+            message = "Failed to build Arrow record batch.",
+            error = %self.error,
+            error_code = self.error_code,
+            error_type = error_type::ENCODER_FAILED,
+            stage = error_stage::SENDING,
+        );
+        counter!(
+            "component_errors_total",
+            "error_code" => self.error_code,
+            "error_type" => error_type::ENCODER_FAILED,
+            "stage" => error_stage::SENDING,
+        )
+        .increment(1);
     }
 }
 
@@ -190,15 +214,13 @@ impl InternalEvent for EncoderNullConstraintError<'_> {
 #[derive(NamedInternalEvent)]
 pub(crate) struct SchemaGenerationError<'a> {
     pub error: &'a arrow::error::ArrowError,
-    pub batch_count: usize,
 }
 
 #[cfg(feature = "parquet")]
 impl InternalEvent for SchemaGenerationError<'_> {
     fn emit(self) {
-        const REASON: &str = "Could not generate schema for batched events";
         error!(
-            message = REASON,
+            message = "Could not generate schema for batched events",
             error = %self.error,
             error_code = "parquet_schema_generation_failed",
             error_type = error_type::ENCODER_FAILED,
@@ -212,10 +234,6 @@ impl InternalEvent for SchemaGenerationError<'_> {
             "stage" => error_stage::SENDING,
         )
         .increment(1);
-        emit(ComponentEventsDropped::<UNINTENTIONAL> {
-            count: self.batch_count,
-            reason: REASON,
-        });
     }
 }
 
@@ -223,15 +241,13 @@ impl InternalEvent for SchemaGenerationError<'_> {
 #[derive(NamedInternalEvent)]
 pub(crate) struct ArrowWriterError<'a> {
     pub error: &'a parquet::errors::ParquetError,
-    pub batch_count: usize,
 }
 
 #[cfg(feature = "parquet")]
 impl InternalEvent for ArrowWriterError<'_> {
     fn emit(self) {
-        const REASON: &str = "Failed to write record batch with ArrowWriter.";
         error!(
-            message = REASON,
+            message = "Failed to write record batch with ArrowWriter.",
             error = %self.error,
             error_code = "parquet_arrow_writer_failed",
             error_type = error_type::ENCODER_FAILED,
@@ -245,10 +261,6 @@ impl InternalEvent for ArrowWriterError<'_> {
             "stage" => error_stage::SENDING,
         )
         .increment(1);
-        emit(ComponentEventsDropped::<UNINTENTIONAL> {
-            count: self.batch_count,
-            reason: REASON,
-        });
     }
 }
 
@@ -256,15 +268,13 @@ impl InternalEvent for ArrowWriterError<'_> {
 #[derive(NamedInternalEvent)]
 pub(crate) struct JsonSerializationError<'a> {
     pub error: &'a serde_json::Error,
-    pub batch_count: usize,
 }
 
 #[cfg(feature = "parquet")]
 impl InternalEvent for JsonSerializationError<'_> {
     fn emit(self) {
-        const CONSTRAINT_REASON: &str = "Could not serialize event to JSON.";
         error!(
-            message = CONSTRAINT_REASON,
+            message = "Could not serialize event to JSON.",
             error = %self.error,
             error_type = error_type::ENCODER_FAILED,
             stage = error_stage::SENDING,
@@ -276,9 +286,5 @@ impl InternalEvent for JsonSerializationError<'_> {
             "stage" => error_stage::SENDING,
         )
         .increment(1);
-        emit(ComponentEventsDropped::<UNINTENTIONAL> {
-            count: self.batch_count,
-            reason: CONSTRAINT_REASON,
-        });
     }
 }
diff --git a/src/sinks/util/encoding.rs b/src/sinks/util/encoding.rs
index 4cc49b00f358b..63f8407cef53b 100644
--- a/src/sinks/util/encoding.rs
+++ b/src/sinks/util/encoding.rs
@@ -107,6 +107,7 @@ impl Encoder<Vec<Event>> for (Transformer, vector_lib::codecs::BatchEncoder) {
         writer: &mut dyn io::Write,
     ) -> io::Result<(usize, GroupedCountByteSize)> {
         use tokio_util::codec::Encoder as _;
+        use vector_lib::internal_event::{ComponentEventsDropped, UNINTENTIONAL};
 
         let mut encoder = self.1.clone();
         let mut byte_size = telemetry().create_request_count_byte_size();
@@ -122,7 +123,22 @@ impl Encoder<Vec<Event>> for (Transformer, vector_lib::codecs::BatchEncoder) {
         let mut bytes = BytesMut::new();
         encoder
             .encode(transformed_events, &mut bytes)
-            .map_err(|error| io::Error::new(io::ErrorKind::InvalidData, error))?;
+            .map_err(|error| {
+                // Codec error paths emit their own internal event
+                // (e.g. SchemaGenerationError, EncoderNullConstraintError,
+                // EncoderRecordBatchError) which logs the error and increments
+                // component_errors_total. We only emit the drop count here to
+                // avoid double-counting.
+                // n_events is the pre-filter count; Parquet filters non-log
+                // events before encoding, but that only happens if a sink is
+                // misconfigured to send non-log events into a log-only encoder,
+                // so the overcount is not a practical concern.
+                emit!(ComponentEventsDropped::<UNINTENTIONAL> {
+                    count: n_events,
+                    reason: "Failed to batch encode events.",
+                });
+                io::Error::new(io::ErrorKind::InvalidData, error)
+            })?;
 
         write_all(writer, n_events, &bytes)?;
         Ok((bytes.len(), byte_size))
@@ -202,6 +218,7 @@ mod tests {
     use std::{collections::BTreeMap, env, path::PathBuf};
 
     use bytes::{BufMut, Bytes};
+    use cfg_if::cfg_if;
     use vector_lib::{
         codecs::{
             CharacterDelimitedEncoder, JsonSerializerConfig, LengthDelimitedEncoder,
@@ -214,6 +231,17 @@ mod tests {
     };
     use vrl::value::{KeyString, Value};
 
+    cfg_if! {
+        if #[cfg(feature = "codecs-arrow")] {
+            use arrow::datatypes::{DataType, Field, Schema as ArrowSchema};
+            use vector_lib::codecs::{
+                BatchEncoder,
+                encoding::{ArrowStreamSerializer, ArrowStreamSerializerConfig, BatchSerializer},
+            };
+            use vector_lib::event_test_util::{clear_recorded_events, contains_name_once};
+        }
+    }
+
     use super::*;
 
     #[test]
@@ -558,4 +586,35 @@ mod tests {
         assert_eq!(CountByteSize(2, input_json_size), size.size().unwrap());
         assert_eq!(Bytes::copy_from_slice(&writer), expected_bytes);
     }
+
+    #[cfg(feature = "codecs-arrow")]
+    #[test]
+    fn test_encode_batch_arrow_emits_record_batch_error_on_type_mismatch() {
+        clear_recorded_events();
+
+        // Schema declares `message` as Int64, but the event below carries a string,
+        // so `build_record_batch` returns `ArrowEncodingError::ArrowJsonDecode`.
+        let schema = ArrowSchema::new(vec![Field::new("message", DataType::Int64, false)]);
+        let serializer = ArrowStreamSerializer::new(ArrowStreamSerializerConfig::new(schema))
+            .expect("failed to build ArrowStreamSerializer");
+        let encoder = BatchEncoder::new(BatchSerializer::Arrow(serializer));
+        let encoding = (Transformer::default(), encoder);
+
+        let event = Event::Log(LogEvent::from(BTreeMap::from([(
+            KeyString::from("message"),
+            Value::from("not_an_integer"),
+        )])));
+
+        let mut writer = Vec::new();
+        let result = encoding.encode_input(vec![event], &mut writer);
+        assert!(
+            result.is_err(),
+            "type mismatch should fail batch encoding, got {result:?}"
+        );
+
+        contains_name_once("EncoderRecordBatchError")
+            .expect("EncoderRecordBatchError should be emitted on ArrowJsonDecode failure");
+        contains_name_once("ComponentEventsDropped")
+            .expect("ComponentEventsDropped should be emitted by the wrapper");
+    }
 }

From d6cdf031d16a382a38046127fbc7ff30c2457709 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 28 Apr 2026 17:40:45 -0400
Subject: [PATCH 176/326] fix(releasing): enable codecs-parquet in all release
 feature sets (#25321)

* fix(releasing): enable codecs-parquet in all release feature sets

The aws_s3 sink's `batch_encoding` field is gated behind the
`codecs-parquet` Cargo feature, but the v0.55.0 release artifacts did
not include that feature. Users running the precompiled binaries hit
`unknown field batch_encoding` even though the feature was advertised
in the v0.55.0 release notes.

Enable `codecs-parquet` in `target-base` (covers every Linux release
triple), `default` (macOS), and `default-msvc` (Windows), plus the
related aggregator features for consistency.

Closes #25313

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(releasing): correct changelog author handle

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(releasing): trim changelog wording

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(external docs): regenerate component docs with parquet codec

Adds the missing `docs::enum_tag_description` metadata on
`ParquetCompression` (required by the doc generator for internally
tagged enums) and regenerates the aws_s3 and clickhouse component
Cue files now that `codecs-parquet` and `codecs-arrow` are part of
the default release feature set.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: address review wording on batch encoding fields

Apply @maycmlee's suggestions in the source rustdocs (and regenerate
the affected Cue):

- aws_s3 `batch_encoding`: `e.g., Parquet` -> `for example, Parquet`
- arrow `allow_nullable_fields`: tighter wording for both enabled and
  disabled cases
- parquet `Zstd`/`Gzip` `level`: drop "currently" from "Vector
  currently supports"

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(releasing): consolidate codecs-parquet into base feature

Every release feature aggregator (default, default-cmake, default-msvc,
default-musl, default-no-api-client, target-base) transitively pulls
`base` either directly or via `enable-api-client`/`enable-unix`. Drop
the redundant per-aggregator listings and add `codecs-parquet` to
`base` once so the feature can't be silently lost when a future
aggregator gets added.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(aws_s3, clickhouse): note supported batch_encoding codec per sink

The `batch_encoding` field on both sinks types as `Option<BatchSerializerConfig>`,
which advertises every codec variant in the generated reference. Each sink
only accepts a subset at runtime: aws_s3 rejects everything except
`parquet`, clickhouse rejects `parquet`. Call out the supported codec in
the field's rustdoc so the published reference matches what the sink
will actually accept.

A follow-up should replace the shared enum with sink-specific config
types so the type system enforces the constraint.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 Cargo.toml                                    |  2 +-
 ...3_enable_codecs_parquet_in_releases.fix.md |  3 +
 lib/codecs/src/encoding/format/arrow.rs       |  6 +-
 lib/codecs/src/encoding/format/parquet.rs     |  7 +-
 src/sinks/aws_s3/config.rs                    |  4 +-
 src/sinks/clickhouse/config.rs                |  2 +
 .../components/sinks/generated/aws_s3.cue     | 99 +++++++++++++++++++
 .../components/sinks/generated/clickhouse.cue | 86 +++++++++++++---
 8 files changed, 186 insertions(+), 23 deletions(-)
 create mode 100644 changelog.d/25313_enable_codecs_parquet_in_releases.fix.md

diff --git a/Cargo.toml b/Cargo.toml
index 70f9fc12a8acc..52161db4b2905 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -519,7 +519,7 @@ vendored = ["rdkafka?/gssapi-vendored"]
 
 # Default features for *-pc-windows-msvc
 # TODO: Enable SASL https://github.com/vectordotdev/vector/pull/3081#issuecomment-659298042
-base = ["api", "enrichment-tables", "sinks", "sources", "transforms", "secrets", "vrl/stdlib"]
+base = ["api", "enrichment-tables", "sinks", "sources", "transforms", "secrets", "vrl/stdlib", "codecs-parquet"]
 enable-api-client = ["base", "api-client"]
 enable-unix = ["enable-api-client", "sources-dnstap", "unix"]
 
diff --git a/changelog.d/25313_enable_codecs_parquet_in_releases.fix.md b/changelog.d/25313_enable_codecs_parquet_in_releases.fix.md
new file mode 100644
index 0000000000000..fe3baaf110d5e
--- /dev/null
+++ b/changelog.d/25313_enable_codecs_parquet_in_releases.fix.md
@@ -0,0 +1,3 @@
+Parquet encoding in the `aws_s3` sink (`batch_encoding`) now works out of the box in the official release binaries. Previously it required compiling Vector from source with the `codecs-parquet` feature.
+
+authors: pront
diff --git a/lib/codecs/src/encoding/format/arrow.rs b/lib/codecs/src/encoding/format/arrow.rs
index 6c600b3777d18..e4b3ca565887f 100644
--- a/lib/codecs/src/encoding/format/arrow.rs
+++ b/lib/codecs/src/encoding/format/arrow.rs
@@ -40,12 +40,12 @@ pub struct ArrowStreamSerializerConfig {
 
     /// Allow null values for non-nullable fields in the schema.
     ///
-    /// When enabled, missing or incompatible values will be encoded as null even for fields
+    /// When enabled, missing or incompatible values are encoded as null, even for fields
     /// marked as non-nullable in the Arrow schema. This is useful when working with downstream
     /// systems that can handle null values through defaults, computed columns, or other mechanisms.
     ///
-    /// When disabled (default), missing values for non-nullable fields will cause encoding errors,
-    /// ensuring all required data is present before sending to the sink.
+    /// When disabled (default), missing values for non-nullable fields results in encoding errors. This is to
+    /// help ensure all required data is present before sending it to the sink.
     #[serde(default)]
     #[configurable(derived)]
     pub allow_nullable_fields: bool,
diff --git a/lib/codecs/src/encoding/format/parquet.rs b/lib/codecs/src/encoding/format/parquet.rs
index adb5b4082749b..b8874d9b1de90 100644
--- a/lib/codecs/src/encoding/format/parquet.rs
+++ b/lib/codecs/src/encoding/format/parquet.rs
@@ -35,17 +35,20 @@ type EventsDroppedError = ComponentEventsDropped<'static, UNINTENTIONAL>;
 /// Compression algorithm and optional level for archive objects.
 #[configurable_component]
 #[derive(Default, Copy, Clone, Debug, PartialEq)]
+#[configurable(metadata(
+    docs::enum_tag_description = "Compression codec applied per column page inside the Parquet file."
+))]
 #[serde(tag = "algorithm", rename_all = "snake_case")]
 pub enum ParquetCompression {
     /// Zstd compression. Level must be between 1 and 21.
     Zstd {
-        /// Compression level (1–21). This is the range Vector currently supports; higher values compress more but are slower.
+        /// Compression level (1–21). This is the range Vector supports; higher values compress more but are slower.
         #[configurable(validation(range(min = 1, max = 21)))]
         level: u8,
     },
     /// Gzip compression. Level must be between 1 and 9.
     Gzip {
-        /// Compression level (1–9). This is the range Vector currently supports; higher values compress more but are slower.
+        /// Compression level (1–9). This is the range Vector supports; higher values compress more but are slower.
         #[configurable(validation(range(min = 1, max = 9)))]
         level: u8,
     },
diff --git a/src/sinks/aws_s3/config.rs b/src/sinks/aws_s3/config.rs
index 61b82105a1211..6e8d2e248c518 100644
--- a/src/sinks/aws_s3/config.rs
+++ b/src/sinks/aws_s3/config.rs
@@ -111,9 +111,11 @@ pub struct S3SinkConfig {
 
     /// Batch encoding configuration for columnar formats.
     ///
-    /// When set, events are encoded together as a batch in a columnar format (e.g., Parquet)
+    /// When set, events are encoded together as a batch in a columnar format (for example, Parquet)
     /// instead of the standard per-event framing-based encoding. The columnar format handles
     /// its own internal compression, so the top-level `compression` setting is bypassed.
+    ///
+    /// Only the `parquet` codec is supported by the AWS S3 sink.
     #[cfg(feature = "codecs-parquet")]
     #[configurable(derived)]
     #[serde(default)]
diff --git a/src/sinks/clickhouse/config.rs b/src/sinks/clickhouse/config.rs
index d7af3413c6b97..435b2504e6a9e 100644
--- a/src/sinks/clickhouse/config.rs
+++ b/src/sinks/clickhouse/config.rs
@@ -104,6 +104,8 @@ pub struct ClickhouseConfig {
     ///
     /// When specified, events are encoded together as a single batch.
     /// This is mutually exclusive with per-event encoding based on the `format` field.
+    ///
+    /// Only the `arrow_stream` codec is supported by the ClickHouse sink.
     #[configurable(derived)]
     #[serde(default)]
     pub batch_encoding: Option<BatchSerializerConfig>,
diff --git a/website/cue/reference/components/sinks/generated/aws_s3.cue b/website/cue/reference/components/sinks/generated/aws_s3.cue
index 6c6dffb4fb3cb..1a4713e2897dd 100644
--- a/website/cue/reference/components/sinks/generated/aws_s3.cue
+++ b/website/cue/reference/components/sinks/generated/aws_s3.cue
@@ -256,6 +256,105 @@ generated: components: sinks: aws_s3: configuration: {
 			}
 		}
 	}
+	batch_encoding: {
+		description: """
+			Batch encoding configuration for columnar formats.
+
+			When set, events are encoded together as a batch in a columnar format (for example, Parquet)
+			instead of the standard per-event framing-based encoding. The columnar format handles
+			its own internal compression, so the top-level `compression` setting is bypassed.
+
+			Only the `parquet` codec is supported by the AWS S3 sink.
+			"""
+		required: false
+		type: object: options: {
+			allow_nullable_fields: {
+				description: """
+					Allow null values for non-nullable fields in the schema.
+
+					When enabled, missing or incompatible values are encoded as null, even for fields
+					marked as non-nullable in the Arrow schema. This is useful when working with downstream
+					systems that can handle null values through defaults, computed columns, or other mechanisms.
+
+					When disabled (default), missing values for non-nullable fields results in encoding errors. This is to
+					help ensure all required data is present before sending it to the sink.
+					"""
+				relevant_when: "codec = \"arrow_stream\""
+				required:      false
+				type: bool: default: false
+			}
+			codec: {
+				description: "The codec to use for batch encoding events."
+				required:    true
+				type: string: enum: {
+					arrow_stream: """
+						Encodes events in [Apache Arrow][apache_arrow] IPC streaming format.
+
+						This is the streaming variant of the Arrow IPC format, which writes
+						a continuous stream of record batches.
+
+						[apache_arrow]: https://arrow.apache.org/
+						"""
+					parquet: """
+						Encodes events in [Apache Parquet][apache_parquet] columnar format.
+
+						[apache_parquet]: https://parquet.apache.org/
+						"""
+				}
+			}
+			compression: {
+				description:   "Compression codec applied per column page inside the Parquet file."
+				relevant_when: "codec = \"parquet\""
+				required:      false
+				type: object: options: {
+					algorithm: {
+						description: "Compression codec applied per column page inside the Parquet file."
+						required:    false
+						type: string: {
+							default: "snappy"
+							enum: {
+								gzip:   "Gzip compression. Level must be between 1 and 9."
+								lz4:    "LZ4 raw compression"
+								none:   "No compression"
+								snappy: "Snappy compression (no level)."
+								zstd:   "Zstd compression. Level must be between 1 and 21."
+							}
+						}
+					}
+					level: {
+						description:   "Compression level (1–21). This is the range Vector supports; higher values compress more but are slower."
+						relevant_when: "algorithm = \"zstd\" or algorithm = \"gzip\""
+						required:      true
+						type: uint: {}
+					}
+				}
+			}
+			schema_file: {
+				description: """
+					Path to a native Parquet schema file (`.schema`).
+
+					Required unless `schema_mode` is `auto_infer`. The file must contain a valid
+					Parquet message type definition.
+					"""
+				relevant_when: "codec = \"parquet\""
+				required:      false
+				type: string: {}
+			}
+			schema_mode: {
+				description:   "Controls how events with fields not present in the schema are handled."
+				relevant_when: "codec = \"parquet\""
+				required:      false
+				type: string: {
+					default: "relaxed"
+					enum: {
+						auto_infer: "Auto infer schema based on the batch. No schema file needed."
+						relaxed:    "Missing fields become null. Extra fields are silently dropped."
+						strict:     "Missing fields become null. Extra fields cause an error."
+					}
+				}
+			}
+		}
+	}
 	bucket: {
 		description: """
 			The S3 bucket name.
diff --git a/website/cue/reference/components/sinks/generated/clickhouse.cue b/website/cue/reference/components/sinks/generated/clickhouse.cue
index a0f4399bdc112..547fbc943e9d9 100644
--- a/website/cue/reference/components/sinks/generated/clickhouse.cue
+++ b/website/cue/reference/components/sinks/generated/clickhouse.cue
@@ -249,6 +249,8 @@ generated: components: sinks: clickhouse: configuration: {
 
 			When specified, events are encoded together as a single batch.
 			This is mutually exclusive with per-event encoding based on the `format` field.
+
+			Only the `arrow_stream` codec is supported by the ClickHouse sink.
 			"""
 		required: false
 		type: object: options: {
@@ -256,34 +258,86 @@ generated: components: sinks: clickhouse: configuration: {
 				description: """
 					Allow null values for non-nullable fields in the schema.
 
-					When enabled, missing or incompatible values will be encoded as null even for fields
+					When enabled, missing or incompatible values are encoded as null, even for fields
 					marked as non-nullable in the Arrow schema. This is useful when working with downstream
 					systems that can handle null values through defaults, computed columns, or other mechanisms.
 
-					When disabled (default), missing values for non-nullable fields will cause encoding errors,
-					ensuring all required data is present before sending to the sink.
+					When disabled (default), missing values for non-nullable fields results in encoding errors. This is to
+					help ensure all required data is present before sending it to the sink.
 					"""
-				required: false
+				relevant_when: "codec = \"arrow_stream\""
+				required:      false
 				type: bool: default: false
 			}
 			codec: {
-				description: """
-					Encodes events in [Apache Arrow][apache_arrow] IPC streaming format.
+				description: "The codec to use for batch encoding events."
+				required:    true
+				type: string: enum: {
+					arrow_stream: """
+						Encodes events in [Apache Arrow][apache_arrow] IPC streaming format.
 
-					This is the streaming variant of the Arrow IPC format, which writes
-					a continuous stream of record batches.
+						This is the streaming variant of the Arrow IPC format, which writes
+						a continuous stream of record batches.
 
-					[apache_arrow]: https://arrow.apache.org/
-					"""
-				required: true
-				type: string: enum: arrow_stream: """
-					Encodes events in [Apache Arrow][apache_arrow] IPC streaming format.
+						[apache_arrow]: https://arrow.apache.org/
+						"""
+					parquet: """
+						Encodes events in [Apache Parquet][apache_parquet] columnar format.
 
-					This is the streaming variant of the Arrow IPC format, which writes
-					a continuous stream of record batches.
+						[apache_parquet]: https://parquet.apache.org/
+						"""
+				}
+			}
+			compression: {
+				description:   "Compression codec applied per column page inside the Parquet file."
+				relevant_when: "codec = \"parquet\""
+				required:      false
+				type: object: options: {
+					algorithm: {
+						description: "Compression codec applied per column page inside the Parquet file."
+						required:    false
+						type: string: {
+							default: "snappy"
+							enum: {
+								gzip:   "Gzip compression. Level must be between 1 and 9."
+								lz4:    "LZ4 raw compression"
+								none:   "No compression"
+								snappy: "Snappy compression (no level)."
+								zstd:   "Zstd compression. Level must be between 1 and 21."
+							}
+						}
+					}
+					level: {
+						description:   "Compression level (1–21). This is the range Vector supports; higher values compress more but are slower."
+						relevant_when: "algorithm = \"zstd\" or algorithm = \"gzip\""
+						required:      true
+						type: uint: {}
+					}
+				}
+			}
+			schema_file: {
+				description: """
+					Path to a native Parquet schema file (`.schema`).
 
-					[apache_arrow]: https://arrow.apache.org/
+					Required unless `schema_mode` is `auto_infer`. The file must contain a valid
+					Parquet message type definition.
 					"""
+				relevant_when: "codec = \"parquet\""
+				required:      false
+				type: string: {}
+			}
+			schema_mode: {
+				description:   "Controls how events with fields not present in the schema are handled."
+				relevant_when: "codec = \"parquet\""
+				required:      false
+				type: string: {
+					default: "relaxed"
+					enum: {
+						auto_infer: "Auto infer schema based on the batch. No schema file needed."
+						relaxed:    "Missing fields become null. Extra fields are silently dropped."
+						strict:     "Missing fields become null. Extra fields cause an error."
+					}
+				}
 			}
 		}
 	}

From 233a35c47eab1a0691b39e4af06991dfe4b0f571 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 28 Apr 2026 19:33:23 -0400
Subject: [PATCH 177/326] fix(ci): correct cross-build artifact name and path
 (#25282)

---
 .github/workflows/cross.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cross.yml b/.github/workflows/cross.yml
index bc2b2b559503b..ec0a7f33f7076 100644
--- a/.github/workflows/cross.yml
+++ b/.github/workflows/cross.yml
@@ -57,5 +57,5 @@ jobs:
       - run: make cross-build-${{ matrix.target }}
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: "vector-debug-${{ matrix.target }}"
-          path: "./target/${{ matrix.target }}/debug/vector"
+          name: "vector-${{ matrix.target }}"
+          path: "./target/${{ matrix.target }}/release/vector"

From 8b465f6406fd088302d42f7e879297937bb8783f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 29 Apr 2026 17:44:41 +0000
Subject: [PATCH 178/326] chore(deps): bump the patches group across 1
 directory with 13 updates (#25283)

* chore(deps): bump the patches group across 1 directory with 13 updates

Bumps the patches group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [async-rs](https://github.com/amqp-rs/async-rs) | `0.8.1` | `0.8.4` |
| [async-compression](https://github.com/Nullus157/async-compression) | `0.4.41` | `0.4.42` |
| [inventory](https://github.com/dtolnay/inventory) | `0.3.22` | `0.3.24` |
| [postgres-openssl](https://github.com/rust-postgres/rust-postgres) | `0.5.2` | `0.5.3` |
| [pulsar](https://github.com/streamnative/pulsar-rs) | `6.7.1` | `6.7.2` |
| [roaring](https://github.com/RoaringBitmap/roaring-rs) | `0.11.3` | `0.11.4` |
| [libc](https://github.com/rust-lang/libc) | `0.2.182` | `0.2.186` |
| [pastey](https://github.com/as1100k/pastey) | `0.2.1` | `0.2.2` |
| [semver](https://github.com/dtolnay/semver) | `1.0.27` | `1.0.28` |
| [env_logger](https://github.com/rust-cli/env_logger) | `0.11.6` | `0.11.9` |
| [quote](https://github.com/dtolnay/quote) | `1.0.44` | `1.0.45` |
| [schannel](https://github.com/steffengy/schannel-rs) | `0.1.28` | `0.1.29` |
| [web-sys](https://github.com/wasm-bindgen/wasm-bindgen) | `0.3.91` | `0.3.97` |



Updates `async-rs` from 0.8.1 to 0.8.4
- [Commits](https://github.com/amqp-rs/async-rs/compare/v0.8.1...v0.8.4)

Updates `async-compression` from 0.4.41 to 0.4.42
- [Release notes](https://github.com/Nullus157/async-compression/releases)
- [Commits](https://github.com/Nullus157/async-compression/compare/async-compression-v0.4.41...async-compression-v0.4.42)

Updates `inventory` from 0.3.22 to 0.3.24
- [Release notes](https://github.com/dtolnay/inventory/releases)
- [Commits](https://github.com/dtolnay/inventory/compare/0.3.22...0.3.24)

Updates `postgres-openssl` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/rust-postgres/rust-postgres/releases)
- [Commits](https://github.com/rust-postgres/rust-postgres/compare/postgres-openssl-v0.5.2...postgres-openssl-v0.5.3)

Updates `pulsar` from 6.7.1 to 6.7.2
- [Release notes](https://github.com/streamnative/pulsar-rs/releases)
- [Commits](https://github.com/streamnative/pulsar-rs/compare/v6.7.1...v6.7.2)

Updates `roaring` from 0.11.3 to 0.11.4
- [Release notes](https://github.com/RoaringBitmap/roaring-rs/releases)
- [Commits](https://github.com/RoaringBitmap/roaring-rs/compare/v0.11.3...v0.11.4)

Updates `libc` from 0.2.182 to 0.2.186
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Changelog](https://github.com/rust-lang/libc/blob/0.2.186/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/libc/compare/0.2.182...0.2.186)

Updates `pastey` from 0.2.1 to 0.2.2
- [Release notes](https://github.com/as1100k/pastey/releases)
- [Changelog](https://github.com/AS1100K/pastey/blob/master/CHANGELOG.md)
- [Commits](https://github.com/as1100k/pastey/compare/v0.2.1...v0.2.2)

Updates `semver` from 1.0.27 to 1.0.28
- [Release notes](https://github.com/dtolnay/semver/releases)
- [Commits](https://github.com/dtolnay/semver/compare/1.0.27...1.0.28)

Updates `env_logger` from 0.11.6 to 0.11.9
- [Release notes](https://github.com/rust-cli/env_logger/releases)
- [Changelog](https://github.com/rust-cli/env_logger/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rust-cli/env_logger/compare/v0.11.6...v0.11.9)

Updates `quote` from 1.0.44 to 1.0.45
- [Release notes](https://github.com/dtolnay/quote/releases)
- [Commits](https://github.com/dtolnay/quote/compare/1.0.44...1.0.45)

Updates `schannel` from 0.1.28 to 0.1.29
- [Release notes](https://github.com/steffengy/schannel-rs/releases)
- [Commits](https://github.com/steffengy/schannel-rs/compare/v0.1.28...v0.1.29)

Updates `web-sys` from 0.3.91 to 0.3.97
- [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases)
- [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits)

---
updated-dependencies:
- dependency-name: async-compression
  dependency-version: 0.4.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: async-rs
  dependency-version: 0.8.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: env_logger
  dependency-version: 0.11.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: inventory
  dependency-version: 0.3.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: libc
  dependency-version: 0.2.186
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: pastey
  dependency-version: 0.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: postgres-openssl
  dependency-version: 0.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: pulsar
  dependency-version: 6.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: quote
  dependency-version: 1.0.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: roaring
  dependency-version: 0.11.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: schannel
  dependency-version: 0.1.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: semver
  dependency-version: 1.0.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
- dependency-name: web-sys
  dependency-version: 0.3.95
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patches
...

Signed-off-by: dependabot[bot] <support@github.com>

* update licenses

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 Cargo.lock                        | 433 +++++++++++++++++++-----------
 Cargo.toml                        |   2 +-
 LICENSE-3rdparty.csv              |   7 +
 lib/file-source-common/Cargo.toml |   2 +-
 lib/file-source/Cargo.toml        |   2 +-
 lib/vector-core/Cargo.toml        |   2 +-
 6 files changed, 293 insertions(+), 155 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 0ad2d1635d855..52ed5cd06c593 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -327,7 +327,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c6368f9ae5c6ec403ca910327ae0c9437b0a85255b6950c90d497e6177f6e5e"
 dependencies = [
  "proc-macro-hack",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 1.0.109",
 ]
 
@@ -847,9 +847,9 @@ dependencies = [
 
 [[package]]
 name = "async-compression"
-version = "0.4.41"
+version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0f9ee0f6e02ffd7ad5816e9464499fba7b3effd01123b515c41d1697c43dad1"
+checksum = "e79b3f8a79cccc2898f31920fc69f304859b3bd567490f75ebf51ae1c792a9ac"
 dependencies = [
  "compression-codecs",
  "compression-core",
@@ -1019,15 +1019,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
 [[package]]
 name = "async-rs"
-version = "0.8.1"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d47e5e0df9bce1f132f67a64409a973b031481366b858330013060ca76b3a80"
+checksum = "31ebdd144e4199c67b5134fe2280e40d9656071f11df525d3322b43b6534c714"
 dependencies = [
  "async-compat",
  "async-global-executor",
@@ -1035,7 +1035,7 @@ dependencies = [
  "cfg-if",
  "futures-core",
  "futures-io",
- "hickory-resolver 0.25.2",
+ "hickory-resolver 0.26.0",
  "tokio",
  "tokio-stream",
 ]
@@ -1076,7 +1076,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -1093,7 +1093,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -1940,7 +1940,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94f7cc1bbae04cfe11de9e39e2c6dc755947901e0f4e76180ab542b6deb5e15e"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
  "tracing 0.1.44",
 ]
@@ -2069,7 +2069,7 @@ dependencies = [
  "clang-sys",
  "itertools 0.13.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "regex",
  "rustc-hash",
  "shlex",
@@ -2112,7 +2112,7 @@ version = "2.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6cbbb8f56245b5a479b30a62cdc86d26e2f35c2b9f594bc4671654b03851380"
 dependencies = [
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -2238,7 +2238,7 @@ dependencies = [
  "ident_case",
  "prettyplease",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "rustversion",
  "syn 2.0.117",
 ]
@@ -2268,7 +2268,7 @@ dependencies = [
  "once_cell",
  "proc-macro-crate 3.2.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -2362,7 +2362,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7ec4c6f261935ad534c0c22dbef2201b45918860eb1c574b972bd213a76af61"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 1.0.109",
 ]
 
@@ -2667,7 +2667,7 @@ checksum = "a92793da1a46a5f2a02a6f4c46c6496b28c43638adea8306fcb0caa1634f24e5"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -2841,9 +2841,9 @@ dependencies = [
 
 [[package]]
 name = "compression-codecs"
-version = "0.4.37"
+version = "0.4.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb7b51a7d9c967fc26773061ba86150f19c50c0d65c887cb1fbe295fd16619b7"
+checksum = "ce2548391e9c1929c21bf6aa2680af86fe4c1b33e6cea9ac1cfeec0bd11218cf"
 dependencies = [
  "brotli",
  "compression-core",
@@ -2855,9 +2855,9 @@ dependencies = [
 
 [[package]]
 name = "compression-core"
-version = "0.4.31"
+version = "0.4.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75984efb6ed102a0d42db99afb6c1948f0380d1d91808d5529916e6c08b49d8d"
+checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
 
 [[package]]
 name = "concurrent-queue"
@@ -3352,7 +3352,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -3385,7 +3385,7 @@ dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "strsim",
  "syn 2.0.117",
 ]
@@ -3399,7 +3399,7 @@ dependencies = [
  "fnv",
  "ident_case",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "strsim",
  "syn 2.0.117",
 ]
@@ -3411,7 +3411,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
  "darling_core 0.20.11",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -3422,7 +3422,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
 dependencies = [
  "darling_core 0.21.3",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -3555,7 +3555,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 1.0.109",
 ]
 
@@ -3566,7 +3566,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d65d7ce8132b7c0e54497a4d9a55a1c2a0912a0d786cf894472ba818fba45762"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -3577,7 +3577,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ef941ded77d15ca19b40374869ac6000af1c9f2a4c0f3d4c70926287e6364a8f"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -3588,7 +3588,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "67e77553c4162a157adbf834ebae5b415acbecbeafc7a74b0e886657506a7611"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -3609,7 +3609,7 @@ checksum = "d48cda787f839151732d396ac69e3473923d54312c070ee21e9effcaa8ca0b1d"
 dependencies = [
  "darling 0.20.11",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -3631,7 +3631,7 @@ checksum = "4fb810d30a7c1953f91334de7244731fc3f3c10d7fe163338a35b9f640960321"
 dependencies = [
  "convert_case 0.4.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "rustc_version",
  "syn 1.0.109",
 ]
@@ -3653,7 +3653,7 @@ checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
 dependencies = [
  "convert_case 0.10.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "rustc_version",
  "syn 2.0.117",
  "unicode-xid 0.2.4",
@@ -3726,7 +3726,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -3832,7 +3832,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0e197fdfd2cdb5fdeb7f8ddcf3aed5d5d04ecde2890d448b14ffb716f7376b70"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -3907,7 +3907,7 @@ checksum = "1d7bc049e1bd8cdeb31b68bbd586a9464ecf9f3944af3958a7a9d0f8b9799417"
 dependencies = [
  "enum-ordinalize",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -4009,7 +4009,7 @@ checksum = "5ffccbb6966c05b32ef8fbac435df276c4ae4d3dc55a8cd0eb9745e6c12f546a"
 dependencies = [
  "heck 0.4.1",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -4029,7 +4029,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ca9601fb2d62598ee17836250842873a413586e5d7ed88b356e38ddbb0ec631"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -4041,7 +4041,7 @@ checksum = "aa18ce2bc66555b3218614519ac839ddb759a7d6720732f979ef8d13be147ecd"
 dependencies = [
  "once_cell",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -4061,7 +4061,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -4073,9 +4073,9 @@ checksum = "62a61b2faff777e62dbccd7f82541d873f96264d050c5dd7e95194f79fc4de29"
 
 [[package]]
 name = "env_filter"
-version = "0.1.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a009aa4810eb158359dda09d0c87378e4bbb89b5a801f016885a4707ba24f7ea"
+checksum = "32e90c2accc4b07a8456ea0debdc2e7587bdd890680d71173a15d4ae604f6eef"
 dependencies = [
  "log",
  "regex",
@@ -4083,14 +4083,14 @@ dependencies = [
 
 [[package]]
 name = "env_logger"
-version = "0.11.6"
+version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcaee3d8e3cfc3fd92428d477bc97fc29ec8716d180c0d74c643bb26166660e0"
+checksum = "b2daee4ea451f429a58296525ddf28b45a3b64f1acf6587e2067437bb11e218d"
 dependencies = [
  "anstream",
  "anstyle",
  "env_filter",
- "humantime",
+ "jiff",
  "log",
 ]
 
@@ -4190,7 +4190,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "332b1937705b7ed2fce76837024e9ae6f41cd2ad18a32c052de081f89982561b"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 1.0.109",
 ]
 
@@ -4530,7 +4530,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -5088,6 +5088,30 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hickory-net"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c61c8db47fae51ba9f8f2a2748bd87542acfbe22f2ec9cf9c8ec72d1ee6e9a6"
+dependencies = [
+ "async-trait",
+ "cfg-if",
+ "data-encoding",
+ "futures-channel",
+ "futures-io",
+ "futures-util",
+ "hickory-proto 0.26.0",
+ "idna",
+ "ipnet",
+ "jni 0.22.4",
+ "rand 0.10.1",
+ "thiserror 2.0.17",
+ "tinyvec",
+ "tokio",
+ "tracing 0.1.44",
+ "url",
+]
+
 [[package]]
 name = "hickory-proto"
 version = "0.24.4"
@@ -5135,7 +5159,26 @@ dependencies = [
  "thiserror 2.0.17",
  "time",
  "tinyvec",
- "tokio",
+ "tracing 0.1.44",
+ "url",
+]
+
+[[package]]
+name = "hickory-proto"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a916d0494600d99ecb15aadfab677ad97c4de559e8f1af0c129353a733ac1fcc"
+dependencies = [
+ "data-encoding",
+ "idna",
+ "ipnet",
+ "jni 0.22.4",
+ "once_cell",
+ "prefix-trie",
+ "rand 0.10.1",
+ "ring",
+ "thiserror 2.0.17",
+ "tinyvec",
  "tracing 0.1.44",
  "url",
 ]
@@ -5163,20 +5206,25 @@ dependencies = [
 
 [[package]]
 name = "hickory-resolver"
-version = "0.25.2"
+version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc62a9a99b0bfb44d2ab95a7208ac952d31060efc16241c87eaf36406fecf87a"
+checksum = "a10bd64d950b4d38ca21e25c8ae230712e4955fb8290cfcb29a5e5dc6017e544"
 dependencies = [
  "cfg-if",
  "futures-util",
- "hickory-proto 0.25.2",
+ "hickory-net",
+ "hickory-proto 0.26.0",
  "ipconfig",
+ "ipnet",
+ "jni 0.22.4",
  "moka",
+ "ndk-context",
  "once_cell",
  "parking_lot",
- "rand 0.9.4",
+ "rand 0.10.1",
  "resolv-conf",
  "smallvec",
+ "system-configuration 0.7.0",
  "thiserror 2.0.17",
  "tokio",
  "tracing 0.1.44",
@@ -5703,7 +5751,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -5835,7 +5883,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b23a0c8dfe501baac4adf6ebbfa6eddf8f0c07f56b058cc1288017e32397846c"
 dependencies = [
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -5847,9 +5895,9 @@ checksum = "8bb03732005da905c88227371639bf1ad885cc712789c011c31c5fb3ab3ccf02"
 
 [[package]]
 name = "inventory"
-version = "0.3.22"
+version = "0.3.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "009ae045c87e7082cb72dab0ccd01ae075dd00141ddc108f43a0ea150a9e7227"
+checksum = "a4f0c30c76f2f4ccee3fe55a2435f691ca00c0e4bd87abe4f4a851b1d4dac39b"
 dependencies = [
  "rustversion",
 ]
@@ -5988,7 +6036,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a8c8b344124222efd714b73bb41f8b5120b27a7cc1c75593a6ff768d9d05aa4"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -6001,19 +6049,68 @@ dependencies = [
  "cesu8",
  "cfg-if",
  "combine",
- "jni-sys",
+ "jni-sys 0.3.0",
  "log",
  "thiserror 1.0.68",
  "walkdir",
  "windows-sys 0.45.0",
 ]
 
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys 0.4.1",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.17",
+ "walkdir",
+ "windows-link 0.2.0",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2 1.0.106",
+ "quote 1.0.45",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "jni-sys"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
 
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote 1.0.45",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "jobserver"
 version = "0.1.32"
@@ -6025,10 +6122,12 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.91"
+version = "0.3.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
+checksum = "a1840c94c045fbcf8ba2812c95db44499f7c64910a912551aaaa541decebcacf"
 dependencies = [
+ "cfg-if",
+ "futures-util",
  "once_cell",
  "wasm-bindgen",
 ]
@@ -6398,9 +6497,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.182"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "libflate"
@@ -6695,7 +6794,7 @@ checksum = "cc33f9f0351468d26fbc53d9ce00a096c8522ecb42f19b50f34f2c422f76d21d"
 dependencies = [
  "macro_magic_core",
  "macro_magic_macros",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -6709,7 +6808,7 @@ dependencies = [
  "derive-syn-parse",
  "macro_magic_core_macros",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -6720,7 +6819,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b02abfe41815b5bd98dbd4260173db2c116dda171dc0fe7838cb206333b83308"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -6731,7 +6830,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73ea28ee64b88876bf45277ed9a5817c1817df061a74f2b988971a12570e5869"
 dependencies = [
  "macro_magic_core",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -6916,7 +7015,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd2209fff77f705b00c737016a48e73733d7fbccb8b007194db148f03561fb70"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -6988,7 +7087,7 @@ dependencies = [
  "once_cell",
  "proc-macro-error2",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "regex",
  "syn 2.0.117",
 ]
@@ -7099,7 +7198,7 @@ checksum = "63981427a0f26b89632fd2574280e069d09fb2912a3138da15de0174d11dd077"
 dependencies = [
  "macro_magic",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -7515,7 +7614,7 @@ checksum = "96667db765a921f7b295ffee8b60472b686a51d4f21c2ee4ffdb94c7013b65a6"
 dependencies = [
  "proc-macro-crate 1.3.1",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -7527,7 +7626,7 @@ checksum = "af1844ef2428cc3e1cb900be36181049ef3d3193c63e43026cfe202983b27a56"
 dependencies = [
  "proc-macro-crate 3.2.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -7731,7 +7830,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -7948,9 +8047,9 @@ checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 
 [[package]]
 name = "pastey"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b867cad97c0791bbd3aaa6472142568c6c9e8f71937e98379f584cfb0cf35bec"
+checksum = "c5a797f0e07bdf071d15742978fc3128ec6c22891c31a3a931513263904c982a"
 
 [[package]]
 name = "pbkdf2"
@@ -8021,7 +8120,7 @@ dependencies = [
  "pest",
  "pest_meta",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -8107,7 +8206,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9b20ed30f105399776b9c883e68e536ef602a16ae6f596d2c473591d6ad64c6"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -8238,9 +8337,9 @@ dependencies = [
 
 [[package]]
 name = "postgres-openssl"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f86f073ad570f76e9e278ce6f05775fc723eed7daa6b4f9c2aa078080a564a0"
+checksum = "06743eefaa1a5c0ef2ccb6d9abf6528790a229eabd62ddcabf9b2a3aeff09fa4"
 dependencies = [
  "openssl",
  "tokio",
@@ -8324,6 +8423,17 @@ dependencies = [
  "termtree",
 ]
 
+[[package]]
+name = "prefix-trie"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23370be78b7e5bcbb0cab4a02047eb040279a693c78daad04c2c5f1c24a83503"
+dependencies = [
+ "either",
+ "ipnet",
+ "num-traits",
+]
+
 [[package]]
 name = "prettydiff"
 version = "0.8.0"
@@ -8392,7 +8502,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
 ]
 
 [[package]]
@@ -8403,7 +8513,7 @@ checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
 dependencies = [
  "proc-macro-error-attr2",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -8497,7 +8607,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "095a99f75c69734802359b682be8daaf8980296731f6470434ea2c652af1dd30"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -8581,7 +8691,7 @@ dependencies = [
  "anyhow",
  "itertools 0.12.1",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -8594,7 +8704,7 @@ dependencies = [
  "anyhow",
  "itertools 0.14.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -8607,7 +8717,7 @@ dependencies = [
  "anyhow",
  "itertools 0.14.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -8683,7 +8793,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "16b845dbfca988fa33db069c0e230574d15a3088f147a87b64c7589eb662c9ac"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 1.0.109",
 ]
 
@@ -8699,9 +8809,9 @@ dependencies = [
 
 [[package]]
 name = "pulsar"
-version = "6.7.1"
+version = "6.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24c00856d6c64af2078a74c2de029842cdaece2f35b1223f5166809ea49cf5cd"
+checksum = "e2367cb38f1b65857bc11dd13b2adf13b7a1d991ef1cd43572f1420958c56cc2"
 dependencies = [
  "async-channel",
  "async-trait",
@@ -8825,7 +8935,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9a28b8493dd664c8b171dd944da82d933f7d456b829bfb236738e1fe06c5ba4"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -8893,9 +9003,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.44"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2 1.0.106",
 ]
@@ -9261,7 +9371,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1165225c21bff1f3bbce98f5a1f889949bc902d3575308cc7b0de30b4f6d27c7"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -9550,7 +9660,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84d7b42d4b8d06048d3ac8db0eb31bcb942cbeb709f0b5f2b2ebde398d3038f5"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 1.0.109",
 ]
 
@@ -9592,9 +9702,9 @@ dependencies = [
 
 [[package]]
 name = "roaring"
-version = "0.11.3"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ba9ce64a8f45d7fc86358410bb1a82e8c987504c0d4900e9141d69a9f26c885"
+checksum = "1dedc5658c6ecb3bdb5ef5f3295bb9253f42dcf3fd1402c03f6b1f7659c3c4a9"
 dependencies = [
  "bytemuck",
  "byteorder",
@@ -9650,7 +9760,7 @@ dependencies = [
  "glob",
  "proc-macro-crate 3.2.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "regex",
  "relative-path 1.9.3",
  "rustc_version",
@@ -9955,9 +10065,9 @@ dependencies = [
 
 [[package]]
 name = "schannel"
-version = "0.1.28"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
 dependencies = [
  "windows-sys 0.61.0",
 ]
@@ -10081,9 +10191,9 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.27"
+version = "1.0.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
 dependencies = [
  "serde",
  "serde_core",
@@ -10162,7 +10272,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -10173,7 +10283,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "18d26a20a969b9e3fdf2fc2d9f21eda6c40e2de84c9408bb5d3b05d499aae711"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -10226,7 +10336,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3081f5ffbb02284dda55132aa26daecedd7372a42417bbbab6f14ab7d6bb9145"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -10279,7 +10389,7 @@ checksum = "de90945e6565ce0d9a25098082ed4ee4002e047cb59892c318d66821e14bb30f"
 dependencies = [
  "darling 0.20.11",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -10331,7 +10441,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -10461,6 +10571,16 @@ version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
 
+[[package]]
+name = "simd_cesu8"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
 [[package]]
 name = "simdutf8"
 version = "0.1.5"
@@ -10600,7 +10720,7 @@ checksum = "990079665f075b699031e9c08fd3ab99be5029b96f3b78dc0709e8f77e4efebf"
 dependencies = [
  "heck 0.4.1",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 1.0.109",
 ]
 
@@ -10612,7 +10732,7 @@ checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -10624,7 +10744,7 @@ checksum = "54254b8531cafa275c5e096f62d48c81435d1015405a91198ddb11e967301d40"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -10751,7 +10871,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2d452988ccaacfbf5e0bdbc348fb91d7c8af5bee192173ac3636b5fb6e6715d"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "sqlx-core",
  "sqlx-macros-core",
  "syn 2.0.117",
@@ -10769,7 +10889,7 @@ dependencies = [
  "hex",
  "once_cell",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "serde",
  "serde_json",
  "sha2",
@@ -10988,7 +11108,7 @@ checksum = "23dc1fa9ac9c169a78ba62f0b841814b7abae11bdd047b9c58f893439e309ea0"
 dependencies = [
  "heck 0.4.1",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "rustversion",
  "syn 2.0.117",
 ]
@@ -11001,7 +11121,7 @@ checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "rustversion",
  "syn 2.0.117",
 ]
@@ -11014,7 +11134,7 @@ checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -11026,7 +11146,7 @@ checksum = "ab85eea0270ee17587ed4156089e10b9e6880ee688791d45a905f5b1ca36f664"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -11073,7 +11193,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "unicode-ident",
 ]
 
@@ -11084,7 +11204,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "unicode-ident",
 ]
 
@@ -11110,7 +11230,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -11183,6 +11303,17 @@ dependencies = [
  "system-configuration-sys 0.6.0",
 ]
 
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags 2.10.0",
+ "core-foundation 0.9.3",
+ "system-configuration-sys 0.6.0",
+]
+
 [[package]]
 name = "system-configuration-sys"
 version = "0.5.0"
@@ -11337,7 +11468,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7c61ec9a6f64d2793d8a45faba21efbe3ced62a886d44c36a009b2b519b4c7e"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -11348,7 +11479,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -11505,7 +11636,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -11859,7 +11990,7 @@ dependencies = [
  "prettyplease",
  "proc-macro2 1.0.106",
  "prost-build 0.12.6",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -12042,7 +12173,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -12168,7 +12299,7 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad06847b7afb65c7866a36664b75c40b895e318cea4f71299f013fb22965329d"
 dependencies = [
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -12255,7 +12386,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f03ca4cb38206e2bef0700092660bb74d696f808514dae47fa1467cbfe26e96e"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -12266,7 +12397,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c36781cc0e46a83726d9879608e4cf6c2505237e263a8eb8c24502989cfdb28"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -12323,7 +12454,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ecee5b05c459ea4cd97df7685db58699c32e070465f88dc806d7c98a5088edc"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "rustc_version",
  "syn 2.0.117",
 ]
@@ -12348,7 +12479,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27a7a9b72ba121f6f1f6c3632b85604cac41aedb5ddc70accbebb6cac83de846"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -12912,7 +13043,7 @@ name = "vector-common-macros"
 version = "0.1.0"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -12948,7 +13079,7 @@ dependencies = [
  "convert_case 0.8.0",
  "darling 0.20.11",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "serde",
  "serde_json",
  "syn 2.0.117",
@@ -12961,7 +13092,7 @@ version = "0.1.0"
 dependencies = [
  "darling 0.20.11",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "serde",
  "serde_derive_internals",
  "syn 2.0.117",
@@ -13463,9 +13594,9 @@ checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
+checksum = "df52b6d9b87e0c74c9edfa1eb2d9bf85e5d63515474513aa50fa181b3c4f5db1"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -13488,32 +13619,32 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
+checksum = "78b1041f495fb322e64aca85f5756b2172e35cd459376e67f2a6c9dffcedb103"
 dependencies = [
- "quote 1.0.44",
+ "quote 1.0.45",
  "wasm-bindgen-macro-support",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
+checksum = "9dcd0ff20416988a18ac686d4d4d0f6aae9ebf08a389ff5d29012b05af2a1b41"
 dependencies = [
  "bumpalo",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
+checksum = "49757b3c82ebf16c57d69365a142940b384176c24df52a087fb748e2085359ea"
 dependencies = [
  "unicode-ident",
 ]
@@ -13581,9 +13712,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.91"
+version = "0.3.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854ba17bb104abfb26ba36da9729addc7ce7f06f5c0f90f3c391f8461cca21f9"
+checksum = "2eadbac71025cd7b0834f20d1fe8472e8495821b4e9801eb0a60bd1f19827602"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -13607,7 +13738,7 @@ checksum = "60b6f804e41d0852e16d2eaee61c7e4f7d3e8ffdb7b8ed85886aeb0791fe9fcd"
 dependencies = [
  "core-foundation 0.9.3",
  "home",
- "jni",
+ "jni 0.21.1",
  "log",
  "ndk-context",
  "objc",
@@ -13786,7 +13917,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2bbd5b46c938e506ecbce286b6628a02171d56153ba733b6c741fc627ec9579b"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -13797,7 +13928,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -13808,7 +13939,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "053c4c462dc91d3b1504c6fe5a726dd15e216ba718e84a0e46a88fbe5ded3515"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -13819,7 +13950,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -14320,7 +14451,7 @@ dependencies = [
  "anyhow",
  "prettyplease",
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
  "wit-bindgen-core",
  "wit-bindgen-rust",
@@ -14425,7 +14556,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28cc31741b18cb6f1d5ff12f5b7523e3d6eb0852bbbad19d73905511d9849b95"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
  "synstructure",
 ]
@@ -14455,7 +14586,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b3c129550b3e6de3fd0ba67ba5c81818f9805e58b8d7fee80a3a59d2c9fc601a"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -14466,7 +14597,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5226bc9a9a9836e7428936cde76bb6b22feea1a8bfdbc0d241136e4d13417e25"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
@@ -14486,7 +14617,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ea7b4a3637ea8669cedf0f1fd5c286a17f3de97b8dd5a70a6c167a1730e63a5"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
  "synstructure",
 ]
@@ -14515,7 +14646,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
 dependencies = [
  "proc-macro2 1.0.106",
- "quote 1.0.44",
+ "quote 1.0.45",
  "syn 2.0.117",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 52161db4b2905..db582e2930491 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -187,7 +187,7 @@ rdkafka = { version = "0.39.0", default-features = false }
 regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
 reqwest = { version = "0.11", features = ["json"] }
 rust_decimal = { version = "1.40.0", default-features = false, features = ["std"] }
-semver = { version = "1.0.27", default-features = false, features = ["serde", "std"] }
+semver = { version = "1.0.28", default-features = false, features = ["serde", "std"] }
 serde = { version = "1.0.219", default-features = false, features = ["alloc", "derive", "rc"] }
 serde_json = { version = "1.0.143", default-features = false, features = ["preserve_order", "raw_value", "std"] }
 serde_yaml = { version = "0.9.34", default-features = false }
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index ea2ff8e85d12e..31c7d69405a20 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -336,6 +336,7 @@ heim-net,https://github.com/heim-rs/heim,Apache-2.0 OR MIT,svartalf <self@svarta
 heim-runtime,https://github.com/heim-rs/heim,Apache-2.0 OR MIT,svartalf <self@svartalf.info>
 hermit-abi,https://github.com/hermit-os/hermit-rs,MIT OR Apache-2.0,Stefan Lankes
 hex,https://github.com/KokaKiwi/rust-hex,MIT OR Apache-2.0,KokaKiwi <kokakiwi@kokakiwi.net>
+hickory-net,https://github.com/hickory-dns/hickory-dns,MIT OR Apache-2.0,The contributors to Hickory DNS
 hickory-proto,https://github.com/hickory-dns/hickory-dns,MIT OR Apache-2.0,The contributors to Hickory DNS
 hickory-resolver,https://github.com/hickory-dns/hickory-dns,MIT OR Apache-2.0,The contributors to Hickory DNS
 hkdf,https://github.com/RustCrypto/KDFs,MIT OR Apache-2.0,RustCrypto Developers
@@ -398,7 +399,11 @@ itoa,https://github.com/dtolnay/itoa,MIT OR Apache-2.0,David Tolnay <dtolnay@gma
 jiff,https://github.com/BurntSushi/jiff,Unlicense OR MIT,Andrew Gallant <jamslam@gmail.com>
 jiff-static,https://github.com/BurntSushi/jiff,Unlicense OR MIT,Andrew Gallant <jamslam@gmail.com>
 jni,https://github.com/jni-rs/jni-rs,MIT OR Apache-2.0,Josh Chase <josh@prevoty.com>
+jni,https://github.com/jni-rs/jni-rs,MIT OR Apache-2.0,jni team
+jni-macros,https://github.com/jni-rs/jni-rs,MIT OR Apache-2.0,The jni-macros Authors
+jni-sys,https://github.com/jni-rs/jni-sys,MIT OR Apache-2.0,"Steven Fackler <sfackler@gmail.com>, Robert Bragg <robert@sixbynine.org>"
 jni-sys,https://github.com/sfackler/rust-jni-sys,MIT OR Apache-2.0,Steven Fackler <sfackler@gmail.com>
+jni-sys-macros,https://github.com/jni-rs/jni-sys,MIT OR Apache-2.0,Robert Bragg <robert@sixbynine.org>
 js-sys,https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/js-sys,MIT OR Apache-2.0,The wasm-bindgen Developers
 json-patch,https://github.com/idubrov/json-patch,MIT OR Apache-2.0,Ivan Dubrov <dubrov.ivan@gmail.com>
 jsonpath-rust,https://github.com/besok/jsonpath-rust,MIT,BorisZhguchev <zhguchev@gmail.com>
@@ -568,6 +573,7 @@ postgres-protocol,https://github.com/rust-postgres/rust-postgres,MIT OR Apache-2
 postgres-types,https://github.com/rust-postgres/rust-postgres,MIT OR Apache-2.0,Steven Fackler <sfackler@gmail.com>
 powerfmt,https://github.com/jhpratt/powerfmt,MIT OR Apache-2.0,Jacob Pratt <jacob@jhpratt.dev>
 ppv-lite86,https://github.com/cryptocorrosion/cryptocorrosion,MIT OR Apache-2.0,The CryptoCorrosion Contributors
+prefix-trie,https://github.com/tiborschneider/prefix-trie,MIT OR Apache-2.0,The prefix-trie Authors
 prettydiff,https://github.com/romankoblov/prettydiff,MIT,Roman Koblov <penpen938@me.com>
 prettyplease,https://github.com/dtolnay/prettyplease,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 prettytable-rs,https://github.com/phsym/prettytable-rs,BSD-3-Clause,Pierre-Henri Symoneaux
@@ -709,6 +715,7 @@ signal-hook-registry,https://github.com/vorner/signal-hook,Apache-2.0 OR MIT,"Mi
 signatory,https://github.com/iqlusioninc/crates/tree/main/signatory,Apache-2.0 OR MIT,Tony Arcieri <tony@iqlusion.io>
 signature,https://github.com/RustCrypto/traits/tree/master/signature,Apache-2.0 OR MIT,RustCrypto Developers
 simd-adler32,https://github.com/mcountryman/simd-adler32,MIT,Marvin Countryman <me@maar.vin>
+simd_cesu8,https://github.com/seancroach/simd_cesu8,Apache-2.0 OR MIT,Sean C. Roach <me@seancroach.dev>
 simdutf8,https://github.com/rusticstuff/simdutf8,MIT OR Apache-2.0,Hans Kratz <hans@appfour.com>
 simpl,https://github.com/durch/simplerr,MIT,Drazen Urch <drazen@urch.eu>
 siphasher,https://github.com/jedisct1/rust-siphash,MIT OR Apache-2.0,Frank Denis <github@pureftpd.org>
diff --git a/lib/file-source-common/Cargo.toml b/lib/file-source-common/Cargo.toml
index e115f3a74bf52..6d3a885bc9a7a 100644
--- a/lib/file-source-common/Cargo.toml
+++ b/lib/file-source-common/Cargo.toml
@@ -20,7 +20,7 @@ serde_json = { version = "1.0.143", default-features = false }
 bstr = { version = "1.12", default-features = false }
 bytes = { version = "1.11.1", default-features = false, features = ["serde"] }
 dashmap = { version = "6.1", default-features = false }
-async-compression = { version = "0.4.41", features = ["tokio", "gzip"] }
+async-compression = { version = "0.4.42", features = ["tokio", "gzip"] }
 vector-common = { path = "../vector-common", default-features = false }
 vector-config = { path = "../vector-config", default-features = false }
 tokio = { workspace = true, features = ["full"] }
diff --git a/lib/file-source/Cargo.toml b/lib/file-source/Cargo.toml
index 7e8e6b6cd1153..a6b6e94c3b27f 100644
--- a/lib/file-source/Cargo.toml
+++ b/lib/file-source/Cargo.toml
@@ -21,7 +21,7 @@ futures = { version = "0.3.31", default-features = false, features = ["executor"
 futures-util.workspace = true
 vector-common = { path = "../vector-common", default-features = false }
 file-source-common = { path = "../file-source-common" }
-async-compression = { version = "0.4.41", features = ["tokio", "gzip"] }
+async-compression = { version = "0.4.42", features = ["tokio", "gzip"] }
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["full"] }
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index c26953cb3590a..8836c2f70beaf 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -71,7 +71,7 @@ quickcheck = { workspace = true, optional = true }
 security-framework = "3.6.0"
 
 [target.'cfg(windows)'.dependencies]
-schannel = "0.1.28"
+schannel = "0.1.29"
 
 [build-dependencies]
 prost-build.workspace = true

From 75b9d07a8231e7c321652e4ff031d8ce0757d9ab Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 29 Apr 2026 15:57:15 -0400
Subject: [PATCH 179/326] feat(website): improve search ranking for component
 reference pages (#25327)

* feat(website): improve search ranking for component reference pages

* Improve regex match
---
 website/scripts/typesense-index.ts | 20 ++++++++++++++++----
 website/typesense.config.json      | 30 ++++++++++++++++++++++++++++--
 2 files changed, 44 insertions(+), 6 deletions(-)

diff --git a/website/scripts/typesense-index.ts b/website/scripts/typesense-index.ts
index f800e710d1754..81c241b331276 100644
--- a/website/scripts/typesense-index.ts
+++ b/website/scripts/typesense-index.ts
@@ -33,6 +33,8 @@ type AlgoliaRecord = {
   ranking: number;
   section: string;
   content: string;
+  componentWithType: string;
+  component: string;
 };
 
 type Section = {
@@ -94,6 +96,11 @@ async function indexHTMLFiles(
     const pageTitle = $("meta[name='algolia:title']").attr("content") || "";
     const pageTagsString = $("meta[name='keywords']").attr("content") || "";
     const pageTags: string[] = pageTagsString === "" ? [] : pageTagsString.split(",");
+    const pageUrl = getPageUrl(file);
+    const componentMatch = pageUrl.match(/\/docs\/reference\/configuration\/(sources|sinks|transforms)\/([^/]+)/);
+    const componentKindMap: Record<string, string> = { sources: "source", sinks: "sink", transforms: "transform" };
+    const pageComponent = componentMatch ? componentMatch[2] : "";
+    const pageComponentWithType = componentMatch ? `${componentMatch[2]} ${componentKindMap[componentMatch[1]]}` : "";
 
     // @ts-ignore
     $(".algolia-no-index").each((_, d) => $(d).remove());
@@ -130,7 +137,6 @@ async function indexHTMLFiles(
     let activeRecord: AlgoliaRecord | null = null;
 
     for (const item of payload) {
-      const pageUrl = getPageUrl(file);
       const itemUrl = getItemUrl(file, item);
       const hashedId = hashString(itemUrl);
 
@@ -146,7 +152,9 @@ async function indexHTMLFiles(
           ranking,
           hierarchy: [],
           tags: pageTags,
-          content: ""
+          content: "",
+          componentWithType: pageComponentWithType,
+          component: pageComponent
         };
       } else if (item.level === 1) {
         // h1 logic
@@ -165,7 +173,9 @@ async function indexHTMLFiles(
           ranking,
           hierarchy: [...activeRecord.hierarchy, activeRecord.title.trim()],
           tags: pageTags,
-          content: ""
+          content: "",
+          componentWithType: pageComponentWithType,
+          component: pageComponent
         };
       } else {
         // h2-h6 logic
@@ -186,7 +196,9 @@ async function indexHTMLFiles(
           ranking,
           hierarchy: [...activeRecord.hierarchy.slice(0, lastIndex)],
           tags: pageTags,
-          content: ""
+          content: "",
+          componentWithType: pageComponentWithType,
+          component: pageComponent
         };
       }
 
diff --git a/website/typesense.config.json b/website/typesense.config.json
index f0543b9133c8b..5e09a5ee14694 100644
--- a/website/typesense.config.json
+++ b/website/typesense.config.json
@@ -136,6 +136,32 @@
             "type": "string[]",
             "stem_dictionary": "",
             "store": true
+          },
+          {
+            "facet": false,
+            "index": true,
+            "infix": false,
+            "locale": "",
+            "name": "componentWithType",
+            "optional": true,
+            "sort": false,
+            "stem": false,
+            "type": "string",
+            "stem_dictionary": "",
+            "store": true
+          },
+          {
+            "facet": false,
+            "index": true,
+            "infix": false,
+            "locale": "",
+            "name": "component",
+            "optional": true,
+            "sort": false,
+            "stem": false,
+            "type": "string",
+            "stem_dictionary": "",
+            "store": true
           }
         ]
       },
@@ -144,8 +170,8 @@
           "name": "vector_docs_search",
           "search_parameters": {
             "sort_by": "_text_match:desc,ranking:desc,level:desc",
-            "query_by": "pageTitle,title,hierarchy,content,tags",
-            "query_by_weights": "4,3,2,1,2",
+            "query_by": "componentWithType,component,pageTitle,title,hierarchy,content,tags",
+            "query_by_weights": "5,4,4,3,2,1,2",
             "text_match_type": "sum_score"
           }
         }

From 625c1d3a57a59784da7b1e42b2318d4c372649d8 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 29 Apr 2026 16:06:31 -0400
Subject: [PATCH 180/326] chore(deps): bump the serde group across 1 directory
 with 2 updates (#25227)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* chore(deps): bump the serde group across 1 directory with 2 updates

Bumps the serde group with 2 updates in the / directory: [serde_with](https://github.com/jonasbb/serde_with) and [serde_json](https://github.com/serde-rs/json).


Updates `serde_with` from 3.14.0 to 3.17.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](https://github.com/jonasbb/serde_with/compare/v3.14.0...v3.17.0)

Updates `serde_json` from 1.0.145 to 1.0.149
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](https://github.com/serde-rs/json/compare/v1.0.145...v1.0.149)

---
updated-dependencies:
- dependency-name: serde_with
  dependency-version: 3.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serde
- dependency-name: serde_json
  dependency-version: 1.0.149
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: serde
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(core): update float size estimator to match serde_json's new formatter

serde_json 1.0.147 switched from Ryū to Żmij for float-to-string
formatting. The EstimatedJsonEncodedSizeOf impls for f32/f64 were using
ryu directly to predict serde_json's output size, which silently drifts
after the bump (for example ryu emits `1e16` while serde_json now emits
`1e+16`). Swap to zmij so the estimate tracks what serde_json actually
produces.

* chore(codecs): update native_json fixtures for new serde_json float formatter

Round-tripped the affected fixtures through serde_json 1.0.149 so
positive exponents render as `e+N` (e.g. `1.797...e+308`) to match the
new Żmij formatter introduced in 1.0.147. Event content is unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(deps): regenerate 3rd-party license file for zmij

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): allow `mij` in spell check

The changelog mentions the Żmij formatter; check-spelling tokenizes
around `Ż` and flags the residual `mij`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(deps): centralize serde_with as a workspace dependency

Move the serde_with version + features into [workspace.dependencies],
mirroring how serde and serde_json are already declared. The workspace
entry carries the union of features previously enabled across the
three dependents (std, macros, chrono_0_4); since Cargo unions
features across the workspace anyway, the resulting workspace build
is identical.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(deps): use workspace serde_json in file-source-common

Addresses review feedback from @thomasqueirozb on #25227. Cargo unions
features across the workspace, so the union for any binary that pulls
file-source-common alongside other serde_json dependents is unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Update Cargo.lock

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 .github/actions/spelling/expect.txt           |  1 +
 Cargo.lock                                    | 61 +++++++++++++++----
 Cargo.toml                                    |  3 +-
 LICENSE-3rdparty.csv                          |  1 +
 changelog.d/serde_group_bump.enhancement.md   |  3 +
 lib/codecs/Cargo.toml                         |  2 +-
 .../tests/data/native_encoding/json/0605.json |  2 +-
 .../tests/data/native_encoding/json/0638.json |  2 +-
 .../tests/data/native_encoding/json/0639.json |  2 +-
 .../tests/data/native_encoding/json/0647.json |  2 +-
 .../tests/data/native_encoding/json/0700.json |  2 +-
 .../tests/data/native_encoding/json/0788.json |  2 +-
 lib/file-source-common/Cargo.toml             |  2 +-
 lib/vector-config/Cargo.toml                  |  4 +-
 lib/vector-core/Cargo.toml                    |  4 +-
 .../event/estimated_json_encoded_size_of.rs   |  4 +-
 16 files changed, 71 insertions(+), 26 deletions(-)
 create mode 100644 changelog.d/serde_group_bump.enhancement.md

diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index 3656732c51bba..353de8bdf6f91 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -350,6 +350,7 @@ mezmo
 mfoo
 mgmt
 MIDP
+mij
 mingrammer
 mkto
 mlua
diff --git a/Cargo.lock b/Cargo.lock
index 52ed5cd06c593..9bab182e05373 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3376,6 +3376,16 @@ dependencies = [
  "darling_macro 0.21.3",
 ]
 
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core 0.23.0",
+ "darling_macro 0.23.0",
+]
+
 [[package]]
 name = "darling_core"
 version = "0.20.11"
@@ -3404,6 +3414,19 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2 1.0.106",
+ "quote 1.0.45",
+ "strsim",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "darling_macro"
 version = "0.20.11"
@@ -3426,6 +3449,17 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core 0.23.0",
+ "quote 1.0.45",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "dary_heap"
 version = "0.3.8"
@@ -10289,16 +10323,16 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.145"
+version = "1.0.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
 dependencies = [
  "indexmap 2.12.0",
  "itoa",
  "memchr",
- "ryu",
  "serde",
  "serde_core",
+ "zmij",
 ]
 
 [[package]]
@@ -10363,9 +10397,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.14.0"
+version = "3.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2c45cd61fefa9db6f254525d46e392b852e0e61d9a1fd36e5bd183450a556d5"
+checksum = "dd5414fad8e6907dbdd5bc441a50ae8d6e26151a03b1de04d89a5576de61d01f"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -10374,8 +10408,7 @@ dependencies = [
  "indexmap 2.12.0",
  "schemars 0.9.0",
  "schemars 1.0.3",
- "serde",
- "serde_derive",
+ "serde_core",
  "serde_json",
  "serde_with_macros",
  "time",
@@ -10383,11 +10416,11 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.14.0"
+version = "3.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de90945e6565ce0d9a25098082ed4ee4002e047cb59892c318d66821e14bb30f"
+checksum = "d3db8978e608f1fe7357e211969fd9abdcae80bac1ba7a3369bb7eb6b404eb65"
 dependencies = [
- "darling 0.20.11",
+ "darling 0.23.0",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
@@ -13148,7 +13181,6 @@ dependencies = [
  "rand 0.9.4",
  "rand_distr",
  "regex",
- "ryu",
  "schannel",
  "security-framework 3.6.0",
  "serde",
@@ -13177,6 +13209,7 @@ dependencies = [
  "vector-config-common",
  "vector-lookup",
  "vrl",
+ "zmij",
 ]
 
 [[package]]
@@ -14656,6 +14689,12 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7948af682ccbc3342b6e9420e8c51c1fe5d7bf7756002b4a3c6cabfe96a7e3c"
 
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+
 [[package]]
 name = "zstd"
 version = "0.13.2"
diff --git a/Cargo.toml b/Cargo.toml
index db582e2930491..904f540cd26a5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -189,7 +189,8 @@ reqwest = { version = "0.11", features = ["json"] }
 rust_decimal = { version = "1.40.0", default-features = false, features = ["std"] }
 semver = { version = "1.0.28", default-features = false, features = ["serde", "std"] }
 serde = { version = "1.0.219", default-features = false, features = ["alloc", "derive", "rc"] }
-serde_json = { version = "1.0.143", default-features = false, features = ["preserve_order", "raw_value", "std"] }
+serde_json = { version = "1.0.149", default-features = false, features = ["preserve_order", "raw_value", "std"] }
+serde_with = { version = "3.18.0", default-features = false, features = ["std", "macros", "chrono_0_4"] }
 serde_yaml = { version = "0.9.34", default-features = false }
 snafu = { version = "0.9.0", default-features = false, features = ["futures", "std"] }
 socket2 = { version = "0.5.10", default-features = false }
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 31c7d69405a20..311b35452684c 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -937,6 +937,7 @@ zeroize,https://github.com/RustCrypto/utils/tree/master/zeroize,Apache-2.0 OR MI
 zerovec,https://github.com/unicode-org/icu4x,Unicode-3.0,The ICU4X Project Developers
 zerovec-derive,https://github.com/unicode-org/icu4x,Unicode-3.0,Manish Goregaokar <manishsmail@gmail.com>
 zlib-rs,https://github.com/trifectatechfoundation/zlib-rs,Zlib,The zlib-rs Authors
+zmij,https://github.com/dtolnay/zmij,MIT,David Tolnay <dtolnay@gmail.com>
 zstd,https://github.com/gyscos/zstd-rs,MIT,Alexandre Bury <alexandre.bury@gmail.com>
 zstd-safe,https://github.com/gyscos/zstd-rs,MIT OR Apache-2.0,Alexandre Bury <alexandre.bury@gmail.com>
 zstd-sys,https://github.com/gyscos/zstd-rs,MIT OR Apache-2.0,Alexandre Bury <alexandre.bury@gmail.com>
diff --git a/changelog.d/serde_group_bump.enhancement.md b/changelog.d/serde_group_bump.enhancement.md
new file mode 100644
index 0000000000000..3c9ea910c6601
--- /dev/null
+++ b/changelog.d/serde_group_bump.enhancement.md
@@ -0,0 +1,3 @@
+Bumped `serde_json` to `1.0.149` and `serde_with` to `3.18.0`. `serde_json` switched its float-to-string formatter from Ryū to Żmij in `1.0.147`, so floats serialized via the `native_json` codec may render with slightly different textual form (for example `1e+16` instead of `1e16`). The change is purely cosmetic: parsed `f32`/`f64` values round-trip identically, and Vector-to-Vector communication between old and new versions is unaffected.
+
+authors: pront
diff --git a/lib/codecs/Cargo.toml b/lib/codecs/Cargo.toml
index b9043b7223d8a..6a5f8424a61fd 100644
--- a/lib/codecs/Cargo.toml
+++ b/lib/codecs/Cargo.toml
@@ -45,7 +45,7 @@ prost-reflect.workspace = true
 rand.workspace = true
 regex.workspace = true
 serde.workspace = true
-serde_with = { version = "3.14.0", default-features = false, features = ["std", "macros", "chrono_0_4"] }
+serde_with.workspace = true
 serde_json.workspace = true
 serde-aux = { version = "4.5", optional = true }
 smallvec = { version = "1", default-features = false, features = ["union"] }
diff --git a/lib/codecs/tests/data/native_encoding/json/0605.json b/lib/codecs/tests/data/native_encoding/json/0605.json
index bcd39f82ae418..1c46a13cf2fb7 100644
--- a/lib/codecs/tests/data/native_encoding/json/0605.json
+++ b/lib/codecs/tests/data/native_encoding/json/0605.json
@@ -1 +1 @@
-{"metric":{"name":"l","tags":{"a":"l","e":"l","q":"n"},"timestamp":"1970-01-01T07:31:02.000011250Z","kind":"absolute","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e308,"max":-1.7976931348623157e308,"sum":-209216.0,"avg":-113920.0}}}}}
\ No newline at end of file
+{"metric":{"name":"l","tags":{"a":"l","e":"l","q":"n"},"timestamp":"1970-01-01T07:31:02.000011250Z","kind":"absolute","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e+308,"max":-1.7976931348623157e+308,"sum":-209216.0,"avg":-113920.0}}}}}
\ No newline at end of file
diff --git a/lib/codecs/tests/data/native_encoding/json/0638.json b/lib/codecs/tests/data/native_encoding/json/0638.json
index 61f4ec83d0fb4..85fb25087875f 100644
--- a/lib/codecs/tests/data/native_encoding/json/0638.json
+++ b/lib/codecs/tests/data/native_encoding/json/0638.json
@@ -1 +1 @@
-{"metric":{"name":"t","namespace":"k","tags":{"s":"b","x":"y"},"timestamp":"1969-12-31T19:41:49.000002928Z","interval_ms":2984613283,"kind":"absolute","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e308,"max":-1.7976931348623157e308,"sum":-667968.0,"avg":-404160.0}}}}}
\ No newline at end of file
+{"metric":{"name":"t","namespace":"k","tags":{"s":"b","x":"y"},"timestamp":"1969-12-31T19:41:49.000002928Z","interval_ms":2984613283,"kind":"absolute","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e+308,"max":-1.7976931348623157e+308,"sum":-667968.0,"avg":-404160.0}}}}}
\ No newline at end of file
diff --git a/lib/codecs/tests/data/native_encoding/json/0639.json b/lib/codecs/tests/data/native_encoding/json/0639.json
index 3f8fd591f1128..9bbe86b1aa695 100644
--- a/lib/codecs/tests/data/native_encoding/json/0639.json
+++ b/lib/codecs/tests/data/native_encoding/json/0639.json
@@ -1 +1 @@
-{"metric":{"name":"y","namespace":"d","kind":"incremental","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e308,"max":-1.7976931348623157e308,"sum":-422464.0,"avg":906752.0}}}}}
\ No newline at end of file
+{"metric":{"name":"y","namespace":"d","kind":"incremental","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e+308,"max":-1.7976931348623157e+308,"sum":-422464.0,"avg":906752.0}}}}}
\ No newline at end of file
diff --git a/lib/codecs/tests/data/native_encoding/json/0647.json b/lib/codecs/tests/data/native_encoding/json/0647.json
index 8dbe86fb16fdd..c6e6cdb1dfbab 100644
--- a/lib/codecs/tests/data/native_encoding/json/0647.json
+++ b/lib/codecs/tests/data/native_encoding/json/0647.json
@@ -1 +1 @@
-{"metric":{"name":"b","interval_ms":586459638,"kind":"incremental","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e308,"max":-1.7976931348623157e308,"sum":999808.0,"avg":-148288.0}}}}}
\ No newline at end of file
+{"metric":{"name":"b","interval_ms":586459638,"kind":"incremental","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e+308,"max":-1.7976931348623157e+308,"sum":999808.0,"avg":-148288.0}}}}}
\ No newline at end of file
diff --git a/lib/codecs/tests/data/native_encoding/json/0700.json b/lib/codecs/tests/data/native_encoding/json/0700.json
index 42fdfec5980f1..da5055a337409 100644
--- a/lib/codecs/tests/data/native_encoding/json/0700.json
+++ b/lib/codecs/tests/data/native_encoding/json/0700.json
@@ -1 +1 @@
-{"metric":{"name":"j","tags":{"f":"k"},"timestamp":"1969-12-31T18:05:17.000026769Z","kind":"absolute","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e308,"max":-1.7976931348623157e308,"sum":-481728.0,"avg":590528.0}}}}}
\ No newline at end of file
+{"metric":{"name":"j","tags":{"f":"k"},"timestamp":"1969-12-31T18:05:17.000026769Z","kind":"absolute","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e+308,"max":-1.7976931348623157e+308,"sum":-481728.0,"avg":590528.0}}}}}
\ No newline at end of file
diff --git a/lib/codecs/tests/data/native_encoding/json/0788.json b/lib/codecs/tests/data/native_encoding/json/0788.json
index f458d97be6718..13f2d0913ec85 100644
--- a/lib/codecs/tests/data/native_encoding/json/0788.json
+++ b/lib/codecs/tests/data/native_encoding/json/0788.json
@@ -1 +1 @@
-{"metric":{"name":"w","interval_ms":870813348,"kind":"incremental","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e308,"max":-1.7976931348623157e308,"sum":-356992.0,"avg":-572800.0}}}}}
\ No newline at end of file
+{"metric":{"name":"w","interval_ms":870813348,"kind":"incremental","sketch":{"sketch":{"AgentDDSketch":{"bins":{"k":[],"n":[]},"count":0,"min":1.7976931348623157e+308,"max":-1.7976931348623157e+308,"sum":-356992.0,"avg":-572800.0}}}}}
\ No newline at end of file
diff --git a/lib/file-source-common/Cargo.toml b/lib/file-source-common/Cargo.toml
index 6d3a885bc9a7a..f7a191d9cae7d 100644
--- a/lib/file-source-common/Cargo.toml
+++ b/lib/file-source-common/Cargo.toml
@@ -16,7 +16,7 @@ chrono.workspace = true
 tracing.workspace = true
 crc = "3.3.0"
 serde = { version = "1.0", default-features = false, features = ["derive"] }
-serde_json = { version = "1.0.143", default-features = false }
+serde_json.workspace = true
 bstr = { version = "1.12", default-features = false }
 bytes = { version = "1.11.1", default-features = false, features = ["serde"] }
 dashmap = { version = "6.1", default-features = false }
diff --git a/lib/vector-config/Cargo.toml b/lib/vector-config/Cargo.toml
index 2283df3d133e1..5f4cfdbdcf1b2 100644
--- a/lib/vector-config/Cargo.toml
+++ b/lib/vector-config/Cargo.toml
@@ -20,7 +20,7 @@ no-proxy = { version = "0.3.6", default-features = false, features = ["serialize
 num-traits = { version = "0.2.19", default-features = false }
 serde.workspace = true
 serde_json.workspace = true
-serde_with = { version = "3.14.0", default-features = false, features = ["std"] }
+serde_with.workspace = true
 snafu.workspace = true
 toml.workspace = true
 tracing.workspace = true
@@ -32,4 +32,4 @@ vector-config-macros = { path = "../vector-config-macros" }
 
 [dev-dependencies]
 assert-json-diff = { version = "2", default-features = false }
-serde_with = { version = "3.14.0", default-features = false, features = ["std", "macros"] }
+serde_with.workspace = true
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index 8836c2f70beaf..5c3370ac1a526 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -42,10 +42,10 @@ prost-types.workspace = true
 prost.workspace = true
 quanta = { version = "0.12.6", default-features = false }
 regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
-ryu = { version = "1", default-features = false }
+zmij = { version = "1", default-features = false }
 serde.workspace = true
 serde_json.workspace = true
-serde_with = { version = "3.14.0", default-features = false, features = ["std", "macros"] }
+serde_with.workspace = true
 smallvec = { version = "1", default-features = false, features = ["serde", "const_generics"] }
 snafu.workspace = true
 socket2.workspace = true
diff --git a/lib/vector-core/src/event/estimated_json_encoded_size_of.rs b/lib/vector-core/src/event/estimated_json_encoded_size_of.rs
index 832dc70cfd343..c6e8c17bc95b2 100644
--- a/lib/vector-core/src/event/estimated_json_encoded_size_of.rs
+++ b/lib/vector-core/src/event/estimated_json_encoded_size_of.rs
@@ -120,13 +120,13 @@ impl EstimatedJsonEncodedSizeOf for bool {
 
 impl EstimatedJsonEncodedSizeOf for f64 {
     fn estimated_json_encoded_size_of(&self) -> JsonSize {
-        ryu::Buffer::new().format_finite(*self).len().into()
+        zmij::Buffer::new().format_finite(*self).len().into()
     }
 }
 
 impl EstimatedJsonEncodedSizeOf for f32 {
     fn estimated_json_encoded_size_of(&self) -> JsonSize {
-        ryu::Buffer::new().format_finite(*self).len().into()
+        zmij::Buffer::new().format_finite(*self).len().into()
     }
 }
 

From b5fb618eb24bade72d5277be6d23836810d24fa8 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 30 Apr 2026 17:53:00 -0400
Subject: [PATCH 181/326] chore(dev): remove unused update_counter macro
 (#25333)

---
 lib/vector-core/src/metrics/mod.rs | 44 ------------------------------
 1 file changed, 44 deletions(-)

diff --git a/lib/vector-core/src/metrics/mod.rs b/lib/vector-core/src/metrics/mod.rs
index 660f29c000db3..cd900d392f004 100644
--- a/lib/vector-core/src/metrics/mod.rs
+++ b/lib/vector-core/src/metrics/mod.rs
@@ -200,50 +200,6 @@ impl Controller {
     }
 }
 
-#[macro_export]
-/// This macro is used to emit metrics as a `counter` while simultaneously
-/// converting from absolute values to incremental values.
-///
-/// Values that do not arrive in strictly monotonically increasing order are
-/// ignored and will not be emitted.
-macro_rules! update_counter {
-    ($label:literal, $value:expr) => {{
-        use ::std::sync::atomic::{AtomicU64, Ordering};
-
-        static PREVIOUS_VALUE: AtomicU64 = AtomicU64::new(0);
-
-        let new_value = $value;
-        let mut previous_value = PREVIOUS_VALUE.load(Ordering::Relaxed);
-
-        loop {
-            // Either a new greater value has been emitted before this thread updated the counter
-            // or values were provided that are not in strictly monotonically increasing order.
-            // Ignore.
-            if new_value <= previous_value {
-                break;
-            }
-
-            match PREVIOUS_VALUE.compare_exchange_weak(
-                previous_value,
-                new_value,
-                Ordering::SeqCst,
-                Ordering::Relaxed,
-            ) {
-                // Another thread has written a new value before us. Re-enter loop.
-                Err(value) => previous_value = value,
-                // Calculate delta to last emitted value and emit it.
-                Ok(_) => {
-                    let delta = new_value - previous_value;
-                    // Albeit very unlikely, note that this sequence of deltas might be emitted in
-                    // a different order than they were calculated.
-                    counter!($label).increment(delta);
-                    break;
-                }
-            }
-        }
-    }};
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

From bd8ab1a245a439134b2bd9f2cb540ca550db860c Mon Sep 17 00:00:00 2001
From: Andy <26137827+ndrsg@users.noreply.github.com>
Date: Fri, 1 May 2026 15:30:24 +0200
Subject: [PATCH 182/326] feat(sinks): introduce RetryStrategy / Config for
 http based sinks (#25057)

* feat(sinks): introduce a configurable retry strategy for http

* feat(sinks): wire the RetryStrategy with the HttpRetryLogic

* feat(sinks): wire RetryStrategy with all HttpStatusRetryLogic and all affected sinks

* docs(sinks): http example config with custom retry strategy

* feat(http sink): add integration test for custom retry strategy

* docs(sinks): add changelog fragment

* fix(http sink): update is_retriable_error logic to respect retry strategy

* fix(http sink): add handling for NOT_IMPLEMENTED status in retry strategy

* chore(sinks): format code

* feat(sinks): implement timeout retry logic and add tests for non-retriable timeouts

* docs(sinks): clarify that success status codes are not retried on RetryAll strategy

* feat(sinks): improve typesafety of RetryStrategy StatusCode

* docs(sinks http): enhance transport error classification for HTTP sinks with shared retry logic

* feat(sinks http): add debug logging for unsuccessful HTTP responses in retry logic

* refactor(http sink): avoid heap allocation on reasoning happy path

* fix(http sink): format example config

* chore: add custom attributes for numeric type in StatusCode metadata

* docs(sinks http): update docs for http sinks supporting retry_strategy

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 benches/http.rs                               |   1 +
 .../10870_http_retry_strategy.feature.md      |   7 +
 ...http_retry_transport_errors.enhancement.md |   9 +
 config/examples/http_sink_custom_retry.yaml   |  42 +++
 lib/vector-config/src/http.rs                 |   6 +
 src/sinks/appsignal/config.rs                 |  11 +-
 src/sinks/axiom/config.rs                     |   8 +-
 src/sinks/azure_logs_ingestion/config.rs      |  16 +-
 src/sinks/azure_monitor_logs/config.rs        |  16 +-
 src/sinks/datadog/events/config.rs            |  14 +-
 src/sinks/gcp/stackdriver/logs/config.rs      |  11 +-
 src/sinks/gcp/stackdriver/metrics/config.rs   |  12 +-
 src/sinks/honeycomb/config.rs                 |  11 +-
 src/sinks/http/config.rs                      |  15 +-
 src/sinks/http/tests.rs                       | 100 +++++++
 src/sinks/keep/config.rs                      |  11 +-
 src/sinks/opentelemetry/mod.rs                |   1 +
 src/sinks/prometheus/remote_write/config.rs   |  11 +-
 src/sinks/util/http.rs                        | 282 ++++++++++++++++--
 src/sinks/util/retries.rs                     |  60 +++-
 .../components/sinks/generated/appsignal.cue  |  31 ++
 .../components/sinks/generated/axiom.cue      |  31 ++
 .../sinks/generated/azure_logs_ingestion.cue  |  31 ++
 .../sinks/generated/azure_monitor_logs.cue    |  31 ++
 .../sinks/generated/datadog_events.cue        |  31 ++
 .../sinks/generated/gcp_stackdriver_logs.cue  |  31 ++
 .../generated/gcp_stackdriver_metrics.cue     |  31 ++
 .../components/sinks/generated/honeycomb.cue  |  31 ++
 .../components/sinks/generated/http.cue       |  31 ++
 .../components/sinks/generated/keep.cue       |  31 ++
 .../sinks/generated/opentelemetry.cue         |  31 ++
 .../generated/prometheus_remote_write.cue     |  31 ++
 32 files changed, 957 insertions(+), 59 deletions(-)
 create mode 100644 changelog.d/10870_http_retry_strategy.feature.md
 create mode 100644 changelog.d/10870_http_retry_transport_errors.enhancement.md
 create mode 100644 config/examples/http_sink_custom_retry.yaml

diff --git a/benches/http.rs b/benches/http.rs
index 30b35b8b257f7..5c8b5eaac7efe 100644
--- a/benches/http.rs
+++ b/benches/http.rs
@@ -63,6 +63,7 @@ fn benchmark_http(c: &mut Criterion) {
                                 request: Default::default(),
                                 tls: Default::default(),
                                 acknowledgements: Default::default(),
+                                retry_strategy: Default::default(),
                             },
                         );
 
diff --git a/changelog.d/10870_http_retry_strategy.feature.md b/changelog.d/10870_http_retry_strategy.feature.md
new file mode 100644
index 0000000000000..09afba2eddd40
--- /dev/null
+++ b/changelog.d/10870_http_retry_strategy.feature.md
@@ -0,0 +1,7 @@
+HTTP-based sinks that use the shared retry helpers now support a `retry_strategy` configuration
+option to control which HTTP response codes are retried. The `http` sink also includes a new
+example showing how to retry only specific transient status codes.
+
+Issue: https://github.com/vectordotdev/vector/issues/10870
+
+authors: ndrsg
diff --git a/changelog.d/10870_http_retry_transport_errors.enhancement.md b/changelog.d/10870_http_retry_transport_errors.enhancement.md
new file mode 100644
index 0000000000000..f06f63b2f0e07
--- /dev/null
+++ b/changelog.d/10870_http_retry_transport_errors.enhancement.md
@@ -0,0 +1,9 @@
+HTTP-based sinks using the shared retry logic now classify transport-layer failures with
+`HttpError::is_retriable`: connection and TLS connector issues may be retried, while failures
+such as invalid HTTP request construction or an invalid proxy URI are not. Setting
+`retry_strategy` to `none` disables retries for these transport errors and for request
+timeouts, in addition to status-code-based retries.
+
+Issue: https://github.com/vectordotdev/vector/issues/10870
+
+authors: ndrsg
diff --git a/config/examples/http_sink_custom_retry.yaml b/config/examples/http_sink_custom_retry.yaml
new file mode 100644
index 0000000000000..fd973c890e991
--- /dev/null
+++ b/config/examples/http_sink_custom_retry.yaml
@@ -0,0 +1,42 @@
+# HTTP sink example with a custom retry strategy
+# ----------------------------------------------------
+# Sends demo logs to an HTTP endpoint and only retries the response codes
+# that the upstream API documents as transient.
+
+data_dir: "/var/lib/vector"
+
+sources:
+  demo_logs:
+    type: "demo_logs"
+    format: "json"
+    interval: 1
+
+sinks:
+  http_out:
+    type: "http"
+    inputs: ["demo_logs"]
+    uri: "https://example.com/ingest"
+    method: "post"
+
+    # Skip the startup probe so the example can be adapted locally.
+    healthcheck:
+      enabled: false
+
+    # Send newline-delimited JSON in the request body.
+    framing:
+      method: "newline_delimited"
+    encoding:
+      codec: "json"
+
+    # Control how many retries are made and how quickly backoff grows.
+    request:
+      timeout_secs: 60
+      retry_attempts: 8
+      retry_initial_backoff_secs: 2
+      retry_max_duration_secs: 30
+
+    # Retry only on the exact HTTP status codes that this destination
+    # treats as temporary failures.
+    retry_strategy:
+      type: "custom"
+      status_codes: [408, 425, 429, 503]
diff --git a/lib/vector-config/src/http.rs b/lib/vector-config/src/http.rs
index 94029610f0441..da51ea1cc156e 100644
--- a/lib/vector-config/src/http.rs
+++ b/lib/vector-config/src/http.rs
@@ -2,9 +2,11 @@ use std::cell::RefCell;
 
 use http::StatusCode;
 use serde_json::Value;
+use vector_config_common::{attributes::CustomAttribute, constants};
 
 use crate::{
     Configurable, GenerateError, Metadata, ToValue,
+    num::NumberClass,
     schema::{SchemaGenerator, SchemaObject, generate_number_schema},
 };
 
@@ -27,6 +29,10 @@ impl Configurable for StatusCode {
         let mut metadata = Metadata::default();
         metadata.set_description("HTTP response status code");
         metadata.set_default_value(StatusCode::OK);
+        metadata.add_custom_attribute(CustomAttribute::kv(
+            constants::DOCS_META_NUMERIC_TYPE,
+            NumberClass::Unsigned,
+        ));
         metadata
     }
 
diff --git a/src/sinks/appsignal/config.rs b/src/sinks/appsignal/config.rs
index 9e8c000f995a3..fea94af05b132 100644
--- a/src/sinks/appsignal/config.rs
+++ b/src/sinks/appsignal/config.rs
@@ -21,7 +21,7 @@ use crate::{
         prelude::{SinkConfig, SinkContext},
         util::{
             BatchConfig, Compression, ServiceBuilderExt, SinkBatchSettings, TowerRequestConfig,
-            http::HttpStatusRetryLogic,
+            http::{HttpStatusRetryLogic, RetryStrategy},
         },
     },
 };
@@ -67,6 +67,10 @@ pub(super) struct AppsignalConfig {
         skip_serializing_if = "crate::serde::is_default"
     )]
     acknowledgements: AcknowledgementsConfig,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    retry_strategy: RetryStrategy,
 }
 
 pub(super) fn default_endpoint() -> String {
@@ -99,7 +103,10 @@ impl AppsignalConfig {
 
         let request_opts = self.request;
         let request_settings = request_opts.into_settings();
-        let retry_logic = HttpStatusRetryLogic::new(|req: &AppsignalResponse| req.http_status);
+        let retry_logic = HttpStatusRetryLogic::new(
+            |req: &AppsignalResponse| req.http_status,
+            self.retry_strategy.clone(),
+        );
 
         let service = ServiceBuilder::new()
             .settings(request_settings, retry_logic)
diff --git a/src/sinks/axiom/config.rs b/src/sinks/axiom/config.rs
index 61421973d5475..0930a997abc12 100644
--- a/src/sinks/axiom/config.rs
+++ b/src/sinks/axiom/config.rs
@@ -15,7 +15,8 @@ use crate::{
         Healthcheck, VectorSink,
         http::config::{HttpMethod, HttpSinkConfig},
         util::{
-            BatchConfig, Compression, RealtimeSizeBasedDefaultBatchSettings, http::RequestConfig,
+            BatchConfig, Compression, RealtimeSizeBasedDefaultBatchSettings,
+            http::{RequestConfig, RetryStrategy},
         },
     },
     tls::TlsConfig,
@@ -124,6 +125,10 @@ pub struct AxiomConfig {
         skip_serializing_if = "crate::serde::is_default"
     )]
     pub acknowledgements: AcknowledgementsConfig,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub retry_strategy: RetryStrategy,
 }
 
 impl GenerateConfig for AxiomConfig {
@@ -180,6 +185,7 @@ impl SinkConfig for AxiomConfig {
             ),
             payload_prefix: "".into(), // Always newline delimited JSON
             payload_suffix: "".into(), // Always newline delimited JSON
+            retry_strategy: self.retry_strategy.clone(),
         };
 
         http_sink_config.build(cx).await
diff --git a/src/sinks/azure_logs_ingestion/config.rs b/src/sinks/azure_logs_ingestion/config.rs
index 3b105d549d0c1..89da496045d9a 100644
--- a/src/sinks/azure_logs_ingestion/config.rs
+++ b/src/sinks/azure_logs_ingestion/config.rs
@@ -10,7 +10,10 @@ use crate::{
     sinks::{
         azure_common::config::AzureAuthentication,
         prelude::*,
-        util::{RealtimeSizeBasedDefaultBatchSettings, UriSerde, http::HttpStatusRetryLogic},
+        util::{
+            RealtimeSizeBasedDefaultBatchSettings, UriSerde,
+            http::{HttpStatusRetryLogic, RetryStrategy},
+        },
     },
 };
 
@@ -102,6 +105,10 @@ pub struct AzureLogsIngestionConfig {
         skip_serializing_if = "crate::serde::is_default"
     )]
     pub acknowledgements: AcknowledgementsConfig,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub retry_strategy: RetryStrategy,
 }
 
 impl Default for AzureLogsIngestionConfig {
@@ -118,6 +125,7 @@ impl Default for AzureLogsIngestionConfig {
             request: Default::default(),
             tls: None,
             acknowledgements: Default::default(),
+            retry_strategy: Default::default(),
         }
     }
 }
@@ -156,8 +164,10 @@ impl AzureLogsIngestionConfig {
         )?;
         let healthcheck = service.healthcheck();
 
-        let retry_logic =
-            HttpStatusRetryLogic::new(|res: &AzureLogsIngestionResponse| res.http_status);
+        let retry_logic = HttpStatusRetryLogic::new(
+            |res: &AzureLogsIngestionResponse| res.http_status,
+            self.retry_strategy.clone(),
+        );
         let request_settings = self.request.into_settings();
         let service = ServiceBuilder::new()
             .settings(request_settings, retry_logic)
diff --git a/src/sinks/azure_monitor_logs/config.rs b/src/sinks/azure_monitor_logs/config.rs
index dc60d179a2ff5..6d68aed7efd75 100644
--- a/src/sinks/azure_monitor_logs/config.rs
+++ b/src/sinks/azure_monitor_logs/config.rs
@@ -16,7 +16,10 @@ use crate::{
     http::{HttpClient, get_http_scheme_from_uri},
     sinks::{
         prelude::*,
-        util::{RealtimeSizeBasedDefaultBatchSettings, UriSerde, http::HttpStatusRetryLogic},
+        util::{
+            RealtimeSizeBasedDefaultBatchSettings, UriSerde,
+            http::{HttpStatusRetryLogic, RetryStrategy},
+        },
     },
 };
 
@@ -113,6 +116,10 @@ pub struct AzureMonitorLogsConfig {
         skip_serializing_if = "crate::serde::is_default"
     )]
     pub acknowledgements: AcknowledgementsConfig,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub retry_strategy: RetryStrategy,
 }
 
 impl Default for AzureMonitorLogsConfig {
@@ -129,6 +136,7 @@ impl Default for AzureMonitorLogsConfig {
             time_generated_key: None,
             tls: None,
             acknowledgements: Default::default(),
+            retry_strategy: Default::default(),
         }
     }
 }
@@ -181,8 +189,10 @@ impl AzureMonitorLogsConfig {
         )?;
         let healthcheck = service.healthcheck();
 
-        let retry_logic =
-            HttpStatusRetryLogic::new(|res: &AzureMonitorLogsResponse| res.http_status);
+        let retry_logic = HttpStatusRetryLogic::new(
+            |res: &AzureMonitorLogsResponse| res.http_status,
+            self.retry_strategy.clone(),
+        );
         let request_settings = self.request.into_settings();
         let service = ServiceBuilder::new()
             .settings(request_settings, retry_logic)
diff --git a/src/sinks/datadog/events/config.rs b/src/sinks/datadog/events/config.rs
index 2bfdc66315c3e..f9b0f9361bba8 100644
--- a/src/sinks/datadog/events/config.rs
+++ b/src/sinks/datadog/events/config.rs
@@ -14,7 +14,10 @@ use crate::{
     sinks::{
         Healthcheck, VectorSink,
         datadog::{DatadogCommonConfig, LocalDatadogCommonConfig},
-        util::{ServiceBuilderExt, TowerRequestConfig, http::HttpStatusRetryLogic},
+        util::{
+            ServiceBuilderExt, TowerRequestConfig,
+            http::{HttpStatusRetryLogic, RetryStrategy},
+        },
     },
     tls::MaybeTlsSettings,
 };
@@ -33,6 +36,10 @@ pub struct DatadogEventsConfig {
     #[configurable(derived)]
     #[serde(default)]
     pub request: TowerRequestConfig,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub retry_strategy: RetryStrategy,
 }
 
 impl GenerateConfig for DatadogEventsConfig {
@@ -64,7 +71,10 @@ impl DatadogEventsConfig {
 
         let request_opts = self.request;
         let request_settings = request_opts.into_settings();
-        let retry_logic = HttpStatusRetryLogic::new(|req: &DatadogEventsResponse| req.http_status);
+        let retry_logic = HttpStatusRetryLogic::new(
+            |req: &DatadogEventsResponse| req.http_status,
+            self.retry_strategy.clone(),
+        );
 
         let service = ServiceBuilder::new()
             .settings(request_settings, retry_logic)
diff --git a/src/sinks/gcp/stackdriver/logs/config.rs b/src/sinks/gcp/stackdriver/logs/config.rs
index 9b66eea4ac214..addb45163df76 100644
--- a/src/sinks/gcp/stackdriver/logs/config.rs
+++ b/src/sinks/gcp/stackdriver/logs/config.rs
@@ -21,7 +21,7 @@ use crate::{
         prelude::*,
         util::{
             BoxedRawValue, RealtimeSizeBasedDefaultBatchSettings,
-            http::{HttpService, http_response_retry_logic},
+            http::{HttpService, RetryStrategy, http_response_retry_logic},
             service::TowerRequestConfigDefaults,
         },
     },
@@ -106,6 +106,10 @@ pub(super) struct StackdriverConfig {
         skip_serializing_if = "crate::serde::is_default"
     )]
     acknowledgements: AcknowledgementsConfig,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub retry_strategy: RetryStrategy,
 }
 
 pub(super) fn default_endpoint() -> String {
@@ -269,7 +273,10 @@ impl SinkConfig for StackdriverConfig {
         let service = HttpService::new(client.clone(), stackdriver_logs_service_request_builder);
 
         let service = ServiceBuilder::new()
-            .settings(request_limits, http_response_retry_logic())
+            .settings(
+                request_limits,
+                http_response_retry_logic(self.retry_strategy.clone()),
+            )
             .service(service);
 
         let sink = StackdriverLogsSink::new(service, batch_settings, request_builder);
diff --git a/src/sinks/gcp/stackdriver/metrics/config.rs b/src/sinks/gcp/stackdriver/metrics/config.rs
index 2398a18e9beb9..ea2cc9d6b5293 100644
--- a/src/sinks/gcp/stackdriver/metrics/config.rs
+++ b/src/sinks/gcp/stackdriver/metrics/config.rs
@@ -15,7 +15,8 @@ use crate::{
         prelude::*,
         util::{
             http::{
-                HttpRequest, HttpService, HttpServiceRequestBuilder, http_response_retry_logic,
+                HttpRequest, HttpService, HttpServiceRequestBuilder, RetryStrategy,
+                http_response_retry_logic,
             },
             service::TowerRequestConfigDefaults,
         },
@@ -77,6 +78,10 @@ pub struct StackdriverConfig {
         skip_serializing_if = "crate::serde::is_default"
     )]
     pub(super) acknowledgements: AcknowledgementsConfig,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub retry_strategy: RetryStrategy,
 }
 
 fn default_metric_namespace_value() -> String {
@@ -126,7 +131,10 @@ impl SinkConfig for StackdriverConfig {
         let service = HttpService::new(client, stackdriver_metrics_service_request_builder);
 
         let service = ServiceBuilder::new()
-            .settings(request_limits, http_response_retry_logic())
+            .settings(
+                request_limits,
+                http_response_retry_logic(self.retry_strategy.clone()),
+            )
             .service(service);
 
         let sink = StackdriverMetricsSink::new(service, batch_settings, request_builder);
diff --git a/src/sinks/honeycomb/config.rs b/src/sinks/honeycomb/config.rs
index 05a56cd9df368..f179248e1697b 100644
--- a/src/sinks/honeycomb/config.rs
+++ b/src/sinks/honeycomb/config.rs
@@ -16,7 +16,7 @@ use crate::{
         prelude::*,
         util::{
             BatchConfig, BoxedRawValue,
-            http::{HttpService, http_response_retry_logic},
+            http::{HttpService, RetryStrategy, http_response_retry_logic},
         },
     },
 };
@@ -71,6 +71,10 @@ pub struct HoneycombConfig {
         skip_serializing_if = "crate::serde::is_default"
     )]
     acknowledgements: AcknowledgementsConfig,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub retry_strategy: RetryStrategy,
 }
 
 fn default_endpoint() -> String {
@@ -124,7 +128,10 @@ impl SinkConfig for HoneycombConfig {
         let request_limits = self.request.into_settings();
 
         let service = ServiceBuilder::new()
-            .settings(request_limits, http_response_retry_logic())
+            .settings(
+                request_limits,
+                http_response_retry_logic(self.retry_strategy.clone()),
+            )
             .service(service);
 
         let sink = HoneycombSink::new(service, batch_settings, request_builder);
diff --git a/src/sinks/http/config.rs b/src/sinks/http/config.rs
index a3a105fa5c608..2b6abebe0d402 100644
--- a/src/sinks/http/config.rs
+++ b/src/sinks/http/config.rs
@@ -30,7 +30,10 @@ use crate::{
         prelude::*,
         util::{
             RealtimeSizeBasedDefaultBatchSettings, UriSerde,
-            http::{HttpService, OrderedHeaderName, RequestConfig, http_response_retry_logic},
+            http::{
+                HttpService, OrderedHeaderName, RequestConfig, RetryStrategy,
+                http_response_retry_logic,
+            },
         },
     },
 };
@@ -100,6 +103,10 @@ pub struct HttpSinkConfig {
         skip_serializing_if = "crate::serde::is_default"
     )]
     pub acknowledgements: AcknowledgementsConfig,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub retry_strategy: RetryStrategy,
 }
 
 /// HTTP method.
@@ -330,7 +337,10 @@ impl SinkConfig for HttpSinkConfig {
         let request_limits = self.request.tower.into_settings();
 
         let service = ServiceBuilder::new()
-            .settings(request_limits, http_response_retry_logic())
+            .settings(
+                request_limits,
+                http_response_retry_logic(self.retry_strategy.clone()),
+            )
             .service(service);
 
         let sink = HttpSink::new(
@@ -405,6 +415,7 @@ mod tests {
                 acknowledgements: AcknowledgementsConfig::default(),
                 payload_prefix: String::new(),
                 payload_suffix: String::new(),
+                retry_strategy: RetryStrategy::default(),
             };
 
             let external_resource = ExternalResource::new(
diff --git a/src/sinks/http/tests.rs b/src/sinks/http/tests.rs
index 12ff994239f5d..2b4b6942c5c7b 100644
--- a/src/sinks/http/tests.rs
+++ b/src/sinks/http/tests.rs
@@ -67,6 +67,7 @@ fn default_cfg(encoding: EncodingConfigWithFraming) -> HttpSinkConfig {
         request: Default::default(),
         tls: Default::default(),
         acknowledgements: Default::default(),
+        retry_strategy: Default::default(),
     }
 }
 
@@ -445,6 +446,105 @@ async fn retries_on_temporary_error() {
     .await;
 }
 
+#[tokio::test]
+async fn custom_retry_retries_only_configured_status_code() {
+    components::assert_sink_compliance(&HTTP_SINK_TAGS, async {
+        const NUM_LINES: usize = 1;
+        const NUM_FAILURES: usize = 2;
+        const CUSTOM_RETRY_CONFIG: &str = r#"
+            request.retry_attempts = 2
+            request.retry_initial_backoff_secs = 1
+            request.retry_max_duration_secs = 1
+            retry_strategy.type = "custom"
+            retry_strategy.status_codes = [408, 425, 429, 503]
+        "#;
+
+        let (in_addr, sink) = build_sink(CUSTOM_RETRY_CONFIG).await;
+
+        let counter = Arc::new(atomic::AtomicUsize::new(0));
+        let in_counter = Arc::clone(&counter);
+        let (rx, trigger, server) = build_test_server_generic(in_addr, move || {
+            let count = in_counter.fetch_add(1, atomic::Ordering::Relaxed);
+            if count < NUM_FAILURES {
+                Response::builder()
+                    .status(StatusCode::SERVICE_UNAVAILABLE)
+                    .body(Body::empty())
+                    .unwrap_or_else(|_| unreachable!())
+            } else {
+                Response::new(Body::empty())
+            }
+        });
+
+        let (batch, mut receiver) = BatchNotifier::new_with_receiver();
+        let (input_lines, events) = random_lines_with_stream(100, NUM_LINES, Some(batch));
+        let pump = sink.run(events);
+
+        tokio::spawn(server);
+
+        pump.await.unwrap();
+        drop(trigger);
+
+        assert_eq!(receiver.try_recv(), Ok(BatchStatus::Delivered));
+
+        let output_lines = get_received_gzip(rx, |parts| {
+            assert_eq!(Method::POST, parts.method);
+            assert_eq!("/frames", parts.uri.path());
+        })
+        .await;
+
+        let tries = counter.load(atomic::Ordering::Relaxed);
+        assert_eq!(tries, NUM_FAILURES + 1);
+        assert_eq!(NUM_LINES, output_lines.len());
+        assert_eq!(input_lines, output_lines);
+    })
+    .await;
+}
+
+#[tokio::test]
+async fn custom_retry_does_not_retry_unconfigured_status_code() {
+    components::assert_sink_error(&COMPONENT_ERROR_TAGS, async {
+        const NUM_LINES: usize = 1;
+        const CUSTOM_RETRY_CONFIG: &str = r#"
+            request.retry_attempts = 2
+            request.retry_initial_backoff_secs = 1
+            request.retry_max_duration_secs = 1
+            retry_strategy.type = "custom"
+            retry_strategy.status_codes = [408, 425, 429, 503]
+        "#;
+
+        let (in_addr, sink) = build_sink(CUSTOM_RETRY_CONFIG).await;
+
+        let counter = Arc::new(atomic::AtomicUsize::new(0));
+        let in_counter = Arc::clone(&counter);
+        let (rx, trigger, server) = build_test_server_generic(in_addr, move || {
+            in_counter.fetch_add(1, atomic::Ordering::Relaxed);
+            Response::builder()
+                .status(StatusCode::BAD_REQUEST)
+                .body(Body::empty())
+                .unwrap_or_else(|_| unreachable!())
+        });
+
+        let (batch, mut receiver) = BatchNotifier::new_with_receiver();
+        let (_input_lines, events) = random_lines_with_stream(100, NUM_LINES, Some(batch));
+        let pump = sink.run(events);
+
+        tokio::spawn(server);
+
+        pump.await.unwrap();
+        drop(trigger);
+
+        assert_eq!(receiver.try_recv(), Ok(BatchStatus::Rejected));
+        assert_eq!(counter.load(atomic::Ordering::Relaxed), 1);
+
+        let output_lines = get_received_gzip(rx, |_| {
+            unreachable!("There should be no successful requests")
+        })
+        .await;
+        assert!(output_lines.is_empty());
+    })
+    .await;
+}
+
 #[tokio::test]
 async fn fails_on_permanent_error() {
     components::assert_sink_error(&COMPONENT_ERROR_TAGS, async {
diff --git a/src/sinks/keep/config.rs b/src/sinks/keep/config.rs
index 7b81281253672..d3810976aa3c1 100644
--- a/src/sinks/keep/config.rs
+++ b/src/sinks/keep/config.rs
@@ -16,7 +16,7 @@ use crate::{
         prelude::*,
         util::{
             BatchConfig, BoxedRawValue,
-            http::{HttpService, http_response_retry_logic},
+            http::{HttpService, RetryStrategy, http_response_retry_logic},
         },
     },
 };
@@ -59,6 +59,10 @@ pub struct KeepConfig {
         skip_serializing_if = "crate::serde::is_default"
     )]
     acknowledgements: AcknowledgementsConfig,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub retry_strategy: RetryStrategy,
 }
 
 fn default_endpoint() -> String {
@@ -111,7 +115,10 @@ impl SinkConfig for KeepConfig {
         let request_limits = self.request.into_settings();
 
         let service = ServiceBuilder::new()
-            .settings(request_limits, http_response_retry_logic())
+            .settings(
+                request_limits,
+                http_response_retry_logic(self.retry_strategy.clone()),
+            )
             .service(service);
 
         let sink = KeepSink::new(service, batch_settings, request_builder);
diff --git a/src/sinks/opentelemetry/mod.rs b/src/sinks/opentelemetry/mod.rs
index 7d73e25c4030d..dcc13624372d5 100644
--- a/src/sinks/opentelemetry/mod.rs
+++ b/src/sinks/opentelemetry/mod.rs
@@ -56,6 +56,7 @@ impl Default for Protocol {
             request: Default::default(),
             tls: Default::default(),
             acknowledgements: Default::default(),
+            retry_strategy: Default::default(),
         })
     }
 }
diff --git a/src/sinks/prometheus/remote_write/config.rs b/src/sinks/prometheus/remote_write/config.rs
index c1b420d6b216d..c9f214953003c 100644
--- a/src/sinks/prometheus/remote_write/config.rs
+++ b/src/sinks/prometheus/remote_write/config.rs
@@ -17,7 +17,7 @@ use crate::{
         prometheus::PrometheusRemoteWriteAuth,
         util::{
             auth::Auth,
-            http::{OrderedHeaderName, http_response_retry_logic},
+            http::{OrderedHeaderName, RetryStrategy, http_response_retry_logic},
             service::TowerRequestConfig,
         },
     },
@@ -129,6 +129,10 @@ pub struct RemoteWriteConfig {
     #[serde(default = "default_compression")]
     #[derivative(Default(value = "default_compression()"))]
     pub compression: Compression,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub retry_strategy: RetryStrategy,
 }
 
 const fn default_compression() -> Compression {
@@ -251,7 +255,10 @@ impl SinkConfig for RemoteWriteConfig {
             headers: validated_headers,
         };
         let service = ServiceBuilder::new()
-            .settings(request_settings, http_response_retry_logic())
+            .settings(
+                request_settings,
+                http_response_retry_logic(self.retry_strategy.clone()),
+            )
             .service(service);
 
         let sink = RemoteWriteSink {
diff --git a/src/sinks/util/http.rs b/src/sinks/util/http.rs
index e19025e3c6ee3..89225f4077741 100644
--- a/src/sinks/util/http.rs
+++ b/src/sinks/util/http.rs
@@ -7,6 +7,7 @@ use futures::{Sink, future::BoxFuture};
 use headers::HeaderName;
 use http::{HeaderValue, Request, Response, StatusCode, header};
 use http_body::Body as _;
+use tracing::debug;
 
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct OrderedHeaderName(HeaderName);
@@ -550,14 +551,137 @@ impl<T: fmt::Debug> sink::Response for http::Response<T> {
     }
 }
 
+/// Serializes and deserializes a [`Vec<StatusCode>`]
+mod status_code_vec {
+    use http::StatusCode;
+    use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error};
+
+    /// Deserializes a [`Vec<StatusCode>`]
+    pub fn deserialize<'de, D>(deserializer: D) -> Result<Vec<StatusCode>, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        Vec::<u16>::deserialize(deserializer)?
+            .into_iter()
+            .map(StatusCode::from_u16)
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(Error::custom)
+    }
+
+    /// Serializes a [`Vec<StatusCode>`]
+    pub fn serialize<S>(status_codes: &[StatusCode], serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        status_codes
+            .iter()
+            .map(StatusCode::as_u16)
+            .collect::<Vec<_>>()
+            .serialize(serializer)
+    }
+}
+
+/// Configurable retry strategy for `http` based sinks.
+///
+/// For more information about error responses, see [Client Error Responses][error_responses].
+///
+/// [error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+#[configurable_component]
+#[derive(Debug, Clone, Default, PartialEq)]
+#[serde(tag = "type", rename_all = "snake_case")]
+#[configurable(metadata(docs::enum_tag_description = "The retry strategy enum."))]
+pub enum RetryStrategy {
+    /// Don't retry any errors, including request timeouts.
+    None,
+
+    /// Default strategy. See [`RetryStrategy::retry_action`] for more details.
+    #[default]
+    Default,
+
+    /// Retry on *all* HTTP status codes except for success codes (2xx)
+    All,
+
+    /// Custom retry strategy
+    Custom {
+        /// Retry on these specific HTTP status codes
+        #[serde(with = "status_code_vec")]
+        status_codes: Vec<StatusCode>,
+    },
+}
+
+impl RetryStrategy {
+    /// Returns the name of the retry strategy.
+    #[must_use]
+    const fn name(&self) -> &str {
+        match self {
+            Self::None => "Never retry strategy",
+            Self::Default => "Default retry strategy",
+            Self::All => "Retry all strategy",
+            Self::Custom { .. } => "Custom retry strategy",
+        }
+    }
+
+    /// Determines if the given status code should be retried.
+    ///
+    /// For the `Default` strategy, the following status codes will be retried:
+    /// - 429 (Too Many Requests)
+    /// - 408 (Request Timeout)
+    /// - 5xx (Server Error)
+    ///
+    /// For the `Custom` strategy, the status codes specified in the `status_codes` field will be retried.
+    ///
+    /// For the `All` strategy, all non-success status codes will be retried.
+    #[must_use]
+    pub fn retry_action<Req>(&self, status: http::StatusCode) -> RetryAction<Req> {
+        if status.is_success() {
+            return RetryAction::Successful;
+        }
+
+        let reason = format!(
+            "{}: {}",
+            self.name(),
+            status.canonical_reason().unwrap_or_else(|| status.as_str())
+        )
+        .into();
+
+        match self {
+            Self::None => RetryAction::DontRetry(reason),
+            Self::Default => match status {
+                StatusCode::TOO_MANY_REQUESTS | StatusCode::REQUEST_TIMEOUT => {
+                    RetryAction::Retry(reason)
+                }
+                StatusCode::NOT_IMPLEMENTED => RetryAction::DontRetry(reason),
+                _ => {
+                    if status.is_server_error() {
+                        RetryAction::Retry(reason)
+                    } else {
+                        RetryAction::DontRetry(reason)
+                    }
+                }
+            },
+            Self::All => RetryAction::Retry(reason),
+            Self::Custom { status_codes } => {
+                if status_codes.contains(&status) {
+                    RetryAction::Retry(reason)
+                } else {
+                    RetryAction::DontRetry(reason)
+                }
+            }
+        }
+    }
+}
+
 #[derive(Debug, Clone)]
 pub struct HttpRetryLogic<Req> {
     request: PhantomData<Req>,
+    retry_strategy: RetryStrategy,
 }
+
 impl<Req> Default for HttpRetryLogic<Req> {
     fn default() -> Self {
         Self {
             request: PhantomData,
+            retry_strategy: RetryStrategy::Default,
         }
     }
 }
@@ -567,25 +691,28 @@ impl<Req: Clone + Send + Sync + 'static> RetryLogic for HttpRetryLogic<Req> {
     type Request = Req;
     type Response = hyper::Response<Bytes>;
 
-    fn is_retriable_error(&self, _error: &Self::Error) -> bool {
-        true
+    fn is_retriable_error(&self, error: &Self::Error) -> bool {
+        if self.retry_strategy == RetryStrategy::None {
+            false
+        } else {
+            error.is_retriable()
+        }
+    }
+
+    fn is_retriable_timeout(&self) -> bool {
+        self.retry_strategy != RetryStrategy::None
     }
 
     fn should_retry_response(&self, response: &Self::Response) -> RetryAction<Self::Request> {
         let status = response.status();
-
-        match status {
-            StatusCode::TOO_MANY_REQUESTS => RetryAction::Retry("too many requests".into()),
-            StatusCode::REQUEST_TIMEOUT => RetryAction::Retry("request timeout".into()),
-            StatusCode::NOT_IMPLEMENTED => {
-                RetryAction::DontRetry("endpoint not implemented".into())
-            }
-            _ if status.is_server_error() => RetryAction::Retry(
-                format!("{}: {}", status, String::from_utf8_lossy(response.body())).into(),
-            ),
-            _ if status.is_success() => RetryAction::Successful,
-            _ => RetryAction::DontRetry(format!("response status: {status}").into()),
+        if !status.is_success() {
+            debug!(
+                message = "HTTP response.",
+                %status,
+                body = %String::from_utf8_lossy(response.body()),
+            );
         }
+        self.retry_strategy.retry_action(status)
     }
 }
 
@@ -596,6 +723,7 @@ pub struct HttpStatusRetryLogic<F, Req, Res> {
     func: F,
     request: PhantomData<Req>,
     response: PhantomData<Res>,
+    retry_strategy: RetryStrategy,
 }
 
 impl<F, Req, Res> HttpStatusRetryLogic<F, Req, Res>
@@ -604,11 +732,12 @@ where
     Req: Send + Sync + 'static,
     Res: Send + Sync + 'static,
 {
-    pub const fn new(func: F) -> HttpStatusRetryLogic<F, Req, Res> {
+    pub const fn new(func: F, retry_strategy: RetryStrategy) -> HttpStatusRetryLogic<F, Req, Res> {
         HttpStatusRetryLogic {
             func,
             request: PhantomData,
             response: PhantomData,
+            retry_strategy,
         }
     }
 }
@@ -623,25 +752,21 @@ where
     type Request = Req;
     type Response = Res;
 
-    fn is_retriable_error(&self, _error: &Self::Error) -> bool {
-        true
+    fn is_retriable_error(&self, error: &Self::Error) -> bool {
+        if self.retry_strategy == RetryStrategy::None {
+            false
+        } else {
+            error.is_retriable()
+        }
+    }
+
+    fn is_retriable_timeout(&self) -> bool {
+        self.retry_strategy != RetryStrategy::None
     }
 
     fn should_retry_response(&self, response: &Res) -> RetryAction<Req> {
         let status = (self.func)(response);
-
-        match status {
-            StatusCode::TOO_MANY_REQUESTS => RetryAction::Retry("too many requests".into()),
-            StatusCode::REQUEST_TIMEOUT => RetryAction::Retry("request timeout".into()),
-            StatusCode::NOT_IMPLEMENTED => {
-                RetryAction::DontRetry("endpoint not implemented".into())
-            }
-            _ if status.is_server_error() => {
-                RetryAction::Retry(format!("Http Status: {status}").into())
-            }
-            _ if status.is_success() => RetryAction::Successful,
-            _ => RetryAction::DontRetry(format!("Http status: {status}").into()),
-        }
+        self.retry_strategy.retry_action(status)
     }
 }
 
@@ -654,6 +779,7 @@ where
             func: self.func.clone(),
             request: PhantomData,
             response: PhantomData,
+            retry_strategy: self.retry_strategy.clone(),
         }
     }
 }
@@ -820,12 +946,17 @@ impl DriverResponse for HttpResponse {
 }
 
 /// Creates a `RetryLogic` for use with `HttpResponse`.
-pub fn http_response_retry_logic<Request: Clone + Send + Sync + 'static>() -> HttpStatusRetryLogic<
+pub fn http_response_retry_logic<Request: Clone + Send + Sync + 'static>(
+    retry_strategy: RetryStrategy,
+) -> HttpStatusRetryLogic<
     impl Fn(&HttpResponse) -> StatusCode + Clone + Send + Sync + 'static,
     Request,
     HttpResponse,
 > {
-    HttpStatusRetryLogic::new(|req: &HttpResponse| req.http_response.status())
+    HttpStatusRetryLogic::new(
+        |req: &HttpResponse| req.http_response.status(),
+        retry_strategy,
+    )
 }
 
 /// Uses the estimated json encoded size to determine batch sizing.
@@ -969,6 +1100,93 @@ mod test {
         );
     }
 
+    #[test]
+    fn retry_strategy_none_preserves_success_and_rejects_failures() {
+        let strategy = RetryStrategy::None;
+
+        assert!(strategy.retry_action::<()>(StatusCode::OK).is_successful());
+        assert!(
+            strategy
+                .retry_action::<()>(StatusCode::INTERNAL_SERVER_ERROR)
+                .is_not_retryable()
+        );
+    }
+
+    #[test]
+    fn retry_strategy_none_disables_timeout_retries() {
+        let logic = HttpRetryLogic::<()> {
+            request: PhantomData,
+            retry_strategy: RetryStrategy::None,
+        };
+        let status_logic =
+            HttpStatusRetryLogic::<_, (), ()>::new(|_: &()| StatusCode::OK, RetryStrategy::None);
+
+        assert!(!logic.is_retriable_timeout());
+        assert!(!status_logic.is_retriable_timeout());
+    }
+
+    #[test]
+    fn retry_strategy_all_preserves_success_and_retries_failures() {
+        let strategy = RetryStrategy::All;
+
+        assert!(strategy.retry_action::<()>(StatusCode::OK).is_successful());
+        assert!(
+            strategy
+                .retry_action::<()>(StatusCode::BAD_REQUEST)
+                .is_retryable()
+        );
+        assert!(
+            strategy
+                .retry_action::<()>(StatusCode::INTERNAL_SERVER_ERROR)
+                .is_retryable()
+        );
+    }
+
+    #[test]
+    fn retry_strategy_custom_only_retries_configured_statuses() {
+        let strategy = RetryStrategy::Custom {
+            status_codes: vec![StatusCode::BAD_REQUEST],
+        };
+
+        assert!(strategy.retry_action::<()>(StatusCode::OK).is_successful());
+        assert!(
+            strategy
+                .retry_action::<()>(StatusCode::BAD_REQUEST)
+                .is_retryable()
+        );
+        assert!(
+            strategy
+                .retry_action::<()>(StatusCode::INTERNAL_SERVER_ERROR)
+                .is_not_retryable()
+        );
+    }
+
+    #[test]
+    fn retry_strategy_custom_serde_roundtrips_status_codes() {
+        let json = r#"{"type":"custom","status_codes":[400,503]}"#;
+        let strategy: RetryStrategy = serde_json::from_str(json).unwrap();
+        assert_eq!(
+            strategy,
+            RetryStrategy::Custom {
+                status_codes: vec![StatusCode::BAD_REQUEST, StatusCode::SERVICE_UNAVAILABLE],
+            }
+        );
+        let encoded = serde_json::to_string(&strategy).unwrap();
+        let roundtrip: RetryStrategy = serde_json::from_str(&encoded).unwrap();
+        assert_eq!(roundtrip, strategy);
+    }
+
+    #[test]
+    fn retry_strategy_custom_serde_rejects_invalid_status_codes() {
+        // `http::StatusCode::from_u16` only accepts 100–999; 1000 is out of range.
+        let json = r#"{"type":"custom","status_codes":[1000]}"#;
+        let result = serde_json::from_str::<RetryStrategy>(json);
+        assert!(
+            result.is_err(),
+            "expected invalid status code to fail deserialization"
+        );
+    }
+
     #[tokio::test]
     async fn util_http_it_makes_http_requests() {
         let (_guard, addr) = next_addr();
diff --git a/src/sinks/util/retries.rs b/src/sinks/util/retries.rs
index be05d559bb18c..2a38a2b4ee900 100644
--- a/src/sinks/util/retries.rs
+++ b/src/sinks/util/retries.rs
@@ -34,6 +34,12 @@ pub trait RetryLogic: Clone + Send + Sync + 'static {
     /// implementors to specify what kinds of errors can be retried.
     fn is_retriable_error(&self, error: &Self::Error) -> bool;
 
+    /// When the Service call times out, this function allows implementors to
+    /// specify if the timeout should be retried.
+    fn is_retriable_timeout(&self) -> bool {
+        true
+    }
+
     /// When the Service call returns an `Ok` response, this function allows
     /// implementors to specify additional logic to determine if the success response
     /// is actually an error. This is particularly useful when the downstream service
@@ -197,10 +203,18 @@ where
                         None
                     }
                 } else if error.downcast_ref::<Elapsed>().is_some() {
-                    warn!(
-                        "Request timed out. If this happens often while the events are actually reaching their destination, try decreasing `batch.max_bytes` and/or using `compression` if applicable. Alternatively `request.timeout_secs` can be increased."
-                    );
-                    Some(self.build_retry())
+                    if self.logic.is_retriable_timeout() {
+                        warn!(
+                            "Request timed out. If this happens often while the events are actually reaching their destination, try decreasing `batch.max_bytes` and/or using `compression` if applicable. Alternatively `request.timeout_secs` can be increased."
+                        );
+                        Some(self.build_retry())
+                    } else {
+                        error!(
+                            message =
+                                "Request timed out and is not retriable; dropping the request."
+                        );
+                        None
+                    }
                 } else {
                     error!(
                         message = "Unexpected error type; dropping the request.",
@@ -338,6 +352,27 @@ mod tests {
         assert_eq!(fut.await.unwrap(), "world");
     }
 
+    #[tokio::test]
+    async fn timeout_error_no_retry() {
+        trace_init();
+
+        let policy = FibonacciRetryPolicy::new(
+            5,
+            Duration::from_secs(1),
+            Duration::from_secs(10),
+            NoTimeoutRetryLogic,
+            JitterMode::None,
+        );
+
+        let (mut svc, mut handle) = mock::spawn_layer(RetryLayer::new(policy));
+
+        assert_ready_ok!(svc.poll_ready());
+
+        let mut fut = task::spawn(svc.call("hello"));
+        assert_request_eq!(handle, "hello").send_error(Elapsed::new());
+        assert_ready_err!(fut.poll());
+    }
+
     #[test]
     fn backoff_grows_to_max() {
         let mut policy = FibonacciRetryPolicy::new(
@@ -425,6 +460,23 @@ mod tests {
         }
     }
 
+    #[derive(Debug, Clone)]
+    struct NoTimeoutRetryLogic;
+
+    impl RetryLogic for NoTimeoutRetryLogic {
+        type Error = Error;
+        type Request = &'static str;
+        type Response = &'static str;
+
+        fn is_retriable_error(&self, error: &Self::Error) -> bool {
+            error.0
+        }
+
+        fn is_retriable_timeout(&self) -> bool {
+            false
+        }
+    }
+
     #[derive(Debug)]
     struct Error(bool);
 
diff --git a/website/cue/reference/components/sinks/generated/appsignal.cue b/website/cue/reference/components/sinks/generated/appsignal.cue
index eb3710974335f..47943be3c1f93 100644
--- a/website/cue/reference/components/sinks/generated/appsignal.cue
+++ b/website/cue/reference/components/sinks/generated/appsignal.cue
@@ -323,6 +323,37 @@ generated: components: sinks: appsignal: configuration: {
 			}
 		}
 	}
+	retry_strategy: {
+		description: """
+			Configurable retry strategy for `http` based sinks.
+
+			For more information about error responses, see [Client Error Responses][error_responses].
+
+			[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+			"""
+		required: false
+		type: object: options: {
+			status_codes: {
+				description:   "Retry on these specific HTTP status codes"
+				relevant_when: "type = \"custom\""
+				required:      true
+				type: array: items: type: uint: default: 200
+			}
+			type: {
+				description: "The retry strategy enum."
+				required:    false
+				type: string: {
+					default: "default"
+					enum: {
+						all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+						custom:  "Custom retry strategy"
+						default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+						none:    "Don't retry any errors, including request timeouts."
+					}
+				}
+			}
+		}
+	}
 	tls: {
 		description: "Configures the TLS options for incoming/outgoing connections."
 		required:    false
diff --git a/website/cue/reference/components/sinks/generated/axiom.cue b/website/cue/reference/components/sinks/generated/axiom.cue
index d4dc62e6294fc..a1f42404ac0c1 100644
--- a/website/cue/reference/components/sinks/generated/axiom.cue
+++ b/website/cue/reference/components/sinks/generated/axiom.cue
@@ -305,6 +305,37 @@ generated: components: sinks: axiom: configuration: {
 			}
 		}
 	}
+	retry_strategy: {
+		description: """
+			Configurable retry strategy for `http` based sinks.
+
+			For more information about error responses, see [Client Error Responses][error_responses].
+
+			[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+			"""
+		required: false
+		type: object: options: {
+			status_codes: {
+				description:   "Retry on these specific HTTP status codes"
+				relevant_when: "type = \"custom\""
+				required:      true
+				type: array: items: type: uint: default: 200
+			}
+			type: {
+				description: "The retry strategy enum."
+				required:    false
+				type: string: {
+					default: "default"
+					enum: {
+						all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+						custom:  "Custom retry strategy"
+						default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+						none:    "Don't retry any errors, including request timeouts."
+					}
+				}
+			}
+		}
+	}
 	tls: {
 		description: """
 			The TLS settings for the connection.
diff --git a/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue b/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue
index 2aaf9b628e3c6..68944f5a6e7d5 100644
--- a/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue
+++ b/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue
@@ -408,6 +408,37 @@ generated: components: sinks: azure_logs_ingestion: configuration: {
 			}
 		}
 	}
+	retry_strategy: {
+		description: """
+			Configurable retry strategy for `http` based sinks.
+
+			For more information about error responses, see [Client Error Responses][error_responses].
+
+			[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+			"""
+		required: false
+		type: object: options: {
+			status_codes: {
+				description:   "Retry on these specific HTTP status codes"
+				relevant_when: "type = \"custom\""
+				required:      true
+				type: array: items: type: uint: default: 200
+			}
+			type: {
+				description: "The retry strategy enum."
+				required:    false
+				type: string: {
+					default: "default"
+					enum: {
+						all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+						custom:  "Custom retry strategy"
+						default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+						none:    "Don't retry any errors, including request timeouts."
+					}
+				}
+			}
+		}
+	}
 	stream_name: {
 		description: """
 			The [Stream name][stream_name] for the Data collection rule.
diff --git a/website/cue/reference/components/sinks/generated/azure_monitor_logs.cue b/website/cue/reference/components/sinks/generated/azure_monitor_logs.cue
index 98b14f8b4faad..c7039b70097e1 100644
--- a/website/cue/reference/components/sinks/generated/azure_monitor_logs.cue
+++ b/website/cue/reference/components/sinks/generated/azure_monitor_logs.cue
@@ -314,6 +314,37 @@ generated: components: sinks: azure_monitor_logs: configuration: {
 			}
 		}
 	}
+	retry_strategy: {
+		description: """
+			Configurable retry strategy for `http` based sinks.
+
+			For more information about error responses, see [Client Error Responses][error_responses].
+
+			[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+			"""
+		required: false
+		type: object: options: {
+			status_codes: {
+				description:   "Retry on these specific HTTP status codes"
+				relevant_when: "type = \"custom\""
+				required:      true
+				type: array: items: type: uint: default: 200
+			}
+			type: {
+				description: "The retry strategy enum."
+				required:    false
+				type: string: {
+					default: "default"
+					enum: {
+						all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+						custom:  "Custom retry strategy"
+						default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+						none:    "Don't retry any errors, including request timeouts."
+					}
+				}
+			}
+		}
+	}
 	shared_key: {
 		description: """
 			The [primary or the secondary key][shared_key] for the Log Analytics workspace.
diff --git a/website/cue/reference/components/sinks/generated/datadog_events.cue b/website/cue/reference/components/sinks/generated/datadog_events.cue
index 7316613acef4e..23b9fb43d6413 100644
--- a/website/cue/reference/components/sinks/generated/datadog_events.cue
+++ b/website/cue/reference/components/sinks/generated/datadog_events.cue
@@ -242,6 +242,37 @@ generated: components: sinks: datadog_events: configuration: {
 			}
 		}
 	}
+	retry_strategy: {
+		description: """
+			Configurable retry strategy for `http` based sinks.
+
+			For more information about error responses, see [Client Error Responses][error_responses].
+
+			[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+			"""
+		required: false
+		type: object: options: {
+			status_codes: {
+				description:   "Retry on these specific HTTP status codes"
+				relevant_when: "type = \"custom\""
+				required:      true
+				type: array: items: type: uint: default: 200
+			}
+			type: {
+				description: "The retry strategy enum."
+				required:    false
+				type: string: {
+					default: "default"
+					enum: {
+						all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+						custom:  "Custom retry strategy"
+						default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+						none:    "Don't retry any errors, including request timeouts."
+					}
+				}
+			}
+		}
+	}
 	site: {
 		description: """
 			The Datadog [site][dd_site] to send observability data to.
diff --git a/website/cue/reference/components/sinks/generated/gcp_stackdriver_logs.cue b/website/cue/reference/components/sinks/generated/gcp_stackdriver_logs.cue
index 2909192f14d3f..9d5e76262bfd2 100644
--- a/website/cue/reference/components/sinks/generated/gcp_stackdriver_logs.cue
+++ b/website/cue/reference/components/sinks/generated/gcp_stackdriver_logs.cue
@@ -420,6 +420,37 @@ generated: components: sinks: gcp_stackdriver_logs: configuration: {
 			}
 		}
 	}
+	retry_strategy: {
+		description: """
+			Configurable retry strategy for `http` based sinks.
+
+			For more information about error responses, see [Client Error Responses][error_responses].
+
+			[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+			"""
+		required: false
+		type: object: options: {
+			status_codes: {
+				description:   "Retry on these specific HTTP status codes"
+				relevant_when: "type = \"custom\""
+				required:      true
+				type: array: items: type: uint: default: 200
+			}
+			type: {
+				description: "The retry strategy enum."
+				required:    false
+				type: string: {
+					default: "default"
+					enum: {
+						all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+						custom:  "Custom retry strategy"
+						default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+						none:    "Don't retry any errors, including request timeouts."
+					}
+				}
+			}
+		}
+	}
 	severity_key: {
 		description: """
 			The field of the log event from which to take the outgoing log’s `severity` field.
diff --git a/website/cue/reference/components/sinks/generated/gcp_stackdriver_metrics.cue b/website/cue/reference/components/sinks/generated/gcp_stackdriver_metrics.cue
index 23ef271177f3a..52c344e278250 100644
--- a/website/cue/reference/components/sinks/generated/gcp_stackdriver_metrics.cue
+++ b/website/cue/reference/components/sinks/generated/gcp_stackdriver_metrics.cue
@@ -334,6 +334,37 @@ generated: components: sinks: gcp_stackdriver_metrics: configuration: {
 			}
 		}
 	}
+	retry_strategy: {
+		description: """
+			Configurable retry strategy for `http` based sinks.
+
+			For more information about error responses, see [Client Error Responses][error_responses].
+
+			[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+			"""
+		required: false
+		type: object: options: {
+			status_codes: {
+				description:   "Retry on these specific HTTP status codes"
+				relevant_when: "type = \"custom\""
+				required:      true
+				type: array: items: type: uint: default: 200
+			}
+			type: {
+				description: "The retry strategy enum."
+				required:    false
+				type: string: {
+					default: "default"
+					enum: {
+						all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+						custom:  "Custom retry strategy"
+						default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+						none:    "Don't retry any errors, including request timeouts."
+					}
+				}
+			}
+		}
+	}
 	tls: {
 		description: "TLS configuration."
 		required:    false
diff --git a/website/cue/reference/components/sinks/generated/honeycomb.cue b/website/cue/reference/components/sinks/generated/honeycomb.cue
index 66ba9ed795a27..c65064a135a00 100644
--- a/website/cue/reference/components/sinks/generated/honeycomb.cue
+++ b/website/cue/reference/components/sinks/generated/honeycomb.cue
@@ -321,4 +321,35 @@ generated: components: sinks: honeycomb: configuration: {
 			}
 		}
 	}
+	retry_strategy: {
+		description: """
+			Configurable retry strategy for `http` based sinks.
+
+			For more information about error responses, see [Client Error Responses][error_responses].
+
+			[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+			"""
+		required: false
+		type: object: options: {
+			status_codes: {
+				description:   "Retry on these specific HTTP status codes"
+				relevant_when: "type = \"custom\""
+				required:      true
+				type: array: items: type: uint: default: 200
+			}
+			type: {
+				description: "The retry strategy enum."
+				required:    false
+				type: string: {
+					default: "default"
+					enum: {
+						all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+						custom:  "Custom retry strategy"
+						default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+						none:    "Don't retry any errors, including request timeouts."
+					}
+				}
+			}
+		}
+	}
 }
diff --git a/website/cue/reference/components/sinks/generated/http.cue b/website/cue/reference/components/sinks/generated/http.cue
index 0fcc53fab8092..8523a27dd0d9b 100644
--- a/website/cue/reference/components/sinks/generated/http.cue
+++ b/website/cue/reference/components/sinks/generated/http.cue
@@ -1024,6 +1024,37 @@ generated: components: sinks: http: configuration: {
 			}
 		}
 	}
+	retry_strategy: {
+		description: """
+			Configurable retry strategy for `http` based sinks.
+
+			For more information about error responses, see [Client Error Responses][error_responses].
+
+			[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+			"""
+		required: false
+		type: object: options: {
+			status_codes: {
+				description:   "Retry on these specific HTTP status codes"
+				relevant_when: "type = \"custom\""
+				required:      true
+				type: array: items: type: uint: default: 200
+			}
+			type: {
+				description: "The retry strategy enum."
+				required:    false
+				type: string: {
+					default: "default"
+					enum: {
+						all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+						custom:  "Custom retry strategy"
+						default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+						none:    "Don't retry any errors, including request timeouts."
+					}
+				}
+			}
+		}
+	}
 	tls: {
 		description: "TLS configuration."
 		required:    false
diff --git a/website/cue/reference/components/sinks/generated/keep.cue b/website/cue/reference/components/sinks/generated/keep.cue
index 29b1d7536611b..d2ed08114a2a9 100644
--- a/website/cue/reference/components/sinks/generated/keep.cue
+++ b/website/cue/reference/components/sinks/generated/keep.cue
@@ -286,4 +286,35 @@ generated: components: sinks: keep: configuration: {
 			}
 		}
 	}
+	retry_strategy: {
+		description: """
+			Configurable retry strategy for `http` based sinks.
+
+			For more information about error responses, see [Client Error Responses][error_responses].
+
+			[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+			"""
+		required: false
+		type: object: options: {
+			status_codes: {
+				description:   "Retry on these specific HTTP status codes"
+				relevant_when: "type = \"custom\""
+				required:      true
+				type: array: items: type: uint: default: 200
+			}
+			type: {
+				description: "The retry strategy enum."
+				required:    false
+				type: string: {
+					default: "default"
+					enum: {
+						all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+						custom:  "Custom retry strategy"
+						default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+						none:    "Don't retry any errors, including request timeouts."
+					}
+				}
+			}
+		}
+	}
 }
diff --git a/website/cue/reference/components/sinks/generated/opentelemetry.cue b/website/cue/reference/components/sinks/generated/opentelemetry.cue
index 4505d8a9bf512..4e8e9d9ff7210 100644
--- a/website/cue/reference/components/sinks/generated/opentelemetry.cue
+++ b/website/cue/reference/components/sinks/generated/opentelemetry.cue
@@ -1025,6 +1025,37 @@ generated: components: sinks: opentelemetry: configuration: protocol: {
 				}
 			}
 		}
+		retry_strategy: {
+			description: """
+				Configurable retry strategy for `http` based sinks.
+
+				For more information about error responses, see [Client Error Responses][error_responses].
+
+				[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+				"""
+			required: false
+			type: object: options: {
+				status_codes: {
+					description:   "Retry on these specific HTTP status codes"
+					relevant_when: "type = \"custom\""
+					required:      true
+					type: array: items: type: uint: default: 200
+				}
+				type: {
+					description: "The retry strategy enum."
+					required:    false
+					type: string: {
+						default: "default"
+						enum: {
+							all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+							custom:  "Custom retry strategy"
+							default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+							none:    "Don't retry any errors, including request timeouts."
+						}
+					}
+				}
+			}
+		}
 		tls: {
 			description: "TLS configuration."
 			required:    false
diff --git a/website/cue/reference/components/sinks/generated/prometheus_remote_write.cue b/website/cue/reference/components/sinks/generated/prometheus_remote_write.cue
index c13fa424999ec..5d74d52359bdd 100644
--- a/website/cue/reference/components/sinks/generated/prometheus_remote_write.cue
+++ b/website/cue/reference/components/sinks/generated/prometheus_remote_write.cue
@@ -539,6 +539,37 @@ generated: components: sinks: prometheus_remote_write: configuration: {
 			}
 		}
 	}
+	retry_strategy: {
+		description: """
+			Configurable retry strategy for `http` based sinks.
+
+			For more information about error responses, see [Client Error Responses][error_responses].
+
+			[error_responses]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status#client_error_responses
+			"""
+		required: false
+		type: object: options: {
+			status_codes: {
+				description:   "Retry on these specific HTTP status codes"
+				relevant_when: "type = \"custom\""
+				required:      true
+				type: array: items: type: uint: default: 200
+			}
+			type: {
+				description: "The retry strategy enum."
+				required:    false
+				type: string: {
+					default: "default"
+					enum: {
+						all:     "Retry on *all* HTTP status codes except for success codes (2xx)"
+						custom:  "Custom retry strategy"
+						default: "Default strategy. See [`RetryStrategy::retry_action`] for more details."
+						none:    "Don't retry any errors, including request timeouts."
+					}
+				}
+			}
+		}
+	}
 	tenant_id: {
 		description: """
 			The tenant ID to send.

From 9c617a7b766dc95ea919384ff16da2654595f6a4 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Fri, 1 May 2026 10:04:29 -0400
Subject: [PATCH 183/326] fix(ci): grant issues:write to remove_wip_label
 workflow (#25339)

The github.rest.issues.removeLabel call (DELETE /repos/{owner}/{repo}/issues/{issue_number}/labels/{name})
requires the issues:write permission per the GitHub REST API. The workflow
only declared pull-requests:write, so the call returned 403 the first time
all preconditions actually held simultaneously (MEMBER reviewer + label
present + approval).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/remove_wip_label.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/remove_wip_label.yml b/.github/workflows/remove_wip_label.yml
index 7c30ee892a949..b4750b0f2b0d6 100644
--- a/.github/workflows/remove_wip_label.yml
+++ b/.github/workflows/remove_wip_label.yml
@@ -1,6 +1,7 @@
 name: Remove Work In Progress Label
 
 permissions:
+  issues: write
   pull-requests: write
 
 on:

From 308d2469b2e70153d3eafd20a647bf33a9d69d73 Mon Sep 17 00:00:00 2001
From: tot19 <31141271+tot19@users.noreply.github.com>
Date: Fri, 1 May 2026 23:43:39 +0900
Subject: [PATCH 184/326] fix(sources): prevent windows_event_log permanent
 freeze from signal-event lost wakeup (#25195)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(windows_event_log): fix pre-drain ResetEvent race and add lost-wakeup regression tests

The Windows Event Log service signals the pull-mode wait handle via SetEvent
each time a new matching event is recorded. Because the handle is manual-reset,
any SetEvent that fires between the last EvtNext call and the post-drain
ResetEvent is silently lost — the subscription then hangs until the next OS
event arrives (vectordotdev/vector#25194).

Fix: reset the handle *before* entering the drain loop. Signals raised during
the drain are preserved because SetEvent on an already-signaled handle is a
no-op. Re-arm (SetEvent) on early exits so the next pull_events revisits the
channel without waiting for a fresh OS notification:
  - budget exhaustion
  - bookmark failure mid-batch
  - transient EvtNext error

Regression tests:
- test_pull_events_preserves_setevent_during_drain: installs DRAIN_STEP_HOOK to
  fire SetEvent mid-drain and asserts wait_for_events_blocking returns
  EventsAvailable, not Timeout.
- test_speculative_pull_recovers_without_signal: manually clears the channel
  signal via ResetEvent, confirms wait times out, then asserts pull_events still
  returns events — proving the speculative timeout pull in mod.rs self-heals
  independently of signal state.

Also: comment re-subscription break paths (ERROR_EVT_QUERY_RESULT_STALE and
INVALID_POSITION) noting the speculative pull as a safety net if the re-subbed
channel does not immediately re-signal; add serialization note to DRAIN_STEP_HOOK.

* fix(windows_event_log): add speculative timeout pull, deduplicate processing, fix error handling

Four related improvements to mod.rs:

1. Speculative pull on WaitResult::Timeout: call pull_events on every timeout
   cycle as a belt-and-suspenders self-heal. EvtNext returns ERROR_NO_MORE_ITEMS
   immediately on an empty channel (near-zero cost). If events are recovered a
   warning is emitted. Guarantees recovery within one timeout period regardless
   of the root cause of the lost wakeup.

2. Extract with_subscription_blocking helper: wraps the spawn_blocking
   ownership-transfer pattern (move subscription in, run blocking fn, return
   subscription + result). All three blocking calls (wait, normal pull,
   speculative pull) now use this helper instead of inlining spawn_blocking.

3. Extract process_event_batch helper: the parse/emit/send_batch/finalize
   sequence was duplicated verbatim between the EventsAvailable arm and the
   speculative-timeout arm. Extracted into a shared free async function.
   Rate limiting is applied consistently in both paths via the helper.

4. Fix error-handling asymmetry: the speculative pull Err branch previously
   only logged warn! and continued, so a non-recoverable error (access denied,
   channel not found) would spam warnings indefinitely. Now mirrors the
   EventsAvailable path: emit WindowsEventLogQueryError, break on
   non-recoverable errors, apply exponential backoff on recoverable ones.

* test(windows_event_log source): harden lost-wakeup regression tests against flakiness

Address two independent flakiness sources in the #25194 regression tests
so the suite is stable on real Windows CI runners.

test_pull_events_preserves_setevent_during_drain:
- Replaced a 1000ms blocking wait with an immediate 0ms poll after
  pull_events returns, so the check measures only the reset/preserve
  behavior of pull_events and is not contaminated by unrelated Windows
  system events signaling the handle during a nonzero wait window.
- Keyed the DRAIN_STEP_HOOK fire-once to the subscription's own signal
  handle so concurrent pull_events calls from other tests can't flip
  the hook first and SetEvent the wrong handle.

test_speculative_pull_recovers_without_signal:
- Same 500ms→0ms poll change, opposite direction: real events arriving
  during the wait would have re-signaled the manually-cleared handle
  and flipped the expected Timeout into a real signal result.
- Seed a deterministic record via 'eventcreate' before subscription
  creation so the non-empty-events assertion is independent of whatever
  backlog the runner happens to have. Freshly provisioned images can
  have an empty Application log, which would otherwise cause
  pull_events(100) to legitimately return empty and false-fail the test.

* fix(windows_event_log): implement Sync for subscription types to satisfy Send bound on source future

EventLogSubscription and ChannelSubscription had unsafe impl Send but no
Sync impl. Since &T: Send requires T: Sync, process_event_batch holding
&EventLogSubscription across an .await made the entire source future !Send,
causing a compile error (ICE + future-not-Send) in release builds.

All mutation on these types requires &mut self; &self methods are read-only
or delegate to already-Sync types (RateLimiter). The underlying Windows
kernel handles are safe for concurrent access.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(changelog): simplify windows_event_log fix fragment to user-focused one-liner

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(windows_event_log): prioritize shutdown signal

* fix(windows_event_log): lighten speculative timeout pulls

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 ...25194_windows_event_log_lost_wakeup.fix.md |   3 +
 src/sources/windows_event_log/mod.rs          | 281 ++++++++-----
 src/sources/windows_event_log/subscription.rs | 374 ++++++++++++++++--
 3 files changed, 546 insertions(+), 112 deletions(-)
 create mode 100644 changelog.d/25194_windows_event_log_lost_wakeup.fix.md

diff --git a/changelog.d/25194_windows_event_log_lost_wakeup.fix.md b/changelog.d/25194_windows_event_log_lost_wakeup.fix.md
new file mode 100644
index 0000000000000..cb6f67987d67c
--- /dev/null
+++ b/changelog.d/25194_windows_event_log_lost_wakeup.fix.md
@@ -0,0 +1,3 @@
+The `windows_event_log` source no longer freezes after periods of inactivity.
+
+authors: tot19
diff --git a/src/sources/windows_event_log/mod.rs b/src/sources/windows_event_log/mod.rs
index 17d900cc07622..28dfc1db4cb79 100644
--- a/src/sources/windows_event_log/mod.rs
+++ b/src/sources/windows_event_log/mod.rs
@@ -29,7 +29,7 @@ cfg_if::cfg_if! {
         use vector_lib::EstimatedJsonEncodedSizeOf;
         use vector_lib::finalizer::OrderedFinalizer;
         use vector_lib::internal_event::{
-            ByteSize, BytesReceived, CountByteSize, InternalEventHandle as _, Protocol,
+            ByteSize, BytesReceived, CountByteSize, InternalEventHandle, Protocol,
         };
         use windows::Win32::Foundation::{DUPLICATE_SAME_ACCESS, DuplicateHandle, HANDLE};
         use windows::Win32::System::Threading::GetCurrentProcess;
@@ -48,6 +48,7 @@ cfg_if::cfg_if! {
             error::WindowsEventLogError,
             parser::EventLogParser,
             subscription::{EventLogSubscription, WaitResult},
+            xml_parser::WindowsEvent,
         };
     }
 }
@@ -157,6 +158,107 @@ impl Finalizer {
     }
 }
 
+/// Parse, emit metrics for, send, and finalize a non-empty batch of pulled Windows events.
+///
+/// Both the `EventsAvailable` path and the speculative-timeout path share this
+/// logic. Returns `true` if the downstream pipeline closed and the caller
+/// should break out of the main event loop.
+async fn process_event_batch(
+    events: Vec<WindowsEvent>,
+    parser: &EventLogParser,
+    acknowledgements: bool,
+    subscription: &EventLogSubscription,
+    out: &mut SourceSender,
+    finalizer: &Finalizer,
+    events_received: &impl InternalEventHandle<Data = CountByteSize>,
+    bytes_received: &impl InternalEventHandle<Data = ByteSize>,
+) -> bool {
+    // Rate limiting between batches (async-compatible).
+    if let Some(limiter) = subscription.rate_limiter() {
+        limiter.until_ready().await;
+    }
+
+    let (batch, receiver) = BatchNotifier::maybe_new_with_receiver(acknowledgements);
+    let mut log_events = Vec::new();
+    let mut total_byte_size = 0usize;
+    let mut channels_in_batch = std::collections::HashSet::new();
+
+    for event in events {
+        let channel = event.channel.clone();
+        channels_in_batch.insert(channel.clone());
+        let event_id = event.event_id;
+        match parser.parse_event(event) {
+            Ok(mut log_event) => {
+                let byte_size = log_event.estimated_json_encoded_size_of();
+                total_byte_size += byte_size.get();
+                if let Some(ref batch) = batch {
+                    log_event = log_event.with_batch_notifier(batch);
+                }
+                log_events.push(log_event);
+            }
+            Err(e) => {
+                emit!(WindowsEventLogParseError {
+                    error: e.to_string(),
+                    channel,
+                    event_id: Some(event_id),
+                });
+            }
+        }
+    }
+
+    if !log_events.is_empty() {
+        let count = log_events.len();
+        events_received.emit(CountByteSize(count, total_byte_size.into()));
+        bytes_received.emit(ByteSize(total_byte_size));
+
+        // BACK PRESSURE: block until the pipeline accepts the batch.
+        // We don't call EvtNext again until this completes.
+        if let Err(_error) = out.send_batch(log_events).await {
+            emit!(StreamClosedError { count });
+            return true; // signal: break the main loop
+        }
+
+        // Register checkpoint entry with the finalizer.
+        let bookmarks: Vec<(String, String)> = channels_in_batch
+            .into_iter()
+            .filter_map(|channel| {
+                subscription
+                    .get_bookmark_xml(&channel)
+                    .map(|xml| (channel, xml))
+            })
+            .collect();
+
+        if !bookmarks.is_empty() {
+            let entry = FinalizerEntry { bookmarks };
+            finalizer.finalize(entry, receiver).await;
+        }
+    }
+
+    false // pipeline still open
+}
+
+/// Transfer ownership of `subscription` into a `spawn_blocking` task, run `f`
+/// on it, then return both the subscription and the result.
+///
+/// All blocking Windows APIs (`WaitForMultipleObjects`, `EvtNext`, `EvtRender`)
+/// must run in `spawn_blocking` to avoid stalling the async runtime. The
+/// ownership-transfer pattern ensures only one thread holds the subscription
+/// at a time, preventing data races without requiring locks.
+async fn with_subscription_blocking<F, R>(
+    subscription: EventLogSubscription,
+    f: F,
+) -> Result<(EventLogSubscription, R), WindowsEventLogError>
+where
+    F: FnOnce(EventLogSubscription) -> (EventLogSubscription, R) + Send + 'static,
+    R: Send + 'static,
+{
+    tokio::task::spawn_blocking(move || f(subscription))
+        .await
+        .map_err(|e| WindowsEventLogError::ConfigError {
+            message: format!("Blocking subscription task panicked: {e}"),
+        })
+}
+
 /// Windows Event Log source implementation
 pub struct WindowsEventLogSource {
     config: WindowsEventLogConfig,
@@ -281,42 +383,25 @@ impl WindowsEventLogSource {
             // Ownership transfer ensures no data races between the blocking thread
             // and async code. The shutdown watcher uses a raw HANDLE value (just an
             // integer) to signal shutdown without needing access to the subscription.
-            let (returned_sub, wait_result) = tokio::task::spawn_blocking({
-                let sub = subscription;
-                move || {
+            let (returned_sub, wait_result) =
+                with_subscription_blocking(subscription, move |sub| {
                     let result = sub.wait_for_events_blocking(timeout_ms);
                     (sub, result)
-                }
-            })
-            .await
-            .map_err(|e| WindowsEventLogError::ConfigError {
-                message: format!("Wait task panicked: {e}"),
-            })?;
-
+                })
+                .await?;
             subscription = returned_sub;
 
             match wait_result {
                 WaitResult::EventsAvailable => {
                     // Pull events via spawn_blocking (EvtNext/EvtRender are blocking APIs)
-                    let (returned_sub, events_result) = tokio::task::spawn_blocking({
-                        let mut sub = subscription;
-                        move || {
+                    let (returned_sub, events_result) =
+                        with_subscription_blocking(subscription, move |mut sub| {
                             let result = sub.pull_events(batch_size);
                             (sub, result)
-                        }
-                    })
-                    .await
-                    .map_err(|e| WindowsEventLogError::ConfigError {
-                        message: format!("Pull task panicked: {e}"),
-                    })?;
-
+                        })
+                        .await?;
                     subscription = returned_sub;
 
-                    // Rate limiting between batches (async-compatible)
-                    if let Some(limiter) = subscription.rate_limiter() {
-                        limiter.until_ready().await;
-                    }
-
                     match events_result {
                         Ok(events) if events.is_empty() => {
                             error_backoff = std::time::Duration::from_millis(100);
@@ -328,65 +413,19 @@ impl WindowsEventLogSource {
                                 message = "Pulled Windows Event Log events.",
                                 event_count = events.len()
                             );
-
-                            let (batch, receiver) =
-                                BatchNotifier::maybe_new_with_receiver(acknowledgements);
-
-                            let mut log_events = Vec::new();
-                            let mut total_byte_size = 0;
-                            let mut channels_in_batch = std::collections::HashSet::new();
-
-                            for event in events {
-                                let channel = event.channel.clone();
-                                channels_in_batch.insert(channel.clone());
-                                let event_id = event.event_id;
-                                match parser.parse_event(event) {
-                                    Ok(mut log_event) => {
-                                        let byte_size = log_event.estimated_json_encoded_size_of();
-                                        total_byte_size += byte_size.get();
-
-                                        if let Some(ref batch) = batch {
-                                            log_event = log_event.with_batch_notifier(batch);
-                                        }
-
-                                        log_events.push(log_event);
-                                    }
-                                    Err(e) => {
-                                        emit!(WindowsEventLogParseError {
-                                            error: e.to_string(),
-                                            channel,
-                                            event_id: Some(event_id),
-                                        });
-                                    }
-                                }
-                            }
-
-                            if !log_events.is_empty() {
-                                let count = log_events.len();
-                                events_received.emit(CountByteSize(count, total_byte_size.into()));
-                                bytes_received.emit(ByteSize(total_byte_size));
-
-                                // BACK PRESSURE: block here until the pipeline accepts
-                                // the batch. We don't call EvtNext again until this completes.
-                                if let Err(_error) = out.send_batch(log_events).await {
-                                    emit!(StreamClosedError { count });
-                                    break;
-                                }
-
-                                // Register checkpoint entry with finalizer
-                                let bookmarks: Vec<(String, String)> = channels_in_batch
-                                    .into_iter()
-                                    .filter_map(|channel| {
-                                        subscription
-                                            .get_bookmark_xml(&channel)
-                                            .map(|xml| (channel, xml))
-                                    })
-                                    .collect();
-
-                                if !bookmarks.is_empty() {
-                                    let entry = FinalizerEntry { bookmarks };
-                                    finalizer.finalize(entry, receiver).await;
-                                }
+                            if process_event_batch(
+                                events,
+                                &parser,
+                                acknowledgements,
+                                &subscription,
+                                &mut out,
+                                &finalizer,
+                                &events_received,
+                                &bytes_received,
+                            )
+                            .await
+                            {
+                                break;
                             }
                         }
                         Err(e) => {
@@ -415,10 +454,6 @@ impl WindowsEventLogSource {
                 }
 
                 WaitResult::Timeout => {
-                    // A full wait cycle without errors means the system is healthy;
-                    // reset backoff so the next transient error starts fresh.
-                    error_backoff = std::time::Duration::from_millis(100);
-
                     // Periodic checkpoint flush (sync mode only)
                     if !acknowledgements && last_checkpoint.elapsed() >= checkpoint_interval {
                         if let Err(e) = subscription.flush_bookmarks().await {
@@ -448,6 +483,74 @@ impl WindowsEventLogSource {
                             );
                         }
                     }
+
+                    // Speculative pull: self-heal against any lost-wakeup scenario,
+                    // regardless of root cause. If the OS signal was lost through any
+                    // mechanism (not just the pre-drain race fixed in #25194), this
+                    // ensures the source recovers within one timeout period.
+                    // Use the speculative pull variant so idle timeout cycles don't
+                    // refresh per-channel record-count gauges via EvtOpenLog /
+                    // EvtGetLogInfo on every configured channel.
+                    let (returned_sub, speculative_result) =
+                        with_subscription_blocking(subscription, move |mut sub| {
+                            let result = sub.pull_events_speculative(batch_size);
+                            (sub, result)
+                        })
+                        .await?;
+                    subscription = returned_sub;
+
+                    match speculative_result {
+                        Ok(events) if events.is_empty() => {
+                            // Healthy cycle: reset backoff so the next transient
+                            // error starts fresh.
+                            error_backoff = std::time::Duration::from_millis(100);
+                        }
+                        Ok(events) => {
+                            // Healthy cycle: reset backoff so the next transient
+                            // error starts fresh.
+                            error_backoff = std::time::Duration::from_millis(100);
+                            warn!(
+                                message = "Speculative timeout pull recovered events; possible lost wakeup detected.",
+                                event_count = events.len(),
+                            );
+                            if process_event_batch(
+                                events,
+                                &parser,
+                                acknowledgements,
+                                &subscription,
+                                &mut out,
+                                &finalizer,
+                                &events_received,
+                                &bytes_received,
+                            )
+                            .await
+                            {
+                                break;
+                            }
+                        }
+                        Err(e) => {
+                            emit!(WindowsEventLogQueryError {
+                                channel: "all".to_string(),
+                                query: None,
+                                error: e.to_string(),
+                            });
+                            if !e.is_recoverable() {
+                                error!(
+                                    message = "Non-recoverable speculative pull error, shutting down.",
+                                    error = %e
+                                );
+                                break;
+                            }
+                            // Exponential backoff mirrors the EventsAvailable error path.
+                            warn!(
+                                message = "Recoverable speculative pull error, backing off.",
+                                backoff_ms = error_backoff.as_millis() as u64,
+                                error = %e
+                            );
+                            tokio::time::sleep(error_backoff).await;
+                            error_backoff = (error_backoff * 2).min(MAX_ERROR_BACKOFF);
+                        }
+                    }
                 }
 
                 WaitResult::Shutdown => {
diff --git a/src/sources/windows_event_log/subscription.rs b/src/sources/windows_event_log/subscription.rs
index dc92713f691d9..4571561a2d349 100644
--- a/src/sources/windows_event_log/subscription.rs
+++ b/src/sources/windows_event_log/subscription.rs
@@ -18,9 +18,9 @@ use windows::Win32::System::EventLog::{
     EvtSubscribeStartAfterBookmark, EvtSubscribeStartAtOldestRecord, EvtSubscribeStrict,
     EvtSubscribeToFutureEvents,
 };
-#[cfg(test)]
-use windows::Win32::System::Threading::SetEvent;
-use windows::Win32::System::Threading::{CreateEventW, ResetEvent, WaitForMultipleObjects};
+use windows::Win32::System::Threading::{
+    CreateEventW, ResetEvent, SetEvent, WaitForMultipleObjects,
+};
 use windows::core::HSTRING;
 
 use super::{
@@ -30,6 +30,19 @@ use super::{
 
 use crate::internal_events::WindowsEventLogBookmarkError;
 
+/// Test-only hook called inside the `pull_events` drain loop after each
+/// `EvtNext` invocation. Used by the lost-wakeup regression test
+/// (see `test_pull_events_preserves_setevent_during_drain`) to race a
+/// `SetEvent` against the drain without relying on thread-timing.
+/// No-op and zero-cost in non-test builds.
+///
+/// Only one test should install a hook at a time; tests that install a hook
+/// must use `#[serial_test::serial]` or equivalent serialization to prevent
+/// concurrent tests from triggering each other's hook.
+#[cfg(test)]
+static DRAIN_STEP_HOOK: std::sync::Mutex<Option<std::sync::Arc<dyn Fn(HANDLE) + Send + Sync>>> =
+    std::sync::Mutex::new(None);
+
 /// Maximum number of entries in the EvtFormatMessage result cache.
 pub const FORMAT_CACHE_CAPACITY: usize = 10_000;
 /// Maximum number of cached publisher metadata handles.
@@ -80,6 +93,7 @@ struct ChannelSubscription {
 
 // SAFETY: Same rationale as EventLogSubscription - Windows kernel handles are thread-safe.
 unsafe impl Send for ChannelSubscription {}
+unsafe impl Sync for ChannelSubscription {}
 
 /// Result of waiting for events across all channels.
 pub enum WaitResult {
@@ -130,8 +144,10 @@ pub struct EventLogSubscription {
 
 // SAFETY: Windows HANDLE and EVT_HANDLE are kernel objects safe to use across
 // threads. In windows 0.58, HANDLE wraps *mut c_void which is !Send/!Sync,
-// but the underlying kernel handles are thread-safe.
+// but the underlying kernel handles are thread-safe. All mutation requires
+// &mut self; &self methods are read-only or delegate to Sync types (RateLimiter).
 unsafe impl Send for EventLogSubscription {}
+unsafe impl Sync for EventLogSubscription {}
 
 impl EventLogSubscription {
     /// Create a new pull-model subscription for all configured channels.
@@ -415,21 +431,20 @@ impl EventLogSubscription {
     /// Wait for events to become available on any channel, or for shutdown.
     ///
     /// Uses `WaitForMultipleObjects` via `spawn_blocking` to avoid blocking the
-    /// Tokio runtime. The wait array includes all channel signal events plus the
-    /// shutdown event.
+    /// Tokio runtime. The wait array puts shutdown first so a stop request wins
+    /// over any channel that is already signaled.
     pub fn wait_for_events_blocking(&self, timeout_ms: u32) -> WaitResult {
-        // Build wait handle array: [channel0_signal, channel1_signal, ..., shutdown_event]
-        let mut handles: Vec<HANDLE> = self.channels.iter().map(|c| c.signal_event).collect();
+        // Build wait handle array: [shutdown_event, channel0_signal, channel1_signal, ...]
+        let mut handles = Vec::with_capacity(self.channels.len() + 1);
         handles.push(self.shutdown_event);
+        handles.extend(self.channels.iter().map(|c| c.signal_event));
 
         let result = unsafe { WaitForMultipleObjects(&handles, false, timeout_ms) };
 
-        let shutdown_index = (self.channels.len()) as u32;
-
         match result {
             r if r == WAIT_TIMEOUT => WaitResult::Timeout,
-            r if r.0 < WAIT_OBJECT_0.0 + shutdown_index => WaitResult::EventsAvailable,
-            r if r.0 == WAIT_OBJECT_0.0 + shutdown_index => WaitResult::Shutdown,
+            r if r == WAIT_OBJECT_0 => WaitResult::Shutdown,
+            r if r.0 <= WAIT_OBJECT_0.0 + self.channels.len() as u32 => WaitResult::EventsAvailable,
             _ => {
                 // WAIT_FAILED or unexpected - treat as timeout to avoid tight loop
                 warn!(
@@ -459,6 +474,28 @@ impl EventLogSubscription {
     pub fn pull_events(
         &mut self,
         max_events: usize,
+    ) -> Result<Vec<xml_parser::WindowsEvent>, WindowsEventLogError> {
+        self.pull_events_inner(max_events, true)
+    }
+
+    /// Pull events for timeout-based speculative recovery.
+    ///
+    /// This keeps the same event-drain behavior as `pull_events`, but avoids
+    /// refreshing per-channel record-count gauges for channels that were empty.
+    /// Timeout pulls can run repeatedly while the host is idle, so skipping
+    /// those metadata queries prevents steady `EvtOpenLog`/`EvtGetLogInfo`
+    /// churn without changing event recovery behavior.
+    pub fn pull_events_speculative(
+        &mut self,
+        max_events: usize,
+    ) -> Result<Vec<xml_parser::WindowsEvent>, WindowsEventLogError> {
+        self.pull_events_inner(max_events, false)
+    }
+
+    fn pull_events_inner(
+        &mut self,
+        max_events: usize,
+        update_records_for_empty_channels: bool,
     ) -> Result<Vec<xml_parser::WindowsEvent>, WindowsEventLogError> {
         let mut all_events = Vec::with_capacity(max_events.min(1000));
         let num_channels = self.channels.len().max(1);
@@ -479,9 +516,25 @@ impl EventLogSubscription {
             let mut bookmark_failed = false;
             let mut channel_count = 0usize;
 
-            // Drain loop: keep calling EvtNext until ERROR_NO_MORE_ITEMS or channel budget.
-            // Only reset the signal once the channel is fully drained; if we hit the
-            // budget limit the signal stays set so WaitForMultipleObjects returns immediately.
+            // Reset the signal BEFORE draining to avoid a lost-wakeup race
+            // (see vectordotdev/vector#25194). The Windows Event Log service
+            // signals this manual-reset event via SetEvent each time a new
+            // matching event is recorded; SetEvent on an already-signaled
+            // event is a no-op, so if we reset AFTER draining, any signal
+            // that arrives between our last EvtNext and ResetEvent is lost
+            // — the subscription then hangs until the next event arrives.
+            // Resetting first means any signal raised during the drain is
+            // preserved, causing the next WaitForMultipleObjects to return
+            // immediately.
+            //
+            // If we exit the drain loop early (channel budget exhausted or
+            // bookmark update failed mid-batch), we re-SetEvent at the end
+            // of this iteration so the next pull_events call revisits this
+            // channel without waiting for a fresh OS signal.
+            unsafe {
+                let _ = ResetEvent(channel_sub.signal_event);
+            }
+
             'drain: loop {
                 if channel_count >= channel_limit {
                     break;
@@ -501,6 +554,17 @@ impl EventLogSubscription {
                     )
                 };
 
+                // Test-only hook: lets the lost-wakeup regression test race
+                // a SetEvent against the drain without thread-timing. No-op
+                // and zero-cost in non-test builds.
+                #[cfg(test)]
+                {
+                    let hook = DRAIN_STEP_HOOK.lock().unwrap().clone();
+                    if let Some(h) = hook {
+                        h(channel_sub.signal_event);
+                    }
+                }
+
                 if let Err(err) = result {
                     let code = (err.code().0 as u32) & 0xFFFF;
                     if code == ERROR_NO_MORE_ITEMS {
@@ -513,6 +577,8 @@ impl EventLogSubscription {
                             channel = %channel_sub.channel
                         );
                         channel_drained = true;
+                        // Speculative pull on timeout in mod.rs is a safety net if the
+                        // re-subscribed channel does not immediately re-signal.
                         break;
                     }
                     if code == ERROR_EVT_QUERY_RESULT_INVALID_POSITION {
@@ -526,7 +592,9 @@ impl EventLogSubscription {
                                     message = "Re-subscription succeeded after stale query.",
                                     channel = %channel_sub.channel
                                 );
-                                // Retry from fresh subscription — the signal will fire again
+                                // Retry from fresh subscription — the signal will fire again.
+                                // Speculative pull on timeout in mod.rs is a safety net if
+                                // the new subscription does not immediately re-signal.
                                 channel_drained = true;
                                 break;
                             }
@@ -538,10 +606,23 @@ impl EventLogSubscription {
                                 );
                                 channel_sub.subscription_active_gauge.set(0.0);
                                 channel_drained = true;
+                                // Speculative pull on timeout in mod.rs is a safety net if
+                                // the failed channel does not re-signal after recovery.
                                 break;
                             }
                         }
                     }
+                    // Re-arm the signal before returning. We reset it pre-drain
+                    // but are bailing out without confirming the drain completed,
+                    // so if events were left un-drained the next pull_events must
+                    // still revisit this channel without waiting for a fresh OS
+                    // signal. This mirrors the `else` branch below that handles
+                    // budget-exhaustion and bookmark-failure early breaks, and
+                    // avoids the same lost-wakeup symptom (vectordotdev/vector#25194)
+                    // on transient EvtNext failures.
+                    unsafe {
+                        let _ = SetEvent(channel_sub.signal_event);
+                    }
                     return Err(WindowsEventLogError::PullEventsError {
                         channel: channel_sub.channel.clone(),
                         source: err,
@@ -697,15 +778,22 @@ impl EventLogSubscription {
             }
 
             if channel_drained && !bookmark_failed {
+                // Update channel record count gauge for lag detection.
+                if update_records_for_empty_channels || channel_count > 0 {
+                    super::render::update_channel_records(
+                        &channel_sub.channel,
+                        &channel_sub.channel_records_gauge,
+                    );
+                }
+            } else {
+                // Drain exited early (budget exhausted or bookmark_failed
+                // mid-batch). Re-arm the signal so the next pull_events
+                // revisits this channel immediately without waiting for a
+                // fresh OS notification. Pairs with the pre-drain ResetEvent
+                // above.
                 unsafe {
-                    let _ = ResetEvent(channel_sub.signal_event);
+                    let _ = SetEvent(channel_sub.signal_event);
                 }
-
-                // Update channel record count gauge for lag detection.
-                super::render::update_channel_records(
-                    &channel_sub.channel,
-                    &channel_sub.channel_records_gauge,
-                );
             }
         }
 
@@ -816,6 +904,15 @@ impl EventLogSubscription {
         self.shutdown_event.0
     }
 
+    /// Test-only accessor for the first channel's signal event handle. Used
+    /// by the lost-wakeup regression test to scope its drain-loop hook to
+    /// exactly this subscription, so it does not fire on concurrent
+    /// `pull_events` calls from other tests in the same process.
+    #[cfg(test)]
+    pub(super) fn first_channel_signal_raw(&self) -> isize {
+        self.channels[0].signal_event.0 as isize
+    }
+
     /// Returns a reference to the rate limiter, if configured.
     pub const fn rate_limiter(
         &self,
@@ -1005,6 +1102,7 @@ impl Drop for EventLogSubscription {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use serial_test::serial;
 
     async fn create_test_checkpointer() -> (Arc<Checkpointer>, tempfile::TempDir) {
         let temp_dir = tempfile::TempDir::new().unwrap();
@@ -1136,6 +1234,31 @@ mod tests {
         drop(subscription);
     }
 
+    /// Test that shutdown wins when both shutdown and channel handles are signaled.
+    #[tokio::test]
+    async fn test_shutdown_signal_takes_priority_over_channel_signal() {
+        let mut config = WindowsEventLogConfig::default();
+        config.channels = vec!["Application".to_string()];
+        config.event_timeout_ms = 500;
+
+        let (checkpointer, _temp_dir) = create_test_checkpointer().await;
+
+        let subscription = EventLogSubscription::new(&config, checkpointer, false)
+            .await
+            .expect("Subscription creation should succeed");
+
+        unsafe {
+            let handle = HANDLE(subscription.shutdown_event_raw());
+            let _ = SetEvent(handle);
+        }
+
+        let result = subscription.wait_for_events_blocking(0);
+        assert!(
+            matches!(result, WaitResult::Shutdown),
+            "shutdown should take priority over already-signaled channels"
+        );
+    }
+
     /// Test pull_events with read_existing_events=true
     #[tokio::test]
     async fn test_pull_events_returns_events() {
@@ -1272,4 +1395,209 @@ mod tests {
         // that the subscription is functional.
         let _events = subscription.pull_events(100).unwrap_or_default();
     }
+
+    /// Proves that `pull_events` works independently of signal state — the
+    /// invariant the speculative timeout pull in mod.rs relies on.
+    ///
+    /// Steps:
+    /// 1. Subscribe to the Application log with `read_existing_events = true`.
+    /// 2. Manually clear the channel signal via `ResetEvent`, simulating a lost wakeup.
+    /// 3. Assert `wait_for_events_blocking` times out (signal cleared, no OS wake-up).
+    /// 4. Assert `pull_events` still returns events — `EvtNext` fetches from the queue
+    ///    regardless of signal state, so the speculative pull in mod.rs self-heals.
+    #[tokio::test]
+    #[serial]
+    async fn test_pull_events_works_with_cleared_signal() {
+        // Seed the Application log with a record so the "events remain
+        // available despite cleared signal" assertion below does not depend
+        // on whatever backlog the runner happens to have. Freshly provisioned
+        // CI images can have an empty Application log, which would otherwise
+        // make `pull_events` legitimately return empty and produce a spurious
+        // failure unrelated to the invariant under test.
+        let seed_output = std::process::Command::new("eventcreate")
+            .args([
+                "/T",
+                "INFORMATION",
+                "/ID",
+                "100",
+                "/L",
+                "APPLICATION",
+                "/SO",
+                "VectorTestSpeculativePullSeed",
+                "/D",
+                "seed event for #25194 speculative-pull regression test",
+            ])
+            .output()
+            .expect("failed to spawn eventcreate — required for deterministic seeding");
+        assert!(
+            seed_output.status.success(),
+            "eventcreate failed to seed Application log (exit={:?}): stdout={:?} stderr={:?}. \
+             This test requires a seeded event to be deterministic; a locked-down runner \
+             without the privilege to write to Application cannot run this test reliably.",
+            seed_output.status.code(),
+            String::from_utf8_lossy(&seed_output.stdout),
+            String::from_utf8_lossy(&seed_output.stderr),
+        );
+        // Give the service a moment to persist the record before we subscribe.
+        tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+
+        let mut config = WindowsEventLogConfig::default();
+        config.channels = vec!["Application".to_string()];
+        config.read_existing_events = true;
+        config.event_timeout_ms = 500;
+
+        let (checkpointer, _temp_dir) = create_test_checkpointer().await;
+
+        let mut subscription = EventLogSubscription::new(&config, checkpointer, false)
+            .await
+            .expect("Subscription creation should succeed");
+
+        // Manually clear the signal to simulate a lost wakeup. The seeded
+        // event above guarantees at least one record is queued in EvtNext
+        // regardless of the runner's pre-existing log state.
+        let signal_raw = subscription.first_channel_signal_raw();
+        unsafe {
+            let _ = ResetEvent(HANDLE(signal_raw as *mut std::ffi::c_void));
+        }
+
+        // Signal is cleared: an immediate (0ms) poll must report Timeout.
+        // A 0ms wait reads only the current signal state with no grace
+        // window, so unrelated Windows system events arriving between the
+        // `ResetEvent` above and the poll cannot re-signal the handle and
+        // cause a spurious failure.
+        let wait_result = subscription.wait_for_events_blocking(0);
+
+        assert!(
+            matches!(wait_result, WaitResult::Timeout),
+            "expected Timeout after manual ResetEvent; signal was not cleared"
+        );
+
+        // Despite the cleared signal, pull_events must still return events.
+        // This is the invariant the speculative timeout pull in mod.rs depends on.
+        let events = subscription.pull_events(100).unwrap_or_default();
+        assert!(
+            !events.is_empty(),
+            "pull_events must return events independently of signal state; \
+             this is the invariant the speculative timeout pull in mod.rs depends on"
+        );
+    }
+
+    /// Regression test for vectordotdev/vector#25194.
+    ///
+    /// The Windows Event Log service signals the pull-mode wait handle via
+    /// `SetEvent` each time a new matching event is recorded. Because the
+    /// handle is manual-reset, `SetEvent` on an already-signaled handle is
+    /// a no-op. If `pull_events` resets the signal *after* draining events
+    /// via `EvtNext`, any signal that fires between the last `EvtNext` and
+    /// the `ResetEvent` call is silently lost — the subscription then
+    /// permanently hangs until a subsequent event arrives.
+    ///
+    /// The fix is to reset the signal *before* the drain loop, so signals
+    /// raised during the drain are preserved and the next wait returns
+    /// immediately.
+    ///
+    /// This test pins that invariant by driving the real `pull_events`
+    /// against a real `EvtSubscribe` handle. It installs a
+    /// `DRAIN_STEP_HOOK` that runs inside the drain loop after each
+    /// `EvtNext` and fires `SetEvent` on the subscription's signal
+    /// handle — simulating the OS signaling a new event arrival during
+    /// the drain window. After `pull_events` returns, the signal must
+    /// still be set — observed via a 0ms `wait_for_events_blocking`
+    /// so the check measures only the reset/preserve behavior of
+    /// `pull_events` and is not contaminated by unrelated Windows
+    /// system events arriving during a nonzero wait. Under the old
+    /// post-drain `ResetEvent` order, the hook's `SetEvent` would be
+    /// clobbered by the reset and the immediate poll would return
+    /// `Timeout` — which is exactly what #25194 reports.
+    #[tokio::test]
+    #[serial]
+    async fn test_pull_events_preserves_setevent_during_drain() {
+        use std::sync::Arc as StdArc;
+
+        let mut config = WindowsEventLogConfig::default();
+        config.channels = vec!["Application".to_string()];
+        config.read_existing_events = true;
+        config.event_timeout_ms = 1000;
+
+        let (checkpointer, _temp_dir) = create_test_checkpointer().await;
+
+        let mut subscription = EventLogSubscription::new(&config, checkpointer, false)
+            .await
+            .expect("Subscription creation should succeed");
+
+        // Capture THIS subscription's signal handle so the hook can scope
+        // itself to this test. DRAIN_STEP_HOOK is a process-global, and
+        // cargo runs tests in parallel by default; without handle-keying,
+        // a concurrent test's pull_events could trigger our one-shot
+        // hook first, flip `fired`, and SetEvent on the wrong handle.
+        let target_signal_raw = subscription.first_channel_signal_raw();
+
+        // Install the drain-loop hook: every EvtNext call inside
+        // pull_events fires SetEvent on the subscription's signal
+        // handle. This simulates the OS signaling a fresh event
+        // mid-drain, which is exactly the race window #25194 exposes.
+        // The hook only needs to fire once to prove the invariant; we
+        // use an AtomicBool to keep it deterministic. The hook is keyed
+        // to `target_signal_raw` so concurrent pull_events calls from
+        // other tests no-op here.
+        let fired = StdArc::new(std::sync::atomic::AtomicBool::new(false));
+        {
+            let fired = StdArc::clone(&fired);
+            let hook: StdArc<dyn Fn(HANDLE) + Send + Sync> = StdArc::new(move |signal: HANDLE| {
+                if signal.0 as isize != target_signal_raw {
+                    return;
+                }
+                if !fired.swap(true, std::sync::atomic::Ordering::SeqCst) {
+                    unsafe {
+                        let _ = SetEvent(signal);
+                    }
+                }
+            });
+            *DRAIN_STEP_HOOK.lock().unwrap() = Some(hook);
+        }
+
+        // Drop-guard: clear the hook even if the test panics, so it
+        // doesn't contaminate other tests in the same process.
+        struct HookGuard;
+        impl Drop for HookGuard {
+            fn drop(&mut self) {
+                *DRAIN_STEP_HOOK.lock().unwrap() = None;
+            }
+        }
+        let _guard = HookGuard;
+
+        // Drive pull_events with a very large budget so the drain
+        // exits via ERROR_NO_MORE_ITEMS (channel_drained = true),
+        // which is the path that ran the post-drain ResetEvent in the
+        // old buggy code. Exiting via budget exhaustion would skip
+        // that reset and cause this test to false-pass against the
+        // pre-fix code.
+        let _ = subscription.pull_events(usize::MAX).unwrap_or_default();
+
+        assert!(
+            fired.load(std::sync::atomic::Ordering::SeqCst),
+            "drain-loop hook never ran — pull_events must call EvtNext \
+             at least once even on an empty channel"
+        );
+
+        // Observe the signal state IMMEDIATELY with a 0ms wait. We want
+        // to know whether pull_events's reset clobbered the hook's
+        // SetEvent — NOT whether new real events arrive during some
+        // wait window. A nonzero timeout against the live Application
+        // channel lets arbitrary Windows system events re-signal us
+        // and false-pass against the pre-fix code. 0ms = WaitForMultiple-
+        // Objects returns the current state with no grace period, so
+        // only the reset/preserve behavior of pull_events is measured.
+        let result = subscription.wait_for_events_blocking(0);
+
+        match result {
+            WaitResult::EventsAvailable => {}
+            WaitResult::Timeout => panic!(
+                "signal set during the drain window was lost — this is the \
+                 lost-wakeup race from vectordotdev/vector#25194. \
+                 pull_events must call ResetEvent BEFORE draining, not after."
+            ),
+            WaitResult::Shutdown => panic!("unexpected shutdown"),
+        }
+    }
 }

From 59a53b138d127fdca68d260628d1dc0035b3f711 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Fri, 1 May 2026 13:43:39 -0400
Subject: [PATCH 185/326] fix(internal docs): remove type-level default on
 StatusCode (#25345)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fix(vector-config): remove type-level default on StatusCode

The Configurable impl for http::StatusCode set a type-level default of
200, which the CUE generator propagated into the `uint` schema for each
item of `Vec<StatusCode>` — including RetryStrategy::Custom.status_codes
introduced in #25057. The CUE schema for #TypeArray hardcodes
items.type._args.required = true, which forbids `default` on item
primitives, so cue-build failed on every http-based sink with:

    components.sinks.<name>.configuration.retry_strategy.type.object: field not allowed

Drop the type-level default. The only field that needs a default for
StatusCode is sources::http_server::response_code, which already sets
its own via #[serde(default = "default_http_response_code")].

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 lib/vector-config/src/http.rs                                   | 1 -
 website/cue/reference/components/sinks/generated/appsignal.cue  | 2 +-
 website/cue/reference/components/sinks/generated/axiom.cue      | 2 +-
 .../components/sinks/generated/azure_logs_ingestion.cue         | 2 +-
 .../reference/components/sinks/generated/azure_monitor_logs.cue | 2 +-
 .../cue/reference/components/sinks/generated/datadog_events.cue | 2 +-
 .../components/sinks/generated/gcp_stackdriver_logs.cue         | 2 +-
 .../components/sinks/generated/gcp_stackdriver_metrics.cue      | 2 +-
 website/cue/reference/components/sinks/generated/honeycomb.cue  | 2 +-
 website/cue/reference/components/sinks/generated/http.cue       | 2 +-
 website/cue/reference/components/sinks/generated/keep.cue       | 2 +-
 .../cue/reference/components/sinks/generated/opentelemetry.cue  | 2 +-
 .../components/sinks/generated/prometheus_remote_write.cue      | 2 +-
 13 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/lib/vector-config/src/http.rs b/lib/vector-config/src/http.rs
index da51ea1cc156e..1f61630bf7cbd 100644
--- a/lib/vector-config/src/http.rs
+++ b/lib/vector-config/src/http.rs
@@ -28,7 +28,6 @@ impl Configurable for StatusCode {
     fn metadata() -> Metadata {
         let mut metadata = Metadata::default();
         metadata.set_description("HTTP response status code");
-        metadata.set_default_value(StatusCode::OK);
         metadata.add_custom_attribute(CustomAttribute::kv(
             constants::DOCS_META_NUMERIC_TYPE,
             NumberClass::Unsigned,
diff --git a/website/cue/reference/components/sinks/generated/appsignal.cue b/website/cue/reference/components/sinks/generated/appsignal.cue
index 47943be3c1f93..41769e4ec2a41 100644
--- a/website/cue/reference/components/sinks/generated/appsignal.cue
+++ b/website/cue/reference/components/sinks/generated/appsignal.cue
@@ -337,7 +337,7 @@ generated: components: sinks: appsignal: configuration: {
 				description:   "Retry on these specific HTTP status codes"
 				relevant_when: "type = \"custom\""
 				required:      true
-				type: array: items: type: uint: default: 200
+				type: array: items: type: uint: {}
 			}
 			type: {
 				description: "The retry strategy enum."
diff --git a/website/cue/reference/components/sinks/generated/axiom.cue b/website/cue/reference/components/sinks/generated/axiom.cue
index a1f42404ac0c1..e08085b79926b 100644
--- a/website/cue/reference/components/sinks/generated/axiom.cue
+++ b/website/cue/reference/components/sinks/generated/axiom.cue
@@ -319,7 +319,7 @@ generated: components: sinks: axiom: configuration: {
 				description:   "Retry on these specific HTTP status codes"
 				relevant_when: "type = \"custom\""
 				required:      true
-				type: array: items: type: uint: default: 200
+				type: array: items: type: uint: {}
 			}
 			type: {
 				description: "The retry strategy enum."
diff --git a/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue b/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue
index 68944f5a6e7d5..9300dd205df64 100644
--- a/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue
+++ b/website/cue/reference/components/sinks/generated/azure_logs_ingestion.cue
@@ -422,7 +422,7 @@ generated: components: sinks: azure_logs_ingestion: configuration: {
 				description:   "Retry on these specific HTTP status codes"
 				relevant_when: "type = \"custom\""
 				required:      true
-				type: array: items: type: uint: default: 200
+				type: array: items: type: uint: {}
 			}
 			type: {
 				description: "The retry strategy enum."
diff --git a/website/cue/reference/components/sinks/generated/azure_monitor_logs.cue b/website/cue/reference/components/sinks/generated/azure_monitor_logs.cue
index c7039b70097e1..205b671072bdb 100644
--- a/website/cue/reference/components/sinks/generated/azure_monitor_logs.cue
+++ b/website/cue/reference/components/sinks/generated/azure_monitor_logs.cue
@@ -328,7 +328,7 @@ generated: components: sinks: azure_monitor_logs: configuration: {
 				description:   "Retry on these specific HTTP status codes"
 				relevant_when: "type = \"custom\""
 				required:      true
-				type: array: items: type: uint: default: 200
+				type: array: items: type: uint: {}
 			}
 			type: {
 				description: "The retry strategy enum."
diff --git a/website/cue/reference/components/sinks/generated/datadog_events.cue b/website/cue/reference/components/sinks/generated/datadog_events.cue
index 23b9fb43d6413..f823c05445a2e 100644
--- a/website/cue/reference/components/sinks/generated/datadog_events.cue
+++ b/website/cue/reference/components/sinks/generated/datadog_events.cue
@@ -256,7 +256,7 @@ generated: components: sinks: datadog_events: configuration: {
 				description:   "Retry on these specific HTTP status codes"
 				relevant_when: "type = \"custom\""
 				required:      true
-				type: array: items: type: uint: default: 200
+				type: array: items: type: uint: {}
 			}
 			type: {
 				description: "The retry strategy enum."
diff --git a/website/cue/reference/components/sinks/generated/gcp_stackdriver_logs.cue b/website/cue/reference/components/sinks/generated/gcp_stackdriver_logs.cue
index 9d5e76262bfd2..2685eda9ffb10 100644
--- a/website/cue/reference/components/sinks/generated/gcp_stackdriver_logs.cue
+++ b/website/cue/reference/components/sinks/generated/gcp_stackdriver_logs.cue
@@ -434,7 +434,7 @@ generated: components: sinks: gcp_stackdriver_logs: configuration: {
 				description:   "Retry on these specific HTTP status codes"
 				relevant_when: "type = \"custom\""
 				required:      true
-				type: array: items: type: uint: default: 200
+				type: array: items: type: uint: {}
 			}
 			type: {
 				description: "The retry strategy enum."
diff --git a/website/cue/reference/components/sinks/generated/gcp_stackdriver_metrics.cue b/website/cue/reference/components/sinks/generated/gcp_stackdriver_metrics.cue
index 52c344e278250..d9897bbaf092e 100644
--- a/website/cue/reference/components/sinks/generated/gcp_stackdriver_metrics.cue
+++ b/website/cue/reference/components/sinks/generated/gcp_stackdriver_metrics.cue
@@ -348,7 +348,7 @@ generated: components: sinks: gcp_stackdriver_metrics: configuration: {
 				description:   "Retry on these specific HTTP status codes"
 				relevant_when: "type = \"custom\""
 				required:      true
-				type: array: items: type: uint: default: 200
+				type: array: items: type: uint: {}
 			}
 			type: {
 				description: "The retry strategy enum."
diff --git a/website/cue/reference/components/sinks/generated/honeycomb.cue b/website/cue/reference/components/sinks/generated/honeycomb.cue
index c65064a135a00..5c3acaed97ffa 100644
--- a/website/cue/reference/components/sinks/generated/honeycomb.cue
+++ b/website/cue/reference/components/sinks/generated/honeycomb.cue
@@ -335,7 +335,7 @@ generated: components: sinks: honeycomb: configuration: {
 				description:   "Retry on these specific HTTP status codes"
 				relevant_when: "type = \"custom\""
 				required:      true
-				type: array: items: type: uint: default: 200
+				type: array: items: type: uint: {}
 			}
 			type: {
 				description: "The retry strategy enum."
diff --git a/website/cue/reference/components/sinks/generated/http.cue b/website/cue/reference/components/sinks/generated/http.cue
index 8523a27dd0d9b..e08fd535971e6 100644
--- a/website/cue/reference/components/sinks/generated/http.cue
+++ b/website/cue/reference/components/sinks/generated/http.cue
@@ -1038,7 +1038,7 @@ generated: components: sinks: http: configuration: {
 				description:   "Retry on these specific HTTP status codes"
 				relevant_when: "type = \"custom\""
 				required:      true
-				type: array: items: type: uint: default: 200
+				type: array: items: type: uint: {}
 			}
 			type: {
 				description: "The retry strategy enum."
diff --git a/website/cue/reference/components/sinks/generated/keep.cue b/website/cue/reference/components/sinks/generated/keep.cue
index d2ed08114a2a9..43b8500746291 100644
--- a/website/cue/reference/components/sinks/generated/keep.cue
+++ b/website/cue/reference/components/sinks/generated/keep.cue
@@ -300,7 +300,7 @@ generated: components: sinks: keep: configuration: {
 				description:   "Retry on these specific HTTP status codes"
 				relevant_when: "type = \"custom\""
 				required:      true
-				type: array: items: type: uint: default: 200
+				type: array: items: type: uint: {}
 			}
 			type: {
 				description: "The retry strategy enum."
diff --git a/website/cue/reference/components/sinks/generated/opentelemetry.cue b/website/cue/reference/components/sinks/generated/opentelemetry.cue
index 4e8e9d9ff7210..3d52d15690bed 100644
--- a/website/cue/reference/components/sinks/generated/opentelemetry.cue
+++ b/website/cue/reference/components/sinks/generated/opentelemetry.cue
@@ -1039,7 +1039,7 @@ generated: components: sinks: opentelemetry: configuration: protocol: {
 					description:   "Retry on these specific HTTP status codes"
 					relevant_when: "type = \"custom\""
 					required:      true
-					type: array: items: type: uint: default: 200
+					type: array: items: type: uint: {}
 				}
 				type: {
 					description: "The retry strategy enum."
diff --git a/website/cue/reference/components/sinks/generated/prometheus_remote_write.cue b/website/cue/reference/components/sinks/generated/prometheus_remote_write.cue
index 5d74d52359bdd..0156777c09fb2 100644
--- a/website/cue/reference/components/sinks/generated/prometheus_remote_write.cue
+++ b/website/cue/reference/components/sinks/generated/prometheus_remote_write.cue
@@ -553,7 +553,7 @@ generated: components: sinks: prometheus_remote_write: configuration: {
 				description:   "Retry on these specific HTTP status codes"
 				relevant_when: "type = \"custom\""
 				required:      true
-				type: array: items: type: uint: default: 200
+				type: array: items: type: uint: {}
 			}
 			type: {
 				description: "The retry strategy enum."

From f1b2c3a3f14f59ab9615829852da6e65a7d2c512 Mon Sep 17 00:00:00 2001
From: tot19 <31141271+tot19@users.noreply.github.com>
Date: Sat, 2 May 2026 02:06:42 +0900
Subject: [PATCH 186/326] fix(sources): add windows_event_log source metadata
 (#25337)

* fix(windows_event_log): add standard source metadata

* chore(changelog): add windows_event_log metadata fix note
---
 ...332_windows_event_log_source_metadata.fix.md |  3 +++
 src/sources/windows_event_log/mod.rs            | 17 +++++++++++++++--
 2 files changed, 18 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/25332_windows_event_log_source_metadata.fix.md

diff --git a/changelog.d/25332_windows_event_log_source_metadata.fix.md b/changelog.d/25332_windows_event_log_source_metadata.fix.md
new file mode 100644
index 0000000000000..936e773cc8588
--- /dev/null
+++ b/changelog.d/25332_windows_event_log_source_metadata.fix.md
@@ -0,0 +1,3 @@
+The `windows_event_log` source now adds standard source metadata, including `source_type`, to emitted log events.
+
+authors: tot19
diff --git a/src/sources/windows_event_log/mod.rs b/src/sources/windows_event_log/mod.rs
index 28dfc1db4cb79..9fb2cff142ee6 100644
--- a/src/sources/windows_event_log/mod.rs
+++ b/src/sources/windows_event_log/mod.rs
@@ -25,6 +25,7 @@ cfg_if::cfg_if! {
         use std::path::PathBuf;
         use std::sync::Arc;
 
+        use chrono::Utc;
         use futures::StreamExt;
         use vector_lib::EstimatedJsonEncodedSizeOf;
         use vector_lib::finalizer::OrderedFinalizer;
@@ -166,6 +167,7 @@ impl Finalizer {
 async fn process_event_batch(
     events: Vec<WindowsEvent>,
     parser: &EventLogParser,
+    log_namespace: LogNamespace,
     acknowledgements: bool,
     subscription: &EventLogSubscription,
     out: &mut SourceSender,
@@ -189,6 +191,12 @@ async fn process_event_batch(
         let event_id = event.event_id;
         match parser.parse_event(event) {
             Ok(mut log_event) => {
+                log_namespace.insert_standard_vector_source_metadata(
+                    &mut log_event,
+                    WindowsEventLogConfig::NAME,
+                    Utc::now(),
+                );
+
                 let byte_size = log_event.estimated_json_encoded_size_of();
                 total_byte_size += byte_size.get();
                 if let Some(ref batch) = batch {
@@ -416,6 +424,7 @@ impl WindowsEventLogSource {
                             if process_event_batch(
                                 events,
                                 &parser,
+                                self.log_namespace,
                                 acknowledgements,
                                 &subscription,
                                 &mut out,
@@ -516,6 +525,7 @@ impl WindowsEventLogSource {
                             if process_event_batch(
                                 events,
                                 &parser,
+                                self.log_namespace,
                                 acknowledgements,
                                 &subscription,
                                 &mut out,
@@ -664,8 +674,11 @@ impl SourceConfig for WindowsEventLogConfig {
                     ),
                 ])),
                 [LogNamespace::Vector],
-            ),
-            LogNamespace::Legacy => vector_lib::schema::Definition::any(),
+            )
+            .with_standard_vector_source_metadata(),
+            LogNamespace::Legacy => {
+                vector_lib::schema::Definition::any().with_standard_vector_source_metadata()
+            }
         };
 
         vec![SourceOutput::new_maybe_logs(

From 9f15e23943d4347a6f2171eaa97a921a5e58d457 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Fri, 1 May 2026 13:56:58 -0400
Subject: [PATCH 187/326] fix(ci): bump cue and add cue-build step to Check Cue
 docs (#25346)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(vector-config): remove type-level default on StatusCode

The Configurable impl for http::StatusCode set a type-level default of
200, which the CUE generator propagated into the `uint` schema for each
item of `Vec<StatusCode>` — including RetryStrategy::Custom.status_codes
introduced in #25057. The CUE schema for #TypeArray hardcodes
items.type._args.required = true, which forbids `default` on item
primitives, so cue-build failed on every http-based sink with:

    components.sinks.<name>.configuration.retry_strategy.type.object: field not allowed

Drop the type-level default. The only field that needs a default for
StatusCode is sources::http_server::response_code, which already sets
its own via #[serde(default = "default_http_response_code")].

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): bump cue from v0.10.0 to v0.16.1

CI's cue v0.10.0 was lax enough that schema violations like the
"field not allowed" error fixed in the previous commit slipped through
the existing `Check Cue docs` step. Newer cue versions enforce closed
struct constraints in disjunctions strictly, matching what local
developers see when running the website build.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci(test): also run make cue-build in Check Cue docs

The Check Cue docs job previously only ran make check-docs, which runs
cue vet. Adding make cue-build (which runs cue export and materializes
website/data/docs.json) catches schema-unification failures that the
website build would hit and that vet may miss.

The new step reuses the cue + VRL docs already produced by the prior
make check-docs invocation, so it adds only the cost of one cue export.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): bump cue to v0.16.1 in remaining installers

Keep all three cue installers in lockstep with .github/actions/setup
to avoid version skew that would let developer / website-Dockerfile
paths accept cue sources the CI Check Cue docs job rejects.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/actions/setup/action.yml              | 6 +++---
 .github/workflows/test.yml                    | 2 ++
 scripts/environment/bootstrap-ubuntu-24.04.sh | 6 +++---
 website/Dockerfile                            | 2 +-
 4 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 6faa185204ced..3c7e645e6831b 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -237,10 +237,10 @@ runs:
         echo "Installing cue"
         TEMP=$(mktemp -d)
         curl \
-          -L https://github.com/cue-lang/cue/releases/download/v0.10.0/cue_v0.10.0_linux_amd64.tar.gz \
-          -o "${TEMP}/cue_v0.10.0_linux_amd64.tar.gz"
+          -L https://github.com/cue-lang/cue/releases/download/v0.16.1/cue_v0.16.1_linux_amd64.tar.gz \
+          -o "${TEMP}/cue_v0.16.1_linux_amd64.tar.gz"
         tar \
-          -xvf "${TEMP}/cue_v0.10.0_linux_amd64.tar.gz" \
+          -xvf "${TEMP}/cue_v0.16.1_linux_amd64.tar.gz" \
           -C "${TEMP}"
         sudo cp "${TEMP}/cue" /usr/bin/cue
         rm -rf "$TEMP"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7e5c28aec476c..5244d8110d823 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -121,6 +121,8 @@ jobs:
           rust: true
           cue: true
       - run: make check-docs
+      - name: Check Cue website build
+        run: cd website && make cue-build
 
   check-markdown:
     name: Check Markdown
diff --git a/scripts/environment/bootstrap-ubuntu-24.04.sh b/scripts/environment/bootstrap-ubuntu-24.04.sh
index 9d135f779b933..4298fb4dba94b 100755
--- a/scripts/environment/bootstrap-ubuntu-24.04.sh
+++ b/scripts/environment/bootstrap-ubuntu-24.04.sh
@@ -56,10 +56,10 @@ apt-get install --yes \
 # Cue
 TEMP=$(mktemp -d)
 curl \
-    -L https://github.com/cue-lang/cue/releases/download/v0.10.0/cue_v0.10.0_linux_amd64.tar.gz \
-    -o "${TEMP}/cue_v0.10.0_linux_amd64.tar.gz"
+    -L https://github.com/cue-lang/cue/releases/download/v0.16.1/cue_v0.16.1_linux_amd64.tar.gz \
+    -o "${TEMP}/cue_v0.16.1_linux_amd64.tar.gz"
 tar \
-    -xvf "${TEMP}/cue_v0.10.0_linux_amd64.tar.gz" \
+    -xvf "${TEMP}/cue_v0.16.1_linux_amd64.tar.gz" \
     -C "${TEMP}"
 cp "${TEMP}/cue" /usr/bin/cue
 rm -rf "$TEMP"
diff --git a/website/Dockerfile b/website/Dockerfile
index e9946941bb459..d98c0f2103ab1 100644
--- a/website/Dockerfile
+++ b/website/Dockerfile
@@ -1,7 +1,7 @@
 FROM debian:bookworm-slim
 
 ARG HUGO_VERSION=0.154.5
-ARG CUE_VERSION=0.10.0
+ARG CUE_VERSION=0.16.1
 ARG NODE_VERSION=24
 
 RUN apt-get update && apt-get install -y --no-install-recommends \

From 7923556313d66be69e638022e10fe3fd13f468ac Mon Sep 17 00:00:00 2001
From: Flavio Cruz <87035001+flaviofcruz@users.noreply.github.com>
Date: Fri, 1 May 2026 14:57:31 -0400
Subject: [PATCH 188/326] fix(clickhouse sink, aws_s3 sink): use dedicated
 batch_encoding types (#25340)

* Fix the clickhouse sink so that it only accepts arrow

* Do not allow arrow stream or parquet on AWS S3

* reformat

* Add changelog fragment

* Remove stale comments

* chore(aws_s3 sink): exhaustive match for batch_encoding default extension

So adding a future S3BatchEncoding variant is a compile error rather than
silently defaulting to "parquet".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(aws_s3 sink): rename shadowing parquet_config bind in tests

Avoid rebinding parquet_config to a borrow of itself from
config.batch_encoding; use a short p binding instead.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(changelog): rewrite batch_encoding fragment for users

Drop internal type names and dev jargon; lead with the user-visible
behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(aws_s3 sink, clickhouse sink): reject unsupported batch_encoding codec at parse time

Add per-sink deserialization-failure tests that pin the schema-tightening
behavior introduced by the dedicated wrapper enums:

- aws_s3 rejects codec: arrow_stream
- clickhouse rejects codec: parquet

Previously both codecs were accepted by serde and rejected later at
sink-build time; the new wrapper enums move rejection up to parse time,
and these tests prevent silent regression of that contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(aws_s3 sink): re-export S3BatchEncoding from aws_s3 module

Programmatic users constructing S3SinkConfig directly need to be able
to set the batch_encoding field. With config kept private in
src/sinks/aws_s3/mod.rs, S3BatchEncoding was unnameable outside the
crate, regressing callers that previously used
BatchSerializerConfig::Parquet(...) at the same field.

Gated by codecs-parquet to mirror the type and field.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 ...use_aws_s3_dedicated_batch_encoding.fix.md |   3 +
 src/sinks/aws_s3/config.rs                    | 139 ++++++++----------
 src/sinks/aws_s3/integration_tests.rs         |   6 +-
 src/sinks/aws_s3/mod.rs                       |   2 +
 src/sinks/clickhouse/config.rs                |  61 ++++++--
 src/sinks/clickhouse/integration_tests.rs     |  14 +-
 .../components/sinks/generated/aws_s3.cue     |  54 ++-----
 .../components/sinks/generated/clickhouse.cue |  80 ++--------
 8 files changed, 147 insertions(+), 212 deletions(-)
 create mode 100644 changelog.d/clickhouse_aws_s3_dedicated_batch_encoding.fix.md

diff --git a/changelog.d/clickhouse_aws_s3_dedicated_batch_encoding.fix.md b/changelog.d/clickhouse_aws_s3_dedicated_batch_encoding.fix.md
new file mode 100644
index 0000000000000..f39347d4c47bd
--- /dev/null
+++ b/changelog.d/clickhouse_aws_s3_dedicated_batch_encoding.fix.md
@@ -0,0 +1,3 @@
+The `aws_s3` and `clickhouse` sinks now correctly advertise only the `batch_encoding.codec` values they actually support: `parquet` for `aws_s3` and `arrow_stream` for `clickhouse`. Previously the documentation and configuration schema listed both codecs for both sinks, even though picking the wrong one produced a startup error.
+
+authors: flaviofcruz
diff --git a/src/sinks/aws_s3/config.rs b/src/sinks/aws_s3/config.rs
index 6e8d2e248c518..05055e6ea0167 100644
--- a/src/sinks/aws_s3/config.rs
+++ b/src/sinks/aws_s3/config.rs
@@ -3,7 +3,7 @@ use tower::ServiceBuilder;
 #[cfg(feature = "codecs-parquet")]
 use vector_lib::codecs::BatchEncoder;
 #[cfg(feature = "codecs-parquet")]
-use vector_lib::codecs::encoding::BatchSerializerConfig;
+use vector_lib::codecs::encoding::{BatchSerializerConfig, format::ParquetSerializerConfig};
 use vector_lib::{
     TimeZone,
     codecs::{
@@ -37,6 +37,21 @@ use crate::{
     tls::TlsConfig,
 };
 
+/// Batch encoding configuration for the `aws_s3` sink.
+#[cfg(feature = "codecs-parquet")]
+#[configurable_component]
+#[derive(Clone, Debug)]
+#[serde(tag = "codec", rename_all = "snake_case")]
+#[configurable(metadata(
+    docs::enum_tag_description = "The codec to use for batch encoding events."
+))]
+pub enum S3BatchEncoding {
+    /// Encodes events in [Apache Parquet][apache_parquet] columnar format.
+    ///
+    /// [apache_parquet]: https://parquet.apache.org/
+    Parquet(ParquetSerializerConfig),
+}
+
 /// Configuration for the `aws_s3` sink.
 #[configurable_component(sink(
     "aws_s3",
@@ -111,15 +126,13 @@ pub struct S3SinkConfig {
 
     /// Batch encoding configuration for columnar formats.
     ///
-    /// When set, events are encoded together as a batch in a columnar format (for example, Parquet)
+    /// When set, events are encoded together as a batch in a columnar format (Parquet)
     /// instead of the standard per-event framing-based encoding. The columnar format handles
     /// its own internal compression, so the top-level `compression` setting is bypassed.
-    ///
-    /// Only the `parquet` codec is supported by the AWS S3 sink.
     #[cfg(feature = "codecs-parquet")]
     #[configurable(derived)]
     #[serde(default)]
-    pub batch_encoding: Option<BatchSerializerConfig>,
+    pub batch_encoding: Option<S3BatchEncoding>,
 
     /// Compression configuration.
     ///
@@ -220,8 +233,10 @@ impl SinkConfig for S3SinkConfig {
 
     fn input(&self) -> Input {
         #[cfg(feature = "codecs-parquet")]
-        if let Some(batch_config) = &self.batch_encoding {
-            return Input::new(batch_config.input_type());
+        if let Some(batch_encoding) = &self.batch_encoding {
+            let S3BatchEncoding::Parquet(parquet_config) = batch_encoding;
+            let resolved = BatchSerializerConfig::Parquet(parquet_config.clone());
+            return Input::new(resolved.input_type());
         }
         Input::new(self.encoding.config().1.input_type())
     }
@@ -272,15 +287,11 @@ impl S3SinkConfig {
         // When batch_encoding is configured (e.g., Parquet), use batch mode
         // with internal compression and appropriate file extension.
         #[cfg(feature = "codecs-parquet")]
-        if let Some(batch_config) = &self.batch_encoding {
-            if !matches!(batch_config, BatchSerializerConfig::Parquet(_)) {
-                return Err(
-                    "batch_encoding only supports encoding with parquet format for amazon s3 sink"
-                        .into(),
-                );
-            }
+        if let Some(batch_encoding) = &self.batch_encoding {
+            let S3BatchEncoding::Parquet(parquet_config) = batch_encoding;
+            let resolved_batch_config = BatchSerializerConfig::Parquet(parquet_config.clone());
 
-            let batch_serializer = batch_config.build_batch_serializer()?;
+            let batch_serializer = resolved_batch_config.build_batch_serializer()?;
             let batch_encoder = BatchEncoder::new(batch_serializer);
 
             // Auto-detect Content-Type from batch format. Users can still
@@ -292,15 +303,14 @@ impl S3SinkConfig {
 
             let encoder = EncoderKind::Batch(batch_encoder);
 
-            // Auto-detect file extension from batch format
-            let filename_extension =
-                self.filename_extension
-                    .clone()
-                    .or_else(|| match batch_config {
-                        BatchSerializerConfig::Parquet(_) => Some("parquet".to_string()),
-                        #[allow(unreachable_patterns)]
-                        _ => None,
-                    });
+            let filename_extension = self.filename_extension.clone().or_else(|| {
+                Some(
+                    match batch_encoding {
+                        S3BatchEncoding::Parquet(_) => "parquet",
+                    }
+                    .to_string(),
+                )
+            });
 
             if self.compression != Compression::None {
                 warn!("Top level compression setting ignored when batch_encoding set to parquet.")
@@ -392,15 +402,10 @@ mod tests {
         let batch_enc = config
             .batch_encoding
             .expect("batch_encoding should be Some");
-        match batch_enc {
-            vector_lib::codecs::encoding::BatchSerializerConfig::Parquet(ref p) => {
-                use vector_lib::codecs::encoding::format::{ParquetCompression, ParquetSchemaMode};
-                assert_eq!(p.schema_mode, ParquetSchemaMode::AutoInfer);
-                assert_eq!(p.compression, ParquetCompression::Snappy);
-            }
-            #[allow(unreachable_patterns)]
-            _ => panic!("expected Parquet variant"),
-        }
+        let super::S3BatchEncoding::Parquet(ref p) = batch_enc;
+        use vector_lib::codecs::encoding::format::{ParquetCompression, ParquetSchemaMode};
+        assert_eq!(p.schema_mode, ParquetSchemaMode::AutoInfer);
+        assert_eq!(p.compression, ParquetCompression::Snappy);
     }
 
     /// Content-Type must be auto-detected as `application/vnd.apache.parquet`
@@ -432,7 +437,7 @@ mod tests {
             options: S3Options::default(),
             region: crate::aws::RegionOrEndpoint::with_both("us-east-1", "http://localhost:4566"),
             encoding: (None::<FramingConfig>, TextSerializerConfig::default()).into(),
-            batch_encoding: Some(BatchSerializerConfig::Parquet(parquet_config)),
+            batch_encoding: Some(super::S3BatchEncoding::Parquet(parquet_config)),
             compression: Compression::None,
             batch: BatchConfig::<BulkSizeBasedDefaultBatchSettings>::default(),
             request: Default::default(),
@@ -444,7 +449,8 @@ mod tests {
             retry_strategy: Default::default(),
         };
 
-        let batch_config = config.batch_encoding.as_ref().unwrap();
+        let super::S3BatchEncoding::Parquet(p) = config.batch_encoding.as_ref().unwrap();
+        let batch_config = BatchSerializerConfig::Parquet(p.clone());
         let batch_serializer = batch_config.build_batch_serializer().unwrap();
         let batch_encoder = vector_lib::codecs::BatchEncoder::new(batch_serializer);
 
@@ -484,7 +490,8 @@ mod tests {
         )
         .unwrap();
 
-        let batch_config = config.batch_encoding.as_ref().unwrap();
+        let super::S3BatchEncoding::Parquet(p) = config.batch_encoding.as_ref().unwrap();
+        let batch_config = vector_lib::codecs::encoding::BatchSerializerConfig::Parquet(p.clone());
         let batch_serializer = batch_config.build_batch_serializer().unwrap();
         let batch_encoder = vector_lib::codecs::BatchEncoder::new(batch_serializer);
 
@@ -500,43 +507,27 @@ mod tests {
         );
     }
 
-    /// Parquet filename extension defaults to `.parquet` when not explicitly set.
+    /// Codecs other than `parquet` must be rejected at parse time, since
+    /// `S3BatchEncoding` only exposes the `parquet` variant.
     #[cfg(feature = "codecs-parquet")]
     #[test]
-    fn parquet_filename_extension_defaults_to_parquet() {
-        let config: S3SinkConfig = toml::from_str(
+    fn parquet_batch_encoding_rejects_unsupported_codec() {
+        let err = serde_yaml::from_str::<S3SinkConfig>(
             r#"
-            bucket = "test-bucket"
-            compression = "none"
-
-            [encoding]
-            codec = "text"
-
-            [batch_encoding]
-            codec = "parquet"
-            schema_mode = "auto_infer"
+            bucket: test-bucket
+            compression: none
+            encoding:
+              codec: text
+            batch_encoding:
+              codec: arrow_stream
             "#,
         )
-        .unwrap();
+        .unwrap_err();
 
         assert!(
-            config.filename_extension.is_none(),
-            "fixture must not set filename_extension"
+            err.to_string().contains("arrow_stream"),
+            "expected error to mention the offending codec, got: {err}"
         );
-
-        let batch_config = config.batch_encoding.as_ref().unwrap();
-        let extension = config
-            .filename_extension
-            .clone()
-            .or_else(|| match batch_config {
-                vector_lib::codecs::encoding::BatchSerializerConfig::Parquet(_) => {
-                    Some("parquet".to_string())
-                }
-                #[allow(unreachable_patterns)]
-                _ => None,
-            });
-
-        assert_eq!(extension.as_deref(), Some("parquet"));
     }
 
     /// Explicit filename_extension overrides the `.parquet` default.
@@ -582,13 +573,8 @@ mod tests {
         )
         .unwrap();
 
-        match config.batch_encoding.unwrap() {
-            vector_lib::codecs::encoding::BatchSerializerConfig::Parquet(p) => {
-                assert_eq!(p.schema_mode, ParquetSchemaMode::Relaxed);
-            }
-            #[allow(unreachable_patterns)]
-            _ => panic!("expected Parquet variant"),
-        }
+        let super::S3BatchEncoding::Parquet(p) = config.batch_encoding.unwrap();
+        assert_eq!(p.schema_mode, ParquetSchemaMode::Relaxed);
     }
 
     /// Explicit `schema_mode = "strict"` is correctly parsed.
@@ -613,12 +599,7 @@ mod tests {
         )
         .unwrap();
 
-        match config.batch_encoding.unwrap() {
-            vector_lib::codecs::encoding::BatchSerializerConfig::Parquet(p) => {
-                assert_eq!(p.schema_mode, ParquetSchemaMode::Strict);
-            }
-            #[allow(unreachable_patterns)]
-            _ => panic!("expected Parquet variant"),
-        }
+        let super::S3BatchEncoding::Parquet(p) = config.batch_encoding.unwrap();
+        assert_eq!(p.schema_mode, ParquetSchemaMode::Strict);
     }
 }
diff --git a/src/sinks/aws_s3/integration_tests.rs b/src/sinks/aws_s3/integration_tests.rs
index a1a2c10af2201..3a7e156208387 100644
--- a/src/sinks/aws_s3/integration_tests.rs
+++ b/src/sinks/aws_s3/integration_tests.rs
@@ -7,6 +7,8 @@ use std::{
     time::Duration,
 };
 
+#[cfg(feature = "codecs-parquet")]
+use super::config::S3BatchEncoding;
 use aws_sdk_s3::{
     Client as S3Client,
     operation::{create_bucket::CreateBucketError, get_object::GetObjectOutput},
@@ -22,8 +24,6 @@ use futures::{Stream, stream};
 use similar_asserts::assert_eq;
 use tempfile::TempDir;
 use tokio_stream::StreamExt;
-#[cfg(feature = "codecs-parquet")]
-use vector_lib::codecs::encoding::BatchSerializerConfig;
 use vector_lib::{
     buffers::{BufferConfig, BufferType, WhenFull},
     codecs::{TextSerializerConfig, encoding::FramingConfig},
@@ -502,7 +502,7 @@ async fn s3_parquet_insert_message() {
     };
 
     let config = S3SinkConfig {
-        batch_encoding: Some(BatchSerializerConfig::Parquet(parquet_config)),
+        batch_encoding: Some(S3BatchEncoding::Parquet(parquet_config)),
         ..config(&bucket, 100, 5.0)
     };
 
diff --git a/src/sinks/aws_s3/mod.rs b/src/sinks/aws_s3/mod.rs
index 3027de1bb6287..4589746175558 100644
--- a/src/sinks/aws_s3/mod.rs
+++ b/src/sinks/aws_s3/mod.rs
@@ -3,4 +3,6 @@ mod sink;
 
 mod integration_tests;
 
+#[cfg(feature = "codecs-parquet")]
+pub use config::S3BatchEncoding;
 pub use config::S3SinkConfig;
diff --git a/src/sinks/clickhouse/config.rs b/src/sinks/clickhouse/config.rs
index 435b2504e6a9e..53050dca831ea 100644
--- a/src/sinks/clickhouse/config.rs
+++ b/src/sinks/clickhouse/config.rs
@@ -4,8 +4,8 @@ use std::fmt;
 
 use http::{Request, StatusCode, Uri};
 use hyper::Body;
+use vector_lib::codecs::encoding::ArrowStreamSerializerConfig;
 use vector_lib::codecs::encoding::format::SchemaProvider;
-use vector_lib::codecs::encoding::{ArrowStreamSerializerConfig, BatchSerializerConfig};
 
 use super::{
     request_builder::ClickhouseRequestBuilder,
@@ -45,6 +45,23 @@ pub enum Format {
     ArrowStream,
 }
 
+/// Batch encoding configuration for the `clickhouse` sink.
+#[configurable_component]
+#[derive(Clone, Debug)]
+#[serde(tag = "codec", rename_all = "snake_case")]
+#[configurable(metadata(
+    docs::enum_tag_description = "The codec to use for batch encoding events."
+))]
+pub enum ClickhouseBatchEncoding {
+    /// Encodes events in [Apache Arrow][apache_arrow] IPC streaming format.
+    ///
+    /// This is the streaming variant of the Arrow IPC format, which writes
+    /// a continuous stream of record batches.
+    ///
+    /// [apache_arrow]: https://arrow.apache.org/
+    ArrowStream(ArrowStreamSerializerConfig),
+}
+
 impl fmt::Display for Format {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
@@ -104,11 +121,9 @@ pub struct ClickhouseConfig {
     ///
     /// When specified, events are encoded together as a single batch.
     /// This is mutually exclusive with per-event encoding based on the `format` field.
-    ///
-    /// Only the `arrow_stream` codec is supported by the ClickHouse sink.
     #[configurable(derived)]
     #[serde(default)]
-    pub batch_encoding: Option<BatchSerializerConfig>,
+    pub batch_encoding: Option<ClickhouseBatchEncoding>,
 
     #[configurable(derived)]
     #[serde(default)]
@@ -282,6 +297,7 @@ impl ClickhouseConfig {
 
         if let Some(batch_encoding) = &self.batch_encoding {
             use vector_lib::codecs::BatchEncoder;
+            use vector_lib::codecs::encoding::BatchSerializerConfig;
 
             // Validate that batch_encoding is only compatible with ArrowStream format
             if self.format != Format::ArrowStream {
@@ -292,16 +308,8 @@ impl ClickhouseConfig {
                 .into());
             }
 
-            let mut arrow_config = match batch_encoding {
-                BatchSerializerConfig::ArrowStream(config) => config.clone(),
-                #[cfg(feature = "codecs-parquet")]
-                BatchSerializerConfig::Parquet(_) => {
-                    return Err(
-                        "ClickHouse sink does not support Parquet batch encoding. Use 'arrow_stream' instead."
-                            .into(),
-                    );
-                }
-            };
+            let ClickhouseBatchEncoding::ArrowStream(arrow_config) = batch_encoding;
+            let mut arrow_config = arrow_config.clone();
 
             self.resolve_arrow_schema(
                 client,
@@ -433,10 +441,31 @@ mod tests {
         );
     }
 
+    /// Codecs other than `arrow_stream` must be rejected at parse time, since
+    /// `ClickhouseBatchEncoding` only exposes the `arrow_stream` variant.
+    #[cfg(feature = "codecs-parquet")]
+    #[test]
+    fn batch_encoding_rejects_unsupported_codec() {
+        let err = serde_yaml::from_str::<ClickhouseConfig>(
+            r#"
+            endpoint: http://localhost:8123
+            table: test_table
+            batch_encoding:
+              codec: parquet
+            "#,
+        )
+        .unwrap_err();
+
+        assert!(
+            err.to_string().contains("parquet"),
+            "expected error to mention the offending codec, got: {err}"
+        );
+    }
+
     /// Helper to create a minimal ClickhouseConfig for testing
     fn create_test_config(
         format: Format,
-        batch_encoding: Option<BatchSerializerConfig>,
+        batch_encoding: Option<ClickhouseBatchEncoding>,
     ) -> ClickhouseConfig {
         ClickhouseConfig {
             endpoint: "http://localhost:8123".parse::<http::Uri>().unwrap().into(),
@@ -469,7 +498,7 @@ mod tests {
         for (format, format_name) in incompatible_formats {
             let config = create_test_config(
                 format,
-                Some(BatchSerializerConfig::ArrowStream(
+                Some(ClickhouseBatchEncoding::ArrowStream(
                     ArrowStreamSerializerConfig::default(),
                 )),
             );
diff --git a/src/sinks/clickhouse/integration_tests.rs b/src/sinks/clickhouse/integration_tests.rs
index a32771bf55730..2e27a20340dfa 100644
--- a/src/sinks/clickhouse/integration_tests.rs
+++ b/src/sinks/clickhouse/integration_tests.rs
@@ -18,7 +18,7 @@ use serde::Deserialize;
 use serde_json::Value;
 use tokio::time::{Duration, timeout};
 use vector_lib::{
-    codecs::encoding::{ArrowStreamSerializerConfig, BatchSerializerConfig},
+    codecs::encoding::ArrowStreamSerializerConfig,
     event::{BatchNotifier, BatchStatus, BatchStatusReceiver, Event, LogEvent},
     lookup::PathPrefix,
 };
@@ -28,7 +28,7 @@ use crate::{
     codecs::{TimestampFormat, Transformer},
     config::{SinkConfig, SinkContext, log_schema},
     sinks::{
-        clickhouse::config::ClickhouseConfig,
+        clickhouse::config::{ClickhouseBatchEncoding, ClickhouseConfig},
         util::{BatchConfig, Compression, TowerRequestConfig},
     },
     test_util::{
@@ -502,7 +502,7 @@ async fn insert_events_arrow_format() {
         table: table.clone().try_into().unwrap(),
         compression: Compression::None,
         format: crate::sinks::clickhouse::config::Format::ArrowStream,
-        batch_encoding: Some(BatchSerializerConfig::ArrowStream(Default::default())),
+        batch_encoding: Some(ClickhouseBatchEncoding::ArrowStream(Default::default())),
         batch,
         request: TowerRequestConfig {
             retry_attempts: 1,
@@ -574,7 +574,7 @@ async fn insert_events_arrow_with_schema_fetching() {
         table: table.clone().try_into().unwrap(),
         compression: Compression::None,
         format: crate::sinks::clickhouse::config::Format::ArrowStream,
-        batch_encoding: Some(BatchSerializerConfig::ArrowStream(Default::default())),
+        batch_encoding: Some(ClickhouseBatchEncoding::ArrowStream(Default::default())),
         batch,
         request: TowerRequestConfig {
             retry_attempts: 1,
@@ -657,7 +657,7 @@ async fn test_complex_types() {
         table: table.clone().try_into().unwrap(),
         compression: Compression::None,
         format: crate::sinks::clickhouse::config::Format::ArrowStream,
-        batch_encoding: Some(BatchSerializerConfig::ArrowStream(arrow_config)),
+        batch_encoding: Some(ClickhouseBatchEncoding::ArrowStream(arrow_config)),
         batch,
         request: TowerRequestConfig {
             retry_attempts: 1,
@@ -1231,7 +1231,7 @@ async fn test_missing_required_field_emits_null_constraint_error() {
         table: table.clone().try_into().unwrap(),
         compression: Compression::None,
         format: crate::sinks::clickhouse::config::Format::ArrowStream,
-        batch_encoding: Some(BatchSerializerConfig::ArrowStream(Default::default())),
+        batch_encoding: Some(ClickhouseBatchEncoding::ArrowStream(Default::default())),
         batch,
         request: TowerRequestConfig {
             retry_attempts: 1,
@@ -1323,7 +1323,7 @@ async fn arrow_schema_excludes_non_insertable_columns() {
         table: table.clone().try_into().unwrap(),
         compression: Compression::None,
         format: crate::sinks::clickhouse::config::Format::ArrowStream,
-        batch_encoding: Some(BatchSerializerConfig::ArrowStream(
+        batch_encoding: Some(ClickhouseBatchEncoding::ArrowStream(
             ArrowStreamSerializerConfig::default(),
         )),
         batch,
diff --git a/website/cue/reference/components/sinks/generated/aws_s3.cue b/website/cue/reference/components/sinks/generated/aws_s3.cue
index 1a4713e2897dd..5627d4636698a 100644
--- a/website/cue/reference/components/sinks/generated/aws_s3.cue
+++ b/website/cue/reference/components/sinks/generated/aws_s3.cue
@@ -260,52 +260,28 @@ generated: components: sinks: aws_s3: configuration: {
 		description: """
 			Batch encoding configuration for columnar formats.
 
-			When set, events are encoded together as a batch in a columnar format (for example, Parquet)
+			When set, events are encoded together as a batch in a columnar format (Parquet)
 			instead of the standard per-event framing-based encoding. The columnar format handles
 			its own internal compression, so the top-level `compression` setting is bypassed.
-
-			Only the `parquet` codec is supported by the AWS S3 sink.
 			"""
 		required: false
 		type: object: options: {
-			allow_nullable_fields: {
+			codec: {
 				description: """
-					Allow null values for non-nullable fields in the schema.
-
-					When enabled, missing or incompatible values are encoded as null, even for fields
-					marked as non-nullable in the Arrow schema. This is useful when working with downstream
-					systems that can handle null values through defaults, computed columns, or other mechanisms.
+					Encodes events in [Apache Parquet][apache_parquet] columnar format.
 
-					When disabled (default), missing values for non-nullable fields results in encoding errors. This is to
-					help ensure all required data is present before sending it to the sink.
+					[apache_parquet]: https://parquet.apache.org/
 					"""
-				relevant_when: "codec = \"arrow_stream\""
-				required:      false
-				type: bool: default: false
-			}
-			codec: {
-				description: "The codec to use for batch encoding events."
-				required:    true
-				type: string: enum: {
-					arrow_stream: """
-						Encodes events in [Apache Arrow][apache_arrow] IPC streaming format.
-
-						This is the streaming variant of the Arrow IPC format, which writes
-						a continuous stream of record batches.
-
-						[apache_arrow]: https://arrow.apache.org/
-						"""
-					parquet: """
-						Encodes events in [Apache Parquet][apache_parquet] columnar format.
+				required: true
+				type: string: enum: parquet: """
+					Encodes events in [Apache Parquet][apache_parquet] columnar format.
 
-						[apache_parquet]: https://parquet.apache.org/
-						"""
-				}
+					[apache_parquet]: https://parquet.apache.org/
+					"""
 			}
 			compression: {
-				description:   "Compression codec applied per column page inside the Parquet file."
-				relevant_when: "codec = \"parquet\""
-				required:      false
+				description: "Compression codec applied per column page inside the Parquet file."
+				required:    false
 				type: object: options: {
 					algorithm: {
 						description: "Compression codec applied per column page inside the Parquet file."
@@ -336,14 +312,12 @@ generated: components: sinks: aws_s3: configuration: {
 					Required unless `schema_mode` is `auto_infer`. The file must contain a valid
 					Parquet message type definition.
 					"""
-				relevant_when: "codec = \"parquet\""
-				required:      false
+				required: false
 				type: string: {}
 			}
 			schema_mode: {
-				description:   "Controls how events with fields not present in the schema are handled."
-				relevant_when: "codec = \"parquet\""
-				required:      false
+				description: "Controls how events with fields not present in the schema are handled."
+				required:    false
 				type: string: {
 					default: "relaxed"
 					enum: {
diff --git a/website/cue/reference/components/sinks/generated/clickhouse.cue b/website/cue/reference/components/sinks/generated/clickhouse.cue
index 547fbc943e9d9..e07014f38a308 100644
--- a/website/cue/reference/components/sinks/generated/clickhouse.cue
+++ b/website/cue/reference/components/sinks/generated/clickhouse.cue
@@ -249,8 +249,6 @@ generated: components: sinks: clickhouse: configuration: {
 
 			When specified, events are encoded together as a single batch.
 			This is mutually exclusive with per-event encoding based on the `format` field.
-
-			Only the `arrow_stream` codec is supported by the ClickHouse sink.
 			"""
 		required: false
 		type: object: options: {
@@ -265,79 +263,27 @@ generated: components: sinks: clickhouse: configuration: {
 					When disabled (default), missing values for non-nullable fields results in encoding errors. This is to
 					help ensure all required data is present before sending it to the sink.
 					"""
-				relevant_when: "codec = \"arrow_stream\""
-				required:      false
+				required: false
 				type: bool: default: false
 			}
 			codec: {
-				description: "The codec to use for batch encoding events."
-				required:    true
-				type: string: enum: {
-					arrow_stream: """
-						Encodes events in [Apache Arrow][apache_arrow] IPC streaming format.
+				description: """
+					Encodes events in [Apache Arrow][apache_arrow] IPC streaming format.
 
-						This is the streaming variant of the Arrow IPC format, which writes
-						a continuous stream of record batches.
+					This is the streaming variant of the Arrow IPC format, which writes
+					a continuous stream of record batches.
 
-						[apache_arrow]: https://arrow.apache.org/
-						"""
-					parquet: """
-						Encodes events in [Apache Parquet][apache_parquet] columnar format.
+					[apache_arrow]: https://arrow.apache.org/
+					"""
+				required: true
+				type: string: enum: arrow_stream: """
+					Encodes events in [Apache Arrow][apache_arrow] IPC streaming format.
 
-						[apache_parquet]: https://parquet.apache.org/
-						"""
-				}
-			}
-			compression: {
-				description:   "Compression codec applied per column page inside the Parquet file."
-				relevant_when: "codec = \"parquet\""
-				required:      false
-				type: object: options: {
-					algorithm: {
-						description: "Compression codec applied per column page inside the Parquet file."
-						required:    false
-						type: string: {
-							default: "snappy"
-							enum: {
-								gzip:   "Gzip compression. Level must be between 1 and 9."
-								lz4:    "LZ4 raw compression"
-								none:   "No compression"
-								snappy: "Snappy compression (no level)."
-								zstd:   "Zstd compression. Level must be between 1 and 21."
-							}
-						}
-					}
-					level: {
-						description:   "Compression level (1–21). This is the range Vector supports; higher values compress more but are slower."
-						relevant_when: "algorithm = \"zstd\" or algorithm = \"gzip\""
-						required:      true
-						type: uint: {}
-					}
-				}
-			}
-			schema_file: {
-				description: """
-					Path to a native Parquet schema file (`.schema`).
+					This is the streaming variant of the Arrow IPC format, which writes
+					a continuous stream of record batches.
 
-					Required unless `schema_mode` is `auto_infer`. The file must contain a valid
-					Parquet message type definition.
+					[apache_arrow]: https://arrow.apache.org/
 					"""
-				relevant_when: "codec = \"parquet\""
-				required:      false
-				type: string: {}
-			}
-			schema_mode: {
-				description:   "Controls how events with fields not present in the schema are handled."
-				relevant_when: "codec = \"parquet\""
-				required:      false
-				type: string: {
-					default: "relaxed"
-					enum: {
-						auto_infer: "Auto infer schema based on the batch. No schema file needed."
-						relaxed:    "Missing fields become null. Extra fields are silently dropped."
-						strict:     "Missing fields become null. Extra fields cause an error."
-					}
-				}
 			}
 		}
 	}

From e1c6139b9717f36027b0ac9fe4d20276da4da128 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Sat, 2 May 2026 16:51:00 -0400
Subject: [PATCH 189/326] chore(metrics): introduce enums for metric names
 (#25342)

* Add MetricName into vector-common

* Use EventName in lib/

* Use MetricName in src/internal_events

* Format

* Fix EventName imports

* Use MetricName in k8s

* Use MetricName in aws_sqs

* Use EventName everywhere and make clippy pass

* Separate MetricName -> CounterName/GaugeName/HistogramName

* Merge imports

* Finish MetricName separation

* chore: update check-events script to support typed metric name enums

* chore: fix stale MetricName doc references in macro wrappers

* chore: remove stale doc paragraph from counter! macro

* Fix clippy.toml

* Use first metric names instead of made up names to remove clippy::disallowed_macros

* chore: replace MetricName with CounterName in Windows internal events
---
 Cargo.lock                                    |   3 +
 Cargo.toml                                    |   1 +
 benches/metrics_snapshot.rs                   |   6 +-
 clippy.toml                                   |   6 +
 lib/codecs/src/internal_events.rs             |  29 +-
 lib/vector-buffers/src/internal_events.rs     |  53 +--
 .../src/topology/channel/limited_queue.rs     |   1 +
 lib/vector-common/Cargo.toml                  |   1 +
 .../src/internal_event/bytes_received.rs      |   8 +-
 .../src/internal_event/bytes_sent.rs          |   8 +-
 .../src/internal_event/cached_event.rs        |  48 +--
 .../component_events_dropped.rs               |   8 +-
 .../component_events_timed_out.rs             |  10 +-
 .../src/internal_event/events_received.rs     |  12 +-
 .../src/internal_event/events_sent.rs         |  18 +-
 .../src/internal_event/metric_name.rs         | 337 ++++++++++++++++++
 lib/vector-common/src/internal_event/mod.rs   |   2 +
 .../src/internal_event/service.rs             |   8 +-
 lib/vector-common/src/lib.rs                  |  57 +++
 lib/vector-core/Cargo.toml                    |   1 +
 lib/vector-core/src/latency.rs                |  12 +-
 lib/vector-core/src/metrics/mod.rs            |  76 ++--
 lib/vector-core/src/source_sender/builder.rs  |   2 +-
 lib/vector-core/src/source_sender/mod.rs      |   8 +-
 lib/vector-core/src/source_sender/sender.rs   |   4 +-
 lib/vector-lib/src/lib.rs                     |   6 +-
 scripts/check-events                          |  11 +
 .../memory/internal_events.rs                 |  32 +-
 src/internal_events/adaptive_concurrency.rs   |  17 +-
 src/internal_events/aggregate.rs              |  13 +-
 src/internal_events/amqp.rs                   |  15 +-
 src/internal_events/apache_metrics.rs         |  11 +-
 src/internal_events/api.rs                    |   9 +-
 src/internal_events/aws.rs                    |   9 +-
 src/internal_events/aws_cloudwatch_logs.rs    |   7 +-
 src/internal_events/aws_ec2_metadata.rs       |  13 +-
 src/internal_events/aws_ecs_metrics.rs        |  13 +-
 src/internal_events/aws_kinesis.rs            |   8 +-
 src/internal_events/aws_kinesis_firehose.rs   |  11 +-
 src/internal_events/aws_sqs.rs                |  42 ++-
 src/internal_events/batch.rs                  |   7 +-
 src/internal_events/common.rs                 |  19 +-
 src/internal_events/conditions.rs             |   9 +-
 src/internal_events/datadog_agent.rs          |   9 +-
 src/internal_events/datadog_metrics.rs        |   7 +-
 src/internal_events/datadog_traces.rs         |   9 +-
 src/internal_events/dedupe.rs                 |   6 +-
 src/internal_events/demo_logs.rs              |   3 +-
 src/internal_events/dnstap.rs                 |   9 +-
 src/internal_events/docker_logs.rs            |  23 +-
 src/internal_events/doris.rs                  |  12 +-
 src/internal_events/encoding_transcode.rs     |  13 +-
 src/internal_events/eventstoredb_metrics.rs   |  11 +-
 src/internal_events/exec.rs                   |  22 +-
 src/internal_events/expansion.rs              |   7 +-
 src/internal_events/file.rs                   |  72 ++--
 src/internal_events/file_descriptor.rs        |   9 +-
 src/internal_events/fluent.rs                 |   9 +-
 src/internal_events/gcp_pubsub.rs             |  13 +-
 src/internal_events/grpc.rs                   |  17 +-
 src/internal_events/heartbeat.rs              |  11 +-
 src/internal_events/host_metrics.rs           |  13 +-
 src/internal_events/http.rs                   |  25 +-
 src/internal_events/http_client.rs            |  22 +-
 src/internal_events/http_client_source.rs     |  13 +-
 src/internal_events/influxdb.rs               |   7 +-
 src/internal_events/internal_logs.rs          |  14 +-
 src/internal_events/journald.rs               |  14 +-
 src/internal_events/kafka.rs                  |  39 +-
 src/internal_events/kubernetes_logs.rs        |  34 +-
 src/internal_events/log_to_metric.rs          |  19 +-
 src/internal_events/logplex.rs                |   9 +-
 src/internal_events/loki.rs                   |  13 +-
 src/internal_events/lua.rs                    |  11 +-
 src/internal_events/metric_to_log.rs          |   7 +-
 src/internal_events/mongodb_metrics.rs        |  13 +-
 src/internal_events/mqtt.rs                   |   9 +-
 src/internal_events/nginx_metrics.rs          |  13 +-
 src/internal_events/open.rs                   |  11 +-
 src/internal_events/parser.rs                 |  15 +-
 src/internal_events/postgresql_metrics.rs     |   9 +-
 src/internal_events/process.rs                |  21 +-
 src/internal_events/prometheus.rs             |  17 +-
 src/internal_events/pulsar.rs                 |  15 +-
 src/internal_events/redis.rs                  |   9 +-
 src/internal_events/reduce.rs                 |  11 +-
 src/internal_events/remap.rs                  |   8 +-
 src/internal_events/sample.rs                 |   6 +-
 src/internal_events/sematext_metrics.rs       |  13 +-
 src/internal_events/socket.rs                 |  33 +-
 src/internal_events/splunk_hec.rs             |  39 +-
 src/internal_events/statsd_sink.rs            |   7 +-
 src/internal_events/tag_cardinality_limit.rs  |  17 +-
 src/internal_events/tcp.rs                    |  19 +-
 src/internal_events/template.rs               |  11 +-
 src/internal_events/throttle.rs               |   9 +-
 src/internal_events/udp.rs                    |  17 +-
 src/internal_events/unix.rs                   |  15 +-
 src/internal_events/websocket.rs              |  27 +-
 src/internal_events/websocket_server.rs       |  23 +-
 src/internal_events/windows.rs                |  19 +-
 src/internal_events/windows_event_log.rs      |  11 +-
 src/internal_telemetry/allocations/mod.rs     |  13 +-
 src/sources/internal_metrics.rs               |  47 ++-
 src/topology/builder.rs                       |   8 +-
 src/utilization.rs                            |   7 +-
 106 files changed, 1254 insertions(+), 711 deletions(-)
 create mode 100644 lib/vector-common/src/internal_event/metric_name.rs

diff --git a/Cargo.lock b/Cargo.lock
index 9bab182e05373..2e217d2d24c4f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -12939,6 +12939,7 @@ dependencies = [
  "sqlx",
  "stream-cancel",
  "strip-ansi-escapes",
+ "strum 0.28.0",
  "sysinfo",
  "syslog",
  "tempfile",
@@ -13064,6 +13065,7 @@ dependencies = [
  "serde_json",
  "smallvec",
  "stream-cancel",
+ "strum 0.28.0",
  "tokio",
  "tracing 0.1.44",
  "vector-common-macros",
@@ -13191,6 +13193,7 @@ dependencies = [
  "smallvec",
  "snafu 0.9.0",
  "socket2 0.5.10",
+ "strum 0.28.0",
  "tokio",
  "tokio-openssl",
  "tokio-stream",
diff --git a/Cargo.toml b/Cargo.toml
index 904f540cd26a5..e9cf7da0f400b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -479,6 +479,7 @@ openssl-src = { version = "300", default-features = false, features = ["force-en
 
 [dev-dependencies]
 approx = "0.5.1"
+strum.workspace = true
 assert_cmd = { version = "2.0.17", default-features = false }
 aws-smithy-runtime = { version = "1.8.3", default-features = false, features = ["tls-rustls"] }
 base64 = "0.22.1"
diff --git a/benches/metrics_snapshot.rs b/benches/metrics_snapshot.rs
index 279911e5e65a4..4df220256f7b9 100644
--- a/benches/metrics_snapshot.rs
+++ b/benches/metrics_snapshot.rs
@@ -1,4 +1,7 @@
 use criterion::{BenchmarkId, Criterion, criterion_group};
+use strum::IntoEnumIterator;
+use vector_lib::counter;
+use vector_lib::internal_event::CounterName;
 
 fn benchmark(c: &mut Criterion) {
     let mut group = c.benchmark_group("metrics_snapshot");
@@ -22,8 +25,9 @@ fn prepare_metrics(cardinality: usize) -> &'static vector::metrics::Controller {
     let controller = vector::metrics::Controller::get().unwrap();
     controller.reset();
 
+    let name = CounterName::iter().next().unwrap();
     for idx in 0..cardinality {
-        metrics::counter!("test", "idx" => idx.to_string()).increment(1);
+        counter!(name, "idx" => idx.to_string()).increment(1);
     }
 
     controller
diff --git a/clippy.toml b/clippy.toml
index cbd8c640fdb71..4aaa1eb15b360 100644
--- a/clippy.toml
+++ b/clippy.toml
@@ -8,6 +8,12 @@ disallowed-methods = [
   { path = "vrl::stdlib::all", reason = "Use `vector_vrl_functions::all()` instead for consistency across all Vector VRL functions." },
 ]
 
+disallowed-macros = [
+  { path = "metrics::counter", reason = "Use the `counter!` macro from `vector_common` with a `CounterName` variant instead of a raw string." },
+  { path = "metrics::histogram", reason = "Use the `histogram!` macro from `vector_common` with a `HistogramName` variant instead of a raw string." },
+  { path = "metrics::gauge", reason = "Use the `gauge!` macro from `vector_common` with a `GaugeName` variant instead of a raw string." },
+]
+
 disallowed-types = [
   { path = "once_cell::sync::OnceCell", reason = "Use `std::sync::OnceLock` instead." },
   { path = "once_cell::unsync::OnceCell", reason = "Use `std::cell::OnceCell` instead." },
diff --git a/lib/codecs/src/internal_events.rs b/lib/codecs/src/internal_events.rs
index d21119419887d..0518247e523a3 100644
--- a/lib/codecs/src/internal_events.rs
+++ b/lib/codecs/src/internal_events.rs
@@ -1,9 +1,12 @@
 //! Internal events for codecs.
 
-use metrics::counter;
 use tracing::error;
-use vector_common::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, emit, error_stage, error_type,
+use vector_common::{
+    counter,
+    internal_event::{
+        ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, emit, error_stage,
+        error_type,
+    },
 };
 use vector_common_macros::NamedInternalEvent;
 
@@ -24,7 +27,7 @@ impl<E: std::fmt::Display> InternalEvent for DecoderFramingError<E> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "decoder_frame",
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -50,7 +53,7 @@ impl InternalEvent for DecoderDeserializeError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "decoder_deserialize",
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -77,7 +80,7 @@ impl InternalEvent for EncoderFramingError<'_> {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "encoder_frame",
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::SENDING,
@@ -105,7 +108,7 @@ impl InternalEvent for EncoderSerializeError<'_> {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "encoder_serialize",
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::SENDING,
@@ -137,7 +140,7 @@ impl<E: std::fmt::Display> InternalEvent for EncoderWriteError<'_, E> {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::SENDING,
         )
@@ -170,7 +173,7 @@ impl InternalEvent for EncoderNullConstraintError<'_> {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "encoding_null_constraint",
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::SENDING,
@@ -201,7 +204,7 @@ impl<E: std::fmt::Display> InternalEvent for EncoderRecordBatchError<'_, E> {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => self.error_code,
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::SENDING,
@@ -228,7 +231,7 @@ impl InternalEvent for SchemaGenerationError<'_> {
             internal_log_rate_limit = false,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "parquet_schema_generation_failed",
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::SENDING,
@@ -255,7 +258,7 @@ impl InternalEvent for ArrowWriterError<'_> {
             internal_log_rate_limit = false,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "parquet_arrow_writer_failed",
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::SENDING,
@@ -281,7 +284,7 @@ impl InternalEvent for JsonSerializationError<'_> {
             internal_log_rate_limit = true,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::SENDING,
         )
diff --git a/lib/vector-buffers/src/internal_events.rs b/lib/vector-buffers/src/internal_events.rs
index 6d2735c7bb75f..31a6089322d0c 100644
--- a/lib/vector-buffers/src/internal_events.rs
+++ b/lib/vector-buffers/src/internal_events.rs
@@ -1,9 +1,10 @@
 use std::time::Duration;
 
-use metrics::{Histogram, counter, gauge, histogram};
+use metrics::Histogram;
 use vector_common::NamedInternalEvent;
 use vector_common::{
-    internal_event::{InternalEvent, error_type},
+    counter, gauge, histogram,
+    internal_event::{CounterName, GaugeName, HistogramName, InternalEvent, error_type},
     registered_event,
 };
 
@@ -21,14 +22,14 @@ impl InternalEvent for BufferCreated {
         let stage = self.idx.to_string();
         if self.max_size_events != 0 {
             gauge!(
-                "buffer_max_size_events",
+                GaugeName::BufferMaxSizeEvents,
                 "buffer_id" => self.buffer_id.clone(),
                 "stage" => stage.clone(),
             )
             .set(self.max_size_events as f64);
             // DEPRECATED: buffer-bytes-events-metrics
             gauge!(
-                "buffer_max_event_size",
+                GaugeName::BufferMaxEventSize,
                 "buffer_id" => self.buffer_id.clone(),
                 "stage" => stage.clone(),
             )
@@ -36,14 +37,14 @@ impl InternalEvent for BufferCreated {
         }
         if self.max_size_bytes != 0 {
             gauge!(
-                "buffer_max_size_bytes",
+                GaugeName::BufferMaxSizeBytes,
                 "buffer_id" => self.buffer_id.clone(),
                 "stage" => stage.clone(),
             )
             .set(self.max_size_bytes as f64);
             // DEPRECATED: buffer-bytes-events-metrics
             gauge!(
-                "buffer_max_byte_size",
+                GaugeName::BufferMaxByteSize,
                 "buffer_id" => self.buffer_id,
                 "stage" => stage,
             )
@@ -66,40 +67,40 @@ impl InternalEvent for BufferEventsReceived {
     #[expect(clippy::cast_precision_loss)]
     fn emit(self) {
         counter!(
-            "buffer_received_events_total",
+            CounterName::BufferReceivedEventsTotal,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .increment(self.count);
 
         counter!(
-            "buffer_received_bytes_total",
+            CounterName::BufferReceivedBytesTotal,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .increment(self.byte_size);
         // DEPRECATED: buffer-bytes-events-metrics
         gauge!(
-            "buffer_events",
+            GaugeName::BufferEvents,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .set(self.total_count as f64);
         gauge!(
-            "buffer_size_events",
+            GaugeName::BufferSizeEvents,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .set(self.total_count as f64);
         gauge!(
-            "buffer_size_bytes",
+            GaugeName::BufferSizeBytes,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .set(self.total_byte_size as f64);
         // DEPRECATED: buffer-bytes-events-metrics
         gauge!(
-            "buffer_byte_size",
+            GaugeName::BufferByteSize,
             "buffer_id" => self.buffer_id,
             "stage" => self.idx.to_string()
         )
@@ -121,39 +122,39 @@ impl InternalEvent for BufferEventsSent {
     #[expect(clippy::cast_precision_loss)]
     fn emit(self) {
         counter!(
-            "buffer_sent_events_total",
+            CounterName::BufferSentEventsTotal,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .increment(self.count);
         counter!(
-            "buffer_sent_bytes_total",
+            CounterName::BufferSentBytesTotal,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .increment(self.byte_size);
         // DEPRECATED: buffer-bytes-events-metrics
         gauge!(
-            "buffer_events",
+            GaugeName::BufferEvents,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .set(self.total_count as f64);
         gauge!(
-            "buffer_size_events",
+            GaugeName::BufferSizeEvents,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .set(self.total_count as f64);
         gauge!(
-            "buffer_size_bytes",
+            GaugeName::BufferSizeBytes,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .set(self.total_byte_size as f64);
         // DEPRECATED: buffer-bytes-events-metrics
         gauge!(
-            "buffer_byte_size",
+            GaugeName::BufferByteSize,
             "buffer_id" => self.buffer_id,
             "stage" => self.idx.to_string()
         )
@@ -200,14 +201,14 @@ impl InternalEvent for BufferEventsDropped {
         }
 
         counter!(
-            "buffer_discarded_events_total",
+            CounterName::BufferDiscardedEventsTotal,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string(),
             "intentional" => intentional_str,
         )
         .increment(self.count);
         counter!(
-            "buffer_discarded_bytes_total",
+            CounterName::BufferDiscardedBytesTotal,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string(),
             "intentional" => intentional_str,
@@ -215,26 +216,26 @@ impl InternalEvent for BufferEventsDropped {
         .increment(self.byte_size);
         // DEPRECATED: buffer-bytes-events-metrics
         gauge!(
-            "buffer_events",
+            GaugeName::BufferEvents,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .set(self.total_count as f64);
         gauge!(
-            "buffer_size_events",
+            GaugeName::BufferSizeEvents,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .set(self.total_count as f64);
         gauge!(
-            "buffer_size_bytes",
+            GaugeName::BufferSizeBytes,
             "buffer_id" => self.buffer_id.clone(),
             "stage" => self.idx.to_string()
         )
         .set(self.total_byte_size as f64);
         // DEPRECATED: buffer-bytes-events-metrics
         gauge!(
-            "buffer_byte_size",
+            GaugeName::BufferByteSize,
             "buffer_id" => self.buffer_id,
             "stage" => self.idx.to_string()
         )
@@ -258,7 +259,7 @@ impl InternalEvent for BufferReadError {
             stage = "processing",
         );
         counter!(
-            "buffer_errors_total", "error_code" => self.error_code,
+            CounterName::BufferErrorsTotal, "error_code" => self.error_code,
             "error_type" => "reader_failed",
             "stage" => "processing",
         )
@@ -270,7 +271,7 @@ registered_event! {
     BufferSendDuration {
         stage: usize,
     } => {
-        send_duration: Histogram = histogram!("buffer_send_duration_seconds", "stage" => self.stage.to_string()),
+        send_duration: Histogram = histogram!(HistogramName::BufferSendDurationSeconds, "stage" => self.stage.to_string()),
     }
 
     fn emit(&self, duration: Duration) {
diff --git a/lib/vector-buffers/src/topology/channel/limited_queue.rs b/lib/vector-buffers/src/topology/channel/limited_queue.rs
index a246aa9659812..3e1f3f7c98c93 100644
--- a/lib/vector-buffers/src/topology/channel/limited_queue.rs
+++ b/lib/vector-buffers/src/topology/channel/limited_queue.rs
@@ -127,6 +127,7 @@ struct Metrics {
 
 impl Metrics {
     #[expect(clippy::cast_precision_loss)] // We have to convert buffer sizes for a gauge, it's okay to lose precision here.
+    #[allow(clippy::disallowed_macros)] // Metric names are constructed dynamically from runtime prefixes.
     fn new(
         limit: MemoryBufferSize,
         metadata: ChannelMetricMetadata,
diff --git a/lib/vector-common/Cargo.toml b/lib/vector-common/Cargo.toml
index 95098f19b1bd3..a583641c68cec 100644
--- a/lib/vector-common/Cargo.toml
+++ b/lib/vector-common/Cargo.toml
@@ -48,6 +48,7 @@ pin-project.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 smallvec = { version = "1", default-features = false }
+strum.workspace = true
 stream-cancel = { version = "0.8.2", default-features = false }
 tokio = { workspace = true, features = ["macros", "time"] }
 tracing.workspace = true
diff --git a/lib/vector-common/src/internal_event/bytes_received.rs b/lib/vector-common/src/internal_event/bytes_received.rs
index 98044ecb84570..4264c3cbc365a 100644
--- a/lib/vector-common/src/internal_event/bytes_received.rs
+++ b/lib/vector-common/src/internal_event/bytes_received.rs
@@ -1,12 +1,14 @@
-use metrics::{Counter, counter};
+use metrics::Counter;
 
-use super::{ByteSize, Protocol, SharedString};
+use crate::counter;
+
+use super::{ByteSize, CounterName, Protocol, SharedString};
 
 crate::registered_event!(
     BytesReceived {
         protocol: SharedString,
     } => {
-        received_bytes: Counter = counter!("component_received_bytes_total", "protocol" => self.protocol.clone()),
+        received_bytes: Counter = counter!(CounterName::ComponentReceivedBytesTotal, "protocol" => self.protocol.clone()),
         protocol: SharedString = self.protocol,
     }
 
diff --git a/lib/vector-common/src/internal_event/bytes_sent.rs b/lib/vector-common/src/internal_event/bytes_sent.rs
index 0b2a88247f96c..b363893783f43 100644
--- a/lib/vector-common/src/internal_event/bytes_sent.rs
+++ b/lib/vector-common/src/internal_event/bytes_sent.rs
@@ -1,13 +1,15 @@
-use metrics::{Counter, counter};
+use metrics::Counter;
+
+use crate::counter;
 use tracing::trace;
 
-use super::{ByteSize, Protocol, SharedString};
+use super::{ByteSize, CounterName, Protocol, SharedString};
 
 crate::registered_event!(
     BytesSent {
         protocol: SharedString,
     } => {
-        bytes_sent: Counter = counter!("component_sent_bytes_total", "protocol" => self.protocol.clone()),
+        bytes_sent: Counter = counter!(CounterName::ComponentSentBytesTotal, "protocol" => self.protocol.clone()),
         protocol: SharedString = self.protocol,
     }
 
diff --git a/lib/vector-common/src/internal_event/cached_event.rs b/lib/vector-common/src/internal_event/cached_event.rs
index 782faeb5a1d01..ec3d492998ab4 100644
--- a/lib/vector-common/src/internal_event/cached_event.rs
+++ b/lib/vector-common/src/internal_event/cached_event.rs
@@ -91,34 +91,36 @@ where
 #[cfg(test)]
 mod tests {
     #![allow(unreachable_pub)]
-    use metrics::{Counter, counter};
+    use metrics::Counter;
+    use strum::IntoEnumIterator;
 
     use super::*;
-
-    crate::registered_event!(
-        TestEvent {
-            fixed: String,
-            dynamic: String,
-        } => {
-            event: Counter = {
-                counter!("test_event_total", "fixed" => self.fixed, "dynamic" => self.dynamic)
-            },
-        }
-
-        fn emit(&self, count: u64) {
-            self.event.increment(count);
-        }
-
-        fn register(fixed: String, dynamic: String) {
-            crate::internal_event::register(TestEvent {
-                fixed,
-                dynamic,
-            })
-        }
-    );
+    use crate::internal_event::CounterName;
 
     #[test]
     fn test_fixed_tag() {
+        crate::registered_event!(
+            TestEvent {
+                fixed: String,
+                dynamic: String,
+            } => {
+                event: Counter = {
+                    crate::counter!(CounterName::iter().next().unwrap(), "fixed" => self.fixed, "dynamic" => self.dynamic)
+                },
+            }
+
+            fn emit(&self, count: u64) {
+                self.event.increment(count);
+            }
+
+            fn register(fixed: String, dynamic: String) {
+                crate::internal_event::register(TestEvent {
+                    fixed,
+                    dynamic,
+                })
+            }
+        );
+
         let event: RegisteredEventCache<String, TestEvent> =
             RegisteredEventCache::new("fixed".to_string());
 
diff --git a/lib/vector-common/src/internal_event/component_events_dropped.rs b/lib/vector-common/src/internal_event/component_events_dropped.rs
index bf45c054e45e1..8421d1d0f49ae 100644
--- a/lib/vector-common/src/internal_event/component_events_dropped.rs
+++ b/lib/vector-common/src/internal_event/component_events_dropped.rs
@@ -1,6 +1,8 @@
-use metrics::{Counter, counter};
+use metrics::Counter;
 
-use super::{Count, InternalEvent, InternalEventHandle, RegisterInternalEvent};
+use crate::counter;
+
+use super::{Count, CounterName, InternalEvent, InternalEventHandle, RegisterInternalEvent};
 use crate::NamedInternalEvent;
 
 pub const INTENTIONAL: bool = true;
@@ -32,7 +34,7 @@ impl<'a, const INTENTIONAL: bool> RegisterInternalEvent
     fn register(self) -> Self::Handle {
         Self::Handle {
             discarded_events: counter!(
-                "component_discarded_events_total",
+                CounterName::ComponentDiscardedEventsTotal,
                 "intentional" => if INTENTIONAL { "true" } else { "false" },
             ),
             reason: self.reason,
diff --git a/lib/vector-common/src/internal_event/component_events_timed_out.rs b/lib/vector-common/src/internal_event/component_events_timed_out.rs
index bf138dd1481c7..4662322fe9776 100644
--- a/lib/vector-common/src/internal_event/component_events_timed_out.rs
+++ b/lib/vector-common/src/internal_event/component_events_timed_out.rs
@@ -1,13 +1,15 @@
-use metrics::{Counter, counter};
+use metrics::Counter;
 
-use super::Count;
+use crate::counter;
+
+use super::{Count, CounterName};
 
 crate::registered_event! {
     ComponentEventsTimedOut {
         reason: &'static str,
     } => {
-        timed_out_events: Counter = counter!("component_timed_out_events_total"),
-        timed_out_requests: Counter = counter!("component_timed_out_requests_total"),
+        timed_out_events: Counter = counter!(CounterName::ComponentTimedOutEventsTotal),
+        timed_out_requests: Counter = counter!(CounterName::ComponentTimedOutRequestsTotal),
         reason: &'static str = self.reason,
     }
 
diff --git a/lib/vector-common/src/internal_event/events_received.rs b/lib/vector-common/src/internal_event/events_received.rs
index 40ba999a8cfca..a08ebc6e8438b 100644
--- a/lib/vector-common/src/internal_event/events_received.rs
+++ b/lib/vector-common/src/internal_event/events_received.rs
@@ -1,13 +1,15 @@
-use metrics::{Counter, Histogram, counter, histogram};
+use metrics::{Counter, Histogram};
+
+use crate::{counter, histogram};
 use tracing::trace;
 
-use super::CountByteSize;
+use super::{CountByteSize, CounterName, HistogramName};
 
 crate::registered_event!(
     EventsReceived => {
-        events_count: Histogram = histogram!("component_received_events_count"),
-        events: Counter = counter!("component_received_events_total"),
-        event_bytes: Counter = counter!("component_received_event_bytes_total"),
+        events_count: Histogram = histogram!(HistogramName::ComponentReceivedEventsCount),
+        events: Counter = counter!(CounterName::ComponentReceivedEventsTotal),
+        event_bytes: Counter = counter!(CounterName::ComponentReceivedEventBytesTotal),
     }
 
     fn emit(&self, data: CountByteSize) {
diff --git a/lib/vector-common/src/internal_event/events_sent.rs b/lib/vector-common/src/internal_event/events_sent.rs
index 21e11260b2d38..3ae63db761381 100644
--- a/lib/vector-common/src/internal_event/events_sent.rs
+++ b/lib/vector-common/src/internal_event/events_sent.rs
@@ -1,9 +1,11 @@
 use std::sync::Arc;
 
-use metrics::{Counter, counter};
+use metrics::Counter;
+
+use crate::counter;
 use tracing::trace;
 
-use super::{CountByteSize, OptionalTag, Output, SharedString};
+use super::{CountByteSize, CounterName, OptionalTag, Output, SharedString};
 use crate::config::ComponentKey;
 
 pub const DEFAULT_OUTPUT: &str = "_default";
@@ -13,14 +15,14 @@ crate::registered_event!(
         output: Option<SharedString>,
     } => {
         events: Counter = if let Some(output) = &self.output {
-            counter!("component_sent_events_total", "output" => output.clone())
+            counter!(CounterName::ComponentSentEventsTotal, "output" => output.clone())
         } else {
-            counter!("component_sent_events_total")
+            counter!(CounterName::ComponentSentEventsTotal)
         },
         event_bytes: Counter = if let Some(output) = &self.output {
-            counter!("component_sent_event_bytes_total", "output" => output.clone())
+            counter!(CounterName::ComponentSentEventBytesTotal, "output" => output.clone())
         } else {
-            counter!("component_sent_event_bytes_total")
+            counter!(CounterName::ComponentSentEventBytesTotal)
         },
         output: Option<SharedString> = self.output,
     }
@@ -75,10 +77,10 @@ crate::registered_event!(
         service: OptionalTag<String>,
     } => {
         events: Counter = {
-            counter!("component_sent_events_total", &make_tags(&self.source, &self.service))
+            counter!(CounterName::ComponentSentEventsTotal, &make_tags(&self.source, &self.service))
         },
         event_bytes: Counter = {
-            counter!("component_sent_event_bytes_total", &make_tags(&self.source, &self.service))
+            counter!(CounterName::ComponentSentEventBytesTotal, &make_tags(&self.source, &self.service))
         },
     }
 
diff --git a/lib/vector-common/src/internal_event/metric_name.rs b/lib/vector-common/src/internal_event/metric_name.rs
new file mode 100644
index 0000000000000..21314695a13bf
--- /dev/null
+++ b/lib/vector-common/src/internal_event/metric_name.rs
@@ -0,0 +1,337 @@
+use strum::{AsRefStr, Display, EnumIter};
+
+/// Canonical list of all per-component internal metric names emitted by Vector.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Display, AsRefStr, EnumIter)]
+#[strum(serialize_all = "snake_case")]
+pub enum CounterName {
+    ComponentReceivedEventsTotal,
+    ComponentReceivedEventBytesTotal,
+    ComponentReceivedBytesTotal,
+    ComponentSentEventsTotal,
+    ComponentSentEventBytesTotal,
+    ComponentSentBytesTotal,
+    ComponentDiscardedEventsTotal,
+    ComponentErrorsTotal,
+    ComponentTimedOutEventsTotal,
+    ComponentTimedOutRequestsTotal,
+    BufferReceivedEventsTotal,
+    BufferReceivedBytesTotal,
+    BufferSentEventsTotal,
+    BufferSentBytesTotal,
+    BufferDiscardedEventsTotal,
+    BufferDiscardedBytesTotal,
+    BufferErrorsTotal,
+    // Internal events from src/internal_events/
+    AggregateEventsRecordedTotal,
+    AggregateFailedUpdates,
+    AggregateFlushesTotal,
+    ApiStartedTotal,
+    CheckpointsTotal,
+    ChecksumErrorsTotal,
+    CollectCompletedTotal,
+    CommandExecutedTotal,
+    ConnectionEstablishedTotal,
+    ConnectionSendErrorsTotal,
+    ConnectionShutdownTotal,
+    ContainerProcessedEventsTotal,
+    ContainersUnwatchedTotal,
+    ContainersWatchedTotal,
+    DecoderBomRemovalsTotal,
+    DecoderMalformedReplacementWarningsTotal,
+    DorisBytesLoadedTotal,
+    DorisRowsFilteredTotal,
+    DorisRowsLoadedTotal,
+    EncoderUnmappableReplacementWarningsTotal,
+    EventsDiscardedTotal,
+    FilesAddedTotal,
+    FilesDeletedTotal,
+    FilesResumedTotal,
+    FilesUnwatchedTotal,
+    GrpcServerMessagesReceivedTotal,
+    GrpcServerMessagesSentTotal,
+    HttpClientErrorsTotal,
+    HttpClientRequestsSentTotal,
+    HttpClientResponsesTotal,
+    HttpServerRequestsReceivedTotal,
+    HttpServerResponsesSentTotal,
+    KafkaConsumedMessagesBytesTotal,
+    KafkaConsumedMessagesTotal,
+    KafkaProducedMessagesBytesTotal,
+    KafkaProducedMessagesTotal,
+    KafkaRequestsBytesTotal,
+    KafkaRequestsTotal,
+    KafkaResponsesBytesTotal,
+    KafkaResponsesTotal,
+    MetadataRefreshFailedTotal,
+    MetadataRefreshSuccessfulTotal,
+    ParseErrorsTotal,
+    QuitTotal,
+    ReloadedTotal,
+    RewrittenTimestampEventsTotal,
+    SqsMessageDeferSucceededTotal,
+    SqsMessageDeleteSucceededTotal,
+    SqsMessageProcessingSucceededTotal,
+    SqsMessageReceiveSucceededTotal,
+    SqsMessageReceivedMessagesTotal,
+    StaleEventsFlushedTotal,
+    StartedTotal,
+    StoppedTotal,
+    TagValueLimitExceededTotal,
+    ValueLimitReachedTotal,
+    WebsocketBytesSentTotal,
+    WebsocketMessagesSentTotal,
+    WindowsServiceInstallTotal,
+    WindowsServiceRestartTotal,
+    WindowsServiceStartTotal,
+    WindowsServiceStopTotal,
+    WindowsServiceUninstallTotal,
+    K8sEventNamespaceAnnotationFailuresTotal,
+    K8sEventNodeAnnotationFailuresTotal,
+    K8sFormatPickerEdgeCasesTotal,
+    K8sDockerFormatParseFailuresTotal,
+    SqsS3EventRecordIgnoredTotal,
+    ComponentAllocatedBytesTotal,
+    ComponentDeallocatedBytesTotal,
+    MemoryEnrichmentTableFailedInsertions,
+    MemoryEnrichmentTableFailedReads,
+    MemoryEnrichmentTableFlushesTotal,
+    MemoryEnrichmentTableInsertionsTotal,
+    MemoryEnrichmentTableReadsTotal,
+    MemoryEnrichmentTableTtlExpirations,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Display, AsRefStr, EnumIter)]
+#[strum(serialize_all = "snake_case")]
+pub enum HistogramName {
+    ComponentReceivedEventsCount,
+    ComponentReceivedBytes,
+    BufferSendDurationSeconds,
+    ComponentLatencySeconds,
+    SourceLagTimeSeconds,
+    SourceSendLatencySeconds,
+    SourceSendBatchLatencySeconds,
+    AdaptiveConcurrencyAveragedRtt,
+    AdaptiveConcurrencyBackPressure,
+    AdaptiveConcurrencyInFlight,
+    AdaptiveConcurrencyLimit,
+    AdaptiveConcurrencyObservedRtt,
+    AdaptiveConcurrencyPastRttMean,
+    AdaptiveConcurrencyReachedLimit,
+    S3ObjectProcessingSucceededDurationSeconds,
+    S3ObjectProcessingFailedDurationSeconds,
+    CollectDurationSeconds,
+    CommandExecutionDurationSeconds,
+    GrpcServerHandlerDurationSeconds,
+    HttpServerHandlerDurationSeconds,
+    HttpClientRttSeconds,
+    HttpClientResponseRttSeconds,
+    HttpClientErrorRttSeconds,
+}
+
+impl HistogramName {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::ComponentReceivedEventsCount => "component_received_events_count",
+            Self::ComponentReceivedBytes => "component_received_bytes",
+            Self::BufferSendDurationSeconds => "buffer_send_duration_seconds",
+            Self::ComponentLatencySeconds => "component_latency_seconds",
+            Self::SourceLagTimeSeconds => "source_lag_time_seconds",
+            Self::SourceSendLatencySeconds => "source_send_latency_seconds",
+            Self::SourceSendBatchLatencySeconds => "source_send_batch_latency_seconds",
+            Self::AdaptiveConcurrencyAveragedRtt => "adaptive_concurrency_averaged_rtt",
+            Self::AdaptiveConcurrencyBackPressure => "adaptive_concurrency_back_pressure",
+            Self::AdaptiveConcurrencyInFlight => "adaptive_concurrency_in_flight",
+            Self::AdaptiveConcurrencyLimit => "adaptive_concurrency_limit",
+            Self::AdaptiveConcurrencyObservedRtt => "adaptive_concurrency_observed_rtt",
+            Self::AdaptiveConcurrencyPastRttMean => "adaptive_concurrency_past_rtt_mean",
+            Self::AdaptiveConcurrencyReachedLimit => "adaptive_concurrency_reached_limit",
+            Self::S3ObjectProcessingSucceededDurationSeconds => {
+                "s3_object_processing_succeeded_duration_seconds"
+            }
+            Self::S3ObjectProcessingFailedDurationSeconds => {
+                "s3_object_processing_failed_duration_seconds"
+            }
+            Self::CollectDurationSeconds => "collect_duration_seconds",
+            Self::CommandExecutionDurationSeconds => "command_execution_duration_seconds",
+            Self::GrpcServerHandlerDurationSeconds => "grpc_server_handler_duration_seconds",
+            Self::HttpServerHandlerDurationSeconds => "http_server_handler_duration_seconds",
+            Self::HttpClientRttSeconds => "http_client_rtt_seconds",
+            Self::HttpClientResponseRttSeconds => "http_client_response_rtt_seconds",
+            Self::HttpClientErrorRttSeconds => "http_client_error_rtt_seconds",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Display, AsRefStr, EnumIter)]
+#[strum(serialize_all = "snake_case")]
+pub enum GaugeName {
+    ComponentLatencyMeanSeconds,
+    BufferMaxSizeEvents,
+    BufferMaxEventSize,
+    BufferMaxSizeBytes,
+    BufferMaxByteSize,
+    BufferEvents,
+    BufferSizeEvents,
+    BufferSizeBytes,
+    BufferByteSize,
+    Utilization,
+    ComponentAllocatedBytes,
+    OpenFiles,
+    UptimeSeconds,
+    BuildInfo,
+    KafkaQueueMessages,
+    KafkaQueueMessagesBytes,
+    KafkaConsumerLag,
+    LuaMemoryUsedBytes,
+    OpenConnections,
+    ActiveEndpoints,
+    SplunkPendingAcks,
+    ActiveClients,
+    MemoryEnrichmentTableObjectsCount,
+    MemoryEnrichmentTableByteSize,
+}
+
+impl GaugeName {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::ComponentLatencyMeanSeconds => "component_latency_mean_seconds",
+            Self::BufferMaxSizeEvents => "buffer_max_size_events",
+            Self::BufferMaxEventSize => "buffer_max_event_size",
+            Self::BufferMaxSizeBytes => "buffer_max_size_bytes",
+            Self::BufferMaxByteSize => "buffer_max_byte_size",
+            Self::BufferEvents => "buffer_events",
+            Self::BufferSizeEvents => "buffer_size_events",
+            Self::BufferSizeBytes => "buffer_size_bytes",
+            Self::BufferByteSize => "buffer_byte_size",
+            Self::Utilization => "utilization",
+            Self::ComponentAllocatedBytes => "component_allocated_bytes",
+            Self::OpenFiles => "open_files",
+            Self::UptimeSeconds => "uptime_seconds",
+            Self::BuildInfo => "build_info",
+            Self::KafkaQueueMessages => "kafka_queue_messages",
+            Self::KafkaQueueMessagesBytes => "kafka_queue_messages_bytes",
+            Self::KafkaConsumerLag => "kafka_consumer_lag",
+            Self::LuaMemoryUsedBytes => "lua_memory_used_bytes",
+            Self::OpenConnections => "open_connections",
+            Self::ActiveEndpoints => "active_endpoints",
+            Self::SplunkPendingAcks => "splunk_pending_acks",
+            Self::ActiveClients => "active_clients",
+            Self::MemoryEnrichmentTableObjectsCount => "memory_enrichment_table_objects_count",
+            Self::MemoryEnrichmentTableByteSize => "memory_enrichment_table_byte_size",
+        }
+    }
+}
+
+impl CounterName {
+    #[allow(clippy::too_many_lines)]
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::ComponentReceivedEventsTotal => "component_received_events_total",
+            Self::ComponentReceivedEventBytesTotal => "component_received_event_bytes_total",
+            Self::ComponentReceivedBytesTotal => "component_received_bytes_total",
+            Self::ComponentSentEventsTotal => "component_sent_events_total",
+            Self::ComponentSentEventBytesTotal => "component_sent_event_bytes_total",
+            Self::ComponentSentBytesTotal => "component_sent_bytes_total",
+            Self::ComponentDiscardedEventsTotal => "component_discarded_events_total",
+            Self::ComponentErrorsTotal => "component_errors_total",
+            Self::ComponentTimedOutEventsTotal => "component_timed_out_events_total",
+            Self::ComponentTimedOutRequestsTotal => "component_timed_out_requests_total",
+            Self::BufferReceivedEventsTotal => "buffer_received_events_total",
+            Self::BufferReceivedBytesTotal => "buffer_received_bytes_total",
+            Self::BufferSentEventsTotal => "buffer_sent_events_total",
+            Self::BufferSentBytesTotal => "buffer_sent_bytes_total",
+            Self::BufferDiscardedEventsTotal => "buffer_discarded_events_total",
+            Self::BufferDiscardedBytesTotal => "buffer_discarded_bytes_total",
+            Self::BufferErrorsTotal => "buffer_errors_total",
+            Self::AggregateEventsRecordedTotal => "aggregate_events_recorded_total",
+            Self::AggregateFailedUpdates => "aggregate_failed_updates",
+            Self::AggregateFlushesTotal => "aggregate_flushes_total",
+            Self::ApiStartedTotal => "api_started_total",
+            Self::CheckpointsTotal => "checkpoints_total",
+            Self::ChecksumErrorsTotal => "checksum_errors_total",
+            Self::CollectCompletedTotal => "collect_completed_total",
+            Self::CommandExecutedTotal => "command_executed_total",
+            Self::ConnectionEstablishedTotal => "connection_established_total",
+            Self::ConnectionSendErrorsTotal => "connection_send_errors_total",
+            Self::ConnectionShutdownTotal => "connection_shutdown_total",
+            Self::ContainerProcessedEventsTotal => "container_processed_events_total",
+            Self::ContainersUnwatchedTotal => "containers_unwatched_total",
+            Self::ContainersWatchedTotal => "containers_watched_total",
+            Self::DecoderBomRemovalsTotal => "decoder_bom_removals_total",
+            Self::DecoderMalformedReplacementWarningsTotal => {
+                "decoder_malformed_replacement_warnings_total"
+            }
+            Self::DorisBytesLoadedTotal => "doris_bytes_loaded_total",
+            Self::DorisRowsFilteredTotal => "doris_rows_filtered_total",
+            Self::DorisRowsLoadedTotal => "doris_rows_loaded_total",
+            Self::EncoderUnmappableReplacementWarningsTotal => {
+                "encoder_unmappable_replacement_warnings_total"
+            }
+            Self::EventsDiscardedTotal => "events_discarded_total",
+            Self::FilesAddedTotal => "files_added_total",
+            Self::FilesDeletedTotal => "files_deleted_total",
+            Self::FilesResumedTotal => "files_resumed_total",
+            Self::FilesUnwatchedTotal => "files_unwatched_total",
+            Self::GrpcServerMessagesReceivedTotal => "grpc_server_messages_received_total",
+            Self::GrpcServerMessagesSentTotal => "grpc_server_messages_sent_total",
+            Self::HttpClientErrorsTotal => "http_client_errors_total",
+            Self::HttpClientRequestsSentTotal => "http_client_requests_sent_total",
+            Self::HttpClientResponsesTotal => "http_client_responses_total",
+            Self::HttpServerRequestsReceivedTotal => "http_server_requests_received_total",
+            Self::HttpServerResponsesSentTotal => "http_server_responses_sent_total",
+            Self::KafkaConsumedMessagesBytesTotal => "kafka_consumed_messages_bytes_total",
+            Self::KafkaConsumedMessagesTotal => "kafka_consumed_messages_total",
+            Self::KafkaProducedMessagesBytesTotal => "kafka_produced_messages_bytes_total",
+            Self::KafkaProducedMessagesTotal => "kafka_produced_messages_total",
+            Self::KafkaRequestsBytesTotal => "kafka_requests_bytes_total",
+            Self::KafkaRequestsTotal => "kafka_requests_total",
+            Self::KafkaResponsesBytesTotal => "kafka_responses_bytes_total",
+            Self::KafkaResponsesTotal => "kafka_responses_total",
+            Self::MetadataRefreshFailedTotal => "metadata_refresh_failed_total",
+            Self::MetadataRefreshSuccessfulTotal => "metadata_refresh_successful_total",
+            Self::ParseErrorsTotal => "parse_errors_total",
+            Self::QuitTotal => "quit_total",
+            Self::ReloadedTotal => "reloaded_total",
+            Self::RewrittenTimestampEventsTotal => "rewritten_timestamp_events_total",
+            Self::SqsMessageDeferSucceededTotal => "sqs_message_defer_succeeded_total",
+            Self::SqsMessageDeleteSucceededTotal => "sqs_message_delete_succeeded_total",
+            Self::SqsMessageProcessingSucceededTotal => "sqs_message_processing_succeeded_total",
+            Self::SqsMessageReceiveSucceededTotal => "sqs_message_receive_succeeded_total",
+            Self::SqsMessageReceivedMessagesTotal => "sqs_message_received_messages_total",
+            Self::StaleEventsFlushedTotal => "stale_events_flushed_total",
+            Self::StartedTotal => "started_total",
+            Self::StoppedTotal => "stopped_total",
+            Self::TagValueLimitExceededTotal => "tag_value_limit_exceeded_total",
+            Self::ValueLimitReachedTotal => "value_limit_reached_total",
+            Self::WebsocketBytesSentTotal => "websocket_bytes_sent_total",
+            Self::WebsocketMessagesSentTotal => "websocket_messages_sent_total",
+            Self::WindowsServiceInstallTotal => "windows_service_install_total",
+            Self::WindowsServiceRestartTotal => "windows_service_restart_total",
+            Self::WindowsServiceStartTotal => "windows_service_start_total",
+            Self::WindowsServiceStopTotal => "windows_service_stop_total",
+            Self::WindowsServiceUninstallTotal => "windows_service_uninstall_total",
+            Self::K8sEventNamespaceAnnotationFailuresTotal => {
+                "k8s_event_namespace_annotation_failures_total"
+            }
+            Self::K8sEventNodeAnnotationFailuresTotal => "k8s_event_node_annotation_failures_total",
+            Self::K8sFormatPickerEdgeCasesTotal => "k8s_format_picker_edge_cases_total",
+            Self::K8sDockerFormatParseFailuresTotal => "k8s_docker_format_parse_failures_total",
+            Self::SqsS3EventRecordIgnoredTotal => "sqs_s3_event_record_ignored_total",
+            Self::ComponentAllocatedBytesTotal => "component_allocated_bytes_total",
+            Self::ComponentDeallocatedBytesTotal => "component_deallocated_bytes_total",
+            Self::MemoryEnrichmentTableFailedInsertions => {
+                "memory_enrichment_table_failed_insertions"
+            }
+            Self::MemoryEnrichmentTableFailedReads => "memory_enrichment_table_failed_reads",
+            Self::MemoryEnrichmentTableFlushesTotal => "memory_enrichment_table_flushes_total",
+            Self::MemoryEnrichmentTableInsertionsTotal => {
+                "memory_enrichment_table_insertions_total"
+            }
+            Self::MemoryEnrichmentTableReadsTotal => "memory_enrichment_table_reads_total",
+            Self::MemoryEnrichmentTableTtlExpirations => "memory_enrichment_table_ttl_expirations",
+        }
+    }
+}
diff --git a/lib/vector-common/src/internal_event/mod.rs b/lib/vector-common/src/internal_event/mod.rs
index 272e2344900e3..e776e89553172 100644
--- a/lib/vector-common/src/internal_event/mod.rs
+++ b/lib/vector-common/src/internal_event/mod.rs
@@ -5,6 +5,7 @@ pub mod component_events_dropped;
 pub mod component_events_timed_out;
 mod events_received;
 mod events_sent;
+pub mod metric_name;
 mod optional_tag;
 mod prelude;
 pub mod service;
@@ -19,6 +20,7 @@ pub use component_events_dropped::{ComponentEventsDropped, INTENTIONAL, UNINTENT
 pub use component_events_timed_out::ComponentEventsTimedOut;
 pub use events_received::{EventsReceived, EventsReceivedHandle};
 pub use events_sent::{DEFAULT_OUTPUT, EventsSent, TaggedEventsSent};
+pub use metric_name::{CounterName, GaugeName, HistogramName};
 pub use metrics::SharedString;
 pub use optional_tag::OptionalTag;
 pub use prelude::{error_stage, error_type};
diff --git a/lib/vector-common/src/internal_event/service.rs b/lib/vector-common/src/internal_event/service.rs
index 93a3c9b745722..60d615b3d61a0 100644
--- a/lib/vector-common/src/internal_event/service.rs
+++ b/lib/vector-common/src/internal_event/service.rs
@@ -1,4 +1,6 @@
-use metrics::counter;
+use super::CounterName;
+
+use crate::counter;
 
 use super::{ComponentEventsDropped, InternalEvent, UNINTENTIONAL, emit, error_stage, error_type};
 use crate::NamedInternalEvent;
@@ -17,7 +19,7 @@ impl<E: std::fmt::Debug> InternalEvent for PollReadyError<E> {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::SENDING,
         )
@@ -43,7 +45,7 @@ impl<E: std::fmt::Debug> InternalEvent for CallError<E> {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::SENDING,
         )
diff --git a/lib/vector-common/src/lib.rs b/lib/vector-common/src/lib.rs
index 099a068578090..75849aac75884 100644
--- a/lib/vector-common/src/lib.rs
+++ b/lib/vector-common/src/lib.rs
@@ -66,6 +66,63 @@ pub mod trigger;
 #[macro_use]
 extern crate tracing;
 
+/// Typed wrapper around `metrics::counter!` that only accepts [`internal_event::CounterName`].
+#[macro_export]
+macro_rules! counter {
+    ($name:expr) => {{
+        let _name: $crate::internal_event::CounterName = $name;
+        #[allow(clippy::disallowed_macros)]
+        {
+            metrics::counter!(_name.as_str())
+        }
+    }};
+    ($name:expr, $($rest:tt)*) => {{
+        let _name: $crate::internal_event::CounterName = $name;
+        #[allow(clippy::disallowed_macros)]
+        {
+            metrics::counter!(_name.as_str(), $($rest)*)
+        }
+    }};
+}
+
+/// Typed wrapper around `metrics::histogram!` that only accepts [`internal_event::HistogramName`].
+#[macro_export]
+macro_rules! histogram {
+    ($name:expr) => {{
+        let _name: $crate::internal_event::HistogramName = $name;
+        #[allow(clippy::disallowed_macros)]
+        {
+            metrics::histogram!(_name.as_str())
+        }
+    }};
+    ($name:expr, $($rest:tt)*) => {{
+        let _name: $crate::internal_event::HistogramName = $name;
+        #[allow(clippy::disallowed_macros)]
+        {
+            metrics::histogram!(_name.as_str(), $($rest)*)
+        }
+    }};
+}
+
+/// Typed wrapper around `metrics::gauge!` that only accepts [`internal_event::GaugeName`].
+#[macro_export]
+macro_rules! gauge {
+    ($name:expr) => {{
+        let _name: $crate::internal_event::GaugeName = $name;
+        #[allow(clippy::disallowed_macros)]
+        {
+            metrics::gauge!(_name.as_str())
+        }
+    }};
+    ($name:expr, $($rest:tt)*) => {{
+        let _name: $crate::internal_event::GaugeName = $name;
+        #[allow(clippy::disallowed_macros)]
+        {
+            metrics::gauge!(_name.as_str(), $($rest)*)
+        }
+    }};
+}
+
 /// Vector's basic error type, dynamically dispatched and safe to send across
 /// threads.
 pub type Error = Box<dyn std::error::Error + Send + Sync + 'static>;
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index 5c3370ac1a526..edf7b43a4a74f 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -78,6 +78,7 @@ prost-build.workspace = true
 
 [dev-dependencies]
 base64 = "0.22.1"
+strum.workspace = true
 chrono-tz.workspace = true
 criterion = { workspace = true, features = ["html_reports"] }
 env-test-util = "1.0.1"
diff --git a/lib/vector-core/src/latency.rs b/lib/vector-core/src/latency.rs
index 536a8ef532d0d..b25ca73427749 100644
--- a/lib/vector-core/src/latency.rs
+++ b/lib/vector-core/src/latency.rs
@@ -1,12 +1,14 @@
 use std::time::Instant;
 
-use metrics::{Histogram, gauge, histogram};
+use metrics::Histogram;
 use vector_common::stats::EwmaGauge;
+use vector_common::{
+    gauge, histogram,
+    internal_event::{GaugeName, HistogramName},
+};
 
 use crate::event::EventArray;
 
-const COMPONENT_LATENCY: &str = "component_latency_seconds";
-const COMPONENT_LATENCY_MEAN: &str = "component_latency_mean_seconds";
 const DEFAULT_LATENCY_EWMA_ALPHA: f64 = 0.9;
 
 #[derive(Debug)]
@@ -18,9 +20,9 @@ pub struct LatencyRecorder {
 impl LatencyRecorder {
     pub fn new(ewma_alpha: Option<f64>) -> Self {
         Self {
-            histogram: histogram!(COMPONENT_LATENCY),
+            histogram: histogram!(HistogramName::ComponentLatencySeconds),
             gauge: EwmaGauge::new(
-                gauge!(COMPONENT_LATENCY_MEAN),
+                gauge!(GaugeName::ComponentLatencyMeanSeconds),
                 ewma_alpha.or(Some(DEFAULT_LATENCY_EWMA_ALPHA)),
             ),
         }
diff --git a/lib/vector-core/src/metrics/mod.rs b/lib/vector-core/src/metrics/mod.rs
index cd900d392f004..ea4c040163c7f 100644
--- a/lib/vector-core/src/metrics/mod.rs
+++ b/lib/vector-core/src/metrics/mod.rs
@@ -202,6 +202,12 @@ impl Controller {
 
 #[cfg(test)]
 mod tests {
+    use strum::IntoEnumIterator;
+    use vector_common::{
+        counter, gauge,
+        internal_event::{CounterName, GaugeName},
+    };
+
     use super::*;
     use crate::{
         config::metrics_expiration::{
@@ -224,8 +230,9 @@ mod tests {
             let controller = Controller::get().unwrap();
             controller.reset();
 
+            let name = CounterName::iter().next().unwrap();
             for idx in 0..cardinality {
-                metrics::counter!("test", "idx" => idx.to_string()).increment(1);
+                counter!(name, "idx" => idx.to_string()).increment(1);
             }
 
             let metrics = controller.capture_metrics();
@@ -253,11 +260,11 @@ mod tests {
     fn handles_registered_metrics() {
         let controller = init_metrics();
 
-        let counter = metrics::counter!("test7");
+        let counter = counter!(CounterName::iter().next().unwrap());
         assert_eq!(controller.capture_metrics().len(), 3);
         counter.increment(1);
         assert_eq!(controller.capture_metrics().len(), 3);
-        let gauge = metrics::gauge!("test8");
+        let gauge = gauge!(GaugeName::iter().next().unwrap());
         assert_eq!(controller.capture_metrics().len(), 4);
         gauge.set(1.0);
         assert_eq!(controller.capture_metrics().len(), 4);
@@ -270,12 +277,16 @@ mod tests {
             .set_expiry(Some(IDLE_TIMEOUT), Vec::new())
             .unwrap();
 
-        metrics::counter!("test2").increment(1);
-        metrics::counter!("test3").increment(2);
+        let mut names = CounterName::iter();
+        let name_a = names.next().unwrap();
+        let name_b = names.next().unwrap();
+
+        counter!(name_a).increment(1);
+        counter!(name_b).increment(2);
         assert_eq!(controller.capture_metrics().len(), 4);
 
         std::thread::sleep(Duration::from_secs_f64(IDLE_TIMEOUT * 2.0));
-        metrics::counter!("test2").increment(3);
+        counter!(name_a).increment(3);
         assert_eq!(controller.capture_metrics().len(), 3);
     }
 
@@ -286,12 +297,13 @@ mod tests {
             .set_expiry(Some(IDLE_TIMEOUT), Vec::new())
             .unwrap();
 
-        metrics::counter!("test4", "tag" => "value1").increment(1);
-        metrics::counter!("test4", "tag" => "value2").increment(2);
+        let name = CounterName::iter().next().unwrap();
+        counter!(name, "tag" => "value1").increment(1);
+        counter!(name, "tag" => "value2").increment(2);
         assert_eq!(controller.capture_metrics().len(), 4);
 
         std::thread::sleep(Duration::from_secs_f64(IDLE_TIMEOUT * 2.0));
-        metrics::counter!("test4", "tag" => "value1").increment(3);
+        counter!(name, "tag" => "value1").increment(3);
         assert_eq!(controller.capture_metrics().len(), 3);
     }
 
@@ -302,8 +314,12 @@ mod tests {
             .set_expiry(Some(IDLE_TIMEOUT), Vec::new())
             .unwrap();
 
-        let a = metrics::counter!("test5");
-        metrics::counter!("test6").increment(5);
+        let mut names = CounterName::iter();
+        let name_a = names.next().unwrap();
+        let name_b = names.next().unwrap();
+
+        let a = counter!(name_a);
+        counter!(name_b).increment(5);
         assert_eq!(controller.capture_metrics().len(), 4);
         a.increment(1);
         assert_eq!(controller.capture_metrics().len(), 4);
@@ -316,7 +332,7 @@ mod tests {
         assert_eq!(metrics.len(), 3);
         let metric = metrics
             .into_iter()
-            .find(|metric| metric.name() == "test5")
+            .find(|metric| metric.name() == name_a.as_str())
             .expect("Test metric is not present");
         match metric.value() {
             MetricValue::Counter { value } => assert_eq!(*value, 2.0),
@@ -327,12 +343,17 @@ mod tests {
     #[test]
     fn expires_metrics_per_set() {
         let controller = init_metrics();
+
+        let mut names = CounterName::iter();
+        let name_a = names.next().unwrap();
+        let name_b = names.next().unwrap();
+
         controller
             .set_expiry(
                 None,
                 vec![PerMetricSetExpiration {
                     name: Some(MetricNameMatcherConfig::Exact {
-                        value: "test3".to_string(),
+                        value: name_b.as_str().to_string(),
                     }),
                     labels: None,
                     expire_secs: IDLE_TIMEOUT,
@@ -340,25 +361,32 @@ mod tests {
             )
             .unwrap();
 
-        metrics::counter!("test2").increment(1);
-        metrics::counter!("test3").increment(2);
+        counter!(name_a).increment(1);
+        counter!(name_b).increment(2);
         assert_eq!(controller.capture_metrics().len(), 4);
 
         std::thread::sleep(Duration::from_secs_f64(IDLE_TIMEOUT * 2.0));
-        metrics::counter!("test2").increment(3);
+        counter!(name_a).increment(3);
         assert_eq!(controller.capture_metrics().len(), 3);
     }
 
     #[test]
     fn expires_metrics_multiple_different_sets() {
         let controller = init_metrics();
+
+        let mut names = CounterName::iter();
+        let name_a = names.next().unwrap();
+        let name_b = names.next().unwrap();
+        let name_c = names.next().unwrap();
+        let name_d = names.next().unwrap();
+
         controller
             .set_expiry(
                 Some(IDLE_TIMEOUT * 3.0),
                 vec![
                     PerMetricSetExpiration {
                         name: Some(MetricNameMatcherConfig::Exact {
-                            value: "test3".to_string(),
+                            value: name_c.as_str().to_string(),
                         }),
                         labels: None,
                         expire_secs: IDLE_TIMEOUT,
@@ -377,22 +405,22 @@ mod tests {
             )
             .unwrap();
 
-        metrics::counter!("test1").increment(1);
-        metrics::counter!("test2").increment(1);
-        metrics::counter!("test3").increment(2);
-        metrics::counter!("test4", "tag" => "value1").increment(3);
+        counter!(name_a).increment(1);
+        counter!(name_b).increment(1);
+        counter!(name_c).increment(2);
+        counter!(name_d, "tag" => "value1").increment(3);
         assert_eq!(controller.capture_metrics().len(), 6);
 
         std::thread::sleep(Duration::from_secs_f64(IDLE_TIMEOUT * 1.5));
-        metrics::counter!("test2").increment(3);
+        counter!(name_b).increment(3);
         assert_eq!(controller.capture_metrics().len(), 5);
 
         std::thread::sleep(Duration::from_secs_f64(IDLE_TIMEOUT));
-        metrics::counter!("test2").increment(3);
+        counter!(name_b).increment(3);
         assert_eq!(controller.capture_metrics().len(), 4);
 
         std::thread::sleep(Duration::from_secs_f64(IDLE_TIMEOUT));
-        metrics::counter!("test2").increment(3);
+        counter!(name_b).increment(3);
         assert_eq!(controller.capture_metrics().len(), 3);
     }
 }
diff --git a/lib/vector-core/src/source_sender/builder.rs b/lib/vector-core/src/source_sender/builder.rs
index f3051726a7f56..7f9f5d522497a 100644
--- a/lib/vector-core/src/source_sender/builder.rs
+++ b/lib/vector-core/src/source_sender/builder.rs
@@ -1,7 +1,7 @@
 use std::{collections::HashMap, time::Duration};
 
-use metrics::histogram;
 use vector_buffers::topology::channel::LimitedReceiver;
+use vector_common::histogram;
 use vector_common::internal_event::DEFAULT_OUTPUT;
 
 use super::{
diff --git a/lib/vector-core/src/source_sender/mod.rs b/lib/vector-core/src/source_sender/mod.rs
index fc0cb417890a0..24eb23688c0a1 100644
--- a/lib/vector-core/src/source_sender/mod.rs
+++ b/lib/vector-core/src/source_sender/mod.rs
@@ -22,6 +22,8 @@ pub const CHUNK_SIZE: usize = 1000;
 #[cfg(any(test, feature = "test"))]
 const TEST_BUFFER_SIZE: usize = 100;
 
-const LAG_TIME_NAME: &str = "source_lag_time_seconds";
-const SEND_LATENCY_NAME: &str = "source_send_latency_seconds";
-const SEND_BATCH_LATENCY_NAME: &str = "source_send_batch_latency_seconds";
+use vector_common::internal_event::HistogramName;
+
+const LAG_TIME_NAME: HistogramName = HistogramName::SourceLagTimeSeconds;
+const SEND_LATENCY_NAME: HistogramName = HistogramName::SourceSendLatencySeconds;
+const SEND_BATCH_LATENCY_NAME: HistogramName = HistogramName::SourceSendBatchLatencySeconds;
diff --git a/lib/vector-core/src/source_sender/sender.rs b/lib/vector-core/src/source_sender/sender.rs
index 6041dad3dad9f..d5834ab0edff5 100644
--- a/lib/vector-core/src/source_sender/sender.rs
+++ b/lib/vector-core/src/source_sender/sender.rs
@@ -5,12 +5,12 @@ use std::{collections::HashMap, time::Instant};
 use futures::Stream;
 #[cfg(any(test, feature = "test"))]
 use futures::StreamExt as _;
-#[cfg(any(test, feature = "test"))]
-use metrics::histogram;
 use vector_buffers::EventCount;
 #[cfg(any(test, feature = "test"))]
 use vector_buffers::topology::channel::LimitedReceiver;
 #[cfg(any(test, feature = "test"))]
+use vector_common::histogram;
+#[cfg(any(test, feature = "test"))]
 use vector_common::internal_event::DEFAULT_OUTPUT;
 #[cfg(doc)]
 use vector_common::internal_event::{ComponentEventsDropped, EventsSent};
diff --git a/lib/vector-lib/src/lib.rs b/lib/vector-lib/src/lib.rs
index 82bb67cf9afce..277d28df18e92 100644
--- a/lib/vector-lib/src/lib.rs
+++ b/lib/vector-lib/src/lib.rs
@@ -11,9 +11,9 @@ pub use vector_buffers as buffers;
 pub use vector_common::event_test_util;
 pub use vector_common::{
     Error, NamedInternalEvent, Result, TimeZone, assert_event_data_eq, atomic, btreemap,
-    byte_size_of, byte_size_of::ByteSizeOf, conversion, encode_logfmt, finalization, finalizer, id,
-    impl_event_data_eq, internal_event, json_size, registered_event, request_metadata,
-    sensitive_string, shutdown, stats, trigger,
+    byte_size_of, byte_size_of::ByteSizeOf, conversion, counter, encode_logfmt, finalization,
+    finalizer, gauge, histogram, id, impl_event_data_eq, internal_event, json_size,
+    registered_event, request_metadata, sensitive_string, shutdown, stats, trigger,
 };
 pub use vector_config as configurable;
 pub use vector_config::impl_generate_config_from_default;
diff --git a/scripts/check-events b/scripts/check-events
index 5d4411b601802..18a3c61b85418 100755
--- a/scripts/check-events
+++ b/scripts/check-events
@@ -78,11 +78,22 @@ class Event
 
   # Scan for counter names and tags
   def scan_metrics(block)
+    # Match string literal names: counter!("metric_name", ...)
     block.scan(/ (counter|gauge|histogram)!\((?:\n\s+)?"([^"]+)",?(.+?)\)[;\n]/ms) \
     do |type, name, tags|
       tags = Hash[tags.scan(/"([^"]+)" => (.+?)(?:,|$)/)]
       add_metric(type, name, tags)
     end
+    # Match typed enum names: counter!(CounterName::VariantName, ...)
+    block.scan(/ (counter|gauge|histogram)!\((?:\n\s+)?\w+Name::(\w+),?(.+?)\)[;\n]/ms) \
+    do |type, variant, tags|
+      # Convert CamelCase variant name to snake_case metric name
+      name = variant.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+                    .gsub(/([a-z\d])([A-Z])/, '\1_\2')
+                    .downcase
+      tags = Hash[tags.scan(/"([^"]+)" => (.+?)(?:,|$)/)]
+      add_metric(type, name, tags)
+    end
   end
 
   # Scan the registered event macro block
diff --git a/src/enrichment_tables/memory/internal_events.rs b/src/enrichment_tables/memory/internal_events.rs
index 0799c6662a6af..dfd7b8d6f4c78 100644
--- a/src/enrichment_tables/memory/internal_events.rs
+++ b/src/enrichment_tables/memory/internal_events.rs
@@ -1,6 +1,8 @@
-use metrics::{counter, gauge};
 use vector_lib::{
-    NamedInternalEvent, configurable::configurable_component, internal_event::InternalEvent,
+    NamedInternalEvent,
+    configurable::configurable_component,
+    counter, gauge,
+    internal_event::{CounterName, GaugeName, InternalEvent},
 };
 
 /// Configuration of internal metrics for enrichment memory table.
@@ -26,12 +28,12 @@ impl InternalEvent for MemoryEnrichmentTableRead<'_> {
     fn emit(self) {
         if self.include_key_metric_tag {
             counter!(
-                "memory_enrichment_table_reads_total",
+                CounterName::MemoryEnrichmentTableReadsTotal,
                 "key" => self.key.to_owned()
             )
             .increment(1);
         } else {
-            counter!("memory_enrichment_table_reads_total",).increment(1);
+            counter!(CounterName::MemoryEnrichmentTableReadsTotal,).increment(1);
         }
     }
 }
@@ -46,12 +48,12 @@ impl InternalEvent for MemoryEnrichmentTableInserted<'_> {
     fn emit(self) {
         if self.include_key_metric_tag {
             counter!(
-                "memory_enrichment_table_insertions_total",
+                CounterName::MemoryEnrichmentTableInsertionsTotal,
                 "key" => self.key.to_owned()
             )
             .increment(1);
         } else {
-            counter!("memory_enrichment_table_insertions_total",).increment(1);
+            counter!(CounterName::MemoryEnrichmentTableInsertionsTotal,).increment(1);
         }
     }
 }
@@ -64,9 +66,9 @@ pub(crate) struct MemoryEnrichmentTableFlushed {
 
 impl InternalEvent for MemoryEnrichmentTableFlushed {
     fn emit(self) {
-        counter!("memory_enrichment_table_flushes_total",).increment(1);
-        gauge!("memory_enrichment_table_objects_count",).set(self.new_objects_count as f64);
-        gauge!("memory_enrichment_table_byte_size",).set(self.new_byte_size as f64);
+        counter!(CounterName::MemoryEnrichmentTableFlushesTotal,).increment(1);
+        gauge!(GaugeName::MemoryEnrichmentTableObjectsCount,).set(self.new_objects_count as f64);
+        gauge!(GaugeName::MemoryEnrichmentTableByteSize,).set(self.new_byte_size as f64);
     }
 }
 
@@ -80,12 +82,12 @@ impl InternalEvent for MemoryEnrichmentTableTtlExpired<'_> {
     fn emit(self) {
         if self.include_key_metric_tag {
             counter!(
-                "memory_enrichment_table_ttl_expirations",
+                CounterName::MemoryEnrichmentTableTtlExpirations,
                 "key" => self.key.to_owned()
             )
             .increment(1);
         } else {
-            counter!("memory_enrichment_table_ttl_expirations",).increment(1);
+            counter!(CounterName::MemoryEnrichmentTableTtlExpirations,).increment(1);
         }
     }
 }
@@ -100,12 +102,12 @@ impl InternalEvent for MemoryEnrichmentTableReadFailed<'_> {
     fn emit(self) {
         if self.include_key_metric_tag {
             counter!(
-                "memory_enrichment_table_failed_reads",
+                CounterName::MemoryEnrichmentTableFailedReads,
                 "key" => self.key.to_owned()
             )
             .increment(1);
         } else {
-            counter!("memory_enrichment_table_failed_reads",).increment(1);
+            counter!(CounterName::MemoryEnrichmentTableFailedReads,).increment(1);
         }
     }
 }
@@ -120,12 +122,12 @@ impl InternalEvent for MemoryEnrichmentTableInsertFailed<'_> {
     fn emit(self) {
         if self.include_key_metric_tag {
             counter!(
-                "memory_enrichment_table_failed_insertions",
+                CounterName::MemoryEnrichmentTableFailedInsertions,
                 "key" => self.key.to_owned()
             )
             .increment(1);
         } else {
-            counter!("memory_enrichment_table_failed_insertions",).increment(1);
+            counter!(CounterName::MemoryEnrichmentTableFailedInsertions,).increment(1);
         }
     }
 }
diff --git a/src/internal_events/adaptive_concurrency.rs b/src/internal_events/adaptive_concurrency.rs
index f815f7d4e2b4b..b43ec8452e20b 100644
--- a/src/internal_events/adaptive_concurrency.rs
+++ b/src/internal_events/adaptive_concurrency.rs
@@ -1,6 +1,7 @@
 use std::time::Duration;
 
-use metrics::{Histogram, histogram};
+use metrics::Histogram;
+use vector_lib::{histogram, internal_event::HistogramName};
 
 #[derive(Clone, Copy)]
 pub struct AdaptiveConcurrencyLimitData {
@@ -17,10 +18,10 @@ registered_event! {
         // These are histograms, as they may have a number of different
         // values over each reporting interval, and each of those values
         // is valuable for diagnosis.
-        limit: Histogram = histogram!("adaptive_concurrency_limit"),
-        reached_limit: Histogram = histogram!("adaptive_concurrency_reached_limit"),
-        back_pressure: Histogram = histogram!("adaptive_concurrency_back_pressure"),
-        past_rtt_mean: Histogram = histogram!("adaptive_concurrency_past_rtt_mean"),
+        limit: Histogram = histogram!(HistogramName::AdaptiveConcurrencyLimit),
+        reached_limit: Histogram = histogram!(HistogramName::AdaptiveConcurrencyReachedLimit),
+        back_pressure: Histogram = histogram!(HistogramName::AdaptiveConcurrencyBackPressure),
+        past_rtt_mean: Histogram = histogram!(HistogramName::AdaptiveConcurrencyPastRttMean),
     }
 
     fn emit(&self, data: AdaptiveConcurrencyLimitData) {
@@ -36,7 +37,7 @@ registered_event! {
 
 registered_event! {
     AdaptiveConcurrencyInFlight => {
-        in_flight: Histogram = histogram!("adaptive_concurrency_in_flight"),
+        in_flight: Histogram = histogram!(HistogramName::AdaptiveConcurrencyInFlight),
     }
 
     fn emit(&self, in_flight: u64) {
@@ -46,7 +47,7 @@ registered_event! {
 
 registered_event! {
     AdaptiveConcurrencyObservedRtt => {
-        observed_rtt: Histogram = histogram!("adaptive_concurrency_observed_rtt"),
+        observed_rtt: Histogram = histogram!(HistogramName::AdaptiveConcurrencyObservedRtt),
     }
 
     fn emit(&self, rtt: Duration) {
@@ -56,7 +57,7 @@ registered_event! {
 
 registered_event! {
     AdaptiveConcurrencyAveragedRtt => {
-        averaged_rtt: Histogram = histogram!("adaptive_concurrency_averaged_rtt"),
+        averaged_rtt: Histogram = histogram!(HistogramName::AdaptiveConcurrencyAveragedRtt),
     }
 
     fn emit(&self, rtt: Duration) {
diff --git a/src/internal_events/aggregate.rs b/src/internal_events/aggregate.rs
index 1b70c4350f614..96f48f5de013c 100644
--- a/src/internal_events/aggregate.rs
+++ b/src/internal_events/aggregate.rs
@@ -1,13 +1,14 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::InternalEvent;
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct AggregateEventRecorded;
 
 impl InternalEvent for AggregateEventRecorded {
     fn emit(self) {
-        counter!("aggregate_events_recorded_total").increment(1);
+        counter!(CounterName::AggregateEventsRecordedTotal).increment(1);
     }
 }
 
@@ -16,7 +17,7 @@ pub struct AggregateFlushed;
 
 impl InternalEvent for AggregateFlushed {
     fn emit(self) {
-        counter!("aggregate_flushes_total").increment(1);
+        counter!(CounterName::AggregateFlushesTotal).increment(1);
     }
 }
 
@@ -25,6 +26,6 @@ pub struct AggregateUpdateFailed;
 
 impl InternalEvent for AggregateUpdateFailed {
     fn emit(self) {
-        counter!("aggregate_failed_updates").increment(1);
+        counter!(CounterName::AggregateFailedUpdates).increment(1);
     }
 }
diff --git a/src/internal_events/amqp.rs b/src/internal_events/amqp.rs
index 45acdf201305a..e7864acc44e98 100644
--- a/src/internal_events/amqp.rs
+++ b/src/internal_events/amqp.rs
@@ -1,8 +1,9 @@
 #[cfg(feature = "sources-amqp")]
 pub mod source {
-    use metrics::counter;
-    use vector_lib::NamedInternalEvent;
-    use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+    use vector_lib::{
+        NamedInternalEvent, counter,
+        internal_event::{CounterName, InternalEvent, error_stage, error_type},
+    };
 
     #[derive(Debug, NamedInternalEvent)]
     pub struct AmqpBytesReceived {
@@ -18,7 +19,7 @@ pub mod source {
                 protocol = %self.protocol,
             );
             counter!(
-                "component_received_bytes_total",
+                CounterName::ComponentReceivedBytesTotal,
                 "protocol" => self.protocol,
             )
             .increment(self.byte_size as u64);
@@ -38,7 +39,7 @@ pub mod source {
                    stage = error_stage::RECEIVING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_type" => error_type::REQUEST_FAILED,
                 "stage" => error_stage::RECEIVING,
             )
@@ -59,7 +60,7 @@ pub mod source {
                    stage = error_stage::RECEIVING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_type" => error_type::ACKNOWLEDGMENT_FAILED,
                 "stage" => error_stage::RECEIVING,
             )
@@ -80,7 +81,7 @@ pub mod source {
                    stage = error_stage::RECEIVING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_type" => error_type::COMMAND_FAILED,
                 "stage" => error_stage::RECEIVING,
             )
diff --git a/src/internal_events/apache_metrics.rs b/src/internal_events/apache_metrics.rs
index dd5e9c34e4cf5..544dda88ba5a6 100644
--- a/src/internal_events/apache_metrics.rs
+++ b/src/internal_events/apache_metrics.rs
@@ -1,7 +1,6 @@
-use metrics::counter;
 use vector_lib::{
-    NamedInternalEvent,
-    internal_event::{InternalEvent, error_stage, error_type},
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
     json_size::JsonSize,
 };
 
@@ -19,12 +18,12 @@ impl InternalEvent for ApacheMetricsEventsReceived<'_> {
     fn emit(self) {
         trace!(message = "Events received.", count = %self.count, byte_size = %self.byte_size, endpoint = %self.endpoint);
         counter!(
-            "component_received_events_total",
+            CounterName::ComponentReceivedEventsTotal,
             "endpoint" => self.endpoint.to_owned(),
         )
         .increment(self.count as u64);
         counter!(
-            "component_received_event_bytes_total",
+            CounterName::ComponentReceivedEventBytesTotal,
             "endpoint" => self.endpoint.to_owned(),
         )
         .increment(self.byte_size.get() as u64);
@@ -47,7 +46,7 @@ impl InternalEvent for ApacheMetricsParseError<'_> {
             endpoint = %self.endpoint,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::PROCESSING,
             "error_type" => error_type::PARSER_FAILED,
             "endpoint" => self.endpoint.to_owned(),
diff --git a/src/internal_events/api.rs b/src/internal_events/api.rs
index de2cb9588537d..b9196989471c8 100644
--- a/src/internal_events/api.rs
+++ b/src/internal_events/api.rs
@@ -1,8 +1,9 @@
 use std::net::SocketAddr;
 
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::InternalEvent;
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct ApiStarted {
@@ -15,6 +16,6 @@ impl InternalEvent for ApiStarted {
             message = "API server running.",
             address = %self.addr,
         );
-        counter!("api_started_total").increment(1);
+        counter!(CounterName::ApiStartedTotal).increment(1);
     }
 }
diff --git a/src/internal_events/aws.rs b/src/internal_events/aws.rs
index ff4da6c01e56b..d4c91776d7d55 100644
--- a/src/internal_events/aws.rs
+++ b/src/internal_events/aws.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::InternalEvent;
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent},
+};
 
 #[derive(NamedInternalEvent)]
 pub struct AwsBytesSent {
@@ -21,7 +22,7 @@ impl InternalEvent for AwsBytesSent {
             region = ?self.region,
         );
         counter!(
-            "component_sent_bytes_total",
+            CounterName::ComponentSentBytesTotal,
             "protocol" => "https",
             "region" => region,
         )
diff --git a/src/internal_events/aws_cloudwatch_logs.rs b/src/internal_events/aws_cloudwatch_logs.rs
index 6325d6c71b25d..b4964f25d84fe 100644
--- a/src/internal_events/aws_cloudwatch_logs.rs
+++ b/src/internal_events/aws_cloudwatch_logs.rs
@@ -1,8 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct AwsCloudwatchLogsMessageSizeError {
@@ -22,7 +21,7 @@ impl InternalEvent for AwsCloudwatchLogsMessageSizeError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "message_too_long",
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_events/aws_ec2_metadata.rs b/src/internal_events/aws_ec2_metadata.rs
index 43c28aee61272..c59364c75348c 100644
--- a/src/internal_events/aws_ec2_metadata.rs
+++ b/src/internal_events/aws_ec2_metadata.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct AwsEc2MetadataRefreshSuccessful;
@@ -8,7 +9,7 @@ pub struct AwsEc2MetadataRefreshSuccessful;
 impl InternalEvent for AwsEc2MetadataRefreshSuccessful {
     fn emit(self) {
         debug!(message = "AWS EC2 metadata refreshed.");
-        counter!("metadata_refresh_successful_total").increment(1);
+        counter!(CounterName::MetadataRefreshSuccessfulTotal).increment(1);
     }
 }
 
@@ -26,12 +27,12 @@ impl InternalEvent for AwsEc2MetadataRefreshError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::PROCESSING,
         )
         .increment(1);
         // deprecated
-        counter!("metadata_refresh_failed_total").increment(1);
+        counter!(CounterName::MetadataRefreshFailedTotal).increment(1);
     }
 }
diff --git a/src/internal_events/aws_ecs_metrics.rs b/src/internal_events/aws_ecs_metrics.rs
index 86b0d32012713..59127134e2666 100644
--- a/src/internal_events/aws_ecs_metrics.rs
+++ b/src/internal_events/aws_ecs_metrics.rs
@@ -1,9 +1,8 @@
 use std::borrow::Cow;
 
-use metrics::counter;
 use vector_lib::{
-    NamedInternalEvent,
-    internal_event::{InternalEvent, error_stage, error_type},
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
     json_size::JsonSize,
 };
 
@@ -24,12 +23,12 @@ impl InternalEvent for AwsEcsMetricsEventsReceived<'_> {
             endpoint = %self.endpoint,
         );
         counter!(
-            "component_received_events_total",
+            CounterName::ComponentReceivedEventsTotal,
             "endpoint" => self.endpoint.to_string(),
         )
         .increment(self.count as u64);
         counter!(
-            "component_received_event_bytes_total",
+            CounterName::ComponentReceivedEventBytesTotal,
             "endpoint" => self.endpoint.to_string(),
         )
         .increment(self.byte_size.get() as u64);
@@ -57,9 +56,9 @@ impl InternalEvent for AwsEcsMetricsParseError<'_> {
             endpoint = %self.endpoint,
             "Failed to parse response.",
         );
-        counter!("parse_errors_total").increment(1);
+        counter!(CounterName::ParseErrorsTotal).increment(1);
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::PROCESSING,
             "error_type" => error_type::PARSER_FAILED,
             "endpoint" => self.endpoint.to_string(),
diff --git a/src/internal_events/aws_kinesis.rs b/src/internal_events/aws_kinesis.rs
index 9fa2fb4315118..f8a7dcff49de2 100644
--- a/src/internal_events/aws_kinesis.rs
+++ b/src/internal_events/aws_kinesis.rs
@@ -1,8 +1,8 @@
-/// Used in both `aws_kinesis_streams` and `aws_kinesis_firehose` sinks
-use metrics::counter;
 use vector_lib::NamedInternalEvent;
+/// Used in both `aws_kinesis_streams` and `aws_kinesis_firehose` sinks
+use vector_lib::counter;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
 };
 
 #[derive(Debug, NamedInternalEvent)]
@@ -22,7 +22,7 @@ impl InternalEvent for AwsKinesisStreamNoPartitionKeyError<'_> {
         );
 
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
diff --git a/src/internal_events/aws_kinesis_firehose.rs b/src/internal_events/aws_kinesis_firehose.rs
index 6cb4ae43ea51f..58f976839debd 100644
--- a/src/internal_events/aws_kinesis_firehose.rs
+++ b/src/internal_events/aws_kinesis_firehose.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 use super::prelude::{http_error_code, io_error_code};
 use crate::sources::aws_kinesis_firehose::Compression;
@@ -49,7 +50,7 @@ impl InternalEvent for AwsKinesisFirehoseRequestError<'_> {
             request_id = %self.request_id.unwrap_or(""),
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::RECEIVING,
             "error_type" => error_type::REQUEST_FAILED,
             "error_code" => self.error_code,
@@ -75,7 +76,7 @@ impl InternalEvent for AwsKinesisFirehoseAutomaticRecordDecodeError {
             compression = %self.compression,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::PROCESSING,
             "error_type" => error_type::PARSER_FAILED,
             "error_code" => io_error_code(&self.error),
diff --git a/src/internal_events/aws_sqs.rs b/src/internal_events/aws_sqs.rs
index 4bdcc8ef48e6c..51e8b78d23941 100644
--- a/src/internal_events/aws_sqs.rs
+++ b/src/internal_events/aws_sqs.rs
@@ -1,11 +1,13 @@
 #![allow(dead_code)] // TODO requires optional feature compilation
 
-use metrics::counter;
 #[cfg(feature = "sources-aws_s3")]
 pub use s3::*;
+use vector_lib::counter;
 #[cfg(any(feature = "sources-aws_s3", feature = "sources-aws_sqs"))]
-use vector_lib::internal_event::{error_stage, error_type};
-use vector_lib::{NamedInternalEvent, internal_event::InternalEvent};
+use vector_lib::{
+    NamedInternalEvent,
+    internal_event::{CounterName, HistogramName, InternalEvent, error_stage, error_type},
+};
 
 #[cfg(feature = "sources-aws_s3")]
 mod s3 {
@@ -15,7 +17,7 @@ mod s3 {
         BatchResultErrorEntry, DeleteMessageBatchRequestEntry, DeleteMessageBatchResultEntry,
         SendMessageBatchRequestEntry, SendMessageBatchResultEntry,
     };
-    use metrics::histogram;
+    use vector_lib::histogram;
 
     use super::*;
     use crate::sources::aws_s3::sqs::ProcessingError;
@@ -34,7 +36,7 @@ mod s3 {
                 duration_ms = %self.duration.as_millis(),
             );
             histogram!(
-                "s3_object_processing_succeeded_duration_seconds",
+                HistogramName::S3ObjectProcessingSucceededDurationSeconds,
                 "bucket" => self.bucket.to_owned(),
             )
             .record(self.duration);
@@ -55,7 +57,7 @@ mod s3 {
                 duration_ms = %self.duration.as_millis(),
             );
             histogram!(
-                "s3_object_processing_failed_duration_seconds",
+                HistogramName::S3ObjectProcessingFailedDurationSeconds,
                 "bucket" => self.bucket.to_owned(),
             )
             .record(self.duration);
@@ -79,7 +81,7 @@ mod s3 {
                 stage = error_stage::PROCESSING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "failed_processing_sqs_message",
                 "error_type" => error_type::PARSER_FAILED,
                 "stage" => error_stage::PROCESSING,
@@ -100,7 +102,8 @@ mod s3 {
                 .map(|x| x.id.as_str())
                 .collect::<Vec<_>>()
                 .join(", "));
-            counter!("sqs_message_delete_succeeded_total").increment(self.message_ids.len() as u64);
+            counter!(CounterName::SqsMessageDeleteSucceededTotal)
+                .increment(self.message_ids.len() as u64);
         }
     }
 
@@ -122,7 +125,7 @@ mod s3 {
                 stage = error_stage::PROCESSING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "failed_deleting_some_sqs_messages",
                 "error_type" => error_type::ACKNOWLEDGMENT_FAILED,
                 "stage" => error_stage::PROCESSING,
@@ -151,7 +154,7 @@ mod s3 {
                 stage = error_stage::PROCESSING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "failed_deleting_all_sqs_messages",
                 "error_type" => error_type::ACKNOWLEDGMENT_FAILED,
                 "stage" => error_stage::PROCESSING,
@@ -172,7 +175,8 @@ mod s3 {
                 .map(|x| x.id.as_str())
                 .collect::<Vec<_>>()
                 .join(", "));
-            counter!("sqs_message_defer_succeeded_total").increment(self.message_ids.len() as u64);
+            counter!(CounterName::SqsMessageDeferSucceededTotal)
+                .increment(self.message_ids.len() as u64);
         }
     }
 
@@ -194,7 +198,7 @@ mod s3 {
                 stage = error_stage::PROCESSING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "failed_deferring_some_sqs_messages",
                 "error_type" => error_type::ACKNOWLEDGMENT_FAILED,
                 "stage" => error_stage::PROCESSING,
@@ -223,7 +227,7 @@ mod s3 {
                 stage = error_stage::PROCESSING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "failed_deferring_all_sqs_messages",
                 "error_type" => error_type::ACKNOWLEDGMENT_FAILED,
                 "stage" => error_stage::PROCESSING,
@@ -248,7 +252,7 @@ impl<E: std::fmt::Display> InternalEvent for SqsMessageReceiveError<'_, E> {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "failed_fetching_sqs_events",
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
@@ -265,8 +269,8 @@ pub struct SqsMessageReceiveSucceeded {
 impl InternalEvent for SqsMessageReceiveSucceeded {
     fn emit(self) {
         trace!(message = "Received SQS messages.", count = %self.count);
-        counter!("sqs_message_receive_succeeded_total").increment(1);
-        counter!("sqs_message_received_messages_total").increment(self.count as u64);
+        counter!(CounterName::SqsMessageReceiveSucceededTotal).increment(1);
+        counter!(CounterName::SqsMessageReceivedMessagesTotal).increment(self.count as u64);
     }
 }
 
@@ -278,7 +282,7 @@ pub struct SqsMessageProcessingSucceeded<'a> {
 impl InternalEvent for SqsMessageProcessingSucceeded<'_> {
     fn emit(self) {
         trace!(message = "Processed SQS message successfully.", message_id = %self.message_id);
-        counter!("sqs_message_processing_succeeded_total").increment(1);
+        counter!(CounterName::SqsMessageProcessingSucceededTotal).increment(1);
     }
 }
 
@@ -300,7 +304,7 @@ impl<E: std::fmt::Display> InternalEvent for SqsMessageDeleteError<'_, E> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
@@ -322,7 +326,7 @@ impl InternalEvent for SqsS3EventRecordInvalidEventIgnored<'_> {
     fn emit(self) {
         warn!(message = "Ignored S3 record in SQS message for an event that was not ObjectCreated.",
             bucket = %self.bucket, key = %self.key, kind = %self.kind, name = %self.name);
-        counter!("sqs_s3_event_record_ignored_total", "ignore_type" => "invalid_event_kind")
+        counter!(CounterName::SqsS3EventRecordIgnoredTotal, "ignore_type" => "invalid_event_kind")
             .increment(1);
     }
 }
diff --git a/src/internal_events/batch.rs b/src/internal_events/batch.rs
index 8b7a4decfa770..bd553c1e9863d 100644
--- a/src/internal_events/batch.rs
+++ b/src/internal_events/batch.rs
@@ -1,8 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct LargeEventDroppedError {
@@ -21,7 +20,7 @@ impl InternalEvent for LargeEventDroppedError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "oversized",
             "error_type" => error_type::CONDITION_FAILED,
             "stage" => error_stage::SENDING,
diff --git a/src/internal_events/common.rs b/src/internal_events/common.rs
index 69877e3db9ef5..5a6f9c50ede93 100644
--- a/src/internal_events/common.rs
+++ b/src/internal_events/common.rs
@@ -1,11 +1,12 @@
 use std::time::Instant;
 
-use metrics::{counter, histogram};
 use vector_lib::NamedInternalEvent;
 pub use vector_lib::internal_event::EventsReceived;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, HistogramName, InternalEvent, UNINTENTIONAL, error_stage,
+    error_type,
 };
+use vector_lib::{counter, histogram};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct EndpointBytesReceived<'a> {
@@ -23,7 +24,7 @@ impl InternalEvent for EndpointBytesReceived<'_> {
             endpoint = %self.endpoint,
         );
         counter!(
-            "component_received_bytes_total",
+            CounterName::ComponentReceivedBytesTotal,
             "protocol" => self.protocol.to_owned(),
             "endpoint" => self.endpoint.to_owned(),
         )
@@ -47,7 +48,7 @@ impl InternalEvent for EndpointBytesSent<'_> {
             endpoint = %self.endpoint
         );
         counter!(
-            "component_sent_bytes_total",
+            CounterName::ComponentSentBytesTotal,
             "protocol" => self.protocol.to_string(),
             "endpoint" => self.endpoint.to_string()
         )
@@ -70,7 +71,7 @@ impl<E: std::error::Error> InternalEvent for SocketOutgoingConnectionError<E> {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "failed_connecting",
             "error_type" => error_type::CONNECTION_FAILED,
             "stage" => error_stage::SENDING,
@@ -95,7 +96,7 @@ impl InternalEvent for StreamClosedError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => STREAM_CLOSED,
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::SENDING,
@@ -117,8 +118,8 @@ pub struct CollectionCompleted {
 impl InternalEvent for CollectionCompleted {
     fn emit(self) {
         debug!(message = "Collection completed.");
-        counter!("collect_completed_total").increment(1);
-        histogram!("collect_duration_seconds").record(self.end - self.start);
+        counter!(CounterName::CollectCompletedTotal).increment(1);
+        histogram!(HistogramName::CollectDurationSeconds).record(self.end - self.start);
     }
 }
 
@@ -139,7 +140,7 @@ impl<E: std::fmt::Display> InternalEvent for SinkRequestBuildError<E> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
diff --git a/src/internal_events/conditions.rs b/src/internal_events/conditions.rs
index 96f7ae0ae0d50..e89f63b6a9c54 100644
--- a/src/internal_events/conditions.rs
+++ b/src/internal_events/conditions.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, Copy, Clone, NamedInternalEvent)]
 pub struct VrlConditionExecutionError<'a> {
@@ -16,7 +17,7 @@ impl InternalEvent for VrlConditionExecutionError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::SCRIPT_FAILED,
             "stage" => error_stage::PROCESSING,
         )
diff --git a/src/internal_events/datadog_agent.rs b/src/internal_events/datadog_agent.rs
index 9ee5296407b24..84a4a8535c0c7 100644
--- a/src/internal_events/datadog_agent.rs
+++ b/src/internal_events/datadog_agent.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct DatadogAgentJsonParseError<'a> {
@@ -16,7 +17,7 @@ impl InternalEvent for DatadogAgentJsonParseError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
diff --git a/src/internal_events/datadog_metrics.rs b/src/internal_events/datadog_metrics.rs
index 5daa3ab87fa79..00e7d50a8a7d7 100644
--- a/src/internal_events/datadog_metrics.rs
+++ b/src/internal_events/datadog_metrics.rs
@@ -1,8 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct DatadogMetricsEncodingError<'a> {
@@ -21,7 +20,7 @@ impl InternalEvent for DatadogMetricsEncodingError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => self.error_code,
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_events/datadog_traces.rs b/src/internal_events/datadog_traces.rs
index 06b48552fb840..016002681f81b 100644
--- a/src/internal_events/datadog_traces.rs
+++ b/src/internal_events/datadog_traces.rs
@@ -1,8 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct DatadogTracesEncodingError {
@@ -22,7 +21,7 @@ impl InternalEvent for DatadogTracesEncodingError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
@@ -51,7 +50,7 @@ impl<E: std::fmt::Display> InternalEvent for DatadogTracesAPMStatsError<E> {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::SENDING,
         )
diff --git a/src/internal_events/dedupe.rs b/src/internal_events/dedupe.rs
index eb7511578cdd7..a1c36a3c4fa2b 100644
--- a/src/internal_events/dedupe.rs
+++ b/src/internal_events/dedupe.rs
@@ -1,5 +1,7 @@
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{ComponentEventsDropped, INTENTIONAL, InternalEvent};
+use vector_lib::{
+    NamedInternalEvent,
+    internal_event::{ComponentEventsDropped, INTENTIONAL, InternalEvent},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct DedupeEventsDropped {
diff --git a/src/internal_events/demo_logs.rs b/src/internal_events/demo_logs.rs
index 406a9856fe6e9..3958f41421ca7 100644
--- a/src/internal_events/demo_logs.rs
+++ b/src/internal_events/demo_logs.rs
@@ -1,5 +1,4 @@
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::InternalEvent;
+use vector_lib::{NamedInternalEvent, internal_event::InternalEvent};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct DemoLogsEventProcessed;
diff --git a/src/internal_events/dnstap.rs b/src/internal_events/dnstap.rs
index 2fc20b95848d1..1ef67ee3001e0 100644
--- a/src/internal_events/dnstap.rs
+++ b/src/internal_events/dnstap.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub(crate) struct DnstapParseError<E> {
@@ -16,7 +17,7 @@ impl<E: std::fmt::Display> InternalEvent for DnstapParseError<E> {
             error_type = error_type::PARSER_FAILED,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::PROCESSING,
             "error_type" => error_type::PARSER_FAILED,
         )
diff --git a/src/internal_events/docker_logs.rs b/src/internal_events/docker_logs.rs
index bb44e112e05b8..fe24d41b6350b 100644
--- a/src/internal_events/docker_logs.rs
+++ b/src/internal_events/docker_logs.rs
@@ -1,9 +1,8 @@
 use bollard::errors::Error;
 use chrono::ParseError;
-use metrics::counter;
 use vector_lib::{
-    NamedInternalEvent,
-    internal_event::{InternalEvent, error_stage, error_type},
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
     json_size::JsonSize,
 };
 
@@ -23,11 +22,11 @@ impl InternalEvent for DockerLogsEventsReceived<'_> {
             container_id = %self.container_id
         );
         counter!(
-            "component_received_events_total", "container_name" => self.container_name.to_owned()
+            CounterName::ComponentReceivedEventsTotal, "container_name" => self.container_name.to_owned()
         )
         .increment(1);
         counter!(
-            "component_received_event_bytes_total", "container_name" => self.container_name.to_owned()
+            CounterName::ComponentReceivedEventBytesTotal, "container_name" => self.container_name.to_owned()
         ).increment(self.byte_size.get() as u64);
     }
 }
@@ -45,7 +44,7 @@ impl InternalEvent for DockerLogsContainerEventReceived<'_> {
             container_id = %self.container_id,
             action = %self.action,
         );
-        counter!("container_processed_events_total").increment(1);
+        counter!(CounterName::ContainerProcessedEventsTotal).increment(1);
     }
 }
 
@@ -60,7 +59,7 @@ impl InternalEvent for DockerLogsContainerWatch<'_> {
             message = "Started watching for container logs.",
             container_id = %self.container_id,
         );
-        counter!("containers_watched_total").increment(1);
+        counter!(CounterName::ContainersWatchedTotal).increment(1);
     }
 }
 
@@ -75,7 +74,7 @@ impl InternalEvent for DockerLogsContainerUnwatch<'_> {
             message = "Stopped watching for container logs.",
             container_id = %self.container_id,
         );
-        counter!("containers_unwatched_total").increment(1);
+        counter!(CounterName::ContainersUnwatchedTotal).increment(1);
     }
 }
 
@@ -95,7 +94,7 @@ impl InternalEvent for DockerLogsCommunicationError<'_> {
             container_id = ?self.container_id
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::CONNECTION_FAILED,
             "stage" => error_stage::RECEIVING,
         )
@@ -119,7 +118,7 @@ impl InternalEvent for DockerLogsContainerMetadataFetchError<'_> {
             container_id = ?self.container_id
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
             "container_id" => self.container_id.to_owned(),
@@ -144,7 +143,7 @@ impl InternalEvent for DockerLogsTimestampParseError<'_> {
             container_id = ?self.container_id
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
             "container_id" => self.container_id.to_owned(),
@@ -169,7 +168,7 @@ impl InternalEvent for DockerLogsLoggingDriverUnsupportedError<'_> {
             container_id = ?self.container_id,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::CONFIGURATION_FAILED,
             "stage" => error_stage::RECEIVING,
             "container_id" => self.container_id.to_owned(),
diff --git a/src/internal_events/doris.rs b/src/internal_events/doris.rs
index 0a2430869b7c5..15dffd26418b4 100644
--- a/src/internal_events/doris.rs
+++ b/src/internal_events/doris.rs
@@ -1,5 +1,7 @@
-use metrics::counter;
-use vector_lib::{NamedInternalEvent, internal_event::InternalEvent};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent},
+};
 
 /// Emitted when rows are successfully loaded into Doris.
 #[derive(Debug, NamedInternalEvent)]
@@ -17,10 +19,10 @@ impl InternalEvent for DorisRowsLoaded {
         );
 
         // Record the number of rows loaded
-        counter!("doris_rows_loaded_total").increment(self.loaded_rows as u64);
+        counter!(CounterName::DorisRowsLoadedTotal).increment(self.loaded_rows as u64);
 
         // Record the number of bytes loaded
-        counter!("doris_bytes_loaded_total").increment(self.load_bytes as u64);
+        counter!(CounterName::DorisBytesLoadedTotal).increment(self.load_bytes as u64);
     }
 }
 
@@ -37,6 +39,6 @@ impl InternalEvent for DorisRowsFiltered {
             filtered_rows = %self.filtered_rows
         );
 
-        counter!("doris_rows_filtered_total").increment(self.filtered_rows as u64);
+        counter!(CounterName::DorisRowsFilteredTotal).increment(self.filtered_rows as u64);
     }
 }
diff --git a/src/internal_events/encoding_transcode.rs b/src/internal_events/encoding_transcode.rs
index 76ad81792a63a..ec6280f1c703d 100644
--- a/src/internal_events/encoding_transcode.rs
+++ b/src/internal_events/encoding_transcode.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::InternalEvent;
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct DecoderBomRemoval {
@@ -13,7 +14,7 @@ impl InternalEvent for DecoderBomRemoval {
             message = "Removing initial BOM bytes from the final output while decoding to utf8.",
             from_encoding = %self.from_encoding
         );
-        counter!("decoder_bom_removals_total").increment(1);
+        counter!(CounterName::DecoderBomRemovalsTotal).increment(1);
     }
 }
 
@@ -30,7 +31,7 @@ impl InternalEvent for DecoderMalformedReplacement {
         );
         // NOT the actual number of replacements in the output: there's no easy
         // way to get that from the lib we use here (encoding_rs)
-        counter!("decoder_malformed_replacement_warnings_total").increment(1);
+        counter!(CounterName::DecoderMalformedReplacementWarningsTotal).increment(1);
     }
 }
 
@@ -47,6 +48,6 @@ impl InternalEvent for EncoderUnmappableReplacement {
         );
         // NOT the actual number of replacements in the output: there's no easy
         // way to get that from the lib we use here (encoding_rs)
-        counter!("encoder_unmappable_replacement_warnings_total").increment(1);
+        counter!(CounterName::EncoderUnmappableReplacementWarningsTotal).increment(1);
     }
 }
diff --git a/src/internal_events/eventstoredb_metrics.rs b/src/internal_events/eventstoredb_metrics.rs
index c72b9c7dbeb7c..c7db7fad354a5 100644
--- a/src/internal_events/eventstoredb_metrics.rs
+++ b/src/internal_events/eventstoredb_metrics.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct EventStoreDbMetricsHttpError {
@@ -16,7 +17,7 @@ impl InternalEvent for EventStoreDbMetricsHttpError {
             error_type = error_type::REQUEST_FAILED,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::RECEIVING,
             "error_type" => error_type::REQUEST_FAILED,
         )
@@ -38,7 +39,7 @@ impl InternalEvent for EventStoreDbStatsParsingError {
             error_type = error_type::PARSER_FAILED,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::PROCESSING,
             "error_type" => error_type::PARSER_FAILED,
         )
diff --git a/src/internal_events/exec.rs b/src/internal_events/exec.rs
index abe226897d5d3..21edc68f9df2a 100644
--- a/src/internal_events/exec.rs
+++ b/src/internal_events/exec.rs
@@ -1,11 +1,11 @@
 use std::time::Duration;
 
-use metrics::{counter, histogram};
 use tokio::time::error::Elapsed;
 use vector_lib::{
-    NamedInternalEvent,
+    NamedInternalEvent, counter, histogram,
     internal_event::{
-        ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+        ComponentEventsDropped, CounterName, HistogramName, InternalEvent, UNINTENTIONAL,
+        error_stage, error_type,
     },
     json_size::JsonSize,
 };
@@ -28,12 +28,12 @@ impl InternalEvent for ExecEventsReceived<'_> {
             command = %self.command,
         );
         counter!(
-            "component_received_events_total",
+            CounterName::ComponentReceivedEventsTotal,
             "command" => self.command.to_owned(),
         )
         .increment(self.count as u64);
         counter!(
-            "component_received_event_bytes_total",
+            CounterName::ComponentReceivedEventBytesTotal,
             "command" => self.command.to_owned(),
         )
         .increment(self.byte_size.get() as u64);
@@ -57,7 +57,7 @@ impl InternalEvent for ExecFailedError<'_> {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "command" => self.command.to_owned(),
             "error_type" => error_type::COMMAND_FAILED,
             "error_code" => io_error_code(&self.error),
@@ -85,7 +85,7 @@ impl InternalEvent for ExecTimeoutError<'_> {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "command" => self.command.to_owned(),
             "error_type" => error_type::TIMED_OUT,
             "stage" => error_stage::RECEIVING,
@@ -120,14 +120,14 @@ impl InternalEvent for ExecCommandExecuted<'_> {
             elapsed_millis = %self.exec_duration.as_millis(),
         );
         counter!(
-            "command_executed_total",
+            CounterName::CommandExecutedTotal,
             "command" => self.command.to_owned(),
             "exit_status" => exit_status.clone(),
         )
         .increment(1);
 
         histogram!(
-            "command_execution_duration_seconds",
+            HistogramName::CommandExecutionDurationSeconds,
             "exit_status" => exit_status,
             "command" => self.command.to_owned(),
         )
@@ -196,7 +196,7 @@ impl InternalEvent for ExecFailedToSignalChildError<'_> {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "command" => format!("{:?}", self.command.as_std()),
             "error_code" => self.error.to_error_code(),
             "error_type" => error_type::COMMAND_FAILED,
@@ -218,7 +218,7 @@ impl InternalEvent for ExecChannelClosedError {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::COMMAND_FAILED,
             "stage" => error_stage::RECEIVING,
         )
diff --git a/src/internal_events/expansion.rs b/src/internal_events/expansion.rs
index 7b2633dd64f97..7f5b48914c69c 100644
--- a/src/internal_events/expansion.rs
+++ b/src/internal_events/expansion.rs
@@ -1,8 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 #[derive(NamedInternalEvent)]
 pub struct PairExpansionError<'a> {
@@ -25,7 +24,7 @@ impl InternalEvent for PairExpansionError<'_> {
             );
 
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_type" => error_type::PARSER_FAILED,
                 "stage" => error_stage::PROCESSING,
             )
diff --git a/src/internal_events/file.rs b/src/internal_events/file.rs
index 0e85c67150621..f1299ae751694 100644
--- a/src/internal_events/file.rs
+++ b/src/internal_events/file.rs
@@ -2,12 +2,13 @@
 
 use std::borrow::Cow;
 
-use metrics::{counter, gauge};
 use vector_lib::{
     NamedInternalEvent,
     configurable::configurable_component,
+    counter, gauge,
     internal_event::{
-        ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+        ComponentEventsDropped, CounterName, GaugeName, InternalEvent, UNINTENTIONAL, error_stage,
+        error_type,
     },
 };
 
@@ -34,7 +35,7 @@ pub struct FileOpen {
 
 impl InternalEvent for FileOpen {
     fn emit(self) {
-        gauge!("open_files").set(self.count as f64);
+        gauge!(GaugeName::OpenFiles).set(self.count as f64);
     }
 }
 
@@ -55,13 +56,13 @@ impl InternalEvent for FileBytesSent<'_> {
         );
         if self.include_file_metric_tag {
             counter!(
-                "component_sent_bytes_total",
+                CounterName::ComponentSentBytesTotal,
                 "protocol" => "file",
                 "file" => self.file.clone().into_owned(),
             )
         } else {
             counter!(
-                "component_sent_bytes_total",
+                CounterName::ComponentSentBytesTotal,
                 "protocol" => "file",
             )
         }
@@ -89,7 +90,7 @@ impl<P: std::fmt::Debug> InternalEvent for FileIoError<'_, P> {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => self.code,
             "error_type" => error_type::IO_FAILED,
             "stage" => error_stage::SENDING,
@@ -110,11 +111,12 @@ mod source {
     use std::{io::Error, path::Path, time::Duration};
 
     use bytes::BytesMut;
-    use metrics::counter;
     use vector_lib::{
-        NamedInternalEvent, emit,
+        NamedInternalEvent, counter, emit,
         file_source_common::internal_events::FileSourceInternalEvents,
-        internal_event::{ComponentEventsDropped, INTENTIONAL, error_stage, error_type},
+        internal_event::{
+            ComponentEventsDropped, CounterName, INTENTIONAL, error_stage, error_type,
+        },
         json_size::JsonSize,
     };
 
@@ -137,13 +139,13 @@ mod source {
             );
             if self.include_file_metric_tag {
                 counter!(
-                    "component_received_bytes_total",
+                    CounterName::ComponentReceivedBytesTotal,
                     "protocol" => "file",
                     "file" => self.file.to_owned()
                 )
             } else {
                 counter!(
-                    "component_received_bytes_total",
+                    CounterName::ComponentReceivedBytesTotal,
                     "protocol" => "file",
                 )
             }
@@ -169,18 +171,18 @@ mod source {
             );
             if self.include_file_metric_tag {
                 counter!(
-                    "component_received_events_total",
+                    CounterName::ComponentReceivedEventsTotal,
                     "file" => self.file.to_owned(),
                 )
                 .increment(self.count as u64);
                 counter!(
-                    "component_received_event_bytes_total",
+                    CounterName::ComponentReceivedEventBytesTotal,
                     "file" => self.file.to_owned(),
                 )
                 .increment(self.byte_size.get() as u64);
             } else {
-                counter!("component_received_events_total").increment(self.count as u64);
-                counter!("component_received_event_bytes_total")
+                counter!(CounterName::ComponentReceivedEventsTotal).increment(self.count as u64);
+                counter!(CounterName::ComponentReceivedEventBytesTotal)
                     .increment(self.byte_size.get() as u64);
             }
         }
@@ -200,11 +202,11 @@ mod source {
             );
             if self.include_file_metric_tag {
                 counter!(
-                    "checksum_errors_total",
+                    CounterName::ChecksumErrorsTotal,
                     "file" => self.file.to_string_lossy().into_owned(),
                 )
             } else {
-                counter!("checksum_errors_total")
+                counter!(CounterName::ChecksumErrorsTotal)
             }
             .increment(1);
         }
@@ -229,7 +231,7 @@ mod source {
             );
             if self.include_file_metric_tag {
                 counter!(
-                    "component_errors_total",
+                    CounterName::ComponentErrorsTotal,
                     "error_code" => "reading_fingerprint",
                     "error_type" => error_type::READER_FAILED,
                     "stage" => error_stage::RECEIVING,
@@ -237,7 +239,7 @@ mod source {
                 )
             } else {
                 counter!(
-                    "component_errors_total",
+                    CounterName::ComponentErrorsTotal,
                     "error_code" => "reading_fingerprint",
                     "error_type" => error_type::READER_FAILED,
                     "stage" => error_stage::RECEIVING,
@@ -268,7 +270,7 @@ mod source {
             );
             if self.include_file_metric_tag {
                 counter!(
-                    "component_errors_total",
+                    CounterName::ComponentErrorsTotal,
                     "file" => self.file.to_string_lossy().into_owned(),
                     "error_code" => DELETION_FAILED,
                     "error_type" => error_type::COMMAND_FAILED,
@@ -276,7 +278,7 @@ mod source {
                 )
             } else {
                 counter!(
-                    "component_errors_total",
+                    CounterName::ComponentErrorsTotal,
                     "error_code" => DELETION_FAILED,
                     "error_type" => error_type::COMMAND_FAILED,
                     "stage" => error_stage::RECEIVING,
@@ -300,11 +302,11 @@ mod source {
             );
             if self.include_file_metric_tag {
                 counter!(
-                    "files_deleted_total",
+                    CounterName::FilesDeletedTotal,
                     "file" => self.file.to_string_lossy().into_owned(),
                 )
             } else {
-                counter!("files_deleted_total")
+                counter!(CounterName::FilesDeletedTotal)
             }
             .increment(1);
         }
@@ -327,13 +329,13 @@ mod source {
             );
             if self.include_file_metric_tag {
                 counter!(
-                    "files_unwatched_total",
+                    CounterName::FilesUnwatchedTotal,
                     "file" => self.file.to_string_lossy().into_owned(),
                     "reached_eof" => reached_eof,
                 )
             } else {
                 counter!(
-                    "files_unwatched_total",
+                    CounterName::FilesUnwatchedTotal,
                     "reached_eof" => reached_eof,
                 )
             }
@@ -360,7 +362,7 @@ mod source {
             );
             if self.include_file_metric_tag {
                 counter!(
-                    "component_errors_total",
+                    CounterName::ComponentErrorsTotal,
                     "error_code" => "watching",
                     "error_type" => error_type::COMMAND_FAILED,
                     "stage" => error_stage::RECEIVING,
@@ -368,7 +370,7 @@ mod source {
                 )
             } else {
                 counter!(
-                    "component_errors_total",
+                    CounterName::ComponentErrorsTotal,
                     "error_code" => "watching",
                     "error_type" => error_type::COMMAND_FAILED,
                     "stage" => error_stage::RECEIVING,
@@ -394,11 +396,11 @@ mod source {
             );
             if self.include_file_metric_tag {
                 counter!(
-                    "files_resumed_total",
+                    CounterName::FilesResumedTotal,
                     "file" => self.file.to_string_lossy().into_owned(),
                 )
             } else {
-                counter!("files_resumed_total")
+                counter!(CounterName::FilesResumedTotal)
             }
             .increment(1);
         }
@@ -418,11 +420,11 @@ mod source {
             );
             if self.include_file_metric_tag {
                 counter!(
-                    "files_added_total",
+                    CounterName::FilesAddedTotal,
                     "file" => self.file.to_string_lossy().into_owned(),
                 )
             } else {
-                counter!("files_added_total")
+                counter!(CounterName::FilesAddedTotal)
             }
             .increment(1);
         }
@@ -441,7 +443,7 @@ mod source {
                 count = %self.count,
                 duration_ms = self.duration.as_millis() as u64,
             );
-            counter!("checkpoints_total").increment(self.count as u64);
+            counter!(CounterName::CheckpointsTotal).increment(self.count as u64);
         }
     }
 
@@ -460,7 +462,7 @@ mod source {
                 stage = error_stage::RECEIVING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "writing_checkpoints",
                 "error_type" => error_type::WRITER_FAILED,
                 "stage" => error_stage::RECEIVING,
@@ -486,7 +488,7 @@ mod source {
                 path = %self.path.display(),
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "globbing",
                 "error_type" => error_type::READER_FAILED,
                 "stage" => error_stage::RECEIVING,
@@ -513,7 +515,7 @@ mod source {
                 stage = error_stage::RECEIVING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "reading_line_from_file",
                 "error_type" => error_type::CONDITION_FAILED,
                 "stage" => error_stage::RECEIVING,
diff --git a/src/internal_events/file_descriptor.rs b/src/internal_events/file_descriptor.rs
index 7882ed4d95b12..8db4e7895729e 100644
--- a/src/internal_events/file_descriptor.rs
+++ b/src/internal_events/file_descriptor.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct FileDescriptorReadError<E> {
@@ -19,7 +20,7 @@ where
             stage = error_stage::RECEIVING
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::CONNECTION_FAILED,
             "stage" => error_stage::RECEIVING,
         )
diff --git a/src/internal_events/fluent.rs b/src/internal_events/fluent.rs
index 6d6bb408edc5f..f47b927d5cbe2 100644
--- a/src/internal_events/fluent.rs
+++ b/src/internal_events/fluent.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 use crate::sources::fluent::DecodeError;
 
@@ -31,7 +32,7 @@ impl InternalEvent for FluentMessageDecodeError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
diff --git a/src/internal_events/gcp_pubsub.rs b/src/internal_events/gcp_pubsub.rs
index 4066d71936529..752546cfa7d09 100644
--- a/src/internal_events/gcp_pubsub.rs
+++ b/src/internal_events/gcp_pubsub.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(NamedInternalEvent)]
 pub struct GcpPubsubConnectError {
@@ -18,7 +19,7 @@ impl InternalEvent for GcpPubsubConnectError {
         );
 
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "failed_connecting",
             "error_type" => error_type::CONNECTION_FAILED,
             "stage" => error_stage::RECEIVING,
@@ -43,7 +44,7 @@ impl InternalEvent for GcpPubsubStreamingPullError {
         );
 
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "failed_streaming_pull",
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
@@ -68,7 +69,7 @@ impl InternalEvent for GcpPubsubReceiveError {
         );
 
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "failed_fetching_events",
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
diff --git a/src/internal_events/grpc.rs b/src/internal_events/grpc.rs
index 882b1dbfaf33b..66da41e10b797 100644
--- a/src/internal_events/grpc.rs
+++ b/src/internal_events/grpc.rs
@@ -1,10 +1,11 @@
 use std::time::Duration;
 
 use http::response::Response;
-use metrics::{counter, histogram};
 use tonic::Code;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter, histogram,
+    internal_event::{CounterName, HistogramName, InternalEvent, error_stage, error_type},
+};
 
 const GRPC_STATUS_LABEL: &str = "grpc_status";
 
@@ -13,7 +14,7 @@ pub struct GrpcServerRequestReceived;
 
 impl InternalEvent for GrpcServerRequestReceived {
     fn emit(self) {
-        counter!("grpc_server_messages_received_total").increment(1);
+        counter!(CounterName::GrpcServerMessagesReceivedTotal).increment(1);
     }
 }
 
@@ -34,8 +35,8 @@ impl<B> InternalEvent for GrpcServerResponseSent<'_, B> {
         let grpc_code = grpc_code_to_name(grpc_code);
 
         let labels = &[(GRPC_STATUS_LABEL, grpc_code)];
-        counter!("grpc_server_messages_sent_total", labels).increment(1);
-        histogram!("grpc_server_handler_duration_seconds", labels).record(self.latency);
+        counter!(CounterName::GrpcServerMessagesSentTotal, labels).increment(1);
+        histogram!(HistogramName::GrpcServerHandlerDurationSeconds, labels).record(self.latency);
     }
 }
 
@@ -53,7 +54,7 @@ impl InternalEvent for GrpcInvalidCompressionSchemeError<'_> {
             stage = error_stage::RECEIVING
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
         )
@@ -78,7 +79,7 @@ where
             stage = error_stage::RECEIVING
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
         )
diff --git a/src/internal_events/heartbeat.rs b/src/internal_events/heartbeat.rs
index 658a24fcb8762..16191669e7317 100644
--- a/src/internal_events/heartbeat.rs
+++ b/src/internal_events/heartbeat.rs
@@ -1,8 +1,9 @@
 use std::time::Instant;
 
-use metrics::gauge;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::InternalEvent;
+use vector_lib::{
+    NamedInternalEvent, gauge,
+    internal_event::{GaugeName, InternalEvent},
+};
 
 use crate::built_info;
 
@@ -14,9 +15,9 @@ pub struct Heartbeat {
 impl InternalEvent for Heartbeat {
     fn emit(self) {
         trace!(target: "vector", message = "Beep.");
-        gauge!("uptime_seconds").set(self.since.elapsed().as_secs() as f64);
+        gauge!(GaugeName::UptimeSeconds).set(self.since.elapsed().as_secs() as f64);
         gauge!(
-            "build_info",
+            GaugeName::BuildInfo,
             "debug" => built_info::DEBUG,
             "version" => built_info::PKG_VERSION,
             "rust_version" => built_info::RUST_VERSION,
diff --git a/src/internal_events/host_metrics.rs b/src/internal_events/host_metrics.rs
index d60771644571e..7662ca5e808a4 100644
--- a/src/internal_events/host_metrics.rs
+++ b/src/internal_events/host_metrics.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct HostMetricsScrapeError {
@@ -16,7 +17,7 @@ impl InternalEvent for HostMetricsScrapeError {
         );
 
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::RECEIVING,
         )
@@ -40,7 +41,7 @@ impl<E: std::fmt::Display> InternalEvent for HostMetricsScrapeDetailError<E> {
         );
 
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::RECEIVING,
         )
@@ -66,7 +67,7 @@ impl InternalEvent for HostMetricsScrapeFilesystemError {
         );
 
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::RECEIVING,
         )
diff --git a/src/internal_events/http.rs b/src/internal_events/http.rs
index a0d8f5d2a92d3..4aad267d7683b 100644
--- a/src/internal_events/http.rs
+++ b/src/internal_events/http.rs
@@ -1,10 +1,9 @@
 use std::{error::Error, time::Duration};
 
 use http::Response;
-use metrics::{counter, histogram};
 use vector_lib::{
-    NamedInternalEvent,
-    internal_event::{InternalEvent, error_stage, error_type},
+    NamedInternalEvent, counter, histogram,
+    internal_event::{CounterName, HistogramName, InternalEvent, error_stage, error_type},
     json_size::JsonSize,
 };
 
@@ -16,7 +15,7 @@ pub struct HttpServerRequestReceived;
 impl InternalEvent for HttpServerRequestReceived {
     fn emit(self) {
         debug!(message = "Received HTTP request.");
-        counter!("http_server_requests_received_total").increment(1);
+        counter!(CounterName::HttpServerRequestsReceivedTotal).increment(1);
     }
 }
 
@@ -32,8 +31,8 @@ impl<B> InternalEvent for HttpServerResponseSent<'_, B> {
             HTTP_STATUS_LABEL,
             self.response.status().as_u16().to_string(),
         )];
-        counter!("http_server_responses_sent_total", labels).increment(1);
-        histogram!("http_server_handler_duration_seconds", labels).record(self.latency);
+        counter!(CounterName::HttpServerResponsesSentTotal, labels).increment(1);
+        histogram!(HistogramName::HttpServerHandlerDurationSeconds, labels).record(self.latency);
     }
 }
 
@@ -53,7 +52,7 @@ impl InternalEvent for HttpBytesReceived<'_> {
             protocol = %self.protocol
         );
         counter!(
-            "component_received_bytes_total",
+            CounterName::ComponentReceivedBytesTotal,
             "http_path" => self.http_path.to_string(),
             "protocol" => self.protocol,
         )
@@ -79,15 +78,15 @@ impl InternalEvent for HttpEventsReceived<'_> {
             protocol = %self.protocol,
         );
 
-        histogram!("component_received_events_count").record(self.count as f64);
+        histogram!(HistogramName::ComponentReceivedEventsCount).record(self.count as f64);
         counter!(
-            "component_received_events_total",
+            CounterName::ComponentReceivedEventsTotal,
             "http_path" => self.http_path.to_string(),
             "protocol" => self.protocol,
         )
         .increment(self.count as u64);
         counter!(
-            "component_received_event_bytes_total",
+            CounterName::ComponentReceivedEventBytesTotal,
             "http_path" => self.http_path.to_string(),
             "protocol" => self.protocol,
         )
@@ -126,7 +125,7 @@ impl InternalEvent for HttpBadRequest<'_> {
             http_code = %self.code,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => self.error_code,
             "error_type" => error_type::REQUEST_FAILED,
             "error_stage" => error_stage::RECEIVING,
@@ -152,7 +151,7 @@ impl InternalEvent for HttpDecompressError<'_> {
             encoding = %self.encoding
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "failed_decompressing_payload",
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::RECEIVING,
@@ -174,7 +173,7 @@ impl InternalEvent for HttpInternalError<'_> {
             stage = error_stage::RECEIVING
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::CONNECTION_FAILED,
             "stage" => error_stage::RECEIVING,
         )
diff --git a/src/internal_events/http_client.rs b/src/internal_events/http_client.rs
index d1e4c7549d15a..346192dfca141 100644
--- a/src/internal_events/http_client.rs
+++ b/src/internal_events/http_client.rs
@@ -5,9 +5,10 @@ use http::{
     header::{self, HeaderMap, HeaderValue},
 };
 use hyper::{Error, body::HttpBody};
-use metrics::{counter, histogram};
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter, histogram,
+    internal_event::{CounterName, HistogramName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct AboutToSendHttpRequest<'a, T> {
@@ -39,7 +40,7 @@ impl<T: HttpBody> InternalEvent for AboutToSendHttpRequest<'_, T> {
             headers = ?remove_sensitive(self.request.headers()),
             body = %FormatBody(self.request.body()),
         );
-        counter!("http_client_requests_sent_total", "method" => self.request.method().to_string())
+        counter!(CounterName::HttpClientRequestsSentTotal, "method" => self.request.method().to_string())
             .increment(1);
     }
 }
@@ -60,13 +61,13 @@ impl<T: HttpBody> InternalEvent for GotHttpResponse<'_, T> {
             body = %FormatBody(self.response.body()),
         );
         counter!(
-            "http_client_responses_total",
+            CounterName::HttpClientResponsesTotal,
             "status" => self.response.status().as_u16().to_string(),
         )
         .increment(1);
-        histogram!("http_client_rtt_seconds").record(self.roundtrip);
+        histogram!(HistogramName::HttpClientRttSeconds).record(self.roundtrip);
         histogram!(
-            "http_client_response_rtt_seconds",
+            HistogramName::HttpClientResponseRttSeconds,
             "status" => self.response.status().as_u16().to_string(),
         )
         .record(self.roundtrip);
@@ -87,9 +88,10 @@ impl InternalEvent for GotHttpWarning<'_> {
             error_type = error_type::REQUEST_FAILED,
             stage = error_stage::PROCESSING,
         );
-        counter!("http_client_errors_total", "error_kind" => self.error.to_string()).increment(1);
-        histogram!("http_client_rtt_seconds").record(self.roundtrip);
-        histogram!("http_client_error_rtt_seconds", "error_kind" => self.error.to_string())
+        counter!(CounterName::HttpClientErrorsTotal, "error_kind" => self.error.to_string())
+            .increment(1);
+        histogram!(HistogramName::HttpClientRttSeconds).record(self.roundtrip);
+        histogram!(HistogramName::HttpClientErrorRttSeconds, "error_kind" => self.error.to_string())
             .record(self.roundtrip);
     }
 }
diff --git a/src/internal_events/http_client_source.rs b/src/internal_events/http_client_source.rs
index ff67535c0c14b..0ba52d722dfee 100644
--- a/src/internal_events/http_client_source.rs
+++ b/src/internal_events/http_client_source.rs
@@ -1,9 +1,8 @@
 #![allow(dead_code)] // TODO requires optional feature compilation
 
-use metrics::counter;
 use vector_lib::{
-    NamedInternalEvent,
-    internal_event::{InternalEvent, error_stage, error_type},
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
     json_size::JsonSize,
 };
 
@@ -25,12 +24,12 @@ impl InternalEvent for HttpClientEventsReceived {
             url = %self.url,
         );
         counter!(
-            "component_received_events_total",
+            CounterName::ComponentReceivedEventsTotal,
             "uri" => self.url.clone(),
         )
         .increment(self.count as u64);
         counter!(
-            "component_received_event_bytes_total",
+            CounterName::ComponentReceivedEventBytesTotal,
             "uri" => self.url.clone(),
         )
         .increment(self.byte_size.get() as u64);
@@ -53,7 +52,7 @@ impl InternalEvent for HttpClientHttpResponseError {
             error_code = %http_error_code(self.code.as_u16()),
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "url" => self.url,
             "stage" => error_stage::RECEIVING,
             "error_type" => error_type::REQUEST_FAILED,
@@ -79,7 +78,7 @@ impl InternalEvent for HttpClientHttpError {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "url" => self.url,
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
diff --git a/src/internal_events/influxdb.rs b/src/internal_events/influxdb.rs
index 22b34c3dc532c..a142642140f6f 100644
--- a/src/internal_events/influxdb.rs
+++ b/src/internal_events/influxdb.rs
@@ -1,8 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct InfluxdbEncodingError {
@@ -20,7 +19,7 @@ impl InternalEvent for InfluxdbEncodingError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
diff --git a/src/internal_events/internal_logs.rs b/src/internal_events/internal_logs.rs
index 63c520723c9c7..2f0674d380edd 100644
--- a/src/internal_events/internal_logs.rs
+++ b/src/internal_events/internal_logs.rs
@@ -1,5 +1,8 @@
-use metrics::counter;
-use vector_lib::{NamedInternalEvent, internal_event::InternalEvent, json_size::JsonSize};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent},
+    json_size::JsonSize,
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct InternalLogsBytesReceived {
@@ -10,7 +13,7 @@ impl InternalEvent for InternalLogsBytesReceived {
     fn emit(self) {
         // MUST NOT emit logs here to avoid an infinite log loop
         counter!(
-            "component_received_bytes_total",
+            CounterName::ComponentReceivedBytesTotal,
             "protocol" => "internal",
         )
         .increment(self.byte_size as u64);
@@ -26,7 +29,8 @@ pub struct InternalLogsEventsReceived {
 impl InternalEvent for InternalLogsEventsReceived {
     fn emit(self) {
         // MUST NOT emit logs here to avoid an infinite log loop
-        counter!("component_received_events_total").increment(self.count as u64);
-        counter!("component_received_event_bytes_total").increment(self.byte_size.get() as u64);
+        counter!(CounterName::ComponentReceivedEventsTotal).increment(self.count as u64);
+        counter!(CounterName::ComponentReceivedEventBytesTotal)
+            .increment(self.byte_size.get() as u64);
     }
 }
diff --git a/src/internal_events/journald.rs b/src/internal_events/journald.rs
index 0debba0de5d29..02f6300cb6905 100644
--- a/src/internal_events/journald.rs
+++ b/src/internal_events/journald.rs
@@ -1,8 +1,8 @@
-use metrics::counter;
 use vector_lib::{
     NamedInternalEvent,
     codecs::decoding::BoxedFramingError,
-    internal_event::{InternalEvent, error_stage, error_type},
+    counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
 };
 
 #[derive(Debug, NamedInternalEvent)]
@@ -21,7 +21,7 @@ impl InternalEvent for JournaldInvalidRecordError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::PROCESSING,
             "error_type" => error_type::PARSER_FAILED,
         )
@@ -43,7 +43,7 @@ impl InternalEvent for JournaldStartJournalctlError {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::RECEIVING,
             "error_type" => error_type::COMMAND_FAILED,
         )
@@ -65,7 +65,7 @@ impl InternalEvent for JournaldReadError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::PROCESSING,
             "error_type" => error_type::READER_FAILED,
         )
@@ -89,7 +89,7 @@ impl InternalEvent for JournaldCheckpointSetError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::PROCESSING,
             "error_type" => error_type::IO_FAILED,
         )
@@ -113,7 +113,7 @@ impl InternalEvent for JournaldCheckpointFileOpenError {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "stage" => error_stage::RECEIVING,
             "error_type" => error_type::IO_FAILED,
         )
diff --git a/src/internal_events/kafka.rs b/src/internal_events/kafka.rs
index 87ad581e1c453..1cbd2ba3ce8cb 100644
--- a/src/internal_events/kafka.rs
+++ b/src/internal_events/kafka.rs
@@ -1,9 +1,8 @@
 #![allow(dead_code)] // TODO requires optional feature compilation
 
-use metrics::{counter, gauge};
 use vector_lib::{
-    NamedInternalEvent,
-    internal_event::{InternalEvent, error_stage, error_type},
+    NamedInternalEvent, counter, gauge,
+    internal_event::{CounterName, GaugeName, InternalEvent, error_stage, error_type},
     json_size::JsonSize,
 };
 use vrl::path::OwnedTargetPath;
@@ -26,7 +25,7 @@ impl InternalEvent for KafkaBytesReceived<'_> {
             partition = %self.partition,
         );
         counter!(
-            "component_received_bytes_total",
+            CounterName::ComponentReceivedBytesTotal,
             "protocol" => self.protocol,
             "topic" => self.topic.to_string(),
             "partition" => self.partition.to_string(),
@@ -53,13 +52,13 @@ impl InternalEvent for KafkaEventsReceived<'_> {
             partition = %self.partition,
         );
         counter!(
-            "component_received_events_total",
+            CounterName::ComponentReceivedEventsTotal,
             "topic" => self.topic.to_string(),
             "partition" => self.partition.to_string(),
         )
         .increment(self.count as u64);
         counter!(
-            "component_received_event_bytes_total",
+            CounterName::ComponentReceivedEventBytesTotal,
             "topic" => self.topic.to_string(),
             "partition" => self.partition.to_string(),
         )
@@ -82,7 +81,7 @@ impl InternalEvent for KafkaOffsetUpdateError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "kafka_offset_update",
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::SENDING,
@@ -106,7 +105,7 @@ impl InternalEvent for KafkaReadError {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "reading_message",
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::RECEIVING,
@@ -123,24 +122,24 @@ pub struct KafkaStatisticsReceived<'a> {
 
 impl InternalEvent for KafkaStatisticsReceived<'_> {
     fn emit(self) {
-        gauge!("kafka_queue_messages").set(self.statistics.msg_cnt as f64);
-        gauge!("kafka_queue_messages_bytes").set(self.statistics.msg_size as f64);
-        counter!("kafka_requests_total").absolute(self.statistics.tx as u64);
-        counter!("kafka_requests_bytes_total").absolute(self.statistics.tx_bytes as u64);
-        counter!("kafka_responses_total").absolute(self.statistics.rx as u64);
-        counter!("kafka_responses_bytes_total").absolute(self.statistics.rx_bytes as u64);
-        counter!("kafka_produced_messages_total").absolute(self.statistics.txmsgs as u64);
-        counter!("kafka_produced_messages_bytes_total")
+        gauge!(GaugeName::KafkaQueueMessages).set(self.statistics.msg_cnt as f64);
+        gauge!(GaugeName::KafkaQueueMessagesBytes).set(self.statistics.msg_size as f64);
+        counter!(CounterName::KafkaRequestsTotal).absolute(self.statistics.tx as u64);
+        counter!(CounterName::KafkaRequestsBytesTotal).absolute(self.statistics.tx_bytes as u64);
+        counter!(CounterName::KafkaResponsesTotal).absolute(self.statistics.rx as u64);
+        counter!(CounterName::KafkaResponsesBytesTotal).absolute(self.statistics.rx_bytes as u64);
+        counter!(CounterName::KafkaProducedMessagesTotal).absolute(self.statistics.txmsgs as u64);
+        counter!(CounterName::KafkaProducedMessagesBytesTotal)
             .absolute(self.statistics.txmsg_bytes as u64);
-        counter!("kafka_consumed_messages_total").absolute(self.statistics.rxmsgs as u64);
-        counter!("kafka_consumed_messages_bytes_total")
+        counter!(CounterName::KafkaConsumedMessagesTotal).absolute(self.statistics.rxmsgs as u64);
+        counter!(CounterName::KafkaConsumedMessagesBytesTotal)
             .absolute(self.statistics.rxmsg_bytes as u64);
 
         if self.expose_lag_metrics {
             for (topic_id, topic) in &self.statistics.topics {
                 for (partition_id, partition) in &topic.partitions {
                     gauge!(
-                        "kafka_consumer_lag",
+                        GaugeName::KafkaConsumerLag,
                         "topic_id" => topic_id.clone(),
                         "partition_id" => partition_id.to_string(),
                     )
@@ -166,7 +165,7 @@ impl InternalEvent for KafkaHeaderExtractionError<'_> {
             header_field = self.header_field.to_string(),
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "extracting_header",
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::RECEIVING,
diff --git a/src/internal_events/kubernetes_logs.rs b/src/internal_events/kubernetes_logs.rs
index c6edb03724169..15b4ca4e61ee0 100644
--- a/src/internal_events/kubernetes_logs.rs
+++ b/src/internal_events/kubernetes_logs.rs
@@ -1,8 +1,8 @@
-use metrics::counter;
 use vector_lib::{
-    NamedInternalEvent,
+    NamedInternalEvent, counter,
     internal_event::{
-        ComponentEventsDropped, INTENTIONAL, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+        ComponentEventsDropped, CounterName, INTENTIONAL, InternalEvent, UNINTENTIONAL,
+        error_stage, error_type,
     },
     json_size::JsonSize,
 };
@@ -37,21 +37,21 @@ impl InternalEvent for KubernetesLogsEventsReceived<'_> {
                 let pod_namespace = pod_info.namespace;
 
                 counter!(
-                    "component_received_events_total",
+                    CounterName::ComponentReceivedEventsTotal,
                     "pod_name" => pod_name.clone(),
                     "pod_namespace" => pod_namespace.clone(),
                 )
                 .increment(1);
                 counter!(
-                    "component_received_event_bytes_total",
+                    CounterName::ComponentReceivedEventBytesTotal,
                     "pod_name" => pod_name,
                     "pod_namespace" => pod_namespace,
                 )
                 .increment(self.byte_size.get() as u64);
             }
             None => {
-                counter!("component_received_events_total").increment(1);
-                counter!("component_received_event_bytes_total")
+                counter!(CounterName::ComponentReceivedEventsTotal).increment(1);
+                counter!(CounterName::ComponentReceivedEventBytesTotal)
                     .increment(self.byte_size.get() as u64);
             }
         }
@@ -75,7 +75,7 @@ impl InternalEvent for KubernetesLogsEventAnnotationError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => ANNOTATION_FAILED,
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -99,13 +99,13 @@ impl InternalEvent for KubernetesLogsEventNamespaceAnnotationError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => ANNOTATION_FAILED,
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
         .increment(1);
-        counter!("k8s_event_namespace_annotation_failures_total").increment(1);
+        counter!(CounterName::K8sEventNamespaceAnnotationFailuresTotal).increment(1);
     }
 }
 
@@ -124,13 +124,13 @@ impl InternalEvent for KubernetesLogsEventNodeAnnotationError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => ANNOTATION_FAILED,
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
         .increment(1);
-        counter!("k8s_event_node_annotation_failures_total").increment(1);
+        counter!(CounterName::K8sEventNodeAnnotationFailuresTotal).increment(1);
     }
 }
 
@@ -145,7 +145,7 @@ impl InternalEvent for KubernetesLogsFormatPickerEdgeCase {
             message = "Encountered format picker edge case.",
             what = %self.what,
         );
-        counter!("k8s_format_picker_edge_cases_total").increment(1);
+        counter!(CounterName::K8sFormatPickerEdgeCasesTotal).increment(1);
     }
 }
 
@@ -163,12 +163,12 @@ impl InternalEvent for KubernetesLogsDockerFormatParseError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
         .increment(1);
-        counter!("k8s_docker_format_parse_failures_total").increment(1);
+        counter!(CounterName::K8sDockerFormatParseFailuresTotal).increment(1);
     }
 }
 
@@ -191,7 +191,7 @@ impl<E: std::fmt::Display> InternalEvent for KubernetesLifecycleError<E> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => KUBERNETES_LIFECYCLE,
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -222,7 +222,7 @@ impl InternalEvent for KubernetesMergedLineTooBigError<'_> {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "reading_line_from_kubernetes_log",
             "error_type" => error_type::CONDITION_FAILED,
             "stage" => error_stage::RECEIVING,
diff --git a/src/internal_events/log_to_metric.rs b/src/internal_events/log_to_metric.rs
index 9fbb64dba0622..e8e3da5b898b7 100644
--- a/src/internal_events/log_to_metric.rs
+++ b/src/internal_events/log_to_metric.rs
@@ -1,9 +1,10 @@
 use std::num::ParseFloatError;
 
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{
+        ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    },
 };
 
 #[derive(NamedInternalEvent)]
@@ -22,7 +23,7 @@ impl InternalEvent for LogToMetricFieldNullError<'_> {
             null_field = %self.field
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "field_null",
             "error_type" => error_type::CONDITION_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -52,7 +53,7 @@ impl InternalEvent for LogToMetricParseFloatError<'_> {
             stage = error_stage::PROCESSING
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "failed_parsing_float",
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -83,7 +84,7 @@ impl InternalEvent for MetricMetadataInvalidFieldValueError<'_> {
             stage = error_stage::PROCESSING
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "invalid_field_value",
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -112,7 +113,7 @@ impl InternalEvent for MetricMetadataParseError<'_> {
             stage = error_stage::PROCESSING
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => format!("failed_parsing_{}", self.kind),
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -137,7 +138,7 @@ impl InternalEvent for MetricMetadataMetricDetailsNotFoundError {
             stage = error_stage::PROCESSING
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "missing_metric_details",
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_events/logplex.rs b/src/internal_events/logplex.rs
index b28588c5c2d1e..4a45df6349b65 100644
--- a/src/internal_events/logplex.rs
+++ b/src/internal_events/logplex.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 use super::prelude::io_error_code;
 
@@ -37,7 +38,7 @@ impl InternalEvent for HerokuLogplexRequestReadError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::READER_FAILED,
             "error_code" => io_error_code(&self.error),
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_events/loki.rs b/src/internal_events/loki.rs
index 523efd7e4f59b..3a5935e1a372a 100644
--- a/src/internal_events/loki.rs
+++ b/src/internal_events/loki.rs
@@ -1,8 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, INTENTIONAL, InternalEvent, error_stage, error_type,
+    ComponentEventsDropped, CounterName, INTENTIONAL, InternalEvent, error_stage, error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct LokiEventUnlabeledError;
@@ -17,7 +16,7 @@ impl InternalEvent for LokiEventUnlabeledError {
         );
 
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "unlabeled_event",
             "error_type" => error_type::CONDITION_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -48,7 +47,7 @@ impl InternalEvent for LokiOutOfOrderEventDroppedError {
         });
 
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "out_of_order",
             "error_type" => error_type::CONDITION_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -69,7 +68,7 @@ impl InternalEvent for LokiOutOfOrderEventRewritten {
             count = self.count,
             reason = "out_of_order",
         );
-        counter!("rewritten_timestamp_events_total").increment(self.count as u64);
+        counter!(CounterName::RewrittenTimestampEventsTotal).increment(self.count as u64);
     }
 }
 
@@ -90,7 +89,7 @@ impl InternalEvent for LokiTimestampNonParsableEventsDropped {
         emit!(ComponentEventsDropped::<INTENTIONAL> { count: 1, reason });
 
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "non-parsable_timestamp",
             "error_type" => error_type::CONDITION_FAILED,
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_events/lua.rs b/src/internal_events/lua.rs
index feb9d04212b88..3a8779d9cd4b1 100644
--- a/src/internal_events/lua.rs
+++ b/src/internal_events/lua.rs
@@ -1,8 +1,9 @@
-use metrics::{counter, gauge};
 use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, GaugeName, InternalEvent, UNINTENTIONAL, error_stage,
+    error_type,
 };
+use vector_lib::{counter, gauge};
 
 use crate::transforms::lua::v2::BuildError;
 
@@ -13,7 +14,7 @@ pub struct LuaGcTriggered {
 
 impl InternalEvent for LuaGcTriggered {
     fn emit(self) {
-        gauge!("lua_memory_used_bytes").set(self.used_memory as f64);
+        gauge!(GaugeName::LuaMemoryUsedBytes).set(self.used_memory as f64);
     }
 }
 
@@ -32,7 +33,7 @@ impl InternalEvent for LuaScriptError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => mlua_error_code(&self.error),
             "error_type" => error_type::SCRIPT_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -62,7 +63,7 @@ impl InternalEvent for LuaBuildError {
             internal_log_rate_limit = false,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => lua_build_error_code(&self.error),
             "error_type" => error_type::SCRIPT_FAILED,
             "stage" => error_stage:: PROCESSING,
diff --git a/src/internal_events/metric_to_log.rs b/src/internal_events/metric_to_log.rs
index a536a1b24df24..a11ed286be17a 100644
--- a/src/internal_events/metric_to_log.rs
+++ b/src/internal_events/metric_to_log.rs
@@ -1,9 +1,8 @@
-use metrics::counter;
 use serde_json::Error;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct MetricToLogSerializeError {
@@ -20,7 +19,7 @@ impl InternalEvent for MetricToLogSerializeError {
             stage = error_stage::PROCESSING
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
diff --git a/src/internal_events/mongodb_metrics.rs b/src/internal_events/mongodb_metrics.rs
index 3cad1e4ef97f9..b0023085f025f 100644
--- a/src/internal_events/mongodb_metrics.rs
+++ b/src/internal_events/mongodb_metrics.rs
@@ -1,8 +1,7 @@
-use metrics::counter;
 use mongodb::{bson, error::Error as MongoError};
 use vector_lib::{
-    NamedInternalEvent,
-    internal_event::{InternalEvent, error_stage, error_type},
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
     json_size::JsonSize,
 };
 
@@ -23,12 +22,12 @@ impl InternalEvent for MongoDbMetricsEventsReceived<'_> {
             endpoint = self.endpoint,
         );
         counter!(
-            "component_received_events_total",
+            CounterName::ComponentReceivedEventsTotal,
             "endpoint" => self.endpoint.to_owned(),
         )
         .increment(self.count as u64);
         counter!(
-            "component_received_event_bytes_total",
+            CounterName::ComponentReceivedEventBytesTotal,
             "endpoint" => self.endpoint.to_owned(),
         )
         .increment(self.byte_size.get() as u64);
@@ -51,7 +50,7 @@ impl InternalEvent for MongoDbMetricsRequestError<'_> {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
         )
@@ -75,7 +74,7 @@ impl InternalEvent for MongoDbMetricsBsonParseError<'_> {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::RECEIVING,
             "endpoint" => self.endpoint.to_owned(),
diff --git a/src/internal_events/mqtt.rs b/src/internal_events/mqtt.rs
index 1e406a9494f1f..8d416c4c748ee 100644
--- a/src/internal_events/mqtt.rs
+++ b/src/internal_events/mqtt.rs
@@ -1,9 +1,10 @@
 use std::fmt::Debug;
 
-use metrics::counter;
 use rumqttc::ConnectionError;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct MqttConnectionError {
@@ -20,7 +21,7 @@ impl InternalEvent for MqttConnectionError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "mqtt_connection_error",
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::SENDING,
diff --git a/src/internal_events/nginx_metrics.rs b/src/internal_events/nginx_metrics.rs
index a3384d4ef0faf..82cd7ea3878b7 100644
--- a/src/internal_events/nginx_metrics.rs
+++ b/src/internal_events/nginx_metrics.rs
@@ -1,7 +1,6 @@
-use metrics::counter;
 use vector_lib::{
-    NamedInternalEvent,
-    internal_event::{InternalEvent, error_stage, error_type},
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
     json_size::JsonSize,
 };
 
@@ -23,12 +22,12 @@ impl InternalEvent for NginxMetricsEventsReceived<'_> {
             endpoint = self.endpoint,
         );
         counter!(
-            "component_received_events_total",
+            CounterName::ComponentReceivedEventsTotal,
             "endpoint" => self.endpoint.to_owned(),
         )
         .increment(self.count as u64);
         counter!(
-            "component_received_event_bytes_total",
+            CounterName::ComponentReceivedEventBytesTotal,
             "endpoint" => self.endpoint.to_owned(),
         )
         .increment(self.byte_size.get() as u64);
@@ -51,7 +50,7 @@ impl InternalEvent for NginxMetricsRequestError<'_> {
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "endpoint" => self.endpoint.to_owned(),
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
@@ -76,7 +75,7 @@ impl InternalEvent for NginxMetricsStubStatusParseError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "endpoint" => self.endpoint.to_owned(),
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_events/open.rs b/src/internal_events/open.rs
index e48e0ac337820..58e9c9d40b3f8 100644
--- a/src/internal_events/open.rs
+++ b/src/internal_events/open.rs
@@ -6,9 +6,10 @@ use std::{
     },
 };
 
-use metrics::gauge;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::InternalEvent;
+use vector_lib::{
+    NamedInternalEvent, gauge,
+    internal_event::{GaugeName, InternalEvent},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct ConnectionOpen {
@@ -17,7 +18,7 @@ pub struct ConnectionOpen {
 
 impl InternalEvent for ConnectionOpen {
     fn emit(self) {
-        gauge!("open_connections").set(self.count as f64);
+        gauge!(GaugeName::OpenConnections).set(self.count as f64);
     }
 }
 
@@ -28,7 +29,7 @@ pub struct EndpointsActive {
 
 impl InternalEvent for EndpointsActive {
     fn emit(self) {
-        gauge!("active_endpoints").set(self.count as f64);
+        gauge!(GaugeName::ActiveEndpoints).set(self.count as f64);
     }
 }
 
diff --git a/src/internal_events/parser.rs b/src/internal_events/parser.rs
index 85a3e1383afa3..2610ae5458958 100644
--- a/src/internal_events/parser.rs
+++ b/src/internal_events/parser.rs
@@ -2,10 +2,11 @@
 
 use std::borrow::Cow;
 
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{
+        ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    },
 };
 
 fn truncate_string_at(s: &str, maxlen: usize) -> Cow<'_, str> {
@@ -36,7 +37,7 @@ impl InternalEvent for ParserMatchError<'_> {
             field = &truncate_string_at(&String::from_utf8_lossy(self.value), 60)[..]
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "no_match_found",
             "error_type" => error_type::CONDITION_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -66,7 +67,7 @@ impl<const DROP_EVENT: bool> InternalEvent for ParserMissingFieldError<'_, DROP_
             stage = error_stage::PROCESSING
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "field_not_found",
             "error_type" => error_type::CONDITION_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -97,7 +98,7 @@ impl InternalEvent for ParserConversionError<'_> {
             stage = error_stage::PROCESSING
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "type_conversion",
             "error_type" => error_type::CONVERSION_FAILED,
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_events/postgresql_metrics.rs b/src/internal_events/postgresql_metrics.rs
index d6a58f968ab7f..62fa4d18a722d 100644
--- a/src/internal_events/postgresql_metrics.rs
+++ b/src/internal_events/postgresql_metrics.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct PostgresqlMetricsCollectError<'a> {
@@ -18,7 +19,7 @@ impl InternalEvent for PostgresqlMetricsCollectError<'_> {
             endpoint = %self.endpoint,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
         )
diff --git a/src/internal_events/process.rs b/src/internal_events/process.rs
index 987724c2da18d..19701c6feaca8 100644
--- a/src/internal_events/process.rs
+++ b/src/internal_events/process.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 use crate::{built_info, config};
 
@@ -17,7 +18,7 @@ impl InternalEvent for VectorStarted {
             arch = built_info::TARGET_ARCH,
             revision = built_info::VECTOR_BUILD_DESC.unwrap_or(""),
         );
-        counter!("started_total").increment(1);
+        counter!(CounterName::StartedTotal).increment(1);
     }
 }
 
@@ -34,7 +35,7 @@ impl InternalEvent for VectorReloaded<'_> {
             path = ?self.config_paths,
             internal_log_rate_limit = false,
         );
-        counter!("reloaded_total").increment(1);
+        counter!(CounterName::ReloadedTotal).increment(1);
     }
 }
 
@@ -59,7 +60,7 @@ impl InternalEvent for VectorStopped {
             target: "vector",
             message = "Vector has stopped.",
         );
-        counter!("stopped_total").increment(1);
+        counter!(CounterName::StoppedTotal).increment(1);
     }
 }
 
@@ -72,7 +73,7 @@ impl InternalEvent for VectorQuit {
             target: "vector",
             message = "Vector has quit.",
         );
-        counter!("quit_total").increment(1);
+        counter!(CounterName::QuitTotal).increment(1);
     }
 }
 
@@ -92,7 +93,7 @@ impl InternalEvent for VectorReloadError {
             internal_log_rate_limit = false,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "reload",
             "error_type" => error_type::CONFIGURATION_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -115,7 +116,7 @@ impl InternalEvent for VectorConfigLoadError {
             internal_log_rate_limit = false,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "config_load",
             "error_type" => error_type::CONFIGURATION_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -137,7 +138,7 @@ impl InternalEvent for VectorRecoveryError {
             internal_log_rate_limit = false,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "recovery",
             "error_type" => error_type::CONFIGURATION_FAILED,
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_events/prometheus.rs b/src/internal_events/prometheus.rs
index 27b28fb5ffafa..3ddd3c555f728 100644
--- a/src/internal_events/prometheus.rs
+++ b/src/internal_events/prometheus.rs
@@ -3,13 +3,14 @@
 #[cfg(feature = "sources-prometheus-scrape")]
 use std::borrow::Cow;
 
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
-};
 #[cfg(feature = "sources-prometheus-scrape")]
 use vector_lib::prometheus::parser::ParserError;
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{
+        ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    },
+};
 
 #[cfg(feature = "sources-prometheus-scrape")]
 #[derive(Debug, NamedInternalEvent)]
@@ -34,7 +35,7 @@ impl InternalEvent for PrometheusParseError<'_> {
             url = %self.url
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
             "url" => self.url.to_string(),
@@ -57,7 +58,7 @@ impl InternalEvent for PrometheusRemoteWriteParseError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
@@ -77,7 +78,7 @@ impl InternalEvent for PrometheusNormalizationError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::CONVERSION_FAILED,
             "stage" => error_stage::PROCESSING,
         )
diff --git a/src/internal_events/pulsar.rs b/src/internal_events/pulsar.rs
index a2212ef0d5971..0e2e11b061f3e 100644
--- a/src/internal_events/pulsar.rs
+++ b/src/internal_events/pulsar.rs
@@ -2,11 +2,10 @@
 
 #[cfg(feature = "sources-pulsar")]
 use metrics::Counter;
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct PulsarSendingError {
@@ -24,7 +23,7 @@ impl InternalEvent for PulsarSendingError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::SENDING,
         )
@@ -51,7 +50,7 @@ impl<F: std::fmt::Display> InternalEvent for PulsarPropertyExtractionError<F> {
             property_field = %self.property_field,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "extracting_property",
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -77,21 +76,21 @@ pub struct PulsarErrorEventData {
 registered_event!(
     PulsarErrorEvent => {
         ack_errors: Counter = counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "acknowledge_message",
             "error_type" => error_type::ACKNOWLEDGMENT_FAILED,
             "stage" => error_stage::RECEIVING,
         ),
 
         nack_errors: Counter = counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "negative_acknowledge_message",
             "error_type" => error_type::ACKNOWLEDGMENT_FAILED,
             "stage" => error_stage::RECEIVING,
         ),
 
         read_errors: Counter = counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "reading_message",
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::RECEIVING,
diff --git a/src/internal_events/redis.rs b/src/internal_events/redis.rs
index 45d76f3670dcd..87b9bc6d7b2f8 100644
--- a/src/internal_events/redis.rs
+++ b/src/internal_events/redis.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct RedisReceiveEventError {
@@ -25,7 +26,7 @@ impl InternalEvent for RedisReceiveEventError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => self.error_code,
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::RECEIVING,
diff --git a/src/internal_events/reduce.rs b/src/internal_events/reduce.rs
index 8917c5aad0a5a..0962c6332a439 100644
--- a/src/internal_events/reduce.rs
+++ b/src/internal_events/reduce.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 use vrl::{path::PathParseError, value::KeyString};
 
 #[derive(Debug, NamedInternalEvent)]
@@ -8,7 +9,7 @@ pub struct ReduceStaleEventFlushed;
 
 impl InternalEvent for ReduceStaleEventFlushed {
     fn emit(self) {
-        counter!("stale_events_flushed_total").increment(1);
+        counter!(CounterName::StaleEventsFlushedTotal).increment(1);
     }
 }
 
@@ -28,7 +29,7 @@ impl InternalEvent for ReduceAddEventError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
diff --git a/src/internal_events/remap.rs b/src/internal_events/remap.rs
index 989a6aa064065..d0e6500d69341 100644
--- a/src/internal_events/remap.rs
+++ b/src/internal_events/remap.rs
@@ -1,8 +1,8 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, INTENTIONAL, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, INTENTIONAL, InternalEvent, UNINTENTIONAL, error_stage,
+    error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct RemapMappingError {
@@ -21,7 +21,7 @@ impl InternalEvent for RemapMappingError {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::CONVERSION_FAILED,
             "stage" => error_stage::PROCESSING,
         )
diff --git a/src/internal_events/sample.rs b/src/internal_events/sample.rs
index 3722f9530b668..825175dc42555 100644
--- a/src/internal_events/sample.rs
+++ b/src/internal_events/sample.rs
@@ -1,5 +1,7 @@
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{ComponentEventsDropped, INTENTIONAL, InternalEvent};
+use vector_lib::{
+    NamedInternalEvent,
+    internal_event::{ComponentEventsDropped, INTENTIONAL, InternalEvent},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct SampleEventDiscarded;
diff --git a/src/internal_events/sematext_metrics.rs b/src/internal_events/sematext_metrics.rs
index 65d23c53e00ef..cb03742a5d3d1 100644
--- a/src/internal_events/sematext_metrics.rs
+++ b/src/internal_events/sematext_metrics.rs
@@ -1,7 +1,8 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{
+        ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    },
 };
 
 use crate::event::metric::Metric;
@@ -23,7 +24,7 @@ impl InternalEvent for SematextMetricsInvalidMetricError<'_> {
             kind = ?self.metric.kind(),
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "invalid_metric",
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -49,7 +50,7 @@ impl<E: std::fmt::Display> InternalEvent for SematextMetricsEncodeEventError<E>
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::PROCESSING,
         )
diff --git a/src/internal_events/socket.rs b/src/internal_events/socket.rs
index f0b58ce33bbd7..d38788f46767c 100644
--- a/src/internal_events/socket.rs
+++ b/src/internal_events/socket.rs
@@ -1,10 +1,10 @@
 use std::net::Ipv4Addr;
 
-use metrics::{counter, histogram};
 use vector_lib::{
-    NamedInternalEvent,
+    NamedInternalEvent, counter, histogram,
     internal_event::{
-        ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+        ComponentEventsDropped, CounterName, HistogramName, InternalEvent, UNINTENTIONAL,
+        error_stage, error_type,
     },
     json_size::JsonSize,
 };
@@ -42,11 +42,11 @@ impl InternalEvent for SocketBytesReceived {
             %protocol,
         );
         counter!(
-            "component_received_bytes_total",
+            CounterName::ComponentReceivedBytesTotal,
             "protocol" => protocol,
         )
         .increment(self.byte_size as u64);
-        histogram!("component_received_bytes").record(self.byte_size as f64);
+        histogram!(HistogramName::ComponentReceivedBytes).record(self.byte_size as f64);
     }
 }
 
@@ -66,10 +66,12 @@ impl InternalEvent for SocketEventsReceived {
             byte_size = self.byte_size.get(),
             %mode,
         );
-        counter!("component_received_events_total", "mode" => mode).increment(self.count as u64);
-        counter!("component_received_event_bytes_total", "mode" => mode)
+        counter!(CounterName::ComponentReceivedEventsTotal, "mode" => mode)
+            .increment(self.count as u64);
+        counter!(CounterName::ComponentReceivedEventBytesTotal, "mode" => mode)
             .increment(self.byte_size.get() as u64);
-        histogram!("component_received_bytes", "mode" => mode).record(self.byte_size.get() as f64);
+        histogram!(HistogramName::ComponentReceivedBytes, "mode" => mode)
+            .record(self.byte_size.get() as f64);
     }
 }
 
@@ -88,7 +90,7 @@ impl InternalEvent for SocketBytesSent {
             %protocol,
         );
         counter!(
-            "component_sent_bytes_total",
+            CounterName::ComponentSentBytesTotal,
             "protocol" => protocol,
         )
         .increment(self.byte_size as u64);
@@ -105,8 +107,9 @@ pub struct SocketEventsSent {
 impl InternalEvent for SocketEventsSent {
     fn emit(self) {
         trace!(message = "Events sent.", count = %self.count, byte_size = %self.byte_size.get());
-        counter!("component_sent_events_total", "mode" => self.mode.as_str()).increment(self.count);
-        counter!("component_sent_event_bytes_total", "mode" => self.mode.as_str())
+        counter!(CounterName::ComponentSentEventsTotal, "mode" => self.mode.as_str())
+            .increment(self.count);
+        counter!(CounterName::ComponentSentEventBytesTotal, "mode" => self.mode.as_str())
             .increment(self.byte_size.get() as u64);
     }
 }
@@ -129,7 +132,7 @@ impl<E: std::fmt::Display> InternalEvent for SocketBindError<E> {
             %mode,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "socket_bind",
             "error_type" => error_type::IO_FAILED,
             "stage" => error_stage::INITIALIZING,
@@ -164,7 +167,7 @@ impl<E: std::fmt::Display> InternalEvent for SocketMulticastGroupJoinError<E> {
             %interface,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "socket_multicast_group_join",
             "error_type" => error_type::IO_FAILED,
             "stage" => error_stage::INITIALIZING,
@@ -194,7 +197,7 @@ impl<E: std::fmt::Display> InternalEvent for SocketReceiveError<E> {
             %mode,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "socket_receive",
             "error_type" => error_type::READER_FAILED,
             "stage" => error_stage::RECEIVING,
@@ -223,7 +226,7 @@ impl<E: std::fmt::Display> InternalEvent for SocketSendError<E> {
             %mode,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "socket_send",
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::SENDING,
diff --git a/src/internal_events/splunk_hec.rs b/src/internal_events/splunk_hec.rs
index 6dcd63084d8e6..bd3fde83c2318 100644
--- a/src/internal_events/splunk_hec.rs
+++ b/src/internal_events/splunk_hec.rs
@@ -7,11 +7,13 @@ pub use self::source::*;
 
 #[cfg(feature = "sinks-splunk_hec")]
 mod sink {
-    use metrics::{counter, gauge};
     use serde_json::Error;
-    use vector_lib::NamedInternalEvent;
-    use vector_lib::internal_event::{
-        ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    use vector_lib::{
+        NamedInternalEvent, counter, gauge,
+        internal_event::{
+            ComponentEventsDropped, CounterName, GaugeName, InternalEvent, UNINTENTIONAL,
+            error_stage, error_type,
+        },
     };
 
     use crate::{
@@ -35,7 +37,7 @@ mod sink {
                 stage = error_stage::PROCESSING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "serializing_json",
                 "error_type" => error_type::ENCODER_FAILED,
                 "stage" => error_stage::PROCESSING,
@@ -63,13 +65,13 @@ mod sink {
                 kind = ?self.kind,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_type" => error_type::INVALID_METRIC,
                 "stage" => error_stage::PROCESSING,
             )
             .increment(1);
             counter!(
-                "component_discarded_events_total",
+                CounterName::ComponentDiscardedEventsTotal,
                 "error_type" => error_type::INVALID_METRIC,
                 "stage" => error_stage::PROCESSING,
             )
@@ -92,7 +94,7 @@ mod sink {
                 stage = error_stage::SENDING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "invalid_response",
                 "error_type" => error_type::PARSER_FAILED,
                 "stage" => error_stage::SENDING,
@@ -117,7 +119,7 @@ mod sink {
                 stage = error_stage::SENDING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "indexer_ack_failed",
                 "error_type" => error_type::ACKNOWLEDGMENT_FAILED,
                 "stage" => error_stage::SENDING,
@@ -141,7 +143,7 @@ mod sink {
                 stage = error_stage::SENDING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "indexer_ack_unavailable",
                 "error_type" => error_type::ACKNOWLEDGMENT_FAILED,
                 "stage" => error_stage::SENDING,
@@ -155,7 +157,7 @@ mod sink {
 
     impl InternalEvent for SplunkIndexerAcknowledgementAckAdded {
         fn emit(self) {
-            gauge!("splunk_pending_acks").increment(1.0);
+            gauge!(GaugeName::SplunkPendingAcks).increment(1.0);
         }
     }
 
@@ -166,7 +168,7 @@ mod sink {
 
     impl InternalEvent for SplunkIndexerAcknowledgementAcksRemoved {
         fn emit(self) {
-            gauge!("splunk_pending_acks").decrement(self.count);
+            gauge!(GaugeName::SplunkPendingAcks).decrement(self.count);
         }
     }
 
@@ -197,9 +199,10 @@ mod sink {
 
 #[cfg(feature = "sources-splunk_hec")]
 mod source {
-    use metrics::counter;
-    use vector_lib::NamedInternalEvent;
-    use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+    use vector_lib::{
+        NamedInternalEvent, counter,
+        internal_event::{CounterName, InternalEvent, error_stage, error_type},
+    };
 
     use crate::sources::splunk_hec::ApiError;
 
@@ -218,7 +221,7 @@ mod source {
                 stage = error_stage::PROCESSING
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "invalid_request_body",
                 "error_type" => error_type::PARSER_FAILED,
                 "stage" => error_stage::PROCESSING,
@@ -243,7 +246,7 @@ mod source {
                         stage = error_stage::RECEIVING
                     );
                     counter!(
-                        "component_errors_total",
+                        CounterName::ComponentErrorsTotal,
                         "error_type" => error_type::AUTHENTICATION_FAILED,
                         "stage" => error_stage::RECEIVING,
                     )
@@ -257,7 +260,7 @@ mod source {
                         stage = error_stage::RECEIVING
                     );
                     counter!(
-                        "component_errors_total",
+                        CounterName::ComponentErrorsTotal,
                         "error_type" => error_type::REQUEST_FAILED,
                         "stage" => error_stage::RECEIVING,
                     )
diff --git a/src/internal_events/statsd_sink.rs b/src/internal_events/statsd_sink.rs
index 7f0ee81f48ddc..858084124b562 100644
--- a/src/internal_events/statsd_sink.rs
+++ b/src/internal_events/statsd_sink.rs
@@ -1,8 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 use crate::event::metric::{MetricKind, MetricValue};
 
@@ -24,7 +23,7 @@ impl InternalEvent for StatsdInvalidMetricError<'_> {
             kind = ?self.kind,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "invalid_metric",
             "error_type" => error_type::ENCODER_FAILED,
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_events/tag_cardinality_limit.rs b/src/internal_events/tag_cardinality_limit.rs
index 83a82acd342ae..9906f5c320f6b 100644
--- a/src/internal_events/tag_cardinality_limit.rs
+++ b/src/internal_events/tag_cardinality_limit.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{ComponentEventsDropped, INTENTIONAL, InternalEvent};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{ComponentEventsDropped, CounterName, INTENTIONAL, InternalEvent},
+};
 
 #[derive(NamedInternalEvent)]
 pub struct TagCardinalityLimitRejectingEvent<'a> {
@@ -20,13 +21,13 @@ impl InternalEvent for TagCardinalityLimitRejectingEvent<'_> {
         );
         if self.include_extended_tags {
             counter!(
-                "tag_value_limit_exceeded_total",
+                CounterName::TagValueLimitExceededTotal,
                 "metric_name" => self.metric_name.to_string(),
                 "tag_key" => self.tag_key.to_string(),
             )
             .increment(1);
         } else {
-            counter!("tag_value_limit_exceeded_total").increment(1);
+            counter!(CounterName::TagValueLimitExceededTotal).increment(1);
         }
 
         emit!(ComponentEventsDropped::<INTENTIONAL> {
@@ -54,13 +55,13 @@ impl InternalEvent for TagCardinalityLimitRejectingTag<'_> {
         );
         if self.include_extended_tags {
             counter!(
-                "tag_value_limit_exceeded_total",
+                CounterName::TagValueLimitExceededTotal,
                 "metric_name" => self.metric_name.to_string(),
                 "tag_key" => self.tag_key.to_string(),
             )
             .increment(1);
         } else {
-            counter!("tag_value_limit_exceeded_total").increment(1);
+            counter!(CounterName::TagValueLimitExceededTotal).increment(1);
         }
     }
 }
@@ -76,6 +77,6 @@ impl InternalEvent for TagCardinalityValueLimitReached<'_> {
             message = "Value_limit reached for key. New values for this key will be rejected.",
             key = %self.key,
         );
-        counter!("value_limit_reached_total").increment(1);
+        counter!(CounterName::ValueLimitReachedTotal).increment(1);
     }
 }
diff --git a/src/internal_events/tcp.rs b/src/internal_events/tcp.rs
index a121eef1e0327..1ec0cfb6322e5 100644
--- a/src/internal_events/tcp.rs
+++ b/src/internal_events/tcp.rs
@@ -1,8 +1,9 @@
 use std::net::SocketAddr;
 
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 use crate::{internal_events::SocketOutgoingConnectionError, tls::TlsError};
 
@@ -18,7 +19,7 @@ impl InternalEvent for TcpSocketConnectionEstablished {
         } else {
             debug!(message = "Connected.", peer_addr = "unknown");
         }
-        counter!("connection_established_total", "mode" => "tcp").increment(1);
+        counter!(CounterName::ConnectionEstablishedTotal, "mode" => "tcp").increment(1);
     }
 }
 
@@ -41,7 +42,7 @@ pub struct TcpSocketConnectionShutdown;
 impl InternalEvent for TcpSocketConnectionShutdown {
     fn emit(self) {
         warn!(message = "Received EOF from the server, shutdown.");
-        counter!("connection_shutdown_total", "mode" => "tcp").increment(1);
+        counter!(CounterName::ConnectionShutdownTotal, "mode" => "tcp").increment(1);
     }
 }
 
@@ -63,7 +64,7 @@ impl<E: std::fmt::Display> InternalEvent for TcpSocketError<'_, E> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::CONNECTION_FAILED,
             "stage" => error_stage::PROCESSING,
         )
@@ -100,7 +101,7 @@ impl InternalEvent for TcpSocketTlsConnectionError {
                     stage = error_stage::SENDING,
                 );
                 counter!(
-                    "component_errors_total",
+                    CounterName::ComponentErrorsTotal,
                     "error_code" => "connection_failed",
                     "error_type" => error_type::WRITER_FAILED,
                     "stage" => error_stage::SENDING,
@@ -127,7 +128,7 @@ impl InternalEvent for TcpSendAckError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "ack_failed",
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::SENDING,
@@ -152,7 +153,7 @@ impl InternalEvent for TcpBytesReceived {
             peer_addr = %self.peer_addr,
         );
         counter!(
-            "component_received_bytes_total", "protocol" => "tcp"
+            CounterName::ComponentReceivedBytesTotal, "protocol" => "tcp"
         )
         .increment(self.byte_size as u64);
     }
diff --git a/src/internal_events/template.rs b/src/internal_events/template.rs
index 147418042a0c6..db43081e2a22a 100644
--- a/src/internal_events/template.rs
+++ b/src/internal_events/template.rs
@@ -1,7 +1,8 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{
+        ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    },
 };
 
 #[derive(NamedInternalEvent)]
@@ -29,7 +30,7 @@ impl InternalEvent for TemplateRenderingError<'_> {
             );
 
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_type" => error_type::TEMPLATE_FAILED,
                 "stage" => error_stage::PROCESSING,
             )
diff --git a/src/internal_events/throttle.rs b/src/internal_events/throttle.rs
index 274fedd7741b9..3757bbae40535 100644
--- a/src/internal_events/throttle.rs
+++ b/src/internal_events/throttle.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{ComponentEventsDropped, INTENTIONAL, InternalEvent};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{ComponentEventsDropped, CounterName, INTENTIONAL, InternalEvent},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub(crate) struct ThrottleEventDiscarded {
@@ -23,7 +24,7 @@ impl InternalEvent for ThrottleEventDiscarded {
             // if we should change the specification wording? Sort of a similar situation to the
             // `error_code` tag for the component errors metric, where it's meant to be optional and
             // only specified when relevant.
-            counter!("events_discarded_total", "key" => self.key).increment(1); // Deprecated.
+            counter!(CounterName::EventsDiscardedTotal, "key" => self.key).increment(1); // Deprecated.
         }
 
         emit!(ComponentEventsDropped::<INTENTIONAL> {
diff --git a/src/internal_events/udp.rs b/src/internal_events/udp.rs
index 0602d4fdb3329..31e5f5c6533a4 100644
--- a/src/internal_events/udp.rs
+++ b/src/internal_events/udp.rs
@@ -1,7 +1,8 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{
+        ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    },
 };
 
 use crate::internal_events::SocketOutgoingConnectionError;
@@ -14,7 +15,7 @@ pub struct UdpSocketConnectionEstablished;
 impl InternalEvent for UdpSocketConnectionEstablished {
     fn emit(self) {
         debug!(message = "Connected.");
-        counter!("connection_established_total", "mode" => "udp").increment(1);
+        counter!(CounterName::ConnectionEstablishedTotal, "mode" => "udp").increment(1);
     }
 }
 
@@ -51,13 +52,13 @@ impl InternalEvent for UdpSendIncompleteError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::SENDING,
         )
         .increment(1);
         // deprecated
-        counter!("connection_send_errors_total", "mode" => "udp").increment(1);
+        counter!(CounterName::ConnectionSendErrorsTotal, "mode" => "udp").increment(1);
 
         emit!(ComponentEventsDropped::<UNINTENTIONAL> { count: 1, reason });
     }
@@ -80,7 +81,7 @@ impl InternalEvent for UdpChunkingError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::SENDING,
         )
diff --git a/src/internal_events/unix.rs b/src/internal_events/unix.rs
index 6fab3348dc4d7..fc98ff7feacbd 100644
--- a/src/internal_events/unix.rs
+++ b/src/internal_events/unix.rs
@@ -2,11 +2,10 @@
 
 use std::{io::Error, path::Path};
 
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
 use vector_lib::internal_event::{
-    ComponentEventsDropped, InternalEvent, UNINTENTIONAL, error_stage, error_type,
+    ComponentEventsDropped, CounterName, InternalEvent, UNINTENTIONAL, error_stage, error_type,
 };
+use vector_lib::{NamedInternalEvent, counter};
 
 use crate::internal_events::SocketOutgoingConnectionError;
 
@@ -18,7 +17,7 @@ pub struct UnixSocketConnectionEstablished<'a> {
 impl InternalEvent for UnixSocketConnectionEstablished<'_> {
     fn emit(self) {
         debug!(message = "Connected.", path = ?self.path);
-        counter!("connection_established_total", "mode" => "unix").increment(1);
+        counter!(CounterName::ConnectionEstablishedTotal, "mode" => "unix").increment(1);
     }
 }
 
@@ -59,7 +58,7 @@ impl<E: std::fmt::Display> InternalEvent for UnixSocketError<'_, E> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::CONNECTION_FAILED,
             "stage" => error_stage::PROCESSING,
         )
@@ -84,7 +83,7 @@ impl<E: std::fmt::Display> InternalEvent for UnixSocketSendError<'_, E> {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::SENDING,
         )
@@ -112,7 +111,7 @@ impl InternalEvent for UnixSendIncompleteError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::SENDING,
         )
@@ -139,7 +138,7 @@ impl InternalEvent for UnixSocketFileDeleteError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "delete_socket_file",
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_events/websocket.rs b/src/internal_events/websocket.rs
index 960aec1916133..b842407ee0313 100644
--- a/src/internal_events/websocket.rs
+++ b/src/internal_events/websocket.rs
@@ -5,14 +5,15 @@ use std::{
     fmt::{Debug, Display, Formatter, Result},
 };
 
-use metrics::{counter, histogram};
 use tokio_tungstenite::tungstenite::error::Error as TungsteniteError;
 use vector_common::{
     internal_event::{error_stage, error_type},
     json_size::JsonSize,
 };
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::InternalEvent;
+use vector_lib::{
+    NamedInternalEvent, counter, histogram,
+    internal_event::{CounterName, HistogramName, InternalEvent},
+};
 
 pub const PROTOCOL: &str = "websocket";
 
@@ -22,7 +23,7 @@ pub struct WebSocketConnectionEstablished;
 impl InternalEvent for WebSocketConnectionEstablished {
     fn emit(self) {
         debug!(message = "Connected.");
-        counter!("connection_established_total").increment(1);
+        counter!(CounterName::ConnectionEstablishedTotal).increment(1);
     }
 }
 
@@ -41,7 +42,7 @@ impl InternalEvent for WebSocketConnectionFailedError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "protocol" => PROTOCOL,
             "error_code" => "websocket_connection_failed",
             "error_type" => error_type::CONNECTION_FAILED,
@@ -57,7 +58,7 @@ pub struct WebSocketConnectionShutdown;
 impl InternalEvent for WebSocketConnectionShutdown {
     fn emit(self) {
         warn!(message = "Closed by the server.");
-        counter!("connection_shutdown_total").increment(1);
+        counter!(CounterName::ConnectionShutdownTotal).increment(1);
     }
 }
 
@@ -76,7 +77,7 @@ impl InternalEvent for WebSocketConnectionError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "protocol" => PROTOCOL,
             "error_code" => "websocket_connection_error",
             "error_type" => error_type::WRITER_FAILED,
@@ -121,7 +122,7 @@ impl InternalEvent for WebSocketBytesReceived<'_> {
             kind = %self.kind
         );
         let counter = counter!(
-            "component_received_bytes_total",
+            CounterName::ComponentReceivedBytesTotal,
             "url" => self.url.to_string(),
             "protocol" => self.protocol,
             "kind" => self.kind.to_string()
@@ -150,17 +151,17 @@ impl InternalEvent for WebSocketMessageReceived<'_> {
             kind = %self.kind
         );
 
-        let histogram = histogram!("component_received_events_count");
+        let histogram = histogram!(HistogramName::ComponentReceivedEventsCount);
         histogram.record(self.count as f64);
         let counter = counter!(
-            "component_received_events_total",
+            CounterName::ComponentReceivedEventsTotal,
             "uri" => self.url.to_string(),
             "protocol" => PROTOCOL,
             "kind" => self.kind.to_string()
         );
         counter.increment(self.count as u64);
         let counter = counter!(
-            "component_received_event_bytes_total",
+            CounterName::ComponentReceivedEventBytesTotal,
             "url" => self.url.to_string(),
             "protocol" => PROTOCOL,
             "kind" => self.kind.to_string()
@@ -184,7 +185,7 @@ impl InternalEvent for WebSocketReceiveError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "protocol" => PROTOCOL,
             "error_code" => "websocket_receive_error",
             "error_type" => error_type::CONNECTION_FAILED,
@@ -209,7 +210,7 @@ impl InternalEvent for WebSocketSendError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "protocol" => PROTOCOL,
             "error_code" => "websocket_send_error",
             "error_type" => error_type::CONNECTION_FAILED,
diff --git a/src/internal_events/websocket_server.rs b/src/internal_events/websocket_server.rs
index fd064c41f2f8a..bdace6b079da5 100644
--- a/src/internal_events/websocket_server.rs
+++ b/src/internal_events/websocket_server.rs
@@ -1,8 +1,9 @@
 use std::{error::Error, fmt::Debug};
 
-use metrics::{counter, gauge};
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter, gauge,
+    internal_event::{CounterName, GaugeName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct WebSocketListenerConnectionEstablished {
@@ -18,8 +19,8 @@ impl InternalEvent for WebSocketListenerConnectionEstablished {
                 self.client_count
             )
         );
-        counter!("connection_established_total", &self.extra_tags).increment(1);
-        gauge!("active_clients", &self.extra_tags).set(self.client_count as f64);
+        counter!(CounterName::ConnectionEstablishedTotal, &self.extra_tags).increment(1);
+        gauge!(GaugeName::ActiveClients, &self.extra_tags).set(self.client_count as f64);
     }
 }
 
@@ -49,7 +50,7 @@ impl InternalEvent for WebSocketListenerConnectionFailedError {
         ]);
         // Tags required by `component_errors_total` are dynamically added above.
         // ## skip check-validity-events ##
-        counter!("component_errors_total", &all_tags).increment(1);
+        counter!(CounterName::ComponentErrorsTotal, &all_tags).increment(1);
     }
 }
 
@@ -67,8 +68,8 @@ impl InternalEvent for WebSocketListenerConnectionShutdown {
                 self.client_count
             )
         );
-        counter!("connection_shutdown_total", &self.extra_tags).increment(1);
-        gauge!("active_clients", &self.extra_tags).set(self.client_count as f64);
+        counter!(CounterName::ConnectionShutdownTotal, &self.extra_tags).increment(1);
+        gauge!(GaugeName::ActiveClients, &self.extra_tags).set(self.client_count as f64);
     }
 }
 
@@ -87,7 +88,7 @@ impl InternalEvent for WebSocketListenerSendError {
             stage = error_stage::SENDING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "ws_server_connection_error",
             "error_type" => error_type::WRITER_FAILED,
             "stage" => error_stage::SENDING,
@@ -104,8 +105,8 @@ pub struct WebSocketListenerMessageSent {
 
 impl InternalEvent for WebSocketListenerMessageSent {
     fn emit(self) {
-        counter!("websocket_messages_sent_total", &self.extra_tags).increment(1);
-        counter!("websocket_bytes_sent_total", &self.extra_tags)
+        counter!(CounterName::WebsocketMessagesSentTotal, &self.extra_tags).increment(1);
+        counter!(CounterName::WebsocketBytesSentTotal, &self.extra_tags)
             .increment(self.message_size as u64);
     }
 }
diff --git a/src/internal_events/windows.rs b/src/internal_events/windows.rs
index 7b36e2fa62466..5ea6bae62aa25 100644
--- a/src/internal_events/windows.rs
+++ b/src/internal_events/windows.rs
@@ -1,6 +1,7 @@
-use metrics::counter;
-use vector_lib::NamedInternalEvent;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::{
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
+};
 
 #[derive(Debug, NamedInternalEvent)]
 pub struct WindowsServiceStart<'a> {
@@ -16,7 +17,7 @@ impl InternalEvent for WindowsServiceStart<'_> {
             "Started Windows Service.",
         );
         counter!(
-            "windows_service_start_total",
+            CounterName::WindowsServiceStartTotal,
             "already_started" => self.already_started.to_string(),
         )
         .increment(1);
@@ -37,7 +38,7 @@ impl InternalEvent for WindowsServiceStop<'_> {
             "Stopped Windows Service.",
         );
         counter!(
-            "windows_service_stop_total",
+            CounterName::WindowsServiceStopTotal,
             "already_stopped" => self.already_stopped.to_string(),
         )
         .increment(1);
@@ -55,7 +56,7 @@ impl InternalEvent for WindowsServiceRestart<'_> {
             name = ?self.name,
             "Restarted Windows Service."
         );
-        counter!("windows_service_restart_total").increment(1)
+        counter!(CounterName::WindowsServiceRestartTotal).increment(1)
     }
 }
 
@@ -70,7 +71,7 @@ impl InternalEvent for WindowsServiceInstall<'_> {
             name = ?self.name,
             "Installed Windows Service.",
         );
-        counter!("windows_service_install_total").increment(1);
+        counter!(CounterName::WindowsServiceInstallTotal).increment(1);
     }
 }
 
@@ -85,7 +86,7 @@ impl InternalEvent for WindowsServiceUninstall<'_> {
             name = ?self.name,
             "Uninstalled Windows Service.",
         );
-        counter!("windows_service_uninstall_total").increment(1);
+        counter!(CounterName::WindowsServiceUninstallTotal).increment(1);
     }
 }
 
@@ -104,7 +105,7 @@ impl InternalEvent for WindowsServiceDoesNotExistError<'_> {
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "service_missing",
             "error_type" => error_type::CONDITION_FAILED,
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_events/windows_event_log.rs b/src/internal_events/windows_event_log.rs
index ae5363e2c52be..7ec356ba253ff 100644
--- a/src/internal_events/windows_event_log.rs
+++ b/src/internal_events/windows_event_log.rs
@@ -1,8 +1,7 @@
-use metrics::counter;
 use tracing::error;
 use vector_lib::{
-    NamedInternalEvent,
-    internal_event::{InternalEvent, error_stage, error_type},
+    NamedInternalEvent, counter,
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
 };
 
 #[derive(Debug, NamedInternalEvent)]
@@ -25,7 +24,7 @@ impl InternalEvent for WindowsEventLogParseError {
             internal_log_rate_limit = true,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "parse_failed",
             "error_type" => error_type::PARSER_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -54,7 +53,7 @@ impl InternalEvent for WindowsEventLogQueryError {
             internal_log_rate_limit = true,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "query_failed",
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
@@ -81,7 +80,7 @@ impl InternalEvent for WindowsEventLogBookmarkError {
             internal_log_rate_limit = true,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "bookmark_failed",
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::PROCESSING,
diff --git a/src/internal_telemetry/allocations/mod.rs b/src/internal_telemetry/allocations/mod.rs
index a2680256ec167..15ad82b3665fa 100644
--- a/src/internal_telemetry/allocations/mod.rs
+++ b/src/internal_telemetry/allocations/mod.rs
@@ -11,8 +11,11 @@ use std::{
 };
 
 use arr_macro::arr;
-use metrics::{counter, gauge};
 use rand_distr::num_traits::ToPrimitive;
+use vector_common::{
+    counter, gauge,
+    internal_event::{CounterName, GaugeName},
+};
 
 use self::allocator::Tracer;
 pub(crate) use self::allocator::{
@@ -144,26 +147,26 @@ pub fn init_allocation_tracing() {
                     let group_info = group.lock().unwrap();
                     if allocations_diff > 0 {
                         counter!(
-                            "component_allocated_bytes_total", "component_kind" => group_info.component_kind.clone(),
+                            CounterName::ComponentAllocatedBytesTotal, "component_kind" => group_info.component_kind.clone(),
                             "component_type" => group_info.component_type.clone(),
                             "component_id" => group_info.component_id.clone()).increment(allocations_diff);
                     }
                     if deallocations_diff > 0 {
                         counter!(
-                            "component_deallocated_bytes_total", "component_kind" => group_info.component_kind.clone(),
+                            CounterName::ComponentDeallocatedBytesTotal, "component_kind" => group_info.component_kind.clone(),
                             "component_type" => group_info.component_type.clone(),
                             "component_id" => group_info.component_id.clone()).increment(deallocations_diff);
                     }
                     if mem_used_diff > 0 {
                         gauge!(
-                            "component_allocated_bytes", "component_type" => group_info.component_type.clone(),
+                            GaugeName::ComponentAllocatedBytes, "component_type" => group_info.component_type.clone(),
                             "component_id" => group_info.component_id.clone(),
                             "component_kind" => group_info.component_kind.clone())
                             .increment(mem_used_diff.to_f64().expect("failed to convert mem_used from int to float"));
                     }
                     if mem_used_diff < 0 {
                         gauge!(
-                            "component_allocated_bytes", "component_type" => group_info.component_type.clone(),
+                            GaugeName::ComponentAllocatedBytes, "component_type" => group_info.component_type.clone(),
                             "component_id" => group_info.component_id.clone(),
                             "component_kind" => group_info.component_kind.clone())
                             .decrement(-mem_used_diff.to_f64().expect("failed to convert mem_used from int to float"));
diff --git a/src/sources/internal_metrics.rs b/src/sources/internal_metrics.rs
index f576efa2a71a1..76dfab8849997 100644
--- a/src/sources/internal_metrics.rs
+++ b/src/sources/internal_metrics.rs
@@ -196,8 +196,13 @@ impl InternalMetrics<'_> {
 mod tests {
     use std::collections::BTreeMap;
 
-    use metrics::{counter, gauge, histogram};
-    use vector_lib::{metric_tags, metrics::Controller};
+    use strum::IntoEnumIterator;
+    use vector_lib::{
+        counter, gauge, histogram,
+        internal_event::{CounterName, GaugeName, HistogramName},
+        metric_tags,
+        metrics::Controller,
+    };
 
     use super::*;
     use crate::{
@@ -223,14 +228,20 @@ mod tests {
         // There *seems* to be a race condition here (CI was flaky), so add a slight delay.
         std::thread::sleep(std::time::Duration::from_millis(300));
 
-        gauge!("foo").set(1.0);
-        gauge!("foo").set(2.0);
-        counter!("bar").increment(3);
-        counter!("bar").increment(4);
-        histogram!("baz").record(5.0);
-        histogram!("baz").record(6.0);
-        histogram!("quux", "host" => "foo").record(8.0);
-        histogram!("quux", "host" => "foo").record(8.1);
+        let gauge_name = GaugeName::iter().next().unwrap();
+        let counter_name = CounterName::iter().next().unwrap();
+        let mut histogram_iter = HistogramName::iter();
+        let histogram_name = histogram_iter.next().unwrap();
+        let histogram_tagged_name = histogram_iter.next().unwrap();
+
+        gauge!(gauge_name).set(1.0);
+        gauge!(gauge_name).set(2.0);
+        counter!(counter_name).increment(3);
+        counter!(counter_name).increment(4);
+        histogram!(histogram_name).record(5.0);
+        histogram!(histogram_name).record(6.0);
+        histogram!(histogram_tagged_name, "host" => "foo").record(8.0);
+        histogram!(histogram_tagged_name, "host" => "foo").record(8.1);
 
         let controller = Controller::get().expect("no controller");
 
@@ -243,10 +254,16 @@ mod tests {
             .map(|metric| (metric.name().to_string(), metric))
             .collect::<BTreeMap<String, Metric>>();
 
-        assert_eq!(&MetricValue::Gauge { value: 2.0 }, output["foo"].value());
-        assert_eq!(&MetricValue::Counter { value: 7.0 }, output["bar"].value());
+        assert_eq!(
+            &MetricValue::Gauge { value: 2.0 },
+            output[gauge_name.as_str()].value()
+        );
+        assert_eq!(
+            &MetricValue::Counter { value: 7.0 },
+            output[counter_name.as_str()].value()
+        );
 
-        match &output["baz"].value() {
+        match &output[histogram_name.as_str()].value() {
             MetricValue::AggregatedHistogram {
                 buckets,
                 count,
@@ -263,7 +280,7 @@ mod tests {
             _ => panic!("wrong type"),
         }
 
-        match &output["quux"].value() {
+        match &output[histogram_tagged_name.as_str()].value() {
             MetricValue::AggregatedHistogram {
                 buckets,
                 count,
@@ -282,7 +299,7 @@ mod tests {
         }
 
         let labels = metric_tags!("host" => "foo");
-        assert_eq!(Some(&labels), output["quux"].tags());
+        assert_eq!(Some(&labels), output[histogram_tagged_name.as_str()].tags());
     }
 
     async fn event_from_config(config: InternalMetricsConfig) -> Event {
diff --git a/src/topology/builder.rs b/src/topology/builder.rs
index 8948109fa7fb7..a25a99d337a26 100644
--- a/src/topology/builder.rs
+++ b/src/topology/builder.rs
@@ -8,7 +8,6 @@ use std::{
 
 use futures::{FutureExt, StreamExt, TryStreamExt, stream::FuturesOrdered};
 use futures_util::stream::FuturesUnordered;
-use metrics::gauge;
 use stream_cancel::{StreamExt as StreamCancelExt, Trigger, Tripwire};
 use tokio::{
     select,
@@ -31,6 +30,7 @@ use vector_lib::{
     source_sender::{CHUNK_SIZE, SourceSenderItem},
     transform::update_runtime_schema_definition,
 };
+use vector_lib::{gauge, internal_event::GaugeName};
 use vector_vrl_metrics::MetricsStorage;
 
 use super::{
@@ -627,7 +627,7 @@ impl<'a> Builder<'a> {
 
             let utilization_sender = self
                 .utilization_registry
-                .add_component(key.clone(), gauge!("utilization"));
+                .add_component(key.clone(), gauge!(GaugeName::Utilization));
             let component_key = key.clone();
             let sink = async move {
                 debug!("Sink starting.");
@@ -747,7 +747,7 @@ impl<'a> Builder<'a> {
 
         let sender = self
             .utilization_registry
-            .add_component(node.key.clone(), gauge!("utilization"));
+            .add_component(node.key.clone(), gauge!(GaugeName::Utilization));
         let runner = Runner::new(
             t,
             input_rx,
@@ -803,7 +803,7 @@ impl<'a> Builder<'a> {
 
         let sender = self
             .utilization_registry
-            .add_component(key.clone(), gauge!("utilization"));
+            .add_component(key.clone(), gauge!(GaugeName::Utilization));
         let output_sender = sender.clone();
         let input_rx = Utilization::new(sender, key.clone(), input_rx.into_stream());
 
diff --git a/src/utilization.rs b/src/utilization.rs
index b3496b998f1c5..21d5f670bf1d9 100644
--- a/src/utilization.rs
+++ b/src/utilization.rs
@@ -344,6 +344,9 @@ impl<S> OutputUtilization<S> {
 mod tests {
     use mock_instant::global::MockClock;
     use serial_test::serial;
+    use strum::IntoEnumIterator;
+    use vector_lib::gauge;
+    use vector_lib::internal_event::GaugeName;
 
     use super::*;
 
@@ -353,7 +356,7 @@ mod tests {
         MockClock::set_time(Duration::from_secs(100));
 
         Timer::new(
-            metrics::gauge!("test_utilization"),
+            gauge!(GaugeName::iter().next().unwrap()),
             #[cfg(debug_assertions)]
             "test_component".into(),
         )
@@ -522,7 +525,7 @@ mod tests {
         let (mut emitter, registry) = UtilizationEmitter::new();
         let key = ComponentKey::from("test_transform");
 
-        let sender = registry.add_component(key.clone(), metrics::gauge!("utilization"));
+        let sender = registry.add_component(key.clone(), gauge!(GaugeName::Utilization));
         let output_sender = sender.clone();
 
         // Upstream channel carrying EventArrays.

From 48be543ff3b84dfbd56a49cc6a0a0aac450bbceb Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 4 May 2026 10:01:46 -0400
Subject: [PATCH 190/326] fix(aws_sqs source): scope HistogramName import to s3
 module (#25353)

`HistogramName` was only used inside the `mod s3` block (gated on
`sources-aws_s3`) but was imported at the parent module level under a
broader cfg, breaking `cargo check --features sources-aws_sqs` with
`#[deny(warnings)]`.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/internal_events/aws_sqs.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/internal_events/aws_sqs.rs b/src/internal_events/aws_sqs.rs
index 51e8b78d23941..c04cb21b117fb 100644
--- a/src/internal_events/aws_sqs.rs
+++ b/src/internal_events/aws_sqs.rs
@@ -6,7 +6,7 @@ use vector_lib::counter;
 #[cfg(any(feature = "sources-aws_s3", feature = "sources-aws_sqs"))]
 use vector_lib::{
     NamedInternalEvent,
-    internal_event::{CounterName, HistogramName, InternalEvent, error_stage, error_type},
+    internal_event::{CounterName, InternalEvent, error_stage, error_type},
 };
 
 #[cfg(feature = "sources-aws_s3")]
@@ -18,6 +18,7 @@ mod s3 {
         SendMessageBatchRequestEntry, SendMessageBatchResultEntry,
     };
     use vector_lib::histogram;
+    use vector_lib::internal_event::HistogramName;
 
     use super::*;
     use crate::sources::aws_s3::sqs::ProcessingError;

From 96db40ef65b0d1246f06581987e5b6428468edf0 Mon Sep 17 00:00:00 2001
From: ArunPiduguDD <arun.pidugu@datadoghq.com>
Date: Mon, 4 May 2026 13:47:01 -0400
Subject: [PATCH 191/326] enhancement(metrics): Make transform-related
 functions in aggregate & tag cardinality transforms public (#25358)

Make transform-related functions in aggregate & tag cardinality processors public
---
 src/transforms/aggregate.rs                 | 4 ++--
 src/transforms/tag_cardinality_limit/mod.rs | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/transforms/aggregate.rs b/src/transforms/aggregate.rs
index c00315ad4871a..67de0815c6d29 100644
--- a/src/transforms/aggregate.rs
+++ b/src/transforms/aggregate.rs
@@ -181,7 +181,7 @@ impl Aggregate {
         })
     }
 
-    fn record(&mut self, event: Event) {
+    pub fn record(&mut self, event: Event) {
         let (series, data, metadata) = event.into_metric().into_parts();
 
         match &mut self.mode {
@@ -300,7 +300,7 @@ impl Aggregate {
         }
     }
 
-    fn flush_into(&mut self, output: &mut Vec<Event>) {
+    pub fn flush_into(&mut self, output: &mut Vec<Event>) {
         let map = std::mem::take(&mut self.map);
         for (series, entry) in map.clone().into_iter() {
             let mut metric = Metric::from_parts(series, entry.0, entry.1);
diff --git a/src/transforms/tag_cardinality_limit/mod.rs b/src/transforms/tag_cardinality_limit/mod.rs
index 2f26e214a5b61..6b936c59ce02c 100644
--- a/src/transforms/tag_cardinality_limit/mod.rs
+++ b/src/transforms/tag_cardinality_limit/mod.rs
@@ -121,7 +121,7 @@ impl TagCardinalityLimit {
             .insert(value.clone());
     }
 
-    fn transform_one(&mut self, mut event: Event) -> Option<Event> {
+    pub fn transform_one(&mut self, mut event: Event) -> Option<Event> {
         let metric = event.as_mut_metric();
         let metric_name = metric.name().to_string();
         let metric_namespace = metric.namespace().map(|n| n.to_string());

From 8073e93b48352f781aace209f816ac55280a8935 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 4 May 2026 15:13:10 -0400
Subject: [PATCH 192/326] chore(ci): rename WIP label workflows to docs review
 label (#25355)

Rename `add_wip_label.yml` and `remove_wip_label.yml` to
`add_docs_review_label.yml` and `remove_docs_review_label.yml`, and
switch the managed label from "work in progress" to
"docs review on hold". The label string is now hoisted to a
workflow-level `LABEL_NAME` env var so future renames are a one-line
edit. Header comments note we can promote these to a reusable
`workflow_call` workflow if a second use case appears.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/CODEOWNERS                            |  2 +-
 ...ip_label.yml => add_docs_review_label.yml} | 12 +++++++++---
 ...label.yml => remove_docs_review_label.yml} | 19 +++++++++++++------
 3 files changed, 23 insertions(+), 10 deletions(-)
 rename .github/workflows/{add_wip_label.yml => add_docs_review_label.yml} (81%)
 rename .github/workflows/{remove_wip_label.yml => remove_docs_review_label.yml} (68%)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ecd6fb374af9c..7534be2fb8652 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -3,7 +3,7 @@
 .github/workflows/regression.yml @vectordotdev/vector @vectordotdev/single-machine-performance
 regression/config.yaml @vectordotdev/vector @vectordotdev/single-machine-performance
 
-# Keep documentation team paths in sync with .github/workflows/add_wip_label.yml
+# Keep documentation team paths in sync with .github/workflows/add_docs_review_label.yml
 docs/ @vectordotdev/vector @vectordotdev/documentation
 website/ @vectordotdev/vector
 website/content @vectordotdev/vector @vectordotdev/documentation
diff --git a/.github/workflows/add_wip_label.yml b/.github/workflows/add_docs_review_label.yml
similarity index 81%
rename from .github/workflows/add_wip_label.yml
rename to .github/workflows/add_docs_review_label.yml
index 7924d4fade926..23f9a697397af 100644
--- a/.github/workflows/add_wip_label.yml
+++ b/.github/workflows/add_docs_review_label.yml
@@ -1,4 +1,7 @@
-name: Add Work In Progress Label
+# Adds a label to PRs that touch documentation paths until a maintainer approves.
+# Currently dedicated to the docs review flow. If a second use case appears, promote
+# this into a reusable workflow (`workflow_call`) with the label as an input.
+name: Add Docs Review Label
 
 permissions:
   pull-requests: write
@@ -12,8 +15,11 @@ on:
       - "website/content/**"
       - "website/cue/reference/**"
 
+env:
+  LABEL_NAME: "docs review on hold"
+
 jobs:
-  add_wip_label:
+  add_label:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
@@ -47,4 +53,4 @@ jobs:
       - if: steps.check.outputs.skip != 'true'
         uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
         with:
-          labels: "work in progress"
+          labels: ${{ env.LABEL_NAME }}
diff --git a/.github/workflows/remove_wip_label.yml b/.github/workflows/remove_docs_review_label.yml
similarity index 68%
rename from .github/workflows/remove_wip_label.yml
rename to .github/workflows/remove_docs_review_label.yml
index b4750b0f2b0d6..093c5a4bd5e90 100644
--- a/.github/workflows/remove_wip_label.yml
+++ b/.github/workflows/remove_docs_review_label.yml
@@ -1,4 +1,7 @@
-name: Remove Work In Progress Label
+# Removes the docs review label once a maintainer approves the PR.
+# Currently dedicated to the docs review flow. If a second use case appears, promote
+# this into a reusable workflow (`workflow_call`) with the label as an input.
+name: Remove Docs Review Label
 
 permissions:
   issues: write
@@ -8,8 +11,11 @@ on:
   pull_request_review:
     types: [submitted]
 
+env:
+  LABEL_NAME: "docs review on hold"
+
 jobs:
-  remove_wip_label:
+  remove_label:
     if: github.event.review.state == 'approved'
     runs-on: ubuntu-24.04
     timeout-minutes: 5
@@ -27,20 +33,21 @@ jobs:
               return;
             }
 
+            const labelName = process.env.LABEL_NAME;
             const { data: labels } = await github.rest.issues.listLabelsOnIssue({
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: context.payload.pull_request.number,
             });
-            const hasLabel = labels.some(l => l.name === 'work in progress');
+            const hasLabel = labels.some(l => l.name === labelName);
             if (!hasLabel) {
-              core.info('Label "work in progress" not found, skipping');
+              core.info(`Label "${labelName}" not found, skipping`);
               return;
             }
             await github.rest.issues.removeLabel({
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: context.payload.pull_request.number,
-              name: 'work in progress',
+              name: labelName,
             });
-            core.info('Removed "work in progress" label');
+            core.info(`Removed "${labelName}" label`);

From 4524b52c921447dfca228338add190f0363b582e Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 4 May 2026 19:08:38 -0400
Subject: [PATCH 193/326] chore(deps): upgrade hickory-proto to 0.26.1, ignore
 RUSTSEC-2026-0119 (#25354)

* chore(deps): upgrade hickory-proto to 0.26.1, ignore RUSTSEC-2026-0119

* Format

* fix(dnstap source): include EDNS OPT record in additional_count
---
 Cargo.lock                                  |  42 +-
 Cargo.toml                                  |   2 +-
 deny.toml                                   |   1 +
 lib/dnsmsg-parser/src/dns_message_parser.rs | 410 ++++++++++----------
 lib/dnsmsg-parser/src/ede.rs                |  11 +-
 5 files changed, 226 insertions(+), 240 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2e217d2d24c4f..cb014b2cd372a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3782,7 +3782,7 @@ version = "0.1.0"
 dependencies = [
  "criterion",
  "data-encoding",
- "hickory-proto 0.25.2",
+ "hickory-proto 0.26.1",
  "snafu 0.9.0",
 ]
 
@@ -3796,7 +3796,7 @@ dependencies = [
  "chrono",
  "chrono-tz",
  "dnsmsg-parser",
- "hickory-proto 0.25.2",
+ "hickory-proto 0.26.1",
  "pastey",
  "prost 0.12.6",
  "prost-build 0.12.6",
@@ -5134,7 +5134,7 @@ dependencies = [
  "futures-channel",
  "futures-io",
  "futures-util",
- "hickory-proto 0.26.0",
+ "hickory-proto 0.26.1",
  "idna",
  "ipnet",
  "jni 0.22.4",
@@ -5172,37 +5172,11 @@ dependencies = [
 
 [[package]]
 name = "hickory-proto"
-version = "0.25.2"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8a6fe56c0038198998a6f217ca4e7ef3a5e51f46163bd6dd60b5c71ca6c6502"
+checksum = "0bab31817bfb44672a252e97fe81cd0c18d1b2cf892108922f6818820df8c643"
 dependencies = [
- "async-trait",
  "bitflags 2.10.0",
- "cfg-if",
- "data-encoding",
- "enum-as-inner",
- "futures-channel",
- "futures-io",
- "futures-util",
- "idna",
- "ipnet",
- "once_cell",
- "rand 0.9.4",
- "ring",
- "rustls-pki-types",
- "thiserror 2.0.17",
- "time",
- "tinyvec",
- "tracing 0.1.44",
- "url",
-]
-
-[[package]]
-name = "hickory-proto"
-version = "0.26.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a916d0494600d99ecb15aadfab677ad97c4de559e8f1af0c129353a733ac1fcc"
-dependencies = [
  "data-encoding",
  "idna",
  "ipnet",
@@ -5211,7 +5185,9 @@ dependencies = [
  "prefix-trie",
  "rand 0.10.1",
  "ring",
+ "rustls-pki-types",
  "thiserror 2.0.17",
+ "time",
  "tinyvec",
  "tracing 0.1.44",
  "url",
@@ -5247,7 +5223,7 @@ dependencies = [
  "cfg-if",
  "futures-util",
  "hickory-net",
- "hickory-proto 0.26.0",
+ "hickory-proto 0.26.1",
  "ipconfig",
  "ipnet",
  "jni 0.22.4",
@@ -12854,7 +12830,7 @@ dependencies = [
  "headers",
  "heim",
  "hex",
- "hickory-proto 0.25.2",
+ "hickory-proto 0.26.1",
  "hostname 0.4.2",
  "http 0.2.12",
  "http 1.3.1",
diff --git a/Cargo.toml b/Cargo.toml
index e9cf7da0f400b..f28e8feabbfd5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -160,7 +160,7 @@ flate2 = { version = "1.1.2", default-features = false, features = ["zlib-rs"] }
 futures = { version = "0.3.31", default-features = false, features = ["std"] }
 futures-util = { version = "0.3.29", default-features = false }
 glob = { version = "0.3.3", default-features = false }
-hickory-proto = { version = "0.25.2", default-features = false, features = ["dnssec-ring"] }
+hickory-proto = { version = "0.26.1", default-features = false, features = ["dnssec-ring"] }
 humantime = { version = "2.3.0", default-features = false }
 indexmap = { version = "2.11.0", default-features = false, features = ["serde", "std"] }
 indoc = { version = "2.0.7" }
diff --git a/deny.toml b/deny.toml
index 0d563622a509e..37db54adf7956 100644
--- a/deny.toml
+++ b/deny.toml
@@ -50,4 +50,5 @@ ignore = [
   { id = "RUSTSEC-2026-0097", reason = "rand 0.8.5 unsound with custom logger - transitive dependency, upstream crates have not updated to rand 0.9+" },
   { id = "RUSTSEC-2026-0104", reason = "rustls-webpki 0.102/0.101 CRL parsing panic - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179); 0.103 already patched to 0.103.13" },
   { id = "RUSTSEC-2026-0105", reason = "core2 is unmaintained and all versions yanked - transitive dependency via libflate -> apache-avro, no safe upgrade available" },
+  { id = "RUSTSEC-2026-0119", reason = "hickory-proto 0.24 - unpatched crate (https://github.com/mongodb/mongo-rust-driver/pull/1682)" },
 ]
diff --git a/lib/dnsmsg-parser/src/dns_message_parser.rs b/lib/dnsmsg-parser/src/dns_message_parser.rs
index d0b271b2e7930..a22b630ffaca4 100644
--- a/lib/dnsmsg-parser/src/dns_message_parser.rs
+++ b/lib/dnsmsg-parser/src/dns_message_parser.rs
@@ -7,16 +7,13 @@ use hickory_proto::{
         PublicKey, SupportedAlgorithms, Verifier,
         rdata::{CDNSKEY, CDS, DNSKEY, DNSSECRData, DS},
     },
-    op::{Query, message::Message as TrustDnsMessage},
+    op::{Message as TrustDnsMessage, Query},
     rr::{
-        Name, RecordType,
+        Name, RData, Record, RecordType,
         rdata::{
             A, AAAA, NULL, OPT, SVCB,
-            caa::Property,
             opt::{EdnsCode, EdnsOption},
         },
-        record_data::RData,
-        resource::Record,
     },
     serialize::binary::{BinDecodable, BinDecoder},
 };
@@ -101,8 +98,11 @@ impl DnsMessageParser {
     }
 
     pub fn parse_as_query_message(&mut self) -> DnsParserResult<DnsQueryMessage> {
-        let msg = TrustDnsMessage::from_vec(&self.raw_message)
-            .map_err(|source| DnsMessageParserError::TrustDnsError { source })?;
+        let msg = TrustDnsMessage::from_vec(&self.raw_message).map_err(|source| {
+            DnsMessageParserError::TrustDnsError {
+                source: ProtoError::from(source),
+            }
+        })?;
         let header = parse_dns_query_message_header(&msg);
         let edns_section = parse_edns(&msg).transpose()?;
         let rcode_high = edns_section.as_ref().map_or(0, |edns| edns.extended_rcode);
@@ -113,16 +113,19 @@ impl DnsMessageParser {
             response: parse_response_code(response_code),
             header,
             question_section: self.parse_dns_query_message_question_section(&msg),
-            answer_section: self.parse_dns_message_section(msg.answers())?,
-            authority_section: self.parse_dns_message_section(msg.name_servers())?,
-            additional_section: self.parse_dns_message_section(msg.additionals())?,
+            answer_section: self.parse_dns_message_section(&msg.answers)?,
+            authority_section: self.parse_dns_message_section(&msg.authorities)?,
+            additional_section: self.parse_dns_message_section(&msg.additionals)?,
             opt_pseudo_section: edns_section,
         })
     }
 
     pub fn parse_as_update_message(&mut self) -> DnsParserResult<DnsUpdateMessage> {
-        let msg = TrustDnsMessage::from_vec(&self.raw_message)
-            .map_err(|source| DnsMessageParserError::TrustDnsError { source })?;
+        let msg = TrustDnsMessage::from_vec(&self.raw_message).map_err(|source| {
+            DnsMessageParserError::TrustDnsError {
+                source: ProtoError::from(source),
+            }
+        })?;
         let header = parse_dns_update_message_header(&msg);
         let response_code = (u16::from(header.rcode)) & 0x000F;
         Ok(DnsUpdateMessage {
@@ -130,9 +133,9 @@ impl DnsMessageParser {
             response: parse_response_code(response_code),
             header,
             zone_to_update: self.parse_dns_update_message_zone_section(&msg)?,
-            prerequisite_section: self.parse_dns_message_section(msg.answers())?,
-            update_section: self.parse_dns_message_section(msg.name_servers())?,
-            additional_section: self.parse_dns_message_section(msg.additionals())?,
+            prerequisite_section: self.parse_dns_message_section(&msg.answers)?,
+            update_section: self.parse_dns_message_section(&msg.authorities)?,
+            additional_section: self.parse_dns_message_section(&msg.additionals)?,
         })
     }
 
@@ -141,7 +144,7 @@ impl DnsMessageParser {
         dns_message: &TrustDnsMessage,
     ) -> Vec<QueryQuestion> {
         dns_message
-            .queries()
+            .queries
             .iter()
             .map(|query| self.parse_dns_query_question(query))
             .collect()
@@ -161,7 +164,7 @@ impl DnsMessageParser {
         dns_message: &TrustDnsMessage,
     ) -> DnsParserResult<ZoneInfo> {
         let zones = dns_message
-            .queries()
+            .queries
             .iter()
             .map(|query| self.parse_dns_query_question(query).into())
             .collect::<Vec<ZoneInfo>>();
@@ -185,18 +188,18 @@ impl DnsMessageParser {
     }
 
     pub(crate) fn parse_dns_record(&mut self, record: &Record) -> DnsParserResult<DnsRecord> {
-        let record_data = match record.data() {
-            RData::Unknown { code, rdata } => self.format_unknown_rdata((*code).into(), rdata),
+        let record_data = match &record.data {
+            RData::Unknown { code, rdata } => self.format_unknown_rdata(u16::from(*code), rdata),
             RData::Update0(_) => Ok((Some(String::from("")), None)), // Previously none value
             rdata => self.format_rdata(rdata),
         }?;
 
         Ok(DnsRecord {
-            name: record.name().to_string_with_options(&self.options),
-            class: record.dns_class().to_string(),
+            name: record.name.to_string_with_options(&self.options),
+            class: record.dns_class.to_string(),
             record_type: format_record_type(record.record_type()),
             record_type_id: u16::from(record.record_type()),
-            ttl: record.ttl(),
+            ttl: record.ttl,
             rdata: record_data.0,
             rdata_bytes: record_data.1,
         })
@@ -381,30 +384,30 @@ impl DnsMessageParser {
         match code {
             dns_message::RTYPE_MB => {
                 let options = self.options.clone();
-                let mut decoder = self.get_rdata_decoder_with_raw_message(rdata.anything());
+                let mut decoder = self.get_rdata_decoder_with_raw_message(&rdata.anything);
                 let madname = Self::parse_domain_name(&mut decoder, &options)?;
                 Ok((Some(madname), None))
             }
 
             dns_message::RTYPE_MG => {
                 let options = self.options.clone();
-                let mut decoder = self.get_rdata_decoder_with_raw_message(rdata.anything());
+                let mut decoder = self.get_rdata_decoder_with_raw_message(&rdata.anything);
                 let mgname = Self::parse_domain_name(&mut decoder, &options)?;
                 Ok((Some(mgname), None))
             }
 
             dns_message::RTYPE_MR => {
                 let options = self.options.clone();
-                let mut decoder = self.get_rdata_decoder_with_raw_message(rdata.anything());
+                let mut decoder = self.get_rdata_decoder_with_raw_message(&rdata.anything);
                 let newname = Self::parse_domain_name(&mut decoder, &options)?;
                 Ok((Some(newname), None))
             }
 
-            dns_message::RTYPE_WKS => self.parse_wks_rdata(rdata.anything()),
+            dns_message::RTYPE_WKS => self.parse_wks_rdata(&rdata.anything),
 
             dns_message::RTYPE_MINFO => {
                 let options = self.options.clone();
-                let mut decoder = self.get_rdata_decoder_with_raw_message(rdata.anything());
+                let mut decoder = self.get_rdata_decoder_with_raw_message(&rdata.anything);
                 let rmailbx = Self::parse_domain_name(&mut decoder, &options)?;
                 let emailbx = Self::parse_domain_name(&mut decoder, &options)?;
                 Ok((Some(format!("{rmailbx} {emailbx}")), None))
@@ -412,7 +415,7 @@ impl DnsMessageParser {
 
             dns_message::RTYPE_RP => {
                 let options = self.options.clone();
-                let mut decoder = self.get_rdata_decoder_with_raw_message(rdata.anything());
+                let mut decoder = self.get_rdata_decoder_with_raw_message(&rdata.anything);
                 let mbox = Self::parse_domain_name(&mut decoder, &options)?;
                 let txt = Self::parse_domain_name(&mut decoder, &options)?;
                 Ok((Some(format!("{mbox} {txt}")), None))
@@ -420,14 +423,14 @@ impl DnsMessageParser {
 
             dns_message::RTYPE_AFSDB => {
                 let options = self.options.clone();
-                let mut decoder = self.get_rdata_decoder_with_raw_message(rdata.anything());
+                let mut decoder = self.get_rdata_decoder_with_raw_message(&rdata.anything);
                 let subtype = parse_u16(&mut decoder)?;
                 let hostname = Self::parse_domain_name(&mut decoder, &options)?;
                 Ok((Some(format!("{subtype} {hostname}")), None))
             }
 
             dns_message::RTYPE_X25 => {
-                let mut decoder = BinDecoder::new(rdata.anything());
+                let mut decoder = BinDecoder::new(&rdata.anything);
                 let psdn_address = parse_character_string(&mut decoder)?;
                 Ok((
                     Some(format!(
@@ -439,7 +442,7 @@ impl DnsMessageParser {
             }
 
             dns_message::RTYPE_ISDN => {
-                let mut decoder = BinDecoder::new(rdata.anything());
+                let mut decoder = BinDecoder::new(&rdata.anything);
                 let address = parse_character_string(&mut decoder)?;
                 if decoder.is_empty() {
                     Ok((
@@ -464,14 +467,14 @@ impl DnsMessageParser {
 
             dns_message::RTYPE_RT => {
                 let options = self.options.clone();
-                let mut decoder = self.get_rdata_decoder_with_raw_message(rdata.anything());
+                let mut decoder = self.get_rdata_decoder_with_raw_message(&rdata.anything);
                 let preference = parse_u16(&mut decoder)?;
                 let intermediate_host = Self::parse_domain_name(&mut decoder, &options)?;
                 Ok((Some(format!("{preference} {intermediate_host}")), None))
             }
 
             dns_message::RTYPE_NSAP => {
-                let raw_rdata = rdata.anything();
+                let raw_rdata = &rdata.anything;
                 let mut decoder = BinDecoder::new(raw_rdata);
                 let rdata_len = raw_rdata.len() as u16;
                 let nsap_rdata = HEXUPPER.encode(&parse_vec_with_u16_len(&mut decoder, rdata_len)?);
@@ -480,27 +483,27 @@ impl DnsMessageParser {
 
             dns_message::RTYPE_PX => {
                 let options = self.options.clone();
-                let mut decoder = self.get_rdata_decoder_with_raw_message(rdata.anything());
+                let mut decoder = self.get_rdata_decoder_with_raw_message(&rdata.anything);
                 let preference = parse_u16(&mut decoder)?;
                 let map822 = Self::parse_domain_name(&mut decoder, &options)?;
                 let mapx400 = Self::parse_domain_name(&mut decoder, &options)?;
                 Ok((Some(format!("{preference} {map822} {mapx400}")), None))
             }
 
-            dns_message::RTYPE_LOC => self.parse_loc_rdata(rdata.anything()),
+            dns_message::RTYPE_LOC => self.parse_loc_rdata(&rdata.anything),
 
             dns_message::RTYPE_KX => {
                 let options = self.options.clone();
-                let mut decoder = self.get_rdata_decoder_with_raw_message(rdata.anything());
+                let mut decoder = self.get_rdata_decoder_with_raw_message(&rdata.anything);
                 let preference = parse_u16(&mut decoder)?;
                 let exchanger = Self::parse_domain_name(&mut decoder, &options)?;
                 Ok((Some(format!("{preference} {exchanger}")), None))
             }
 
-            dns_message::RTYPE_A6 => self.parse_a6_rdata(rdata.anything()),
+            dns_message::RTYPE_A6 => self.parse_a6_rdata(&rdata.anything),
 
             dns_message::RTYPE_SINK => {
-                let raw_rdata = rdata.anything();
+                let raw_rdata = &rdata.anything;
                 let mut decoder = BinDecoder::new(raw_rdata);
                 let meaning = parse_u8(&mut decoder)?;
                 let coding = parse_u8(&mut decoder)?;
@@ -511,10 +514,10 @@ impl DnsMessageParser {
                 Ok((Some(format!("{meaning} {coding} {subcoding} {data}")), None))
             }
 
-            dns_message::RTYPE_APL => self.parse_apl_rdata(rdata.anything()),
+            dns_message::RTYPE_APL => self.parse_apl_rdata(&rdata.anything),
 
             dns_message::RTYPE_DHCID => {
-                let raw_rdata = rdata.anything();
+                let raw_rdata = &rdata.anything;
                 let mut decoder = BinDecoder::new(raw_rdata);
                 let raw_data_len = raw_rdata.len() as u16;
                 let digest = BASE64.encode(&parse_vec_with_u16_len(&mut decoder, raw_data_len)?);
@@ -522,7 +525,7 @@ impl DnsMessageParser {
             }
 
             dns_message::RTYPE_SPF => {
-                let mut decoder = BinDecoder::new(rdata.anything());
+                let mut decoder = BinDecoder::new(&rdata.anything);
                 let mut text = String::new();
                 while !decoder.is_empty() {
                     text.push('\"');
@@ -532,7 +535,7 @@ impl DnsMessageParser {
                 Ok((Some(text.trim_end().to_string()), None))
             }
 
-            _ => Ok((None, Some(rdata.anything().to_vec()))),
+            _ => Ok((None, Some(rdata.anything.clone()))),
         }
     }
 
@@ -543,13 +546,13 @@ impl DnsMessageParser {
             RData::ANAME(name) => Ok((Some(name.to_string_with_options(&self.options)), None)),
             RData::CNAME(name) => Ok((Some(name.to_string_with_options(&self.options)), None)),
             RData::CERT(cert) => {
-                let crl = BASE64.encode(&cert.cert_data());
+                let crl = BASE64.encode(&cert.cert_data);
                 Ok((
                     Some(format!(
                         "{} {} {} {}",
-                        u16::from(cert.cert_type()),
-                        cert.key_tag(),
-                        cert.algorithm(),
+                        u16::from(cert.cert_type),
+                        cert.key_tag,
+                        cert.algorithm,
                         crl
                     )),
                     None,
@@ -564,15 +567,15 @@ impl DnsMessageParser {
             RData::MX(mx) => {
                 let srv_rdata = format!(
                     "{} {}",
-                    mx.preference(),
-                    mx.exchange().to_string_with_options(&self.options),
+                    mx.preference,
+                    mx.exchange.to_string_with_options(&self.options),
                 );
                 Ok((Some(srv_rdata), None))
             }
-            RData::NULL(null) => Ok((Some(BASE64.encode(null.anything())), None)),
+            RData::NULL(null) => Ok((Some(BASE64.encode(&null.anything)), None)),
             RData::NS(ns) => Ok((Some(ns.to_string_with_options(&self.options)), None)),
             RData::OPENPGPKEY(key) => {
-                if let Ok(key_string) = String::from_utf8(Vec::from(key.public_key())) {
+                if let Ok(key_string) = String::from_utf8(key.public_key.clone()) {
                     Ok((Some(format!("({})", &key_string)), None))
                 } else {
                     Err(DnsMessageParserError::SimpleError {
@@ -584,29 +587,29 @@ impl DnsMessageParser {
             RData::SOA(soa) => Ok((
                 Some(format!(
                     "{} {} {} {} {} {} {}",
-                    soa.mname().to_string_with_options(&self.options),
-                    soa.rname().to_string_with_options(&self.options),
-                    soa.serial(),
-                    soa.refresh(),
-                    soa.retry(),
-                    soa.expire(),
-                    soa.minimum()
+                    soa.mname.to_string_with_options(&self.options),
+                    soa.rname.to_string_with_options(&self.options),
+                    soa.serial,
+                    soa.refresh,
+                    soa.retry,
+                    soa.expire,
+                    soa.minimum
                 )),
                 None,
             )),
             RData::SRV(srv) => {
                 let srv_rdata = format!(
                     "{} {} {} {}",
-                    srv.priority(),
-                    srv.weight(),
-                    srv.port(),
-                    srv.target().to_string_with_options(&self.options)
+                    srv.priority,
+                    srv.weight,
+                    srv.port,
+                    srv.target.to_string_with_options(&self.options)
                 );
                 Ok((Some(srv_rdata), None))
             }
             RData::TXT(txt) => {
                 let txt_rdata = txt
-                    .txt_data()
+                    .txt_data
                     .iter()
                     .map(|value| {
                         format!(
@@ -623,41 +626,35 @@ impl DnsMessageParser {
             RData::CAA(caa) => {
                 let caa_rdata = format!(
                     "{} {} \"{}\"",
-                    caa.issuer_critical() as u8,
-                    caa.tag().as_str(),
-                    match caa.tag() {
-                        Property::Iodef => {
-                            let url = caa.value_as_iodef().map_err(|source| {
-                                DnsMessageParserError::TrustDnsError { source }
-                            })?;
-                            url.as_str().to_string()
-                        }
-                        Property::Issue | Property::IssueWild => {
-                            let (option_name, vec_keyvalue) =
-                                caa.value_as_issue().map_err(|source| {
-                                    DnsMessageParserError::TrustDnsError { source }
-                                })?;
-
-                            let mut final_issuer = String::new();
-                            if let Some(name) = option_name {
-                                final_issuer.push_str(&name.to_string_with_options(&self.options));
-                                for keyvalue in vec_keyvalue.iter() {
-                                    final_issuer.push_str("; ");
-                                    final_issuer.push_str(keyvalue.key());
-                                    final_issuer.push('=');
-                                    final_issuer.push_str(keyvalue.value());
-                                }
+                    caa.issuer_critical as u8,
+                    &caa.tag,
+                    if caa.tag.eq_ignore_ascii_case("iodef") {
+                        let url = caa
+                            .value_as_iodef()
+                            .map_err(|source| DnsMessageParserError::TrustDnsError { source })?;
+                        url.as_str().to_string()
+                    } else if caa.tag.eq_ignore_ascii_case("issue")
+                        || caa.tag.eq_ignore_ascii_case("issuewild")
+                    {
+                        let (option_name, vec_keyvalue) = caa
+                            .value_as_issue()
+                            .map_err(|source| DnsMessageParserError::TrustDnsError { source })?;
+
+                        let mut final_issuer = String::new();
+                        if let Some(name) = option_name {
+                            final_issuer.push_str(&name.to_string_with_options(&self.options));
+                            for keyvalue in vec_keyvalue.iter() {
+                                final_issuer.push_str("; ");
+                                final_issuer.push_str(keyvalue.key());
+                                final_issuer.push('=');
+                                final_issuer.push_str(keyvalue.value());
                             }
-                            final_issuer.trim_end().to_string()
-                        }
-                        Property::Unknown(_) => {
-                            let unknown = caa.raw_value();
-                            std::str::from_utf8(unknown)
-                                .map_err(|source| DnsMessageParserError::Utf8ParsingError {
-                                    source,
-                                })?
-                                .to_string()
                         }
+                        final_issuer.trim_end().to_string()
+                    } else {
+                        std::str::from_utf8(&caa.value)
+                            .map_err(|source| DnsMessageParserError::Utf8ParsingError { source })?
+                            .to_string()
                     }
                 );
                 Ok((Some(caa_rdata), None))
@@ -666,52 +663,52 @@ impl DnsMessageParser {
             RData::TLSA(tlsa) => {
                 let tlsa_rdata = format!(
                     "{} {} {} {}",
-                    u8::from(tlsa.cert_usage()),
-                    u8::from(tlsa.selector()),
-                    u8::from(tlsa.matching()),
-                    HEXUPPER.encode(tlsa.cert_data())
+                    u8::from(tlsa.cert_usage),
+                    u8::from(tlsa.selector),
+                    u8::from(tlsa.matching),
+                    HEXUPPER.encode(&tlsa.cert_data)
                 );
                 Ok((Some(tlsa_rdata), None))
             }
             RData::SSHFP(sshfp) => {
                 let sshfp_rdata = format!(
                     "{} {} {}",
-                    Into::<u8>::into(sshfp.algorithm()),
-                    Into::<u8>::into(sshfp.fingerprint_type()),
-                    HEXUPPER.encode(sshfp.fingerprint())
+                    Into::<u8>::into(sshfp.algorithm),
+                    Into::<u8>::into(sshfp.fingerprint_type),
+                    HEXUPPER.encode(&sshfp.fingerprint)
                 );
                 Ok((Some(sshfp_rdata), None))
             }
             RData::NAPTR(naptr) => {
                 let naptr_rdata = format!(
                     r#"{} {} "{}" "{}" "{}" {}"#,
-                    naptr.order(),
-                    naptr.preference(),
+                    naptr.order,
+                    naptr.preference,
                     escape_string_for_text_representation(
-                        std::str::from_utf8(naptr.flags())
+                        std::str::from_utf8(&naptr.flags)
                             .map_err(|source| DnsMessageParserError::Utf8ParsingError { source })?
                             .to_string()
                     ),
                     escape_string_for_text_representation(
-                        std::str::from_utf8(naptr.services())
+                        std::str::from_utf8(&naptr.services)
                             .map_err(|source| DnsMessageParserError::Utf8ParsingError { source })?
                             .to_string()
                     ),
                     escape_string_for_text_representation(
-                        std::str::from_utf8(naptr.regexp())
+                        std::str::from_utf8(&naptr.regexp)
                             .map_err(|source| DnsMessageParserError::Utf8ParsingError { source })?
                             .to_string()
                     ),
-                    naptr.replacement().to_string_with_options(&self.options)
+                    naptr.replacement.to_string_with_options(&self.options)
                 );
                 Ok((Some(naptr_rdata), None))
             }
             RData::HINFO(hinfo) => {
                 let hinfo_data = format!(
                     r#""{}" "{}""#,
-                    std::str::from_utf8(hinfo.cpu())
+                    std::str::from_utf8(&hinfo.cpu)
                         .map_err(|source| DnsMessageParserError::Utf8ParsingError { source })?,
-                    std::str::from_utf8(hinfo.os())
+                    std::str::from_utf8(&hinfo.os)
                         .map_err(|source| DnsMessageParserError::Utf8ParsingError { source })?,
                 );
                 Ok((Some(hinfo_data), None))
@@ -794,37 +791,41 @@ impl DnsMessageParser {
                 DNSSECRData::SIG(sig) => {
                     let sig_rdata = format!(
                         "{} {} {} {} {} {} {} {} {}",
-                        match format_record_type(sig.type_covered()) {
+                        match format_record_type(sig.input().type_covered) {
                             Some(record_type) => record_type,
                             None => String::from("Unknown record type"),
                         },
-                        u8::from(sig.algorithm()),
-                        sig.num_labels(),
-                        sig.original_ttl(),
-                        sig.sig_expiration().get(), // currently in epoch convert to human readable ?
-                        sig.sig_inception().get(), // currently in epoch convert to human readable ?
-                        sig.key_tag(),
-                        sig.signer_name().to_string_with_options(&self.options),
+                        u8::from(sig.input().algorithm),
+                        sig.input().num_labels,
+                        sig.input().original_ttl,
+                        sig.input().sig_expiration.get(), // currently in epoch convert to human readable ?
+                        sig.input().sig_inception.get(), // currently in epoch convert to human readable ?
+                        sig.input().key_tag,
+                        sig.input()
+                            .signer_name
+                            .to_string_with_options(&self.options),
                         BASE64.encode(sig.sig())
                     );
                     Ok((Some(sig_rdata), None))
                 }
-                // RSIG is a derivation of SIG but choosing to keep this duplicate code in lieu of the alternative
+                // RRSIG is a derivation of SIG but choosing to keep this duplicate code in lieu of the alternative
                 // which is to allocate to the heap with Box in order to deref.
                 DNSSECRData::RRSIG(sig) => {
                     let sig_rdata = format!(
                         "{} {} {} {} {} {} {} {} {}",
-                        match format_record_type(sig.type_covered()) {
+                        match format_record_type(sig.input().type_covered) {
                             Some(record_type) => record_type,
                             None => String::from("Unknown record type"),
                         },
-                        u8::from(sig.algorithm()),
-                        sig.num_labels(),
-                        sig.original_ttl(),
-                        sig.sig_expiration().get(), // currently in epoch convert to human readable ?
-                        sig.sig_inception().get(), // currently in epoch convert to human readable ?
-                        sig.key_tag(),
-                        sig.signer_name().to_string_with_options(&self.options),
+                        u8::from(sig.input().algorithm),
+                        sig.input().num_labels,
+                        sig.input().original_ttl,
+                        sig.input().sig_expiration.get(), // currently in epoch convert to human readable ?
+                        sig.input().sig_inception.get(), // currently in epoch convert to human readable ?
+                        sig.input().key_tag,
+                        sig.input()
+                            .signer_name
+                            .to_string_with_options(&self.options),
                         BASE64.encode(sig.sig())
                     );
                     Ok((Some(sig_rdata), None))
@@ -839,9 +840,7 @@ impl DnsMessageParser {
                     );
                     Ok((Some(key_rdata), None))
                 }
-                DNSSECRData::Unknown { code: _, rdata } => {
-                    Ok((None, Some(rdata.anything().to_vec())))
-                }
+                DNSSECRData::Unknown { code: _, rdata } => Ok((None, Some(rdata.anything.clone()))),
                 _ => Err(DnsMessageParserError::SimpleError {
                     cause: format!("Unsupported rdata {rdata:?}"),
                 }),
@@ -870,9 +869,9 @@ fn format_record_type(record_type: RecordType) -> Option<String> {
 fn format_svcb_record(svcb: &SVCB, options: &DnsParserOptions) -> String {
     format!(
         "{} {} {}",
-        svcb.svc_priority(),
-        svcb.target_name().to_string_with_options(options),
-        svcb.svc_params()
+        svcb.svc_priority,
+        svcb.target_name.to_string_with_options(options),
+        svcb.svc_params
             .iter()
             .map(|(key, value)| format!(r#"{}="{}""#, key, value.to_string().trim_end_matches(',')))
             .collect::<Vec<_>>()
@@ -965,38 +964,38 @@ fn parse_response_code(rcode: u16) -> Option<&'static str> {
 
 fn parse_dns_query_message_header(dns_message: &TrustDnsMessage) -> QueryHeader {
     QueryHeader {
-        id: dns_message.header().id(),
-        opcode: dns_message.header().op_code().into(),
-        rcode: dns_message.header().response_code(),
-        qr: dns_message.header().message_type() as u8,
-        aa: dns_message.header().authoritative(),
-        tc: dns_message.header().truncated(),
-        rd: dns_message.header().recursion_desired(),
-        ra: dns_message.header().recursion_available(),
-        ad: dns_message.header().authentic_data(),
-        cd: dns_message.header().checking_disabled(),
-        question_count: dns_message.header().query_count(),
-        answer_count: dns_message.header().answer_count(),
-        authority_count: dns_message.header().name_server_count(),
-        additional_count: dns_message.header().additional_count(),
+        id: dns_message.id,
+        opcode: dns_message.op_code.into(),
+        rcode: dns_message.response_code,
+        qr: dns_message.message_type as u8,
+        aa: dns_message.authoritative,
+        tc: dns_message.truncation,
+        rd: dns_message.recursion_desired,
+        ra: dns_message.recursion_available,
+        ad: dns_message.authentic_data,
+        cd: dns_message.checking_disabled,
+        question_count: dns_message.queries.len() as u16,
+        answer_count: dns_message.answers.len() as u16,
+        authority_count: dns_message.authorities.len() as u16,
+        additional_count: dns_message.additionals.len() as u16 + dns_message.edns.is_some() as u16,
     }
 }
 
 fn parse_dns_update_message_header(dns_message: &TrustDnsMessage) -> UpdateHeader {
     UpdateHeader {
-        id: dns_message.header().id(),
-        opcode: dns_message.header().op_code().into(),
-        rcode: dns_message.header().response_code(),
-        qr: dns_message.header().message_type() as u8,
-        zone_count: dns_message.header().query_count(),
-        prerequisite_count: dns_message.header().answer_count(),
-        update_count: dns_message.header().name_server_count(),
-        additional_count: dns_message.header().additional_count(),
+        id: dns_message.id,
+        opcode: dns_message.op_code.into(),
+        rcode: dns_message.response_code,
+        qr: dns_message.message_type as u8,
+        zone_count: dns_message.queries.len() as u16,
+        prerequisite_count: dns_message.answers.len() as u16,
+        update_count: dns_message.authorities.len() as u16,
+        additional_count: dns_message.additionals.len() as u16 + dns_message.edns.is_some() as u16,
     }
 }
 
 fn parse_edns(dns_message: &TrustDnsMessage) -> Option<DnsParserResult<OptPseudoSection>> {
-    dns_message.extensions().as_ref().map(|edns| {
+    dns_message.edns.as_ref().map(|edns| {
         parse_edns_options(edns.options()).map(|(ede, rest)| OptPseudoSection {
             extended_rcode: edns.rcode_high(),
             version: edns.version(),
@@ -1014,10 +1013,11 @@ fn parse_edns_options(edns: &OPT) -> DnsParserResult<(Vec<EDE>, Vec<EdnsOptionEn
         .iter()
         .filter_map(|(_, option)| {
             if let EdnsOption::Unknown(EDE_OPTION_CODE, option) = option {
-                Some(
-                    EDE::from_bytes(option)
-                        .map_err(|source| DnsMessageParserError::TrustDnsError { source }),
-                )
+                Some(EDE::from_bytes(option).map_err(|source| {
+                    DnsMessageParserError::TrustDnsError {
+                        source: ProtoError::from(source),
+                    }
+                }))
             } else {
                 None
             }
@@ -1172,18 +1172,24 @@ fn parse_vec_with_u16_len(
 
 fn parse_ipv6_address(decoder: &mut BinDecoder<'_>) -> DnsParserResult<String> {
     Ok(<AAAA as BinDecodable>::read(decoder)
-        .map_err(|source| DnsMessageParserError::TrustDnsError { source })?
+        .map_err(|source| DnsMessageParserError::TrustDnsError {
+            source: ProtoError::from(source),
+        })?
         .to_string())
 }
 
 fn parse_ipv4_address(decoder: &mut BinDecoder<'_>) -> DnsParserResult<String> {
     Ok(<A as BinDecodable>::read(decoder)
-        .map_err(|source| DnsMessageParserError::TrustDnsError { source })?
+        .map_err(|source| DnsMessageParserError::TrustDnsError {
+            source: ProtoError::from(source),
+        })?
         .to_string())
 }
 
 fn parse_domain_name(decoder: &mut BinDecoder<'_>) -> DnsParserResult<Name> {
-    Name::read(decoder).map_err(|source| DnsMessageParserError::TrustDnsError { source })
+    Name::read(decoder).map_err(|source| DnsMessageParserError::TrustDnsError {
+        source: ProtoError::from(source),
+    })
 }
 
 fn escape_string_for_text_representation(original_string: String) -> String {
@@ -1305,11 +1311,13 @@ mod tests {
         dnssec::{
             Algorithm as DNSSEC_Algorithm, DigestType, Nsec3HashAlgorithm, PublicKeyBuf,
             rdata::{
-                KEY, NSEC, NSEC3, NSEC3PARAM, RRSIG, SIG,
+                KEY, NSEC, NSEC3, NSEC3PARAM, RRSIG,
                 key::{KeyTrust, KeyUsage, Protocol},
+                sig::SigInput,
             },
         },
         rr::{
+            SerialNumber,
             domain::Name,
             rdata::{
                 CAA, CERT, CSYNC, HINFO, HTTPS, NAPTR, OPT, SSHFP, TLSA, TXT,
@@ -1435,7 +1443,10 @@ mod tests {
             .expect_err("Expected TrustDnsError.");
         match err {
             DnsMessageParserError::TrustDnsError { source: e } => {
-                assert_eq!(e.to_string(), "unexpected end of input reached")
+                assert_eq!(
+                    e.to_string(),
+                    "decoding error: unexpected end of input reached"
+                )
             }
             DnsMessageParserError::SimpleError { cause: e } => {
                 panic!("Expected TrustDnsError, got {}.", &e)
@@ -1859,29 +1870,26 @@ mod tests {
 
     #[test]
     fn test_format_rdata_for_sig_type() {
-        let rdata = RData::DNSSEC(DNSSECRData::SIG(SIG::new(
-            RecordType::NULL,
-            DNSSEC_Algorithm::RSASHA256,
+        // SIG wire: type_covered=NULL(10), alg=8, labels=0, orig_ttl=0, expire=2, inception=1,
+        // keytag=5, signer=www.example.com, sig=[0..=31]
+        let mut wire: Vec<u8> = Vec::new();
+        wire.extend_from_slice(&10u16.to_be_bytes());
+        wire.push(8u8);
+        wire.push(0u8);
+        wire.extend_from_slice(&0u32.to_be_bytes());
+        wire.extend_from_slice(&2u32.to_be_bytes());
+        wire.extend_from_slice(&1u32.to_be_bytes());
+        wire.extend_from_slice(&5u16.to_be_bytes());
+        wire.extend_from_slice(&[
+            3, b'w', b'w', b'w', 7, b'e', b'x', b'a', b'm', b'p', b'l', b'e', 3, b'c', b'o', b'm',
             0,
-            0,
-            2,
-            1,
-            5,
-            Name::from_str("www.example.com").unwrap(),
-            vec![
-                0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22,
-                23, 24, 25, 26, 27, 28, 29, 29, 31,
-            ],
-        )));
-        let rdata_text = format_rdata(&rdata);
-        assert!(rdata_text.is_ok());
-        if let Ok((parsed, raw_rdata)) = rdata_text {
-            assert!(raw_rdata.is_none());
-            assert_eq!(
-                "NULL 8 0 0 2 1 5 www.example.com AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHR8=",
-                parsed.unwrap()
-            );
-        }
+        ]);
+        wire.extend(0u8..=31);
+        test_format_rdata(
+            &BASE64.encode(&wire),
+            24,
+            "NULL 8 0 0 2 1 5 www.example.com. AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
+        );
     }
 
     #[test]
@@ -1918,26 +1926,26 @@ mod tests {
     // so there isn't really a great way to reduce code duplication here.
     #[test]
     fn test_format_rdata_for_rsig_type() {
-        let rdata = RData::DNSSEC(DNSSECRData::RRSIG(RRSIG::new(
-            RecordType::NULL,
-            DNSSEC_Algorithm::RSASHA256,
-            0,
-            0,
-            2,
-            1,
-            5,
-            Name::from_str("www.example.com").unwrap(),
-            vec![
-                0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22,
-                23, 24, 25, 26, 27, 28, 29, 29, 31,
-            ],
+        let input = SigInput {
+            type_covered: RecordType::NULL,
+            algorithm: DNSSEC_Algorithm::RSASHA256,
+            num_labels: 0,
+            original_ttl: 0,
+            sig_expiration: SerialNumber::new(2),
+            sig_inception: SerialNumber::new(1),
+            key_tag: 5,
+            signer_name: Name::from_str("www.example.com").unwrap(),
+        };
+        let rdata = RData::DNSSEC(DNSSECRData::RRSIG(RRSIG::from_sig(
+            input,
+            (0u8..=31).collect(),
         )));
         let rdata_text = format_rdata(&rdata);
         assert!(rdata_text.is_ok());
         if let Ok((parsed, raw_rdata)) = rdata_text {
             assert!(raw_rdata.is_none());
             assert_eq!(
-                "NULL 8 0 0 2 1 5 www.example.com AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHR8=",
+                "NULL 8 0 0 2 1 5 www.example.com AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=",
                 parsed.unwrap()
             );
         }
diff --git a/lib/dnsmsg-parser/src/ede.rs b/lib/dnsmsg-parser/src/ede.rs
index 0c3ee6c2f12e6..26bd22ed008ea 100644
--- a/lib/dnsmsg-parser/src/ede.rs
+++ b/lib/dnsmsg-parser/src/ede.rs
@@ -1,6 +1,6 @@
 use hickory_proto::{
     ProtoError,
-    serialize::binary::{BinDecodable, BinDecoder, BinEncodable, BinEncoder},
+    serialize::binary::{BinDecodable, BinDecoder, BinEncodable, BinEncoder, DecodeError},
 };
 
 pub const EDE_OPTION_CODE: u16 = 15u16;
@@ -77,14 +77,15 @@ impl BinEncodable for EDE {
 }
 
 impl<'a> BinDecodable<'a> for EDE {
-    fn read(decoder: &mut BinDecoder<'a>) -> Result<Self, ProtoError> {
+    fn read(decoder: &mut BinDecoder<'a>) -> Result<Self, DecodeError> {
         let info_code = decoder.read_u16()?.unverified();
         let extra_text = if decoder.is_empty() {
             None
         } else {
-            Some(String::from_utf8(
-                decoder.read_vec(decoder.len())?.unverified(),
-            )?)
+            Some(
+                String::from_utf8(decoder.read_vec(decoder.len())?.unverified())
+                    .map_err(DecodeError::Utf8)?,
+            )
         };
         Ok(Self {
             info_code,

From 6c3116a6e0a1d44113e5e2ce0b7e5aeeef3db785 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 5 May 2026 09:33:38 -0400
Subject: [PATCH 194/326] chore(ci): retry apt fetches in deb-verify to reduce
 flakes (#25367)

Set Acquire::Retries=5 and Acquire::http::Timeout=30 on the apt-get
calls in the deb-verify job so transient connection failures to the
Ubuntu mirrors don't fail the whole job.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4f82bd06e3894..7e8455b60de58 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -204,8 +204,8 @@ jobs:
       image: ${{ matrix.container }}
     steps:
       - run: |
-          apt-get update && \
-          apt-get install -y \
+          apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 update && \
+          apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 install -y \
           ca-certificates \
           curl \
           git \

From 95756d72356406d1a71625dbcc8f83e49f43947d Mon Sep 17 00:00:00 2001
From: jh7459-gh <90462481+jh7459-gh@users.noreply.github.com>
Date: Tue, 5 May 2026 10:34:08 -0500
Subject: [PATCH 195/326] enhancement(transforms): dynamic rate for sample
 (#25035)

feat(sample transform): add ratio_field and rate_field for dynamic sampling

Add per-event dynamic sampling to the `sample` transform. `ratio_field`
reads a numeric ratio in `(0, 1]` from the event; `rate_field` reads a
positive integer rate (`1/N`). Either falls back to the static
`rate`/`ratio` configuration when the field is missing or invalid.

- `ratio_field` and `rate_field` are mutually exclusive, and neither
  can combine with `key_field` (key-based coherence conflicts with
  per-event values).
- Sampling is event-granular and uses a hash of (group_by_key, counter)
  so mixed dynamic values within the same `group_by` group sample at
  their respective expected rates.
- `group_by` is supported alongside dynamic fields for independent
  per-group sampling.
- The dynamic-rate path is `NonZeroU64`-typed end-to-end so the
  `is_multiple_of(0)` panic is unreachable by construction.

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../sample_dynamic_ratio_field.feature.md     |   3 +
 src/transforms/sample/config.rs               | 195 ++++++++++-
 src/transforms/sample/tests.rs                | 329 +++++++++++++++++-
 src/transforms/sample/transform.rs            | 254 +++++++++++---
 .../transforms/generated/sample.cue           |  29 ++
 5 files changed, 749 insertions(+), 61 deletions(-)
 create mode 100644 changelog.d/sample_dynamic_ratio_field.feature.md

diff --git a/changelog.d/sample_dynamic_ratio_field.feature.md b/changelog.d/sample_dynamic_ratio_field.feature.md
new file mode 100644
index 0000000000000..d2e3c04839c19
--- /dev/null
+++ b/changelog.d/sample_dynamic_ratio_field.feature.md
@@ -0,0 +1,3 @@
+Added `ratio_field` and `rate_field` options to the `sample` transform to support dynamic per-event sampling, while requiring static `rate` or `ratio` fallback configuration and disallowing `ratio_field` and `rate_field` together.
+
+authors: jhammer
diff --git a/src/transforms/sample/config.rs b/src/transforms/sample/config.rs
index 209d2d655e7c9..1b5f7426d86a3 100644
--- a/src/transforms/sample/config.rs
+++ b/src/transforms/sample/config.rs
@@ -6,7 +6,7 @@ use vector_lib::{
 };
 use vrl::value::Kind;
 
-use super::transform::{Sample, SampleMode};
+use super::transform::{DynamicSampleFields, Sample, SampleMode};
 use crate::{
     conditions::AnyCondition,
     config::{
@@ -29,10 +29,23 @@ pub enum SampleError {
     #[snafu(display("Only non-zero numbers are allowed values for `rate`"))]
     InvalidRate,
 
+    #[snafu(display("Only one value can be provided for either 'rate' or 'ratio', but not both"))]
+    InvalidStaticConfiguration,
+
+    #[snafu(display(
+        "Only one value can be provided for either 'ratio_field' or 'rate_field', but not both"
+    ))]
+    InvalidDynamicConfiguration,
+
+    #[snafu(display(
+        "Exactly one value must be provided for either 'rate' or 'ratio' to configure static sampling"
+    ))]
+    MissingStaticConfiguration,
+
     #[snafu(display(
-        "Exactly one value must be provided for either 'rate' or 'ratio', but not both"
+        "'key_field' cannot be combined with 'ratio_field' or 'rate_field' because dynamic values can vary per event and break key-based coherence"
     ))]
-    InvalidConfiguration,
+    InvalidKeyFieldDynamicCombination,
 }
 
 /// Configuration for the `sample` transform.
@@ -61,6 +74,24 @@ pub struct SampleConfig {
     #[configurable(validation(range(min = 0.0, max = 1.0)))]
     pub ratio: Option<f64>,
 
+    /// The event field whose numeric value is used as the sampling ratio on a per-event basis.
+    ///
+    /// Accepts integer, floating point, or string values that parse as a number. The value must be
+    /// in `(0, 1]` to be considered valid (for example, `0.25` keeps 25%). If the field is missing
+    /// or invalid, static sampling settings (`rate` or `ratio`) are used as a fallback.
+    /// This option cannot be used together with `rate_field`.
+    #[configurable(metadata(docs::examples = "sample_rate"))]
+    pub ratio_field: Option<String>,
+
+    /// The event field whose integer value is used as the sampling rate on a per-event basis, expressed as `1/N`.
+    ///
+    /// Accepts an integer, or a string that parses as a positive integer; floating point values
+    /// are rejected. The value must be a positive integer to be considered valid. If the field is
+    /// missing or invalid, static sampling settings (`rate` or `ratio`) are used as a fallback.
+    /// This option cannot be used together with `ratio_field`.
+    #[configurable(metadata(docs::examples = "sample_rate_n"))]
+    pub rate_field: Option<String>,
+
     /// The name of the field whose value is hashed to determine if the event should be
     /// sampled.
     ///
@@ -72,6 +103,8 @@ pub struct SampleConfig {
     ///
     /// This can be useful to, for example, ensure that all logs for a given transaction are
     /// sampled together, but that overall `1/N` transactions are sampled.
+    ///
+    /// This option cannot be combined with `ratio_field` or `rate_field`.
     #[configurable(metadata(docs::examples = "message"))]
     pub key_field: Option<String>,
 
@@ -84,6 +117,9 @@ pub struct SampleConfig {
     ///
     /// If left unspecified, or if the event doesn't have `group_by`, then the event is not
     /// sampled separately.
+    ///
+    /// This can also be used with `ratio_field` or `rate_field` to apply dynamic sampling
+    /// independently per rendered group value.
     #[configurable(metadata(
         docs::examples = "{{ service }}",
         docs::examples = "{{ hostname }}-{{ service }}"
@@ -96,6 +132,18 @@ pub struct SampleConfig {
 
 impl SampleConfig {
     fn sample_rate(&self) -> Result<SampleMode, SampleError> {
+        if self.ratio_field.is_some() && self.rate_field.is_some() {
+            return Err(SampleError::InvalidDynamicConfiguration);
+        }
+
+        if self.key_field.is_some() && (self.ratio_field.is_some() || self.rate_field.is_some()) {
+            return Err(SampleError::InvalidKeyFieldDynamicCombination);
+        }
+
+        if self.rate.is_some() && self.ratio.is_some() {
+            return Err(SampleError::InvalidStaticConfiguration);
+        }
+
         match (self.rate, self.ratio) {
             (None, Some(ratio)) => {
                 if ratio <= 0.0 {
@@ -111,7 +159,8 @@ impl SampleConfig {
                     Ok(SampleMode::new_rate(rate))
                 }
             }
-            _ => Err(SampleError::InvalidConfiguration),
+            (None, None) => Err(SampleError::MissingStaticConfiguration),
+            _ => Err(SampleError::InvalidStaticConfiguration),
         }
     }
 }
@@ -121,6 +170,8 @@ impl GenerateConfig for SampleConfig {
         toml::Value::try_from(Self {
             rate: None,
             ratio: Some(0.1),
+            ratio_field: None,
+            rate_field: None,
             key_field: None,
             group_by: None,
             exclude: None::<AnyCondition>,
@@ -134,19 +185,37 @@ impl GenerateConfig for SampleConfig {
 #[typetag::serde(name = "sample")]
 impl TransformConfig for SampleConfig {
     async fn build(&self, context: &TransformContext) -> crate::Result<Transform> {
-        Ok(Transform::function(Sample::new(
-            Self::NAME.to_string(),
-            self.sample_rate()?,
-            self.key_field.clone(),
-            self.group_by.clone(),
-            self.exclude
-                .as_ref()
-                .map(|condition| {
-                    condition.build(&context.enrichment_tables, &context.metrics_storage)
-                })
-                .transpose()?,
-            self.sample_rate_key.clone(),
-        )))
+        let sample_mode = self.sample_rate()?;
+        let exclude = self
+            .exclude
+            .as_ref()
+            .map(|condition| condition.build(&context.enrichment_tables, &context.metrics_storage))
+            .transpose()?;
+
+        let sample = if self.ratio_field.is_some() || self.rate_field.is_some() {
+            Sample::new_with_dynamic(
+                Self::NAME.to_string(),
+                sample_mode,
+                DynamicSampleFields {
+                    ratio_field: self.ratio_field.clone(),
+                    rate_field: self.rate_field.clone(),
+                },
+                self.group_by.clone(),
+                exclude,
+                self.sample_rate_key.clone(),
+            )
+        } else {
+            Sample::new(
+                Self::NAME.to_string(),
+                sample_mode,
+                self.key_field.clone(),
+                self.group_by.clone(),
+                exclude,
+                self.sample_rate_key.clone(),
+            )
+        };
+
+        Ok(Transform::function(sample))
     }
 
     fn input(&self) -> Input {
@@ -191,10 +260,100 @@ pub fn default_sample_rate_key() -> OptionalValuePath {
 
 #[cfg(test)]
 mod tests {
-    use crate::transforms::sample::config::SampleConfig;
+    use crate::{
+        config::TransformConfig,
+        transforms::sample::config::{SampleConfig, SampleError},
+    };
 
     #[test]
     fn generate_config() {
         crate::test_util::test_generate_config::<SampleConfig>();
     }
+
+    #[test]
+    fn rejects_dynamic_ratio_only_configuration() {
+        let config = SampleConfig {
+            rate: None,
+            ratio: None,
+            ratio_field: Some("sample_rate".to_string()),
+            rate_field: None,
+            key_field: None,
+            sample_rate_key: super::default_sample_rate_key(),
+            group_by: None,
+            exclude: None,
+        };
+
+        let err = config.sample_rate().unwrap_err();
+        assert!(matches!(err, SampleError::MissingStaticConfiguration));
+    }
+
+    #[test]
+    fn rejects_dynamic_rate_only_configuration() {
+        let config = SampleConfig {
+            rate: None,
+            ratio: None,
+            ratio_field: None,
+            rate_field: Some("sample_rate_n".to_string()),
+            key_field: None,
+            sample_rate_key: super::default_sample_rate_key(),
+            group_by: None,
+            exclude: None,
+        };
+
+        let err = config.sample_rate().unwrap_err();
+        assert!(matches!(err, SampleError::MissingStaticConfiguration));
+    }
+
+    #[test]
+    fn validates_static_with_dynamic_configuration() {
+        let config = SampleConfig {
+            rate: Some(10),
+            ratio: None,
+            ratio_field: None,
+            rate_field: Some("sample_rate_n".to_string()),
+            key_field: None,
+            sample_rate_key: super::default_sample_rate_key(),
+            group_by: None,
+            exclude: None,
+        };
+
+        assert!(config.validate(&crate::schema::Definition::any()).is_ok());
+    }
+
+    #[test]
+    fn rejects_both_dynamic_fields_configuration() {
+        let config = SampleConfig {
+            rate: Some(10),
+            ratio: None,
+            ratio_field: Some("sample_rate".to_string()),
+            rate_field: Some("sample_rate_n".to_string()),
+            key_field: None,
+            sample_rate_key: super::default_sample_rate_key(),
+            group_by: None,
+            exclude: None,
+        };
+
+        let err = config.sample_rate().unwrap_err();
+        assert!(matches!(err, SampleError::InvalidDynamicConfiguration));
+    }
+
+    #[test]
+    fn rejects_key_field_with_dynamic_configuration() {
+        let config = SampleConfig {
+            rate: Some(10),
+            ratio: None,
+            ratio_field: Some("sample_ratio".to_string()),
+            rate_field: None,
+            key_field: Some("trace_id".to_string()),
+            sample_rate_key: super::default_sample_rate_key(),
+            group_by: None,
+            exclude: None,
+        };
+
+        let err = config.sample_rate().unwrap_err();
+        assert!(matches!(
+            err,
+            SampleError::InvalidKeyFieldDynamicCombination
+        ));
+    }
 }
diff --git a/src/transforms/sample/tests.rs b/src/transforms/sample/tests.rs
index c705ff2cc4f1f..e6fec5c12a35d 100644
--- a/src/transforms/sample/tests.rs
+++ b/src/transforms/sample/tests.rs
@@ -1,4 +1,5 @@
 use approx::assert_relative_eq;
+use indoc::indoc;
 use tokio::sync::mpsc;
 use tokio_stream::wrappers::ReceiverStream;
 use vector_lib::lookup::lookup_v2::OptionalValuePath;
@@ -14,7 +15,7 @@ use crate::{
         FunctionTransform, OutputBuffer,
         sample::{
             config::{SampleConfig, default_sample_rate_key},
-            transform::{Sample, SampleMode},
+            transform::{DynamicSampleFields, Sample, SampleMode},
         },
         test::{create_topology, transform_one},
     },
@@ -26,6 +27,8 @@ async fn emits_internal_events() {
         let config = SampleConfig {
             rate: None,
             ratio: Some(1.0),
+            ratio_field: None,
+            rate_field: None,
             key_field: None,
             group_by: None,
             exclude: None,
@@ -324,6 +327,330 @@ fn sample_at_rates_higher_then_half() {
     }
 }
 
+#[test]
+fn dynamic_ratio_field_overrides_static_ratio() {
+    let mut sampler = Sample::new_with_dynamic(
+        "sample".to_string(),
+        SampleMode::new_ratio(0.1),
+        DynamicSampleFields {
+            ratio_field: Some("dynamic_ratio".to_string()),
+            rate_field: None,
+        },
+        None,
+        None,
+        default_sample_rate_key(),
+    );
+
+    let mut event = Event::Log(LogEvent::from("hello"));
+    let log = event.as_mut_log();
+    log.insert("dynamic_ratio", 1.0);
+
+    let output = transform_one(&mut sampler, event).expect("event should be sampled");
+    assert_eq!(output.as_log()["sample_rate"], "1".into());
+}
+
+#[test]
+fn dynamic_ratio_field_falls_back_to_static_ratio_when_missing() {
+    let mut sampler = Sample::new_with_dynamic(
+        "sample".to_string(),
+        SampleMode::new_ratio(1.0),
+        DynamicSampleFields {
+            ratio_field: Some("dynamic_ratio".to_string()),
+            rate_field: None,
+        },
+        None,
+        None,
+        default_sample_rate_key(),
+    );
+
+    let event = Event::Log(LogEvent::from("hello"));
+    let output = transform_one(&mut sampler, event).expect("event should be sampled");
+    assert_eq!(output.as_log()["sample_rate"], "1".into());
+}
+
+#[test]
+fn dynamic_rate_field_overrides_static_ratio() {
+    let mut sampler = Sample::new_with_dynamic(
+        "sample".to_string(),
+        SampleMode::new_ratio(0.0),
+        DynamicSampleFields {
+            ratio_field: None,
+            rate_field: Some("dynamic_rate".to_string()),
+        },
+        None,
+        None,
+        default_sample_rate_key(),
+    );
+
+    let mut event = Event::Log(LogEvent::from("hello"));
+    let log = event.as_mut_log();
+    log.insert("dynamic_rate", 1);
+
+    let output = transform_one(&mut sampler, event).expect("event should be sampled");
+    assert_eq!(output.as_log()["sample_rate"], "1".into());
+}
+
+#[test]
+fn dynamic_rate_field_falls_back_to_static_ratio_when_missing() {
+    let mut sampler = Sample::new_with_dynamic(
+        "sample".to_string(),
+        SampleMode::new_ratio(1.0),
+        DynamicSampleFields {
+            ratio_field: None,
+            rate_field: Some("dynamic_rate".to_string()),
+        },
+        None,
+        None,
+        default_sample_rate_key(),
+    );
+
+    let event = Event::Log(LogEvent::from("hello"));
+    let output = transform_one(&mut sampler, event).expect("event should be sampled");
+    assert_eq!(output.as_log()["sample_rate"], "1".into());
+}
+
+#[test]
+fn dynamic_rate_field_rejects_float_and_falls_back_to_static_ratio() {
+    let mut sampler = Sample::new_with_dynamic(
+        "sample".to_string(),
+        SampleMode::new_ratio(1.0),
+        DynamicSampleFields {
+            ratio_field: None,
+            rate_field: Some("dynamic_rate".to_string()),
+        },
+        None,
+        None,
+        default_sample_rate_key(),
+    );
+
+    let mut event = Event::Log(LogEvent::from("hello"));
+    let log = event.as_mut_log();
+    log.insert("dynamic_rate", 2.0);
+
+    let output = transform_one(&mut sampler, event).expect("event should be sampled");
+    assert_eq!(output.as_log()["sample_rate"], "1".into());
+}
+
+#[test]
+fn dynamic_ratio_honors_group_by_key() {
+    let ratio = 0.5_f64;
+    let events_per_service = 200;
+    let mut sampler = Sample::new_with_dynamic(
+        "sample".to_string(),
+        SampleMode::new_ratio(0.0),
+        DynamicSampleFields {
+            ratio_field: Some("dynamic_ratio".to_string()),
+            rate_field: None,
+        },
+        Some(Template::try_from("{{ service }}").unwrap()),
+        None,
+        default_sample_rate_key(),
+    );
+
+    let mut sampled_service_a = 0;
+    let mut sampled_service_b = 0;
+    for _ in 0..events_per_service {
+        for service in ["service-a", "service-b"] {
+            let mut event = Event::Log(LogEvent::from("hello"));
+            let log = event.as_mut_log();
+            log.insert("service", service);
+            log.insert("dynamic_ratio", ratio);
+            if let Some(output) = transform_one(&mut sampler, event) {
+                assert_eq!(output.as_log()["sample_rate"], "0.5".into());
+                if service == "service-a" {
+                    sampled_service_a += 1;
+                } else {
+                    sampled_service_b += 1;
+                }
+            }
+        }
+    }
+
+    assert!(
+        (60..140).contains(&sampled_service_a),
+        "service-a sampled {} out of {events_per_service}",
+        sampled_service_a
+    );
+    assert!(
+        (60..140).contains(&sampled_service_b),
+        "service-b sampled {} out of {events_per_service}",
+        sampled_service_b
+    );
+}
+
+#[test]
+fn dynamic_rate_honors_group_by_key() {
+    let rate = 2_i64;
+    let events_per_service = 200;
+    let mut sampler = Sample::new_with_dynamic(
+        "sample".to_string(),
+        SampleMode::new_ratio(0.0),
+        DynamicSampleFields {
+            ratio_field: None,
+            rate_field: Some("dynamic_rate".to_string()),
+        },
+        Some(Template::try_from("{{ service }}").unwrap()),
+        None,
+        default_sample_rate_key(),
+    );
+
+    let mut sampled_service_a = 0;
+    let mut sampled_service_b = 0;
+    for _ in 0..events_per_service {
+        for service in ["service-a", "service-b"] {
+            let mut event = Event::Log(LogEvent::from("hello"));
+            let log = event.as_mut_log();
+            log.insert("service", service);
+            log.insert("dynamic_rate", rate);
+            if let Some(output) = transform_one(&mut sampler, event) {
+                assert_eq!(output.as_log()["sample_rate"], "2".into());
+                if service == "service-a" {
+                    sampled_service_a += 1;
+                } else {
+                    sampled_service_b += 1;
+                }
+            }
+        }
+    }
+
+    assert!(
+        (60..140).contains(&sampled_service_a),
+        "service-a sampled {} out of {events_per_service}",
+        sampled_service_a
+    );
+    assert!(
+        (60..140).contains(&sampled_service_b),
+        "service-b sampled {} out of {events_per_service}",
+        sampled_service_b
+    );
+}
+
+#[test]
+fn dynamic_ratio_group_by_samples_mixed_ratios_at_expected_rates() {
+    let events_per_ratio = 500;
+    let mut sampler = Sample::new_with_dynamic(
+        "sample".to_string(),
+        SampleMode::new_ratio(0.0),
+        DynamicSampleFields {
+            ratio_field: Some("dynamic_ratio".to_string()),
+            rate_field: None,
+        },
+        Some(Template::try_from("{{ service }}").unwrap()),
+        None,
+        default_sample_rate_key(),
+    );
+
+    let mut sampled_low_ratio = 0;
+    let mut sampled_high_ratio = 0;
+    for _ in 0..events_per_ratio {
+        for (ratio, is_low_ratio) in [(0.25_f64, true), (0.75_f64, false)] {
+            let mut event = Event::Log(LogEvent::from("hello"));
+            let log = event.as_mut_log();
+            log.insert("service", "service-a");
+            log.insert("dynamic_ratio", ratio);
+            if let Some(output) = transform_one(&mut sampler, event) {
+                assert_eq!(output.as_log()["sample_rate"], ratio.to_string().into());
+                if is_low_ratio {
+                    sampled_low_ratio += 1;
+                } else {
+                    sampled_high_ratio += 1;
+                }
+            }
+        }
+    }
+
+    assert!(
+        (80..220).contains(&sampled_low_ratio),
+        "ratio=0.25 sampled {} out of {events_per_ratio}",
+        sampled_low_ratio
+    );
+    assert!(
+        (300..450).contains(&sampled_high_ratio),
+        "ratio=0.75 sampled {} out of {events_per_ratio}",
+        sampled_high_ratio
+    );
+    assert!(
+        sampled_high_ratio > sampled_low_ratio,
+        "ratio=0.75 sampled {sampled_high_ratio}, ratio=0.25 sampled {sampled_low_ratio}"
+    );
+}
+
+#[test]
+fn dynamic_rate_group_by_samples_mixed_rates_at_expected_rates() {
+    let events_per_rate = 600;
+    let mut sampler = Sample::new_with_dynamic(
+        "sample".to_string(),
+        SampleMode::new_ratio(0.0),
+        DynamicSampleFields {
+            ratio_field: None,
+            rate_field: Some("dynamic_rate".to_string()),
+        },
+        Some(Template::try_from("{{ service }}").unwrap()),
+        None,
+        default_sample_rate_key(),
+    );
+
+    let mut sampled_rate_2 = 0;
+    let mut sampled_rate_3 = 0;
+    for _ in 0..events_per_rate {
+        for rate in [2_i64, 3_i64] {
+            let mut event = Event::Log(LogEvent::from("hello"));
+            let log = event.as_mut_log();
+            log.insert("service", "service-a");
+            log.insert("dynamic_rate", rate);
+            if let Some(output) = transform_one(&mut sampler, event) {
+                assert_eq!(output.as_log()["sample_rate"], rate.to_string().into());
+                if rate == 2 {
+                    sampled_rate_2 += 1;
+                } else {
+                    sampled_rate_3 += 1;
+                }
+            }
+        }
+    }
+
+    assert!(
+        (220..380).contains(&sampled_rate_2),
+        "rate=2 sampled {} out of {events_per_rate}",
+        sampled_rate_2
+    );
+    assert!(
+        (120..280).contains(&sampled_rate_3),
+        "rate=3 sampled {} out of {events_per_rate}",
+        sampled_rate_3
+    );
+    assert!(
+        sampled_rate_2 > sampled_rate_3,
+        "rate=2 sampled {sampled_rate_2}, rate=3 sampled {sampled_rate_3}"
+    );
+}
+
+#[tokio::test]
+async fn dynamic_field_config_drives_dynamic_sampling() {
+    assert_transform_compliance(async move {
+        let config: SampleConfig = serde_yaml::from_str(indoc! {r#"
+            ratio_field: dynamic_ratio
+            ratio: 1.0
+        "#})
+        .expect("config should deserialize");
+
+        let (tx, rx) = mpsc::channel(1);
+        let (topology, mut out) = create_topology(ReceiverStream::new(rx), config).await;
+
+        let mut log = LogEvent::from("hello");
+        log.insert("dynamic_ratio", 1.0);
+        tx.send(log.into()).await.unwrap();
+
+        let event = out.recv().await.expect("event should be sampled");
+        assert_eq!(event.as_log()["sample_rate"], "1".into());
+
+        drop(tx);
+        topology.stop().await;
+        assert_eq!(out.recv().await, None);
+    })
+    .await
+}
+
 fn condition_contains(key: &str, needle: &str) -> Condition {
     let vrl_config = VrlConfig {
         source: format!(r#"contains!(."{key}", "{needle}")"#),
diff --git a/src/transforms/sample/transform.rs b/src/transforms/sample/transform.rs
index 74786a43fdc51..00728b076e68c 100644
--- a/src/transforms/sample/transform.rs
+++ b/src/transforms/sample/transform.rs
@@ -1,4 +1,9 @@
-use std::{collections::HashMap, fmt};
+use std::{
+    collections::HashMap,
+    fmt,
+    hash::{Hash, Hasher},
+    num::NonZeroU64,
+};
 
 use vector_lib::{
     config::LegacyKey,
@@ -91,6 +96,26 @@ impl SampleMode {
     }
 }
 
+enum EventSampleMode {
+    Ratio(f64),
+    Rate(NonZeroU64),
+}
+
+impl EventSampleMode {
+    fn sample_rate_label(&self) -> String {
+        match self {
+            Self::Ratio(ratio) => ratio.to_string(),
+            Self::Rate(rate) => rate.to_string(),
+        }
+    }
+}
+
+#[derive(Clone, Default)]
+pub struct DynamicSampleFields {
+    pub ratio_field: Option<String>,
+    pub rate_field: Option<String>,
+}
+
 impl fmt::Display for SampleMode {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         // Avoids the print of an additional '.0' which was not performed in the previous
@@ -102,12 +127,24 @@ impl fmt::Display for SampleMode {
     }
 }
 
+#[derive(Clone)]
+pub enum SampleKeySource {
+    Static {
+        key_field: Option<String>,
+        group_by: Option<Template>,
+    },
+    Dynamic {
+        fields: DynamicSampleFields,
+        group_by: Option<Template>,
+    },
+}
+
 #[derive(Clone)]
 pub struct Sample {
     name: String,
-    rate: SampleMode,
-    key_field: Option<String>,
-    group_by: Option<Template>,
+    static_mode: SampleMode,
+    key_source: SampleKeySource,
+    dynamic_event_counters: HashMap<Option<String>, u64>,
     exclude: Option<Condition>,
     sample_rate_key: OptionalValuePath,
 }
@@ -116,19 +153,55 @@ impl Sample {
     // This function is dead code when the feature flag `transforms-impl-sample` is specified but not
     // `transforms-sample`.
     #![allow(dead_code)]
-    pub const fn new(
+    pub fn new(
         name: String,
-        rate: SampleMode,
+        static_mode: SampleMode,
         key_field: Option<String>,
         group_by: Option<Template>,
         exclude: Option<Condition>,
         sample_rate_key: OptionalValuePath,
+    ) -> Self {
+        Self::new_with_source(
+            name,
+            static_mode,
+            SampleKeySource::Static {
+                key_field,
+                group_by,
+            },
+            exclude,
+            sample_rate_key,
+        )
+    }
+
+    pub fn new_with_dynamic(
+        name: String,
+        static_mode: SampleMode,
+        fields: DynamicSampleFields,
+        group_by: Option<Template>,
+        exclude: Option<Condition>,
+        sample_rate_key: OptionalValuePath,
+    ) -> Self {
+        Self::new_with_source(
+            name,
+            static_mode,
+            SampleKeySource::Dynamic { fields, group_by },
+            exclude,
+            sample_rate_key,
+        )
+    }
+
+    fn new_with_source(
+        name: String,
+        static_mode: SampleMode,
+        key_source: SampleKeySource,
+        exclude: Option<Condition>,
+        sample_rate_key: OptionalValuePath,
     ) -> Self {
         Self {
             name,
-            rate,
-            key_field,
-            group_by,
+            static_mode,
+            key_source,
+            dynamic_event_counters: HashMap::default(),
             exclude,
             sample_rate_key,
         }
@@ -136,11 +209,120 @@ impl Sample {
 
     #[cfg(test)]
     pub fn ratio(&self) -> f64 {
-        match self.rate {
-            SampleMode::Rate { rate, .. } => 1.0f64 / rate as f64,
-            SampleMode::Ratio { ratio, .. } => ratio,
+        match &self.static_mode {
+            SampleMode::Rate { rate, .. } => 1.0f64 / *rate as f64,
+            SampleMode::Ratio { ratio, .. } => *ratio,
         }
     }
+
+    fn dynamic_sample_hash(group_by_key: Option<&str>, counter: u64) -> u64 {
+        let mut hasher = seahash::SeaHasher::new();
+        group_by_key.hash(&mut hasher);
+        counter.hash(&mut hasher);
+        hasher.finish()
+    }
+
+    fn sample_with_dynamic_ratio(&mut self, ratio: f64, group_by_key: Option<String>) -> bool {
+        let counter_value = self
+            .dynamic_event_counters
+            .entry(group_by_key.clone())
+            .or_default();
+        let old_counter_value = *counter_value;
+        *counter_value += 1;
+
+        let hash = Self::dynamic_sample_hash(group_by_key.as_deref(), old_counter_value);
+        let hash_ratio_threshold = (ratio * (u64::MAX as u128) as f64) as u64;
+        hash <= hash_ratio_threshold
+    }
+
+    fn event_ratio(&self, event: &Event) -> Option<f64> {
+        let ratio_field = match &self.key_source {
+            SampleKeySource::Dynamic { fields, .. } => fields.ratio_field.as_ref()?,
+            SampleKeySource::Static { .. } => return None,
+        };
+
+        let value = self.get_event_value(event, ratio_field.as_str())?;
+
+        let ratio = match value {
+            Value::Integer(value) => *value as f64,
+            Value::Float(value) => value.into_inner(),
+            Value::Bytes(bytes) => std::str::from_utf8(bytes).ok()?.parse::<f64>().ok()?,
+            _ => return None,
+        };
+
+        (ratio > 0.0 && ratio <= 1.0).then_some(ratio)
+    }
+
+    fn event_rate(&self, event: &Event) -> Option<NonZeroU64> {
+        let rate_field = match &self.key_source {
+            SampleKeySource::Dynamic { fields, .. } => fields.rate_field.as_ref()?,
+            SampleKeySource::Static { .. } => return None,
+        };
+
+        let value = self.get_event_value(event, rate_field.as_str())?;
+
+        match value {
+            Value::Integer(value) => u64::try_from(*value).ok().and_then(NonZeroU64::new),
+            Value::Bytes(bytes) => std::str::from_utf8(bytes).ok()?.parse::<NonZeroU64>().ok(),
+            _ => None,
+        }
+    }
+
+    fn get_event_value<'a>(&self, event: &'a Event, path: &str) -> Option<&'a Value> {
+        match event {
+            Event::Log(event) => event.parse_path_and_get_value(path).ok().flatten(),
+            Event::Trace(event) => event.parse_path_and_get_value(path).ok().flatten(),
+            Event::Metric(_) => panic!("component can never receive metric events"),
+        }
+    }
+
+    fn event_sample_mode(&self, event: &Event) -> Option<EventSampleMode> {
+        self.event_ratio(event)
+            .map(EventSampleMode::Ratio)
+            .or_else(|| self.event_rate(event).map(EventSampleMode::Rate))
+    }
+
+    fn sample_with_dynamic_rate(&mut self, rate: NonZeroU64, group_by_key: Option<String>) -> bool {
+        let counter_value = self
+            .dynamic_event_counters
+            .entry(group_by_key.clone())
+            .or_default();
+        let old_counter_value = *counter_value;
+        *counter_value += 1;
+        let hash = Self::dynamic_sample_hash(group_by_key.as_deref(), old_counter_value);
+
+        hash.is_multiple_of(rate.get())
+    }
+
+    fn group_by_key(&self, event: &Event) -> Option<String> {
+        let group_by = match &self.key_source {
+            SampleKeySource::Static { group_by, .. } => group_by.as_ref()?,
+            SampleKeySource::Dynamic { group_by, .. } => group_by.as_ref()?,
+        };
+
+        match event {
+            Event::Log(event) => group_by.render_string(event),
+            Event::Trace(event) => group_by.render_string(event),
+            Event::Metric(_) => panic!("component can never receive metric events"),
+        }
+        .map_err(|error| {
+            emit!(TemplateRenderingError {
+                error,
+                field: Some("group_by"),
+                drop_event: false,
+            })
+        })
+        .ok()
+    }
+
+    fn static_key_value<'a>(&self, event: &'a Event) -> Option<&'a Value> {
+        let key_field = match &self.key_source {
+            SampleKeySource::Static { key_field, .. } => key_field.as_ref()?,
+            SampleKeySource::Dynamic { .. } => return None,
+        };
+
+        self.get_event_value(event, key_field)
+    }
 }
 
 impl FunctionTransform for Sample {
@@ -159,36 +341,24 @@ impl FunctionTransform for Sample {
             }
         };
 
-        let value = self.key_field.as_ref().and_then(|key_field| match &event {
-            Event::Log(event) => event
-                .parse_path_and_get_value(key_field.as_str())
-                .ok()
-                .flatten(),
-            Event::Trace(event) => event
-                .parse_path_and_get_value(key_field.as_str())
-                .ok()
-                .flatten(),
-            Event::Metric(_) => panic!("component can never receive metric events"),
-        });
-
-        // Fetch actual field value if group_by option is set.
-        let group_by_key = self.group_by.as_ref().and_then(|group_by| {
-            match &event {
-                Event::Log(event) => group_by.render_string(event),
-                Event::Trace(event) => group_by.render_string(event),
-                Event::Metric(_) => panic!("component can never receive metric events"),
+        let group_by_key = self.group_by_key(&event);
+        let value = self.static_key_value(&event);
+
+        let event_sample_mode = self.event_sample_mode(&event);
+        let sample_rate = event_sample_mode
+            .as_ref()
+            .map(EventSampleMode::sample_rate_label)
+            .unwrap_or_else(|| self.static_mode.to_string());
+
+        let should_sample = match event_sample_mode {
+            Some(EventSampleMode::Ratio(ratio)) => {
+                self.sample_with_dynamic_ratio(ratio, group_by_key)
             }
-            .map_err(|error| {
-                emit!(TemplateRenderingError {
-                    error,
-                    field: Some("group_by"),
-                    drop_event: false,
-                })
-            })
-            .ok()
-        });
+            Some(EventSampleMode::Rate(rate)) => self.sample_with_dynamic_rate(rate, group_by_key),
+            None => self.static_mode.increment(group_by_key, value),
+        };
 
-        if self.rate.increment(group_by_key, value) {
+        if should_sample {
             if let Some(path) = &self.sample_rate_key.path {
                 match event {
                     Event::Log(ref mut event) => {
@@ -197,11 +367,11 @@ impl FunctionTransform for Sample {
                             event,
                             Some(LegacyKey::Overwrite(path)),
                             path,
-                            self.rate.to_string(),
+                            sample_rate.clone(),
                         );
                     }
                     Event::Trace(ref mut event) => {
-                        event.insert(&OwnedTargetPath::event(path.clone()), self.rate.to_string());
+                        event.insert(&OwnedTargetPath::event(path.clone()), sample_rate);
                     }
                     Event::Metric(_) => panic!("component can never receive metric events"),
                 };
diff --git a/website/cue/reference/components/transforms/generated/sample.cue b/website/cue/reference/components/transforms/generated/sample.cue
index 11a91141683fa..eeba9fa813427 100644
--- a/website/cue/reference/components/transforms/generated/sample.cue
+++ b/website/cue/reference/components/transforms/generated/sample.cue
@@ -12,6 +12,9 @@ generated: components: transforms: sample: configuration: {
 
 			If left unspecified, or if the event doesn't have `group_by`, then the event is not
 			sampled separately.
+
+			This can also be used with `ratio_field` or `rate_field` to apply dynamic sampling
+			independently per rendered group value.
 			"""
 		required: false
 		type: string: {
@@ -32,6 +35,8 @@ generated: components: transforms: sample: configuration: {
 
 			This can be useful to, for example, ensure that all logs for a given transaction are
 			sampled together, but that overall `1/N` transactions are sampled.
+
+			This option cannot be combined with `ratio_field` or `rate_field`.
 			"""
 		required: false
 		type: string: examples: ["message"]
@@ -49,6 +54,18 @@ generated: components: transforms: sample: configuration: {
 			1500,
 		]
 	}
+	rate_field: {
+		description: """
+			The event field whose integer value is used as the sampling rate on a per-event basis, expressed as `1/N`.
+
+			Accepts an integer, or a string that parses as a positive integer; floating point values
+			are rejected. The value must be a positive integer to be considered valid. If the field is
+			missing or invalid, static sampling settings (`rate` or `ratio`) are used as a fallback.
+			This option cannot be used together with `ratio_field`.
+			"""
+		required: false
+		type: string: examples: ["sample_rate_n"]
+	}
 	ratio: {
 		description: """
 			The rate at which events are forwarded, expressed as a percentage
@@ -63,6 +80,18 @@ generated: components: transforms: sample: configuration: {
 			0.13,
 		]
 	}
+	ratio_field: {
+		description: """
+			The event field whose numeric value is used as the sampling ratio on a per-event basis.
+
+			Accepts integer, floating point, or string values that parse as a number. The value must be
+			in `(0, 1]` to be considered valid (for example, `0.25` keeps 25%). If the field is missing
+			or invalid, static sampling settings (`rate` or `ratio`) are used as a fallback.
+			This option cannot be used together with `rate_field`.
+			"""
+		required: false
+		type: string: examples: ["sample_rate"]
+	}
 	sample_rate_key: {
 		description: "The event key in which the sample rate is stored. If set to an empty string, the sample rate will not be added to the event."
 		required:    false

From f7cc83e980e5af429ee040c07aab7f96dd70cb15 Mon Sep 17 00:00:00 2001
From: Aaron Zheng <aaron.zheng@datadoghq.com>
Date: Tue, 5 May 2026 13:37:26 -0400
Subject: [PATCH 196/326] fix(external docs): adjust tocbot content tracking
 (#25359)

* bug fix

* fix(website): fix tocbot not updating active TOC entry on scroll

h-screen on <html> caused document.documentElement.scrollTop to always
be 0, so tocbot never detected scroll position changes. Changed html to
min-h-full and body to min-h-screen so the document scrolls normally.
Also cleaned up tocbot config to remove unused options.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(website): conform below.js to prettier config

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 website/assets/js/below.js           | 5 ++++-
 website/layouts/_default/baseof.html | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/website/assets/js/below.js b/website/assets/js/below.js
index 0123d5eb2c36c..d5af00dacf115 100644
--- a/website/assets/js/below.js
+++ b/website/assets/js/below.js
@@ -7,7 +7,10 @@ const tableOfContents = () => {
       tocSelector: "#toc",
       contentSelector: "#page-content",
       headingSelector: "h2,h3,h4,h5",
-      scrollSmoothDuration: 400
+      scrollSmoothDuration: 400,
+      headingsOffset: 80,
+      scrollSmoothOffset: -80,
+      hasInnerContainers: true
     });
   }
 };
diff --git a/website/layouts/_default/baseof.html b/website/layouts/_default/baseof.html
index 0ba071a5aab44..5cea52ab977ab 100644
--- a/website/layouts/_default/baseof.html
+++ b/website/layouts/_default/baseof.html
@@ -7,7 +7,7 @@
   x-data="{ dark: $store.global.dark{{ if $hasBottomNav }}, slideover: false {{ end }} }"
   x-on:toggle-dark="dark = !dark"
   :class="{ 'dark': dark, 'light': !dark }"
-  class="h-screen">
+  class="min-h-full">
 
   <head>
     {{/* Make sure the page is always visible if JS is disabled */}}
@@ -37,7 +37,7 @@
     {{/* JS that needs to load at the start */}}
     {{ partial "javascript/head.html" . }}
   </head>
-  <body class="dark:bg-dark font-sans antialiased flex flex-col min-h-full{{ if $hasBottomNav }} pb-16 lg:pb-0{{ end }}" onload="showBody()" style="visibility: hidden;">
+  <body class="dark:bg-dark font-sans antialiased flex flex-col min-h-screen{{ if $hasBottomNav }} pb-16 lg:pb-0{{ end }}" onload="showBody()" style="visibility: hidden;">
     <!-- Google Tag Manager (noscript) -->
     <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M7MFKZ9" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
     <!-- End Google Tag Manager (noscript) -->

From bec3290d7806fbefc1923fd676bb865c95e7f115 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 5 May 2026 13:39:34 -0400
Subject: [PATCH 197/326] chore(website deps): bump axios from 1.15.0 to 1.16.0
 in /website (#25369)

Bumps [axios](https://github.com/axios/axios) from 1.15.0 to 1.16.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.15.0...v1.16.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.16.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 website/yarn.lock | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/website/yarn.lock b/website/yarn.lock
index c2d1c9ed279dc..bab5839f0d5c7 100644
--- a/website/yarn.lock
+++ b/website/yarn.lock
@@ -1641,11 +1641,11 @@ autoprefixer@^10.2.5:
     postcss-value-parser "^4.2.0"
 
 axios@^1.6.0, axios@^1.8.4:
-  version "1.15.0"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-1.15.0.tgz#0fcee91ef03d386514474904b27863b2c683bf4f"
-  integrity sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.16.0.tgz#f8e5dd931cef2a5f8c32216d5784eda2f8750eb7"
+  integrity sha512-6hp5CwvTPlN2A31g5dxnwAX0orzM7pmCRDLnZSX772mv8WDqICwFjowHuPs04Mc8deIld1+ejhtaMn5vp6b+1w==
   dependencies:
-    follow-redirects "^1.15.11"
+    follow-redirects "^1.16.0"
     form-data "^4.0.5"
     proxy-from-env "^2.1.0"
 
@@ -2382,7 +2382,7 @@ fn.name@1.x.x:
   resolved "https://registry.npmjs.org/fn.name/-/fn.name-1.1.0.tgz"
   integrity sha512-GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==
 
-follow-redirects@^1.15.11:
+follow-redirects@^1.16.0:
   version "1.16.0"
   resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.16.0.tgz#28474a159d3b9d11ef62050a14ed60e4df6d61bc"
   integrity sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==

From 202c974c18a8bfdb8102f6f0a8c3580bd3e9e96a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 5 May 2026 14:00:29 -0400
Subject: [PATCH 198/326] chore(website deps): bump postcss from 8.5.6 to
 8.5.14 in /website (#25368)

Bumps [postcss](https://github.com/postcss/postcss) from 8.5.6 to 8.5.14.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.6...8.5.14)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.14
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 website/yarn.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/website/yarn.lock b/website/yarn.lock
index bab5839f0d5c7..f2f1ff986161b 100644
--- a/website/yarn.lock
+++ b/website/yarn.lock
@@ -3146,9 +3146,9 @@ postcss-value-parser@^4.0.0, postcss-value-parser@^4.1.0, postcss-value-parser@^
   integrity sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==
 
 postcss@^8.1.6, postcss@^8.3.5:
-  version "8.5.6"
-  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.6.tgz#2825006615a619b4f62a9e7426cc120b349a8f3c"
-  integrity sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==
+  version "8.5.14"
+  resolved "https://registry.yarnpkg.com/postcss/-/postcss-8.5.14.tgz#a66c2d7808fadf69ebb5b84a03f8bafd76c4919c"
+  integrity sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==
   dependencies:
     nanoid "^3.3.11"
     picocolors "^1.1.1"

From 92ee2b26923ea0eaf8c0b4c1bc0398c679a4b44d Mon Sep 17 00:00:00 2001
From: ArunPiduguDD <arun.pidugu@datadoghq.com>
Date: Tue, 5 May 2026 23:49:05 -0400
Subject: [PATCH 199/326] enhancement(metrics): Add remove tag function for
 metrics which returns entire tag set (#25361)

---
 lib/vector-core/src/event/metric/tags.rs | 33 ++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/lib/vector-core/src/event/metric/tags.rs b/lib/vector-core/src/event/metric/tags.rs
index 52c9a365d2534..d83813732be48 100644
--- a/lib/vector-core/src/event/metric/tags.rs
+++ b/lib/vector-core/src/event/metric/tags.rs
@@ -528,6 +528,12 @@ impl MetricTags {
         self.0.remove(name).and_then(TagValueSet::into_single)
     }
 
+    /// Remove a tag and return its full [`TagValueSet`], preserving all values rather than reducing
+    /// to a single string like [`Self::remove`].
+    pub fn remove_set(&mut self, name: &str) -> Option<TagValueSet> {
+        self.0.remove(name)
+    }
+
     pub fn keys(&self) -> impl Iterator<Item = &str> {
         self.0.keys().map(String::as_str)
     }
@@ -640,6 +646,33 @@ mod tests {
 
     use super::*;
 
+    fn make_tags(pairs: &[(&str, &str)]) -> MetricTags {
+        pairs
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.to_string()))
+            .collect()
+    }
+
+    #[test]
+    fn remove_set_returns_full_value_set() {
+        let mut tags = MetricTags::default();
+        tags.insert("k".to_string(), TagValue::Value("a".to_string()));
+        tags.insert("k".to_string(), TagValue::Value("b".to_string()));
+
+        let removed = tags.remove_set("k").expect("tag should exist");
+        assert_eq!(removed.len(), 2);
+        assert!(removed.contains(&TagValue::Value("a".to_string())));
+        assert!(removed.contains(&TagValue::Value("b".to_string())));
+        assert!(!tags.contains_key("k"));
+    }
+
+    #[test]
+    fn remove_set_missing_returns_none() {
+        let mut tags = make_tags(&[("a", "1")]);
+        assert!(tags.remove_set("missing").is_none());
+        assert!(tags.contains_key("a"));
+    }
+
     proptest! {
         #[test]
         fn reduces_set_to_simple(mut values: TagValueSet) {

From 249d064d75e5337efd1cd4fd2949de20e16d801e Mon Sep 17 00:00:00 2001
From: Swaraj Patil <patilswaraj1111@gmail.com>
Date: Wed, 6 May 2026 18:06:13 +0530
Subject: [PATCH 200/326] feat(dev): rewrite scripts/generate-component-docs.rb
 in Rust (#22350) (#24781)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Rewrite scripts/generate-component-docs.rb in Rust (#22350)

* fix(docs): resolve IndexMap type mismatches and ensure determinism using shift_remove

* fix(docs): resolve clippy warnings, whitespace, and enum JSON rendering for Cue compatibility

* fix(docs): handle const enum tags and apply cargo fmt to vdev

* fix: deterministic cue generation alignment with ruby definitions

* fix(vdev): address PR feedback for component-docs Rust generator

- Use IndexMap for caches and enum maps to preserve insertion order
- Apply sort_hash_nested recursively in unwrap_resolved_schema (match Ruby)
- Implement missing enum patterns: external unit/non-unit, untagged narrowed, fallback mixed-mode
- Fix resolved_schema_type to avoid Box::leak; use static type match
- Use sorted iteration for component_bases, apis, global_options, all_components
- Fix Clippy: redundant else, or-patterns, collapsible_if, semicolon

* chore(docs): regenerate component CUE files with Rust generator

Regenerate all component CUE docs via make generate-component-docs
so check-component-docs passes and output is deterministic.

* fix(vdev): fix default value handling and enum rendering in component-docs generator

- Skip null defaults in resolve_bare_schema (matching Ruby's nil-skip behavior)
- Rewrite apply_schema_default_value to recursively push object defaults
  to sub-properties instead of setting them flat at the object type level
- Apply scalar defaults only to the matching type def, not all type defs
- Add find_nested_object_property_schema for recursive default resolution
- Make get_docs_type_for_value schema-aware for numeric type metadata
- Fix apply_object_property_fields to treat null as "no default"
- Fix schema_aware_nested_merge const check (was inspecting parent object
  instead of the const value object)
- Convert merged const arrays to enum format in mixed-mode fallback

* Update website/cue/reference/components/sinks/generated/redis.cue

Co-authored-by: May Lee <may.lee@datadoghq.com>

* chore(vdev): apply cargo fmt to component-docs generator

* fix(vdev): copy docs::warnings metadata in component-docs generator

The Rust generator was not propagating docs::warnings metadata to
resolved schemas. This caused security/safety warnings on fields like
azure_blob connection_string, file sink path, and api config to be
silently dropped from generated CUE docs.

* fix(vdev): fail fast on unexpected enum variants and propagate resolve errors

- External non-unit enum variants with != 1 property now error instead
  of being silently skipped (prevents partial/incomplete docs)
- Fallback mixed-mode enum path now propagates resolve_schema errors
  via ? instead of swallowing them with .ok() (prevents silent data
  corruption from unresolved references)

* style(vdev): fix rustfmt in schema_enum error! macro

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(vdev): preserve insertion order in component-docs resolver

serde_json::Map::remove is swap_remove under the preserve_order feature,
which silently swaps the last entry into the removed position. The
internally-tagged-enum merge in resolve_enum_schema relied on stable
ordering, so removing the tag field reshuffled property keys (e.g. the
`buffer` field's options ended up as `max_size, when_full, max_events,
type` instead of `when_full, max_events, max_size, type`).

Switch every Map::remove call in the schema resolver to shift_remove so
keys keep their original positions and CUE output matches the Ruby
generator's behavior.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(vdev): convert const to enum in reconcile_resolved_schema

The reconcile pass was a stub. CUE has no const type, so the Ruby
generator converted every {type: T: const: {value, description}} (and
its array form when subschemas merge multiple consts) into
{type: T: enum: {value: description}}. Without this step the Rust
generator emits raw const blocks for single-variant tagged enums (e.g.
the aws_s3 sink's batch_encoding codec, redis sink's sorted-set method)
which no consumer of the CUE expects.

Port the Ruby logic: recurse into object properties, drop null defaults
on required leaf schemas, and rewrite single/array const payloads as
enum maps using each variant's description.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(vdev): render top-level configuration fields with groups

The previous global-options pass scanned definitions for
docs::component_type == "global_option", a metadata key the schema no
longer emits. As a result generated/configuration.cue collapsed to an
empty object.

Match the Ruby script (PR #24863): walk root_schema.allOf, merge every
flattened ConfigBuilder/GlobalOptions property, skip docs::hidden,
resolve each field, and tag it with a group from a fixed map
(sources/transforms/sinks/enrichment_tables -> pipeline_components,
api -> api, schema/log_schema -> schema, secret -> secrets, default ->
global_options). Emit a sibling `groups` block describing each group's
title, description, and order.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(redis sink): align ZAdd doc with intended CUE wording

Match the wording the docs editors landed in 52ae17fc3e so regenerating
component docs is idempotent.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(docs): regenerate CUE for single-variant tagged enums

Output of make generate-component-docs after the reconcile fix. Single
const variants (clickhouse arrow_stream codec, redis zadd method,
vector source version, lua transform version) now render as enum maps
to match every other tagged enum in the docs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(vdev): make reconcile_resolved_schema an associated fn

Drops self_only_used_in_recursion allow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(redis sink): regenerate CUE from source comment

Reverts the source-comment alignment in be9a9357ad. The CUE now matches
what the Rust source actually says, which is the right direction for a
generator: the source is canonical and the CUE follows.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(vdev): handle non-string consts in const→enum conversion

The reconcile pass only string-checked const values, silently dropping
numeric/bool variants. CUE enum keys are strings, so coerce scalar
values uniformly via a helper and use it for both single and array
const payloads.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(vdev): bail on schema/default mismatches instead of dropping silently

The default-value applier and the top-level config resolver both used to
swallow malformed input and emit partial CUE:

- apply_schema_default_value silently dropped a default whose type had
  no matching definition in the resolved schema (`if let Some(...)` on
  pointer_mut). A schema-generation bug there would now mean a missing
  `default:` line in the docs with no warning.
- resolve_top_level_config_fields accepted an empty top-level allOf and
  produced an empty configuration.cue.

Match the Ruby behavior and bail with the relevant schemas/values so
the failure points at the offending Rust type instead of producing
silently-wrong output.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(greptimedb_logs sink): drop empty extra_headers example

The metadata pointed to extra_headers_examples() which returned an
empty HashMap. The resulting [{}] example tells readers nothing and
also rendered awkwardly in CUE output. Drop the metadata and the
helper.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(vdev): stop generating standalone api.cue

The api documentation was folded into the global-options pages in
#24858, which deleted website/cue/reference/generated/api.cue and
removed the corresponding render step from the Ruby script. The Rust
port still ran the api pass, producing an empty stub file that didn't
exist on master.

Drop the api collection/render step and remove the leftover stub.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(vdev): preserve all merged const variants in mixed-mode enums

schema_aware_nested_merge bailed out of its const-merge fast path once
the accumulated value became an array. The third and later const
variants then fell through to the generic merge, which replaced the
accumulated array with the new variant — silently dropping earlier
documented variants from the generated enum output.

Detect const merges by inspecting the override (and accept either an
existing object {value,...} or array of such objects on the base
side), and accumulate via a helper so each variant lands in the final
array exactly once.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(vdev): require matching nested property schemas before applying defaults

find_nested_object_property_schema returned the first match found
walking oneOf/anyOf/allOf branches. If multiple variants defined the
same property name with different shapes, apply_schema_default_value
could route an object default through the wrong branch and either
write the default under the wrong type or fail generation later.

Match the Ruby behavior: collect every matching property, compare
their reduced forms, and only return one when they all agree.
Otherwise return None so the caller falls back to the per-property
default-by-type path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(vdev): replace error!+exit with bail! in component-docs

Every schema-validation failure used to log via tracing's error! and
then std::process::exit(1), which kills the process before anyhow's
context chain can be printed and yields no exit code distinguishable
from a panic. Switch to anyhow::bail! everywhere these checks fire so
the error propagates up through Result<...> and lands as a normal
"Error: ..." message with the offending schema/value embedded.

Pure refactor: same control flow (every site already either returned
Result or was inside one), no CUE output changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(vdev): emit string descriptions for raw JSON Schema enum entries

The bare-enum branch wrote each allowed value as `enum: { value: {} }`,
but every other enum site (const→enum reconcile, externally-tagged
unit-variant enum, internally-tagged tag field) emits
`enum: { value: "description" }` and the docs renderer expects that
shape. A schema using `generate_enum_schema` directly (e.g.
CompressionLevel) would otherwise produce unrenderable CUE on the next
regen.

Insert an empty-string placeholder so the shape matches everywhere.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: May Lee <may.lee@datadoghq.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 scripts/generate-component-docs.rb            | 1914 -----------------
 src/sinks/greptimedb/logs/config.rs           |    5 -
 vdev/src/commands/build/component_docs/mod.rs |   20 +
 .../commands/build/component_docs/runner.rs   |  356 +++
 .../commands/build/component_docs/schema.rs   |  190 ++
 .../build/component_docs/schema_core.rs       |  131 ++
 .../build/component_docs/schema_enum.rs       |  413 ++++
 .../build/component_docs/schema_resolve.rs    |  302 +++
 .../build/component_docs/schema_utils.rs      |  573 +++++
 vdev/src/commands/build/mod.rs                |    5 +-
 .../sinks/generated/greptimedb_logs.cue       |   11 +-
 11 files changed, 1990 insertions(+), 1930 deletions(-)
 delete mode 100755 scripts/generate-component-docs.rb
 create mode 100644 vdev/src/commands/build/component_docs/mod.rs
 create mode 100644 vdev/src/commands/build/component_docs/runner.rs
 create mode 100644 vdev/src/commands/build/component_docs/schema.rs
 create mode 100644 vdev/src/commands/build/component_docs/schema_core.rs
 create mode 100644 vdev/src/commands/build/component_docs/schema_enum.rs
 create mode 100644 vdev/src/commands/build/component_docs/schema_resolve.rs
 create mode 100644 vdev/src/commands/build/component_docs/schema_utils.rs

diff --git a/scripts/generate-component-docs.rb b/scripts/generate-component-docs.rb
deleted file mode 100755
index 9f5fa7f695434..0000000000000
--- a/scripts/generate-component-docs.rb
+++ /dev/null
@@ -1,1914 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-begin
-  require 'json'
-  require 'tempfile'
-rescue LoadError => e
-  puts "Load error: #{e.message}"
-  exit 1
-end
-
-DEBUG_LEVEL = 1
-INFO_LEVEL = 2
-ERROR_LEVEL = 3
-
-LEVEL_MAPPINGS = {
-  'debug' => { 'numeric' => DEBUG_LEVEL, 'colored' => "\033[34mDEBUG\033[0m" },
-  'info' => { 'numeric' => INFO_LEVEL, 'colored' => "\033[32mINFO\033[0m" },
-  'error' => { 'numeric' => ERROR_LEVEL, 'colored' => "\033[31mERROR\033[0m" },
-}
-
-def numerical_level(level_str)
-  LEVEL_MAPPINGS.dig(level_str.downcase, 'numeric') if !level_str.nil?
-end
-
-def colored_level(level_str)
-  LEVEL_MAPPINGS.dig(level_str.downcase, 'colored') if !level_str.nil?
-end
-
-class Logger
-  def initialize
-    @level = numerical_level(ENV['LOG_LEVEL'] || '') || INFO_LEVEL
-    @is_tty = STDOUT.isatty
-  end
-
-  def formatted_level(level)
-    if @is_tty
-      colored_level(level)
-    else
-      level.upcase
-    end
-  end
-
-  def log(level, msg)
-    numeric_level = numerical_level(level)
-    if numeric_level >= @level
-      formatted_level = self.formatted_level(level)
-      dt = Time.now.strftime('%Y-%m-%dT%H:%M:%S')
-      puts "[#{dt}] #{formatted_level} #{msg}"
-    end
-  end
-
-  def debug(msg)
-    self.log('debug', msg)
-  end
-
-  def info(msg)
-    self.log('info', msg)
-  end
-
-  def error(msg)
-    self.log('error', msg)
-  end
-end
-
-@logger = Logger.new
-
-@integer_schema_types = %w[uint int]
-@number_schema_types = %w[float]
-@numeric_schema_types = @integer_schema_types + @number_schema_types
-
-# Cross-platform friendly method of finding if command exists on the current path.
-#
-# If the command is found, the full path to it is returned. Otherwise, `nil` is returned.
-def find_command_on_path(command)
-  exts = ENV['PATHEXT'] ? ENV['PATHEXT'].split(';') : ['']
-  ENV['PATH'].split(File::PATH_SEPARATOR).each do |path|
-    exts.each do |ext|
-      maybe_command_path = File.join(path, "#{command}#{ext}")
-      return maybe_command_path if File.executable?(maybe_command_path) && !File.directory?(maybe_command_path)
-    end
-  end
-  nil
-end
-
-@cue_binary_path = find_command_on_path('cue')
-
-# Helpers for caching resolved/expanded schemas and detecting schema resolution cycles.
-@resolved_schema_cache = {}
-@expanded_schema_cache = {}
-
-# Gets the schema of the given `name` from the resolved schema cache, if it exists.
-def get_cached_resolved_schema(schema_name)
-  @resolved_schema_cache[schema_name]
-end
-
-# Gets the schema of the given `name` from the expanded schema cache, if it exists.
-def get_cached_expanded_schema(schema_name)
-  @expanded_schema_cache[schema_name]
-end
-
-# Generic helpers for making working with Ruby a bit easier.
-def to_pretty_json(value)
-  if value.is_a?(Hash)
-    JSON.pretty_generate(Hash[*value.sort.flatten])
-  else
-    JSON.pretty_generate(value)
-  end
-end
-
-def deep_copy(obj)
-  Marshal.load(Marshal.dump(obj))
-end
-
-def mergeable?(value)
-  value.is_a?(Hash) || value.is_a?(Array)
-end
-
-def _nested_merge_impl(base, override, merger)
-  # Handle some basic cases first.
-  if base.nil?
-    return override
-  elsif override.nil?
-    return base
-  elsif !mergeable?(base) && !mergeable?(override)
-    return override
-  end
-
-  deep_copy(base).merge(override.to_h, &merger)
-end
-
-def nested_merge(base, override)
-  merger = proc { |_, v1, v2|
-    if v1.is_a?(Hash) && v2.is_a?(Hash)
-      v1.merge(v2, &merger)
-    elsif v1.is_a?(Array) && v2.is_a?(Array)
-      v1 | v2
-    else
-      [:undefined, nil, :nil].include?(v2) ? v1 : v2
-    end
-  }
-  _nested_merge_impl(base, override, merger)
-end
-
-def schema_aware_nested_merge(base, override)
-  merger = proc { |key, v1, v2|
-    if v1.is_a?(Hash) && v2.is_a?(Hash)
-      # Special behavior for merging const schemas together so they can be properly enum-ified.
-      if key == 'const' && v1.has_key?('value') && v2.has_key?('value')
-        [v1].flatten | [v2].flatten
-      else
-        v1.merge(v2, &merger)
-      end
-    elsif v1.is_a?(Array) && v2.is_a?(Array)
-      v1 | v2
-    else
-      [:undefined, nil, :nil].include?(v2) ? v1 : v2
-    end
-  }
-  _nested_merge_impl(base, override, merger)
-end
-
-def sort_hash_nested(input)
-  input.keys.sort.each_with_object({}) do |key, acc|
-    acc[key] = if input[key].is_a?(Hash)
-      sort_hash_nested(input[key])
-    else
-      input[key]
-    end
-  end
-end
-
-def write_to_temp_file(prefix, data)
-  file = Tempfile.new(prefix)
-  file.write(data)
-  file.close
-
-  file.path
-end
-
-# Gets the JSON Schema-compatible type name for the given Ruby Value.
-def json_type_str(value)
-  if value.is_a?(String)
-    'string'
-  elsif value.is_a?(Integer)
-    'integer'
-  elsif value.is_a?(Float)
-    'number'
-  elsif [true, false].include?(value)
-    'boolean'
-  elsif value.is_a?(Array)
-    'array'
-  elsif value.is_a?(Hash)
-    'object'
-  else
-    'null'
-  end
-end
-
-# Gets the docs-compatible type name for the given Ruby value.
-#
-# This is slightly different from the JSON Schema types, and is mostly an artifact of the original
-# documentation design, and not representative of anything fundamental.
-def docs_type_str(value)
-  type_str = json_type_str(value)
-  type_str = 'bool' if type_str == 'boolean'
-  type_str
-end
-
-# Gets the type of the resolved schema.
-#
-# If the resolved schema has more than one type defined, `nil` is returned.
-def resolved_schema_type?(resolved_schema)
-  if resolved_schema['type'].length == 1
-    resolved_schema['type'].keys.first
-  end
-end
-
-# Gets the numeric type of the resolved schema.
-#
-# If the resolved schema has more than one type defined, or the type is not a numeric type, `nil` is
-# returned.
-def numeric_schema_type(resolved_schema)
-  schema_type = resolved_schema_type?(resolved_schema)
-  schema_type if @numeric_schema_types.include?(schema_type)
-end
-
-# Gets the docs type for the given value's type.
-#
-# When dealing with a source schema, and trying to get the "docs"-compatible schema type, we need to
-# cross-reference the original schema with the type of the value we have on the Ruby side. While
-# some types like a string will always have a type of "string", numbers represent an area where we
-# need to do some digging.
-#
-# For example, we encode the specific class of number on the source schema -- unsigned, signed, or
-# floating-point -- and we can discern nearly as much from the Ruby value itself (integer vs float),
-# but we need to be able to discern the precise type i.e. the unsigned vs signed vs floating-point
-# bit.
-#
-# This function cross-references the Ruby value given with the source schema it is associated with
-# and returns the appropriate "docs" schema type for that value. If the value is not recognized, or
-# if the source schema does not match the given value, `nil` is returned.
-#
-# Otherwise, the most precise "docs" schema type for the given value is returned.
-def get_docs_type_for_value(schema, value)
-  # If there's no schema to check against, or there is but it has no type field, that means we're
-  # dealing with something like a complex, overlapping `oneOf` subschema, where we couldn't
-  # declaratively figure out the right field to dig into if we were discerning an integer/number
-  # value, and so on.
-  #
-  # We just use the detected value type in that case.
-  schema_instance_type = get_json_schema_instance_type(schema) unless schema.nil?
-  if schema.nil? || schema_instance_type.nil?
-    return docs_type_str(value)
-  end
-
-  # If the schema defines a type, see if it matches the value type. If it doesn't, that's a bad sign
-  # and we abort. Otherwise, we fallthrough below to make sure we're handling special cases i.e.
-  # numeric types.
-  value_type = json_type_str(value)
-  if value_type != schema_instance_type
-    @logger.error "Schema instance type and value type are a mismatch, which should not happen."
-    @logger.error "Schema instance type: #{schema_instance_type}"
-    @logger.error "Value: #{value} (type: #{value_type})"
-    exit 1
-  end
-
-  # For any numeric type, extract the value of `docs::numeric_type`, which must always be present in
-  # the schema for numeric fields. If the schema is `nil`, though, then it means we're dealing with
-  # a complex schema (like an overlapping `oneOf` subschema, etc) and we just fallback to the
-  # detected type.
-  if ['number', 'integer'].include?(value_type)
-    numeric_type = get_schema_metadata(schema, 'docs::numeric_type')
-    if numeric_type.nil?
-      @logger.error "All fields with numeric types should have 'docs::numeric_type' metadata included." +
-        "e.g. #[configurable(metadata(docs::numeric_type = \"bytes\"))]"
-      @logger.error "Value: #{value} (type: #{value_type})"
-      exit 1
-    end
-
-    return numeric_type
-  end
-
-  # TODO: The documentation should really just use `boolean` to match JSON Schema, which would let
-  # us get rid of this weird `json_type_str`/`docs_type_str` dichotomy.
-  docs_type_str(value)
-end
-
-# Gets the schema type field for the given value's type.
-#
-# Essentially, as we resolve a schema we end up with a hash that looks like this:
-#
-# { "type" => { "string" => { ... } }
-#
-# When we want to do something like specify a default value, or give example values, we need to set
-# them on the hash that represents the actual property value type. If a schema resolves as a string
-# schema, we can trivially take that default value, calculate its type, and know that we need to set
-# further data under the `string` key in the above example.
-#
-# This gets trickier for numeric types, however, as we encode them more specifically -- unsigned
-# integer, floating-point number, etc -- in the resolved schema... but can only determine (on the
-# Ruby side) if a value is the `number` type. To handle this, for any value of the type `number`, we
-# iteratively try and find a matching type definition in the resolved schema for any of the possible
-# numeric types.
-def get_json_schema_type_field_for_value(source_schema, resolved_schema, value)
-  value_type = get_docs_type_for_value(source_schema, value)
-  resolved_schema.dig('type', value_type)
-end
-
-# Tries to find the schema for an object property nested in the given schema.
-#
-# This function will search through either the properties of the schema itself, if it is an object
-# schema, or the properties of any object subschema that is present in `oneOf`/`allOf`.
-#
-# If no property is found, `nil` is returned.
-def find_nested_object_property_schema(schema, property_name)
-  # See if we're checking an object schema directly.
-  if !schema['properties'].nil?
-    return schema['properties'][property_name]
-  end
-
-  # The schema isn't an object schema, so check to see if it's a `oneOf`/`allOf`, and if so,
-  # recursively visit each of those subschemas, looking for object schemas along the way that we can
-  # check for the given property within.
-  matching_property_schemas = []
-  unvisited_subschemas = schema['oneOf'].dup || schema['anyOf'].dup|| schema['allOf'].dup || []
-  while !unvisited_subschemas.empty? do
-    unvisited_subschema = unvisited_subschemas.pop
-
-    # If the subschema has object properties, it won't be `oneOf`/`allOf`, so just try and grab the
-    # property if it exists, and move on.
-    if !unvisited_subschema['properties'].nil?
-      subschema_property = unvisited_subschema.dig('properties', property_name)
-      matching_property_schemas.push(subschema_property) unless subschema_property.nil?
-      next
-    end
-
-    # If the subschema had no object properties, see if it's an `oneOf`/`allOf` subschema, and if
-    # so, collect any of _those_ subschemas and add them to our list of subschemas to visit.
-    maybe_unvisited_subschemas = unvisited_subschema['oneOf'].dup || unvisited_subschema['anyOf'].dup || unvisited_subschema['allOf'].dup || []
-    unvisited_subschemas.concat(maybe_unvisited_subschemas) unless maybe_unvisited_subschemas.nil?
-  end
-
-  # Compare all matching property schemas to each other -- in their reduced form -- to see if they're
-  # identical. If they're not, or there were no matches, return `nil`.
-  #
-  # Otherwise, return the first matching property schema.
-  reduced_matching_property_schemas = matching_property_schemas.map { |schema| get_reduced_schema(schema) }
-  matching_property_schemas[0] unless reduced_matching_property_schemas.uniq.count != 1
-end
-
-def get_schema_metadata(schema, key)
-  schema.dig('_metadata', key)
-end
-
-def get_schema_ref(schema)
-  schema['$ref']
-end
-
-# Gets the schema type for the given schema.
-def get_json_schema_type(schema)
-  if schema.key?('allOf')
-    'all-of'
-  elsif schema.key?('oneOf')
-    'one-of'
-  elsif schema.key?('anyOf')
-    'any-of'
-  elsif schema.key?('type')
-    get_json_schema_instance_type(schema)
-  elsif schema.key?('const')
-    'const'
-  elsif schema.key?('enum')
-    'enum'
-  end
-end
-
-def get_json_schema_instance_type(schema)
-  maybe_type = schema['type']
-
-  # We don't deal with null instance types at all in the documentation generation phase.
-  if maybe_type == 'null'
-    return nil
-  end
-
-  # If the schema specifies multiple instance types, see if `null` is one of them, and if so,
-  # remove it. After that, if only one value is left, return that value directly rather than
-  # wrapped in an array.
-  #
-  # Otherwise, return the original array.
-  if maybe_type.is_a?(Array)
-    filtered = maybe_type.reject { |instance_type| instance_type == "null" }
-    if filtered.length == 1
-      return filtered[0]
-    end
-  end
-
-  maybe_type
-end
-
-# Fixes grouped enums by adjusting the schema type where necessary.
-#
-# For "grouped enums", these represent the sum of all possible enum values in an `enum` schema being
-# grouped by their JSON type. For example, a set of enums such as `[0, 1, 2, true, false]` would be
-# grouped as:
-#
-# { "bool": [true, false], "number": [0, 1, 2] }
-#
-# This is technically correct, but in the documentation output, that `number` key needs to be `uint`
-# or `int` or what have you. Since `enum` schemas don't carry the "numeric type" information, we try
-# and figure that out here.
-#
-# If we find a `number` group, we check all of its values to see if they fit neatly within the
-# bounds of any of the possible numeric types `int`, `uint`, or `float`. We try and coalesce
-# towards `uint` as it's by far the most common numeric type in Vector configuration, but after
-# that, we aim for `int`, unless the values are too large, in which case we'll shift up to `float`.
-def fix_grouped_enums_if_numeric!(grouped_enums)
-  ['integer', 'number'].each { |type_name|
-    number_group = grouped_enums.delete(type_name)
-    if !number_group.nil?
-      is_integer = number_group.all? { |n| n.is_a?(Integer) }
-      within_uint = number_group.all? { |n| n >= 0 && n <= 2 ** 64 }
-      within_int = number_group.all? { |n| n >= -(2 ** 63) && n <= (2 ** 63) - 1 }
-
-      # If the values themselves are not all integers, or they are but not all of them can fit within
-      # a normal 64-bit signed/unsigned integer, then we use `float` as it's the only other type that
-      # could reasonably satisfy the constraints.
-      numeric_type = if !is_integer || (!within_int && !within_uint)
-        'float'
-      else
-        if within_uint
-          'uint'
-        elsif within_int
-          'int'
-        else
-          # This should never actually happen, _but_, technically Ruby integers could be a "BigNum"
-          # aka arbitrary-precision integer, so this protects us if somehow we get a value that is an
-          # integer but doesn't actually fit neatly into 64 bits.
-          'float'
-        end
-      end
-
-      grouped_enums[numeric_type] = number_group
-    end
-  }
-end
-
-# Gets a schema definition from the root schema, by name.
-def get_schema_by_name(root_schema, schema_name)
-  schema_name = schema_name.gsub(%r{#/definitions/}, '')
-  schema_def = root_schema.dig('definitions', schema_name)
-  if schema_def.nil?
-    @logger.error "Could not find schema definition '#{schema_name}' in given schema."
-    exit 1
-  end
-
-  schema_def
-end
-
-# Gets the dereferenced version of this schema.
-#
-# If the schema has no schema reference, `nil` is returned.
-def dereferenced_schema(schema)
-  schema_name = get_schema_ref(schema)
-  if !schema_ref.nil?
-    get_schema_by_name(root_schema, schema_name)
-  end
-end
-
-# Applies various fields to an object property.
-#
-# This includes items such as any default value that is present, or whether or not the property is
-# required.
-def apply_object_property_fields!(parent_schema, property_schema, property_name, property)
-  @logger.debug "Applying object property fields for '#{property_name}'..."
-
-  required_properties = parent_schema['required'] || []
-  has_self_default_value = !property_schema['default'].nil?
-  has_parent_default_value = !parent_schema.dig('default', property_name).nil?
-  has_default_value = has_self_default_value || has_parent_default_value
-  is_required = required_properties.include?(property_name)
-
-  if has_self_default_value
-    @logger.debug "Property has self-defined default value: #{property_schema['default']}"
-  end
-
-  if has_parent_default_value
-    @logger.debug "Property has parent-defined default value: #{parent_schema.dig('default', property_name)}"
-  end
-
-  if is_required
-    @logger.debug "Property is marked as required."
-  end
-
-  # Set whether or not this property is required.
-  property['required'] = required_properties.include?(property_name) && !has_default_value
-end
-
-# Expands any schema references in the given schema.
-#
-# If the schema contains a top-level schema reference, or if any of the parts of its schema contain
-# schema references (array items schema, any subschemas in `oneOf`/`allOf`, etc), then those
-# references are expanded. Expansion happens recursively until all schema references
-#
-# For any overlapping fields in the given schema and the referenced schema, the fields from the
-# given schema will win.
-def expand_schema_references(root_schema, unexpanded_schema)
-  schema = deep_copy(unexpanded_schema)
-
-  # Grab the existing title/description from our unexpanded schema, and reset them after
-  # merging. This avoids us adding a title where there was only a description, and so on, since
-  # we have special handling rules around titles vs descriptions.
-  #
-  # TODO: If we ever just get rid of the title/description dichotomy, we could clean up this
-  # logic.
-  original_title = unexpanded_schema['title']
-  original_description = unexpanded_schema['description']
-
-  # If the schema has a top level reference, we expand it.
-  schema_ref = schema['$ref']
-  if !schema_ref.nil?
-    expanded_schema_ref = get_cached_expanded_schema(schema_ref)
-    if expanded_schema_ref.nil?
-      @logger.debug "Expanding top-level schema ref of '#{schema_ref}'..."
-
-      unexpanded_schema_ref = get_schema_by_name(root_schema, schema_ref)
-      expanded_schema_ref = expand_schema_references(root_schema, unexpanded_schema_ref)
-
-      @expanded_schema_cache[schema_ref] = expanded_schema_ref
-    end
-
-    schema.delete('$ref')
-    schema = nested_merge(expanded_schema_ref, schema)
-  end
-
-  # If the schema is an array type and has a reference for its items, we expand that.
-  items_ref = schema.dig('items', '$ref')
-  if !items_ref.nil?
-    expanded_items_schema_ref = expand_schema_references(root_schema, schema['items'])
-
-    schema['items'].delete('$ref')
-    schema['items'] = nested_merge(expanded_items_schema_ref, schema['items'])
-  end
-
-  # If the schema has any object properties, we expand those.
-  if !schema['properties'].nil?
-    schema['properties'] = schema['properties'].transform_values { |property_schema|
-      new_property_schema = expand_schema_references(root_schema, property_schema)
-      new_property_schema
-    }
-  end
-
-  # If the schema has any `allOf`/`oneOf` subschemas, we expand those, too.
-  if !schema['allOf'].nil?
-    schema['allOf'] = schema['allOf'].map { |subschema|
-      new_subschema = expand_schema_references(root_schema, subschema)
-      new_subschema
-    }
-  end
-
-  if !schema['oneOf'].nil?
-    schema['oneOf'] = schema['oneOf'].map { |subschema|
-      new_subschema = expand_schema_references(root_schema, subschema)
-      new_subschema
-    }
-  end
-
-  if !schema['anyOf'].nil?
-    schema['anyOf'] = schema['anyOf'].map { |subschema|
-      new_subschema = expand_schema_references(root_schema, subschema)
-      new_subschema
-    }
-  end
-
-  # If the original schema had either a title or description, we forcefully reset both of them back
-  # to their original state, either in terms of their value or them not existing as fields.
-  #
-  # If neither were present, we allow the merged in title/description, if any, to persist, as this
-  # maintains the "#[configurable(derived)]" behavior of titles/descriptions for struct fields.
-  if !original_title.nil? || !original_description.nil?
-    if !original_title.nil?
-      schema['title'] = original_title
-    else
-      schema.delete('title')
-    end
-
-    if
-      schema['description'] = original_description
-    else
-      schema.delete('description')
-    end
-  end
-
-  schema
-end
-
-# Gets a reduced version of a schema.
-#
-# The reduced version strips out extraneous fields from the given schema, such that a value should
-# be returned that is suitable for comparison with other schemas, to determine if the schemas --
-# specifically the values that are allowed/valid -- are the same, while ignoring things like titles
-# and descriptions.
-def get_reduced_schema(schema)
-  schema = deep_copy(schema)
-
-  allowed_properties = ['type', 'const', 'enum', 'allOf', 'oneOf', '$ref', 'items', 'properties']
-  schema.delete_if { |key, _value| !allowed_properties.include?(key) }
-
-  if schema.key?('items')
-    schema['items'] = get_reduced_schema(schema['items'])
-  end
-
-  if schema.key?('properties')
-    schema['properties'] = schema['properties'].transform_values { |property_schema| get_reduced_schema(property_schema) }
-  end
-
-  if schema.key?('allOf')
-    schema['allOf'] = schema['allOf'].map { |subschema| get_reduced_schema(subschema) }
-  end
-
-  if schema.key?('oneOf')
-    schema['oneOf'] = schema['oneOf'].map { |subschema| get_reduced_schema(subschema) }
-  end
-
-  schema
-end
-
-# Gets a reduced version of a resolved schema.
-#
-# This is similar in purpose to `get_reduced_schema` but only cares about fields relevant to a
-# resolved schema.
-def get_reduced_resolved_schema(schema)
-  schema = deep_copy(schema)
-
-  allowed_types = ['condition', 'object', 'array', 'enum', 'const', 'string', 'bool', 'float', 'int', 'uint']
-  allowed_fields = []
-
-  # Clear out anything not related to the type definitions first.
-  schema.delete_if { |key, _value| key != 'type' }
-  type_defs = schema['type']
-  if !type_defs.nil?
-    type_defs.delete_if { |key, _value| !allowed_types.include?(key) }
-    schema['type'].each { |type_name, type_def|
-      case type_name
-      when "object"
-        type_def.delete_if { |key, _value| key != 'options' }
-        type_def['options'].transform_values! { |property|
-          get_reduced_resolved_schema(property)
-        }
-      when "array"
-        type_def.delete_if { |key, _value| key != 'items' }
-        type_def['items'] = get_reduced_resolved_schema(type_def['items'])
-      else
-        type_def.delete_if { |key, _value| !allowed_types.include?(key) }
-      end
-    }
-  end
-
-  schema
-end
-
-# Fully resolves a schema definition, if it exists.
-#
-# This looks up a schema definition by the given `name` within `root_schema` and resolves it.
-# If no schema definition exists for the given name, `nil` is returned. Otherwise, the schema
-# definition is preprocessed (collapsing schema references, etc), and then resolved. Both the
-# "source" schema (preprocessed value) and the resolved schema are returned.
-#
-# Resolved schemas are cached.
-#
-# See `resolve_schema` for more details.
-def resolve_schema_by_name(root_schema, schema_name)
-  # If it's already cached, use that.
-  resolved = get_cached_resolved_schema(schema_name)
-  return deep_copy(resolved) unless resolved.nil?
-
-  # It wasn't already cached, so we actually have to resolve it.
-  schema = get_schema_by_name(root_schema, schema_name)
-  resolved = resolve_schema(root_schema, schema)
-  @resolved_schema_cache[schema_name] = resolved
-  deep_copy(resolved)
-end
-
-# Fully resolves the schema.
-#
-# This recursively resolves schema references, as well as flattening them into a single object, and
-# transforming certain usages -- composite/enum (`allOf`, `oneOf`), etc -- into more human-readable
-# forms.
-def resolve_schema(root_schema, schema)
-  # If the schema we've been given if a schema reference, we expand that first. This happens
-  # recursively, such that the resulting expanded schema has no schema references left. We need this
-  # because in further steps, we need the access to the full input schema that was used to generate
-  # the resolved schema.
-  schema = expand_schema_references(root_schema, schema)
-
-  # Skip any schema that is marked as hidden.
-  #
-  # While this is already sort of obvious, one non-obvious usage is for certain types that we
-  # manually merge after this script runs, such as the high-level "outer" (`SinkOuter`, etc) types.
-  # Those types include a field that uses the Big Enum -- an enum with all possible components of
-  # that type -- which, if we resolved it here, would spit out a ton of nonsense.
-  #
-  # We mark that field hidden so that it's excluded when we resolve the schema for `SinkOuter`, etc,
-  # and then we individually resolve the component schemas, and merge the two (outer + component
-  # itself) schemas back together.
-  if get_schema_metadata(schema, 'docs::hidden')
-    @logger.debug 'Instructed to skip resolution for the given schema.'
-    return
-  end
-
-  # Handle schemas that have type overrides.
-  #
-  # In order to better represent specific field types in the documentation, we may opt to use a
-  # special type definition name, separate from the classic types like "bool" or "string" or
-  # "object", and so on, in order to let the documentation generation process inject more
-  # full-fledged output than we can curry from the Rust side, across the configuration schema.
-  #
-  # We intentially set no actual definition for these types, relying on the documentation generation
-  # process to provide the actual details. We only need to specify the custom type name.
-  #
-  # To handle u8 types as ascii characters and not there uint representation between 0 and 255 we
-  # added a special handling of these exact values. This means
-  # `#[configurable(metadata(docs::type_override = "ascii_char"))]` should only be used consciously
-  # for rust u8 type. See lib/codecs/src/encoding/format/csv.rs for an example and
-  # https://github.com/vectordotdev/vector/pull/20498
-  type_override = get_schema_metadata(schema, 'docs::type_override')
-  if !type_override.nil?
-    if type_override == 'ascii_char'
-      if !schema['default'].nil?
-        resolved = { 'type' => { type_override.to_s => { 'default' => schema['default'].chr } } }
-      else
-        resolved = { 'type' => { type_override.to_s => { } } }
-      end
-    else
-      resolved = { 'type' => { type_override.to_s => {} } }
-    end
-    description = get_rendered_description_from_schema(schema)
-    resolved['description'] = description unless description.empty?
-    return resolved
-  end
-
-  # Now that the schema is fully expanded and it didn't need special handling, we'll go ahead and
-  # fully resolve it.
-  resolved = resolve_bare_schema(root_schema, schema)
-  if resolved.nil?
-    return
-  end
-
-  # If this is an array schema, remove the description from the schema used for the items, as we
-  # want the description for the overall property, using this array schema, to describe everything.
-  items_schema = resolved.dig('type', 'array', 'items')
-  if !items_schema.nil?
-    items_schema.delete('description')
-  end
-
-  # Apply any necessary defaults, descriptions, etc, to the resolved schema. This must happen here
-  # because there could be callsite-specific overrides to defaults, descriptions, etc, for a given
-  # schema definition that have to be layered.
-  apply_schema_default_value!(schema, resolved)
-  apply_schema_metadata!(schema, resolved)
-
-  description = get_rendered_description_from_schema(schema)
-  resolved['description'] = description unless description.empty?
-
-  ## Resolve the deprecated flag. An optional deprecated message can also be set in the metadata.
-  if schema.fetch('deprecated', false)
-    resolved['deprecated'] = true
-    message = get_schema_metadata(schema, 'deprecated_message')
-    if message
-      resolved['deprecated_message'] = message
-    end
-  end
-
-  # required for global option configuration
-  is_common_field = get_schema_metadata(schema, 'docs::common')
-  if !is_common_field.nil?
-    resolved['common'] = is_common_field
-  end
-
-  is_required_field = get_schema_metadata(schema, 'docs::required')
-  if !is_required_field.nil?
-    resolved['required'] = is_required_field
-  end
-
-  # Resolve any warnings attached to this option.
-  #
-  # Warnings can be specified in Rust via `#[configurable(metadata(docs::warnings = "..."))]`.
-  # Multiple warnings can be specified by repeating the attribute, and they will be emitted as an
-  # array in the CUE output.
-  warnings = get_schema_metadata(schema, 'docs::warnings')
-  if !warnings.nil?
-    resolved['warnings'] = warnings.is_a?(Array) ? warnings : [warnings]
-  end
-
-  # Reconcile the resolve schema, which essentially gives us a chance to, once the schema is
-  # entirely resolved, check it for logical inconsistencies, fix up anything that we reasonably can,
-  # and so on.
-  reconcile_resolved_schema!(resolved)
-
-  resolved
-end
-
-# Fully resolves a bare schema.
-#
-# A bare schema is one that has no references to another schema, etc.
-def resolve_bare_schema(root_schema, schema)
-  resolved = case get_json_schema_type(schema)
-    when 'all-of'
-      @logger.debug 'Resolving composite schema.'
-
-      # Composite schemas are indeed the sum of all of their parts, so resolve each subschema and
-      # merge their resolved state together.
-      reduced = schema['allOf'].filter_map { |subschema| resolve_schema(root_schema, subschema) }
-                              .reduce { |acc, item| nested_merge(acc, item) }
-      reduced['type']
-    when 'one-of', 'any-of'
-      @logger.debug 'Resolving enum schema.'
-
-      # We completely defer resolution of enum schemas to `resolve_enum_schema` because there's a
-      # lot of tricks and matching we need to do to suss out patterns that can be represented in more
-      # condensed resolved forms.
-      wrapped = resolve_enum_schema(root_schema, schema)
-
-      # `resolve_enum_schema` always hands back the resolved schema under the key `_resolved`, so
-      # that we can add extra details about the resolved schema (anything that will help us render
-      # it better in the docs output) on the side. That's why we have to unwrap the resolved schema
-      # like this.
-
-      # TODO: Do something with the extra detail (`annotations`).
-
-      wrapped.dig('_resolved', 'type')
-    when 'array'
-      @logger.debug 'Resolving array schema.'
-
-      { 'array' => { 'items' => resolve_schema(root_schema, schema['items']) } }
-    when 'object'
-      @logger.debug 'Resolving object schema.'
-
-      # TODO: Not all objects have an actual set of properties, such as anything using
-      # `additionalProperties` to allow for arbitrary key/values to be set, which is why we're
-      # handling the case of nothing in `properties`... but we probably want to be able to better
-      # handle expressing this in the output.. or maybe it doesn't matter, dunno!
-      properties = schema['properties'] || {}
-
-      options = properties.filter_map do |property_name, property_schema|
-        @logger.debug "Resolving object property '#{property_name}'..."
-        resolved_property = resolve_schema(root_schema, property_schema)
-        if !resolved_property.nil?
-          apply_object_property_fields!(schema, property_schema, property_name, resolved_property)
-
-          @logger.debug "Resolved object property '#{property_name}'."
-
-          [property_name, resolved_property]
-        else
-          @logger.debug "Resolution failed for '#{property_name}'."
-
-          nil
-        end
-      end
-
-      # If the object schema has `additionalProperties` set, we add an additional field
-      # (`*`) which uses the specified schema for that field.
-      additional_properties = schema['additionalProperties']
-      if !additional_properties.nil?
-        @logger.debug "Handling additional properties."
-
-        # Normally, we only get here if there's a hashmap field on a struct that can act as the
-        # catch-all for additional properties. That field, by definition, will be required to have a
-        # description, and maybe will have a title.
-        #
-        # That title/description makes sense for the field itself, but when we generate this new
-        # wildcard property, we generally want to have something short and simple, in the singular
-        # form. For example, if we have a field called "labels", the title/description might talk
-        # about what the labels are used for, any special requirements, and so on... and then for
-        # the wildcard property, we might want to have the description read as "A foobar label."
-        # just to make the UI look nice.
-        #
-        # Rather than try and derive this from the title/description on the field, we'll require
-        # such a description to be provided on the Rust side via the metadata attribute shown below.
-        singular_description = get_schema_metadata(schema, 'docs::additional_props_description')
-        if singular_description.nil?
-          @logger.error "Missing 'docs::additional_props_description' metadata for a wildcard field.\n\n" \
-          "For map fields (`HashMap<...>`, etc), a description (in the singular form) must be provided by via `#[configurable(metadata(docs::additional_props_description = \"Description of the field.\"))]`.\n\n" \
-          "The description on the field, derived from the code comments, is shown specifically for `field`, while the description provided via `docs::additional_props_description` is shown for the special `field.*` entry that denotes that the field is actually a map."
-
-          @logger.error "Relevant schema: #{JSON.pretty_generate(schema)}"
-          exit 1
-        end
-
-        resolved_additional_properties = resolve_schema(root_schema, additional_properties)
-        resolved_additional_properties['required'] = true
-        resolved_additional_properties['description'] = singular_description
-        options.push(['*', resolved_additional_properties])
-      end
-
-      { 'object' => { 'options' => options.to_h } }
-    when 'string'
-      @logger.debug 'Resolving string schema.'
-
-      string_def = {}
-      string_def['default'] = schema['default'] unless schema['default'].nil?
-
-      { 'string' => string_def }
-    when 'number', 'integer'
-      @logger.debug 'Resolving number schema.'
-
-      numeric_type = get_schema_metadata(schema, 'docs::numeric_type') || 'number'
-      number_def = {}
-      number_def['default'] = schema['default'] unless schema['default'].nil?
-
-      @logger.debug 'Resolved number schema.'
-
-      { numeric_type => number_def }
-    when 'boolean'
-      @logger.debug 'Resolving boolean schema.'
-
-      bool_def = {}
-      bool_def['default'] = schema['default'] unless schema['default'].nil?
-
-      { 'bool' => bool_def }
-    when 'const'
-      @logger.debug 'Resolving const schema.'
-
-      # For `const` schemas, just figure out the type of the constant value so we can generate the
-      # resolved output.
-      const_type = get_docs_type_for_value(schema, schema['const'])
-      const_value = { 'value' => schema['const'] }
-      const_description = get_rendered_description_from_schema(schema)
-      const_value['description'] = const_description unless const_description.nil?
-      { const_type => { 'const' => const_value } }
-    when 'enum'
-      @logger.debug 'Resolving enum const schema.'
-
-      # Similarly to `const` schemas, `enum` schemas are merely multiple possible constant values. Given
-      # that JSON Schema does allow for the constant values to differ in type, we group them all by
-      # type to get the resolved output.
-      enum_values = schema['enum']
-      grouped = enum_values.group_by { |value| docs_type_str(value) }
-      fix_grouped_enums_if_numeric!(grouped)
-      grouped.transform_values! { |values| { 'enum' => values } }
-      grouped
-    when nil
-      # Unconstrained/empty schema (e.g., Value without constraints).
-      # Represent it as accepting any JSON type so downstream code can render it
-      # and attach defaults/examples based on actual values.
-      @logger.debug 'Resolving unconstrained schema (any type).'
-
-      { '*' => {} }
-    else
-      @logger.error "Failed to resolve the schema. Schema: #{schema}"
-      exit 1
-    end
-
-  { 'type' => resolved }
-end
-
-def resolve_enum_schema(root_schema, schema)
-  # Figure out if this is a one-of or any-of enum schema. Both at the same time is never correct.
-  subschemas = if schema.key?('oneOf')
-    schema['oneOf']
-  elsif schema.key?('anyOf')
-    schema['anyOf']
-  else
-    @logger.error "Enum schema had both `oneOf` and `anyOf` specified. Schema: #{schema}"
-    exit 1
-  end
-
-  # Filter out all subschemas which are purely null schemas used for indicating optionality, as well
-  # as any subschemas that are marked as being hidden.
-  is_optional = get_schema_metadata(schema, 'docs::optional')
-  subschemas = subschemas
-    .reject { |subschema| subschema['type'] == 'null' }
-    .reject { |subschema| get_schema_metadata(subschema, 'docs::hidden') }
-  subschema_count = subschemas.count
-
-  # If we only have one subschema after filtering, check to see if it's an `allOf` or `oneOf` schema
-  # and `is_optional` is true.
-  #
-  # If it's an `allOf` subschema, then that means we originally had an `allOf` schema that we had to
-  # make optional, thus converting it to a `oneOf` with subschemas in the shape of `[null, allOf]`.
-  # In this case, we'll just remove the `oneOf` and move the `allOf` subschema up, as if it this
-  # schema was a `allOf` one all along.
-  #
-  # If so, we unwrap it such that we end up with a copy of `schema` that looks like it was an
-  # `allOf` schema all along. We do this to properly resolve `allOf` schemas that were wrapped as
-  # `oneOf` w/ a null schema in order to establish optionality.
-  if is_optional && subschema_count == 1
-    if get_json_schema_type(subschemas[0]) == 'all-of'
-      @logger.debug "Detected optional all-of schema, unwrapping all-of schema to resolve..."
-
-      # Copy the current schema and drop `oneOf` and set `allOf` with the subschema, which will get us the correct
-      # unwrapped structure.
-      unwrapped_schema = deep_copy(schema)
-      unwrapped_schema.delete('oneOf')
-      unwrapped_schema['allOf'] = deep_copy(subschemas[0]['allOf'])
-
-      return { '_resolved' => resolve_schema(root_schema, unwrapped_schema) }
-    else
-      # For all other subschema types, we copy the current schema, drop the `oneOf`, and merge the
-      # subschema into it. This essentially unnests the schema.
-      unwrapped_schema = deep_copy(schema)
-      unwrapped_schema.delete('oneOf')
-      unwrapped_schema = schema_aware_nested_merge(unwrapped_schema, subschemas[0])
-
-      return { '_resolved' => resolve_schema(root_schema, unwrapped_schema) }
-    end
-  end
-
-  # Collect all of the tagging mode information upfront.
-  enum_tagging = get_schema_metadata(schema, 'docs::enum_tagging')
-  if enum_tagging.nil?
-    @logger.error 'Enum schemas should never be missing the metadata for the enum tagging mode.'
-    @logger.error "Schema: #{JSON.pretty_generate(schema)}"
-    @logger.error "Filter subschemas: #{JSON.pretty_generate(subschemas)}"
-    exit 1
-  end
-
-  enum_tag_field = get_schema_metadata(schema, 'docs::enum_tag_field')
-
-  # Schema pattern: X or array of X.
-  #
-  # We employ this pattern on the Vector side to allow specifying a single instance of X -- object,
-  # string, whatever -- or as an array of X. We just need to inspect both schemas to make sure one
-  # is an array of X and the other is the same as X, or vice versa.
-  if subschema_count == 2
-    array_idx = subschemas.index { |subschema| subschema['type'] == 'array' }
-    unless array_idx.nil?
-      @logger.debug "Detected likely 'X or array of X' enum schema, applying further validation..."
-
-      single_idx = array_idx.zero? ? 1 : 0
-
-      # We 'reduce' the subschemas, which strips out all things that aren't fundamental, which boils
-      # it down to only the shape of what the schema accepts, so no title or description or default
-      # values, and so on.
-      single_reduced_subschema = get_reduced_schema(subschemas[single_idx])
-      array_reduced_subschema = get_reduced_schema(subschemas[array_idx])
-
-      if single_reduced_subschema == array_reduced_subschema['items']
-        @logger.debug 'Reduced schemas match, fully resolving schema for X...'
-
-        # The single subschema and the subschema for the array items are a match! We'll resolve this
-        # as the schema of the "single" option, but with an annotation that it can be specified
-        # multiple times.
-
-        # Copy the subschema, and if the parent schema we're resolving has a default value with a
-        # type that matches the type of the "single" subschema, add it to the copy of that schema.
-        #
-        # It's hard to propagate the default from the configuration schema generation side, but much
-        # easier to do so here.
-        single_subschema = deep_copy(subschemas[single_idx])
-        if get_json_schema_type(single_subschema) == json_type_str(schema['default'])
-          single_subschema['default'] = schema['default']
-        end
-        resolved_subschema = resolve_schema(root_schema, subschemas[single_idx])
-
-        @logger.debug "Resolved as 'X or array of X' enum schema."
-
-        return { '_resolved' => resolved_subschema, 'annotations' => 'single_or_array' }
-      end
-    end
-  end
-
-  # Schema pattern: simple internally tagged enum with named fields.
-  #
-  # This a common pattern where we'll typically have enum variants that have named fields, and we
-  # use an internal tag (looks like a normal field next to the fields of the enum variant itself)
-  # where the tag value is the variant name.
-  #
-  # We want to generate an object schema where we expose the unique sum of all named fields from the
-  # various subschemas, and annotate each resulting unique property with the field value that makes
-  # it relevant. We do require that any overlapping fields between variants be identical, however.
-  #
-  # For example, buffer configuration allows configuring in-memory buffers or disk buffers. When
-  # using in-memory buffers, a property called `max_events` becomes relevant, so we want to be able
-  # to say that the `max_events` field is `relevant_when` the value of `type` (the adjacent tag) is
-  # `memory`. We do this for every property that _isn't_ the adjacent tag, but the adjacent tag
-  # _does_ get included in the resulting properties.
-  if enum_tagging == 'internal'
-    @logger.debug "Resolving enum subschemas to detect 'object'-ness..."
-
-    # This transformation only makes sense when all subschemas are objects, so only resolve the ones
-    # that are objects, and only proceed if all of them were resolved.
-    resolved_subschemas = subschemas.filter_map do |subschema|
-      # TODO: the exact enum variant probably isn't an object? but probabilistic is... gotta handle that
-      resolved = resolve_schema(root_schema, subschema)
-      resolved if resolved_schema_type?(resolved) == 'object'
-    end
-
-    if resolved_subschemas.count == subschemas.count
-      @logger.debug "Detected likely 'internally-tagged with named fields' enum schema, applying further validation..."
-
-      unique_resolved_properties = {}
-      unique_tag_values = {}
-
-      resolved_subschemas.each do |resolved_subschema|
-        @logger.debug "Resolved subschema: #{JSON.dump(resolved_subschema)}"
-        resolved_subschema_properties = resolved_subschema.dig('type', 'object', 'options')
-
-        # Extract the tag property and figure out any necessary intersections, etc.
-        #
-        # Technically, a `const` value in JSON Schema can be an array or object, too... but like, we
-        # only ever use `const` for describing enum variants and what not, so this is my middle-ground
-        # approach to also allow for other constant-y types, but not objects/arrays which would
-        # just... not make sense.
-        #
-        # We also steal the title and/or description from the variant subschema and apply it to the
-        # tag's subschema, as we don't curry the title/description for a variant itself to the
-        # respective tag field used to indicate which variant is specified.
-        tag_subschema = resolved_subschema_properties.delete(enum_tag_field)
-        tag_subschema['title'] = resolved_subschema['title'] if !resolved_subschema['title'].nil?
-        tag_subschema['description'] = resolved_subschema['description'] if !resolved_subschema['description'].nil?
-        tag_value = nil
-
-        %w[string number integer boolean].each do |allowed_type|
-          maybe_tag_values = tag_subschema.dig('type', allowed_type, 'enum')
-          maybe_tag_value = maybe_tag_values.keys.first unless maybe_tag_values.nil?
-          unless maybe_tag_value.nil?
-            tag_value = maybe_tag_value
-            break
-          end
-        end
-
-        @logger.debug "Tag value of #{tag_value}, with original resolved schema: #{resolved_subschema}"
-
-        if tag_value.nil?
-          @logger.error 'All enum subschemas representing an internally-tagged enum must have the tag field use a const value.'
-          @logger.error "Tag subschema: #{tag_subschema}"
-          exit 1
-        end
-
-        if unique_tag_values.key?(tag_value)
-          @logger.error "Found duplicate tag value '#{tag_value}' when resolving enum subschemas."
-          exit 1
-        end
-
-        unique_tag_values[tag_value] = tag_subschema
-
-        # Now merge all of the properties from the given subschema, so long as the overlapping
-        # properties have the same schema.
-        resolved_subschema_properties.each do |property_name, property_schema|
-          existing_property = unique_resolved_properties[property_name]
-          resolved_property = if !existing_property.nil?
-            # The property is already being tracked, so just do a check to make sure the property from our
-            # current subschema matches the existing property, schema-wise, before we update it.
-            reduced_existing_property = get_reduced_resolved_schema(existing_property)
-            reduced_new_property = get_reduced_resolved_schema(property_schema)
-
-            if reduced_existing_property != reduced_new_property
-              @logger.error "Had overlapping property '#{property_name}' from resolved enum subschema, but schemas differed:"
-              @logger.error "Existing property schema (reduced): #{to_pretty_json(reduced_existing_property)}"
-              @logger.error "New property schema (reduced): #{to_pretty_json(reduced_new_property)}"
-              exit 1
-            end
-
-            @logger.debug "Adding relevant tag to existing resolved property schema for '#{property_name}'."
-
-            # The schemas match, so just update the list of "relevant when" values.
-            existing_property['relevant_when'].push(tag_value)
-            existing_property
-          else
-            @logger.debug "First time seeing resolved property schema for '#{property_name}'."
-
-            # First time seeing this particular property.
-            property_schema['relevant_when'] = [tag_value]
-            property_schema
-          end
-
-          unique_resolved_properties[property_name] = resolved_property
-          @logger.debug "Set unique resolved property '#{property_name}' to resolved schema: #{resolved_property}"
-        end
-      end
-
-      # Now that we've gone through all of the non-tag field, possibly overlapped properties, go
-      # through and modify the properties so that we only keep the "relevant when" values if the
-      # list of those values does not match the full set of unique tag values. We don't want to show
-      # "relevant when" for fields that all variants share, basically.
-      unique_tags = unique_tag_values.keys
-
-      unique_resolved_properties.transform_values! do |value|
-        # We check if a given property is relevant to all tag values by getting an intersection
-        # between `relevant_when` and the list of unique tag values, as well as asserting that the
-        # list lengths are identical.
-        relevant_when = value['relevant_when']
-        if relevant_when.length == unique_tags.length && relevant_when & unique_tags == unique_tags
-          value.delete('relevant_when')
-        end
-
-        # Add enough information from consumers to figure out _which_ field needs to have the given
-        # "relevant when" value.
-        if value.key?('relevant_when')
-          value['relevant_when'] = value['relevant_when'].map do |value|
-            "#{enum_tag_field} = #{JSON.dump(value)}"
-          end.to_a.join(' or ')
-        end
-
-        value
-      end
-
-      # Now we build our property for the tag field itself, and add that in before returning all of
-      # the unique resolved properties.
-      enum_values = unique_tag_values.transform_values do |tag_schema|
-        @logger.debug "Tag schema: #{tag_schema}"
-        get_rendered_description_from_schema(tag_schema)
-      end
-
-      @logger.debug "Resolved enum values for tag property: #{enum_values}"
-      resolved_tag_property = {
-        'required' => true,
-        'type' => {
-          'string' => {
-            'enum' => enum_values
-          }
-        }
-      }
-
-      tag_description = get_schema_metadata(schema, 'docs::enum_tag_description')
-      if tag_description.nil?
-        @logger.error "A unique tag description must be specified for enums which are internally tagged (i.e. `#[serde(tag = \"...\")/`). This can be specified via `#[configurable(metadata(docs::enum_tag_description = \"...\"))]`."
-        @logger.error "Schema being generated: #{JSON.pretty_generate(schema)}"
-        exit 1
-      end
-      resolved_tag_property['description'] = tag_description
-      unique_resolved_properties[enum_tag_field] = resolved_tag_property
-
-      @logger.debug "Resolved as 'internally-tagged with named fields' enum schema."
-      @logger.debug "Resolved properties for ITNF enum schema: #{unique_resolved_properties}"
-
-      return { '_resolved' => { 'type' => { 'object' => { 'options' => unique_resolved_properties } } } }
-    end
-  end
-
-  # Schema pattern: simple externally tagged enum with only unit variants.
-  #
-  # This a common pattern where basic enums that only have unit variants -- i.e. `enum { A, B, C }`
-  # -- end up being represented by a bunch of subschemas that are purely `const` values.
-  if enum_tagging == 'external'
-    tag_values = {}
-
-    subschemas.each do |subschema|
-      # For each subschema, try and grab the value of the `const` property and use it as the key for
-      # storing this subschema.
-      #
-      # We take advantage of missing key index gets returning `nil` by checking below to make sure
-      # none of the keys are nil. If any of them _are_ nill, then we know not all variants had a
-      # `const` schema.
-      tag_values[subschema['const']] = subschema
-    end
-
-    if tag_values.keys.all? { |tag| !tag.nil? && tag.is_a?(String) }
-      @logger.debug "Resolved as 'externally-tagged with only unit variants' enum schema."
-
-      return { '_resolved' => { 'type' => { 'string' => {
-        'enum' => tag_values.transform_values { |tag_schema| get_rendered_description_from_schema(tag_schema) }
-      } } } }
-    end
-  end
-
-  # Schema pattern: untagged enum with narrowing constant variants and catch-all free-form variant.
-  #
-  # This a common pattern where an enum might represent a particular single value type, say a
-  # string, and it contains multiple variants where one is a "dynamic" variant and the others are
-  # "fixed", such that the dynamic variant can represent all possible string values _except_ for the
-  # string values defined by each fixed variant.
-  #
-  # An example of this is the `TimeZone` enum, where there is one variant `Local`, represented by
-  # `"local"`, and the other variant `Named` can represent any other possible timezone.
-  if enum_tagging == 'untagged'
-    type_def_kinds = []
-    fixed_subschemas = 0
-    freeform_subschemas = 0
-
-    subschemas.each do |subschema|
-      @logger.debug "Untagged subschema: #{subschema}"
-      schema_type = get_json_schema_type(subschema)
-      case schema_type
-      when nil, "all-of", "one-of"
-        # We don't handle these cases.
-      when "const"
-        # Track the type definition kind associated with the constant value.
-        type_def_kinds << docs_type_str(subschema['const'])
-        fixed_subschemas = fixed_subschemas + 1
-      when "enum"
-        # Figure out the type definition kind for each enum value and track it.
-        type_def_kinds << subschema['enum'].map { |value| docs_type_str(value) }
-        fixed_subschemas = fixed_subschemas + 1
-      else
-        # Just a regular schema type, so track it.
-        type_def_kinds << schema_type
-        freeform_subschemas = freeform_subschemas + 1
-      end
-    end
-
-    # If there's more than a single type definition in play, then it doesn't qualify.
-    unique_type_def_kinds = type_def_kinds.flatten.uniq
-    if unique_type_def_kinds.length == 1 && fixed_subschemas >= 1 && freeform_subschemas == 1
-      @logger.debug "Resolved as 'untagged with narrowed free-form' enum schema."
-
-      type_def_kind = unique_type_def_kinds[0]
-
-      # TODO: It would be nice to forward along the fixed values so they could be enumerated in the
-      # documentation, and we could have a boilerplate blurb about "these values are fixed/reserved,
-      # but any other value than these can be passed", etc.
-
-      return { '_resolved' => { 'type' => { type_def_kind => {} } }, 'annotations' => 'narrowed_free_form' }
-    end
-  end
-
-  # Schema pattern: simple externally tagged enum with only non-unit variants.
-  #
-  # This pattern represents an enum where the default external tagging mode is used, which leads to
-  # a schema for each variant that looks like it's an object with a single property -- the name of
-  # which is the name of the variant itself -- and the schema of that property representing whatever
-  # the fields are for the variant.
-  #
-  # Contrasted with an externally tagged enum with only unit variants, this type of enum is treated
-  # like an object itself, where each possible variant is its own property, with whatever the
-  # resulting subschema for that variant may be.
-  if enum_tagging == 'external'
-    # With external tagging, and non-unit variants, each variant must be represented as an object schema.
-    if subschemas.all? { |subschema| get_json_schema_type(subschema) == "object" }
-      # Generate our overall object schema, where each variant is a property on this schema. The
-      # schema of that property should be the schema for the variant's tagging field. For example,
-      # a variant called `Foo` will have an object schema with a single, required field `foo`. We
-      # take the schema of that property `foo`, and set it as the schema for property `foo` on our
-      # new aggregated object schema.
-      #
-      # Additionally, since this is a "one of" schema, we can't make any of the properties on the
-      # aggregated object schema be required, since the whole point is that they're deserialized
-      # opportunistically.
-      aggregated_properties = {}
-
-      subschemas.each { |subschema|
-        resolved_subschema = resolve_schema(root_schema, subschema)
-
-        @logger.debug "ETNUV original subschema: #{subschema}"
-        @logger.debug "ETNUV resolved subschema: #{resolved_subschema}"
-
-        resolved_properties = resolved_subschema.dig('type', 'object', 'options')
-        if resolved_properties.nil? || resolved_properties.keys.length != 1
-          @logger.error "Encountered externally tagged enum schema with non-unit variants where the resulting \
-          resolved schema for a given variant had more than one property!"
-          @logger.error "Original variant subschema: #{subschema}"
-          @logger.error "Resolved variant subschema: #{resolved_subschema}"
-        end
-
-        # Generate a description from the overall subschema and apply it to the properly itself. We
-        # do this since it would be lost otherwise.
-        description = get_rendered_description_from_schema(subschema)
-        resolved_properties.each { |property_name, property_schema|
-          property_schema['description'] = description unless description.empty?
-          aggregated_properties[property_name] = property_schema
-        }
-      }
-
-      @logger.debug "Resolved as 'externally-tagged with only non-unit variants' enum schema."
-
-      return { '_resolved' => { 'type' => { 'object' => { 'options' => aggregated_properties } } } }
-    end
-  end
-
-  # Fallback schema pattern: mixed-mode enums.
-  #
-  # These are enums that can basically be some combination of possible values: `Concurrency` is the
-  # canonical example as it can be set via `"none"`, `"adaptive"`, or an integer between 1 and...
-  # 2^64 or something like that. None of the subschemas overlap in any way.
-  #
-  # We just end up emitting a composite type output to cover each possibility, so the above would
-  # have the `string` type with an `enum` of `"none"` and `"adaptive"`, and the uint type for the
-  # integer side. This code mostly assumes the upstream schema is itself correct, in terms of not
-  # providing a schema that is too ambiguous to properly validate against an input document.
-  @logger.debug "Resolved as 'fallback mixed-mode' enum schema."
-
-  @logger.debug "Tagging mode: #{enum_tagging}"
-  @logger.debug "Input subschemas: #{subschemas}"
-
-  resolved_subschemas = subschemas.filter_map { |subschema| resolve_schema(root_schema, subschema) }
-  @logger.debug "Resolved fallback schemas: #{resolved_subschemas}"
-
-  type_defs = resolved_subschemas.reduce { |acc, item| schema_aware_nested_merge(acc, item) }
-
-  @logger.debug "Schema-aware merged result: #{type_defs}"
-
-  { '_resolved' => { 'type' => type_defs['type'] }, 'annotations' => 'mixed_mode' }
-end
-
-def apply_schema_default_value!(source_schema, resolved_schema)
-  @logger.debug "Applying schema default values."
-
-  default_value = source_schema['default']
-  unless default_value.nil?
-    # Make sure that the resolved schema actually has a type definition that matches the type of the
-    # given default value, since anything else would be indicative of a nasty bug in schema
-    # generation.
-    default_value_type = docs_type_str(default_value)
-    resolved_schema_type_field = get_json_schema_type_field_for_value(source_schema, resolved_schema, default_value)
-    if resolved_schema_type_field.nil?
-      @logger.error "Schema has default value declared that does not match type of resolved schema: \
-      \
-      Source schema: #{to_pretty_json(source_schema)} \
-      Default value: #{to_pretty_json(default_value)} (type: #{default_value_type}) \
-      Resolved schema: #{to_pretty_json(resolved_schema)}"
-      exit 1
-    end
-
-    case default_value_type
-    when 'object'
-      # For objects, we set the default values on a per-property basis by trying to extract the
-      # value for each property from the object set as the default value. This is because of how we
-      # generally render documentation for fields that are objects, where we want to show the
-      # default value alongside the field itself, rather than specifying at the top level all of the
-      # default values...
-      #
-      # In other words, instead of this:
-      #
-      #  buffer:
-      #    default value: { type = "memory", max_events = 500 }
-      #
-      #    type:
-      #      ...
-      #    max_events:
-      #      ...
-      #
-      # we want to get this:
-      #
-      #  buffer:
-      #    type:
-      #      default value: "memory"
-      #    max_events:
-      #      default value: 500
-      #
-      resolved_properties = resolved_schema_type_field['options']
-      resolved_properties.each do |property_name, resolved_property|
-        @logger.debug "Trying to apply default value for resolved property '#{property_name}'..."
-        property_default_value = default_value[property_name]
-        if !property_default_value.nil?
-          source_property = find_nested_object_property_schema(source_schema, property_name)
-          if !source_property.nil?
-            # If we found the source schema for the property itself, use that to cleanly apply
-            # default values to the property.
-            source_property_with_default = deep_copy(source_property)
-            source_property_with_default['default'] = property_default_value
-            apply_schema_default_value!(source_property_with_default, resolved_property)
-
-            resolved_property['required'] = false
-          else
-            # We don't have a source for the property itself, presumably because we're dealing with
-            # a complex subschema, so just go based off of the type of the default value itself.
-            property_type_field = get_json_schema_type_field_for_value(source_property, resolved_property, property_default_value)
-            if !property_type_field.nil?
-              property_type_field['default'] = property_default_value
-              resolved_property['required'] = false
-            end
-          end
-        end
-      end
-    else
-      # We're dealing with an array or normal scalar or whatever, so just apply the default directly.
-      resolved_schema_type_field['default'] = default_value
-    end
-
-    @logger.debug "Applied default value(s) to schema."
-  end
-end
-
-def apply_schema_metadata!(source_schema, resolved_schema)
-  # Handle marking string schemas as templateable, which shows a special blurb in the rendered
-  # documentation HTML that explains what this means and links to the template syntax, etc.
-  is_templateable = get_schema_metadata(source_schema, 'docs::templateable') == true
-  string_type_def = resolved_schema.dig('type', 'string')
-  if !string_type_def.nil? && is_templateable
-    @logger.debug "Schema is templateable."
-    string_type_def['syntax'] = 'template'
-  end
-
-  # TODO: Handle the niche case where we have an object schema without any of its own fields -- aka a map
-  # of optional key/value pairs i.e. tags -- and it allows templateable values.
-
-  # Handle adding any defined examples to the type definition.
-  #
-  # TODO: Since a resolved schema could be represented by _multiple_ input types, and we only take
-  # examples in the form of strings, we don't have a great way to discern which type definition
-  # should get the examples applied to it (i.e. for a number-or-enum-of-strings schema, do we
-  # apply the examples to the number type def or the enum type def?) so we simply... apply them to
-  # any type definition present in the resolved schema.
-  #
-  # We might be able to improve this in the future with a simply better heuristic, dunno. This might
-  # also work totally fine as-is!
-  examples = get_schema_metadata(source_schema, 'docs::examples')
-  if !examples.nil?
-    flattened_examples = [examples].flatten.map { |example|
-      if example.is_a?(Hash)
-        sort_hash_nested(example)
-      else
-        example
-      end
-    }
-
-    @logger.debug "Schema has #{flattened_examples.length} example(s)."
-    resolved_schema['type'].each { |type_name, type_def|
-      # We need to recurse one more level if we're dealing with an array type definition, as we need
-      # to stick the examples on the type definition for the array's `items`. There might also be
-      # multiple type definitions under `items`, but we'll cross that bridge if/when we get to it.
-      case type_name
-      when 'array'
-        type_def['items']['type'].each { |subtype_name, subtype_def|
-          if subtype_name != 'array'
-            subtype_def['examples'] = flattened_examples
-          end
-        }
-      else
-        type_def['examples'] = flattened_examples
-      end
-    }
-  end
-
-  # Apply any units that have been specified.
-  type_unit = get_schema_metadata(source_schema, 'docs::type_unit')
-  if !type_unit.nil?
-    schema_type = numeric_schema_type(resolved_schema)
-    if !schema_type.nil?
-      resolved_schema['type'][schema_type]['unit'] = type_unit.to_s
-    end
-  end
-
-  # Modify the `syntax` of a string type definition if overridden via metadata.
-  syntax_override = get_schema_metadata(source_schema, 'docs::syntax_override')
-  if !syntax_override.nil?
-    if resolved_schema_type?(resolved_schema) != "string"
-      @logger.error "Non-string schemas should not use the `syntax_override` metadata attribute."
-      exit 1
-    end
-
-    resolved_schema['type']['string']['syntax'] = syntax_override.to_s
-  end
-end
-
-# Reconciles the resolved schema, detecting and fixing any logical inconsistencies.
-#
-# This provides a mechanism to fix up any inconsistencies that are created during the resolution
-# process that would otherwise be very complex to fix in the resolution codepath. Sometimes,
-# inconsistencies are only present after resolving merged subschemas, and so on, and so this
-# function serves as a spot to do such reconciliation, as it is called right before returning a
-# resolved schema.
-def reconcile_resolved_schema!(resolved_schema)
-  @logger.debug "Reconciling resolved schema..."
-
-  # Only works if `type` is an object, which it won't be in some cases, such as a schema that maps
-  # to a cycle entrypoint, or is hidden, and so on.
-  if !resolved_schema['type'].is_a?(Hash)
-    @logger.debug "Schema was not a fully resolved schema; reconciliation not applicable."
-    return
-  end
-
-  @logger.debug "Reconciling schema: #{to_pretty_json(resolved_schema)}"
-
-  # If we're dealing with an object schema, run this for each of its properties.
-  object_properties = resolved_schema.dig('type', 'object', 'options')
-  if !object_properties.nil?
-    object_properties.values.each { |resolved_property| reconcile_resolved_schema!(resolved_property) }
-  else
-    # Look for required/default value inconsistencies.
-    #
-    # One example is the `lua` transform and the `version` field. It's marked as required by the
-    # version 2 configuration types, but it's optional for version 1, which allows the deserializer to
-    # only deserialize things as version 1 if `version` isn't set, avoiding a backwards-incompatible
-    # situation... but in this script, we only compare the subschemas in terms of their const-ness,
-    # and don't look at the `required` portion.
-    #
-    # This means that we can generate output for a field that says it has a default value of `null`
-    # but is a required field, which is a logical inconsistency in terms of the Cue schema where we
-    # import the generated output of this script: it doesn't allow setting a default value for a field
-    # if the field is required, and vice versa.
-    if resolved_schema['required']
-      # For all schema type fields, see if they have a default value equal to `nil`. If so, remove
-      # the `default` field entirely.
-      resolved_schema['type'].keys.each { |type_field|
-        type_field_default_value = resolved_schema['type'][type_field].fetch('default', :does_not_exist)
-        if type_field_default_value.nil?
-          @logger.debug "Removing null `default` field for type field '#{type_field}'..."
-
-          resolved_schema['type'][type_field].delete('default')
-        end
-      }
-    end
-
-    # Look for merged string const values that need to become an enum.
-    #
-    # As part of our enum schema resolving, we have a fallback mode where we resolve each subschema
-    # and merge them together in a nested fashion, under the assumption that they don't overlap in
-    # an invalid way i.e. same field in two schemas but with differing/incompatible types.
-    #
-    # This works, but one area it falls down is where a field is a `const` in different subschemas,
-    # where even if the value is the same type for all overlaps of `const`, the normal nested merge
-    # would result in a last-write-wins for that field. We compensate for this by using a
-    # schema-aware nested merge, where if we're merging a field called `const`, we turn it into a
-    # array of the const data, which includes the const value itself and the description of the enum
-    # variant.
-    #
-    # The final step would be to change from `const` to `enum`, because Cue doesn't recognize the
-    # `const` type, regardless of whether it's a single value or a map of key/value pairs. We cannot
-    # do that in the merge, however, because there's no way to specify a new resulting key to use,
-    # only how the values should be merged.
-    #
-    # Thus, we handle that here by looking for any `const` field that has an array value, turning it
-    # into a map of const value to enum variant description. Since no normal schema would have a
-    # `const` value that was an array value to begin with, we can safely search for such instances
-    # and confidently know that the field can be renamed from `const` to `enum`.
-    resolved_schema['type'].keys.each { |type_field|
-      const_type_field = resolved_schema.dig('type', type_field, 'const')
-      if !const_type_field.nil?
-        @logger.debug "Converting `const` values to `enum` for type field '#{type_field}'..."
-        @logger.debug "Resolved schema: #{resolved_schema}"
-
-        enum_values = if const_type_field.is_a?(Array)
-          const_type_field
-            .map { |const| [const['value'], const['description']] }
-        else
-          # If the value isn't already an array, we'll create the enum values map directly.
-          { const_type_field['value'] => const_type_field['description'] }
-        end
-
-        @logger.debug "Reconciled enum values for const: #{enum_values}"
-
-        resolved_schema['type'][type_field].delete('const')
-        resolved_schema['type'][type_field]['enum'] = enum_values
-      end
-    }
-
-    # Push the schema description into the type field for string consts.
-    #
-    # As part of resolving const schemas, we need to use their descriptions when eventually
-    # converting them to an enum schema that is supported on the Cue side. This implies the const
-    # value becoming a key in a map, whose value is the description of the const schema.
-    #
-    # We do that here because it's simpler to not have to special case the addition of the
-    # description when resolving a const schema, as we do so uniformly as part of the final steps of
-    # resolving a schema in general, but before reconciliation is triggered.
-    resolved_schema['type'].keys.each { |type_field|
-      const_type_field = resolved_schema.dig('type', type_field, 'const')
-      if !const_type_field.nil? && !const_type_field.is_a?(Array)
-        @logger.debug "Adding schema description to `const` type field '#{type_field}'..."
-
-        schema_description = resolved_schema['description']
-        const_type_field['description'] = schema_description unless schema_description.nil?
-      end
-    }
-  end
-
-  @logger.debug "Reconciled resolved schema."
-end
-
-def get_rendered_description_from_schema(schema)
-  # Grab both the raw description and raw title, and if the title is empty, just use the
-  # description, otherwise concatenate the title and description with newlines so that there's a
-  # whitespace break between the title and description.
-  raw_description = schema.fetch('description', '')
-  raw_title = schema.fetch('title', '')
-
-  description = raw_title.empty? ? raw_description : "#{raw_title}\n\n#{raw_description}"
-  description.strip
-end
-
-def unwrap_resolved_schema(root_schema, schema_name, friendly_name)
-  @logger.info "[*] Resolving schema definition for #{friendly_name}..."
-
-  # Try and resolve the schema, unwrapping it as an object schema which is a requirement/expectation
-  # of all component-level schemas. We additionally sort all of the object properties, which makes
-  # sure the docs are generated in alphabetical order.
-  resolved_schema = resolve_schema_by_name(root_schema, schema_name)
-
-  unwrapped_resolved_schema = resolved_schema.dig('type', 'object', 'options')
-  if unwrapped_resolved_schema.nil?
-    @logger.error 'Configuration types must always resolve to an object schema.'
-    exit 1
-  end
-
-  return sort_hash_nested(unwrapped_resolved_schema)
-end
-
-def render_and_import_schema(unwrapped_resolved_schema, friendly_name, config_map_path, cue_relative_path)
-
-  # Set up the appropriate structure for the value based on the configuration map path. It defines
-  # the nested levels of the map where our resolved schema should go, as well as a means to generate
-  # an appropriate prefix for our temporary file.
-  data = {}
-  last = data
-  config_map_path.each do |segment|
-    last[segment] = {} if last[segment].nil?
-
-    last = last[segment]
-  end
-
-  last['configuration'] = unwrapped_resolved_schema
-
-  config_map_path.prepend('config-schema-base')
-  tmp_file_prefix = config_map_path.join('-')
-
-  final_json = to_pretty_json(data)
-
-  # Write the resolved schema as JSON, which we'll then use to import into a Cue file.
-  json_output_file = write_to_temp_file(["config-schema-#{tmp_file_prefix}-", '.json'], final_json)
-  @logger.info "[✓]   Wrote #{friendly_name} schema to '#{json_output_file}'. (#{final_json.length} bytes)"
-
-  # Try importing it as Cue.
-  @logger.info "[*] Importing #{friendly_name} schema as Cue file..."
-  cue_output_file = "website/cue/reference/#{cue_relative_path}"
-  unless system(@cue_binary_path, 'import', '-f', '-o', cue_output_file, '-p', 'metadata', json_output_file)
-    @logger.error "[!]   Failed to import #{friendly_name} schema as valid Cue."
-    exit 1
-  end
-  @logger.info "[✓]   Imported #{friendly_name} schema to '#{cue_output_file}'."
-end
-
-def render_and_import_generated_component_schema(root_schema, schema_name, component_type)
-  friendly_name = "generated #{component_type} configuration"
-  unwrapped_resolved_schema = unwrap_resolved_schema(root_schema, schema_name, friendly_name)
-  render_and_import_schema(
-    unwrapped_resolved_schema,
-    friendly_name,
-    ["generated", "components", "#{component_type}s"],
-    "components/generated/#{component_type}s.cue"
-  )
-end
-
-def render_and_import_component_schema(root_schema, schema_name, component_type, component_name)
-  friendly_name = "'#{component_name}' #{component_type} configuration"
-  unwrapped_resolved_schema = unwrap_resolved_schema(root_schema, schema_name, friendly_name)
-  render_and_import_schema(
-    unwrapped_resolved_schema,
-    friendly_name,
-    ["generated", "components", "#{component_type}s", component_name],
-    "components/#{component_type}s/generated/#{component_name}.cue"
-  )
-end
-
-def render_and_import_generated_top_level_config_schema(root_schema)
-  top_level_config_schema = {}
-
-  # Define logical groupings for top-level configuration fields
-  # These groups will be used to organize separate documentation pages
-  field_groups = {
-    # Pipeline component containers
-    'sources' => 'pipeline_components',
-    'transforms' => 'pipeline_components',
-    'sinks' => 'pipeline_components',
-    'enrichment_tables' => 'pipeline_components',
-
-    # Individual feature pages
-    'api' => 'api',
-    'schema' => 'schema',
-    'log_schema' => 'schema',
-    'secret' => 'secrets',
-
-    # Global options (everything else defaults to this)
-  }
-
-  group_metadata = {
-    'global_options' => {
-      'title' => 'Global Options',
-      'description' => 'Global configuration options that apply to Vector as a whole.',
-      'order' => 1
-    },
-    'pipeline_components' => {
-      'title' => 'Pipeline Components',
-      'description' => 'Configure sources, transforms, sinks, and enrichment tables for your observability pipeline.',
-      'order' => 2
-    },
-    'api' => {
-      'title' => 'API',
-      'description' => 'Configure Vector\'s observability API.',
-      'order' => 3
-    },
-    'schema' => {
-      'title' => 'Schema',
-      'description' => 'Configure Vector\'s internal schema system for type tracking and validation.',
-      'order' => 4
-    },
-    'secrets' => {
-      'title' => 'Secrets',
-      'description' => 'Configure secrets management for secure configuration.',
-      'order' => 5
-    }
-  }
-
-  # Usage of #[serde(flatten)] creates multiple schemas in the `allOf` array:
-  # - One or more schemas contain ConfigBuilder's direct fields
-  # - One or more schemas contain flattened GlobalOptions fields
-  all_of_schemas = root_schema['allOf'] || []
-
-  if all_of_schemas.empty?
-    @logger.error "Could not find ConfigBuilder allOf schemas in root schema"
-    return
-  end
-
-  # Collect all properties from all allOf schemas into a single hash.
-  # Since ConfigBuilder uses #[serde(flatten)], field names are unique across all schemas.
-  all_properties = all_of_schemas.reduce({}) do |acc, schema|
-    acc.merge(schema['properties'] || {})
-  end
-
-  @logger.info "[*] Found #{all_properties.keys.length} total properties across #{all_of_schemas.length} allOf schemas"
-
-  # Process each property once
-  all_properties.each do |field_name, field_schema|
-    # Skip fields marked with docs::hidden
-    metadata = field_schema['_metadata'] || {}
-    if metadata['docs::hidden']
-      @logger.info "[*] Skipping '#{field_name}' (marked as docs::hidden)"
-      next
-    end
-
-    # Extract and resolve the field
-    @logger.info "[*] Extracting '#{field_name}' field from ConfigBuilder..."
-    resolved_field = resolve_schema(root_schema, field_schema)
-
-    # Assign group metadata to organize the documentation
-    if field_groups.key?(field_name)
-      group_name = field_groups[field_name]
-      resolved_field['group'] = group_name
-      @logger.debug "Assigned '#{field_name}' to group '#{group_name}'"
-    else
-      # Default to global_options for any fields not explicitly grouped
-      resolved_field['group'] = 'global_options'
-      @logger.debug "Assigned '#{field_name}' to default group 'global_options'"
-    end
-
-    top_level_config_schema[field_name] = resolved_field
-    @logger.info "[✓] Resolved '#{field_name}'"
-  end
-
-  # Build the final data structure with both configuration and group metadata
-  friendly_name = "configuration"
-  config_map_path = ["generated", "configuration"]
-  cue_relative_path = "generated/configuration.cue"
-
-  # Set up the structure for the value based on the configuration map path
-  data = {}
-  last = data
-  config_map_path.each do |segment|
-    last[segment] = {} if last[segment].nil?
-    last = last[segment]
-  end
-
-  # Add both the configuration schema and the group metadata
-  last['configuration'] = top_level_config_schema
-  last['groups'] = group_metadata
-
-  config_map_path.prepend('config-schema-base')
-  tmp_file_prefix = config_map_path.join('-')
-  final_json = to_pretty_json(data)
-
-  # Write the resolved schema as JSON
-  json_output_file = write_to_temp_file(["config-schema-#{tmp_file_prefix}-", '.json'], final_json)
-  @logger.info "[✓]   Wrote #{friendly_name} schema to '#{json_output_file}'. (#{final_json.length} bytes)"
-
-  # Import it as Cue
-  @logger.info "[*] Importing #{friendly_name} schema as Cue file..."
-  cue_output_file = "website/cue/reference/#{cue_relative_path}"
-  unless system(@cue_binary_path, 'import', '-f', '-o', cue_output_file, '-p', 'metadata', json_output_file)
-    @logger.error "[!]   Failed to import #{friendly_name} schema as valid Cue."
-    exit 1
-  end
-  @logger.info "[✓]   Imported #{friendly_name} schema to '#{cue_output_file}'."
-end
-
-if ARGV.empty?
-  puts 'usage: extract-component-schema.rb <configuration schema path>'
-  exit 1
-end
-
-# Ensure that Cue is present since we need it to import our intermediate JSON representation.
-if @cue_binary_path.nil?
-  puts 'Failed to find \'cue\' binary on the current path. Install \'cue\' (or make it available on the current path) and try again.'
-  exit 1
-end
-
-schema_path = ARGV[0]
-root_schema = JSON.parse(File.read(schema_path))
-
-component_types = %w[source transform sink]
-
-# First off, we generate the component type configuration bases. These are the high-level
-# configuration settings that are universal on a per-component type basis.
-#
-# For example, the "generated" configuration for a sink would be the inputs, buffer settings, healthcheck
-# settings, and proxy settings... and then the configuration for a sink would be those, plus
-# whatever the sink itself defines.
-component_bases = root_schema['definitions'].filter_map do |key, definition|
-  component_base_type = get_schema_metadata(definition, 'docs::component_base_type')
-  { component_base_type => key } if component_types.include? component_base_type
-end
-.reduce { |acc, item| nested_merge(acc, item) }
-
-component_bases.each do |component_type, schema_name|
-  render_and_import_generated_component_schema(root_schema, schema_name, component_type)
-end
-
-# Now we'll generate the base configuration for each component.
-all_components = root_schema['definitions'].filter_map do |key, definition|
-  component_type = get_schema_metadata(definition, 'docs::component_type')
-  component_name = get_schema_metadata(definition, 'docs::component_name')
-  { component_type => { component_name => key } } if component_types.include? component_type
-end
-.reduce { |acc, item| nested_merge(acc, item) }
-
-all_components.each do |component_type, components|
-  components.each do |component_name, schema_name|
-    render_and_import_component_schema(root_schema, schema_name, component_type, component_name)
-  end
-end
-
-# Finally, generate the top-level Vector configuration schema. We extract ALL top-level config fields directly from the
-# ConfigBuilder struct (defined in src/config/builder.rs) by processing its allOf schemas. ConfigBuilder is the single
-# source of truth for what's actually allowed at the top level of Vector's configuration file.
-render_and_import_generated_top_level_config_schema(root_schema)
diff --git a/src/sinks/greptimedb/logs/config.rs b/src/sinks/greptimedb/logs/config.rs
index 317827453d939..d667d4ce64f68 100644
--- a/src/sinks/greptimedb/logs/config.rs
+++ b/src/sinks/greptimedb/logs/config.rs
@@ -28,10 +28,6 @@ fn extra_params_examples() -> HashMap<String, String> {
     HashMap::<_, _>::from_iter([("source".to_owned(), "vector".to_owned())])
 }
 
-fn extra_headers_examples() -> HashMap<String, String> {
-    HashMap::new()
-}
-
 /// Configuration for the `greptimedb_logs` sink.
 #[configurable_component(sink("greptimedb_logs", "Ingest logs data into GreptimeDB."))]
 #[derive(Clone, Debug, Default, Derivative)]
@@ -108,7 +104,6 @@ pub struct GreptimeDBLogsConfig {
     #[configurable(metadata(
         docs::additional_props_description = "Extra header key-value pairs."
     ))]
-    #[configurable(metadata(docs::examples = "extra_headers_examples()"))]
     pub extra_headers: Option<HashMap<String, String>>,
 
     #[configurable(derived)]
diff --git a/vdev/src/commands/build/component_docs/mod.rs b/vdev/src/commands/build/component_docs/mod.rs
new file mode 100644
index 0000000000000..364593d053fb5
--- /dev/null
+++ b/vdev/src/commands/build/component_docs/mod.rs
@@ -0,0 +1,20 @@
+use anyhow::Result;
+use clap::Args;
+use std::path::PathBuf;
+
+mod runner;
+mod schema;
+
+/// Build the component documentation by parsing the JSON configuration schema and generating cue files.
+#[derive(Args, Debug)]
+#[command()]
+pub struct Cli {
+    /// The path to the configuration schema JSON file
+    configuration_schema: PathBuf,
+}
+
+impl Cli {
+    pub fn exec(self) -> Result<()> {
+        runner::run(&self.configuration_schema)
+    }
+}
diff --git a/vdev/src/commands/build/component_docs/runner.rs b/vdev/src/commands/build/component_docs/runner.rs
new file mode 100644
index 0000000000000..7b9eb3dbbfbac
--- /dev/null
+++ b/vdev/src/commands/build/component_docs/runner.rs
@@ -0,0 +1,356 @@
+use super::schema::SchemaContext;
+use anyhow::{Context, Result, bail};
+use indexmap::IndexMap;
+use serde_json::{Value, json};
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+pub fn run(schema_path: &Path) -> Result<()> {
+    let schema_content = fs::read_to_string(schema_path)
+        .with_context(|| format!("Failed to read schema file from {}", schema_path.display()))?;
+
+    let root_schema: Value =
+        serde_json::from_str(&schema_content).with_context(|| "Failed to parse schema JSON")?;
+
+    let mut context = SchemaContext::new(root_schema.clone())?;
+
+    let component_types = ["source", "transform", "sink"];
+
+    // 1. Process Component Bases (sorted by component type for deterministic output)
+    let mut component_bases: IndexMap<String, String> = IndexMap::new();
+    if let Some(definitions) = root_schema.get("definitions").and_then(|d| d.as_object()) {
+        for (key, definition) in definitions {
+            if let Some(base_type) =
+                super::schema::get_schema_metadata(definition, "docs::component_base_type")
+                    .and_then(|v| v.as_str())
+                && component_types.contains(&base_type)
+            {
+                component_bases.insert(base_type.to_string(), key.clone());
+            }
+        }
+    }
+    component_bases.sort_keys();
+
+    for (comp_type, schema_name) in &component_bases {
+        render_and_import_generated_component_schema(&mut context, schema_name, comp_type)?;
+    }
+
+    // 2. Process All Components (sorted by component type and name for deterministic output)
+    let mut all_components: IndexMap<String, IndexMap<String, String>> = IndexMap::new();
+    if let Some(definitions) = root_schema.get("definitions").and_then(|d| d.as_object()) {
+        for (key, definition) in definitions {
+            let comp_type = super::schema::get_schema_metadata(definition, "docs::component_type")
+                .and_then(|v| v.as_str());
+            let comp_name = super::schema::get_schema_metadata(definition, "docs::component_name")
+                .and_then(|v| v.as_str());
+
+            if let (Some(t), Some(n)) = (comp_type, comp_name)
+                && component_types.contains(&t)
+            {
+                all_components
+                    .entry(t.to_string())
+                    .or_default()
+                    .insert(n.to_string(), key.clone());
+            }
+        }
+    }
+    all_components.sort_keys();
+    for (_, components) in &mut all_components {
+        components.sort_keys();
+    }
+
+    for (comp_type, components) in &all_components {
+        for (comp_name, schema_name) in components {
+            render_and_import_component_schema(&mut context, schema_name, comp_type, comp_name)?;
+        }
+    }
+
+    // 3. Process top-level configuration fields (formerly "global options").
+    // The standalone API schema (`generated/api.cue`) was retired in #24858; api
+    // is now rendered as a top-level field with `group: "api"`.
+    render_and_import_generated_top_level_config_schema(&mut context, &root_schema)?;
+
+    Ok(())
+}
+
+fn write_to_temp_file(prefix: &str, suffix: &str, content: &str) -> Result<PathBuf> {
+    use std::io::Write;
+    let mut tmp = tempfile::Builder::new()
+        .prefix(prefix)
+        .suffix(suffix)
+        .tempfile()?;
+    tmp.write_all(content.as_bytes())?;
+    let path = tmp.into_temp_path().keep()?;
+    Ok(path)
+}
+
+fn render_and_import_schema(
+    context: &mut SchemaContext,
+    unwrapped_resolved_schema: Value,
+    friendly_name: &str,
+    config_map_path: &[&str],
+    cue_relative_path: &str,
+) -> Result<()> {
+    let mut data = serde_json::Map::new();
+    // Simplified nesting since serde doesn't make building deeply nested objects inline easy
+    // In practice, this needs to build a nested path of objects and put `configuration` at the end
+
+    let mut current_obj = &mut data;
+    for segment in config_map_path {
+        current_obj.insert(
+            (*segment).to_string(),
+            Value::Object(serde_json::Map::new()),
+        );
+        current_obj = current_obj
+            .get_mut(*segment)
+            .unwrap()
+            .as_object_mut()
+            .unwrap();
+    }
+    current_obj.insert("configuration".to_string(), unwrapped_resolved_schema);
+
+    let mut prefix = String::from("config-schema-base-");
+    prefix.push_str(&config_map_path.join("-"));
+    prefix.push('-');
+
+    let final_json = serde_json::to_string_pretty(&data)?;
+    let json_output_file = write_to_temp_file(&prefix, ".json", &final_json)?;
+
+    info!(
+        "[✓]   Wrote {} schema to '{}'. ({} bytes)",
+        friendly_name,
+        json_output_file.display(),
+        final_json.len()
+    );
+
+    info!("[*] Importing {} schema as Cue file...", friendly_name);
+    let cue_output_file = PathBuf::from("website/cue/reference").join(cue_relative_path);
+
+    if let Some(parent) = cue_output_file.parent() {
+        fs::create_dir_all(parent)?;
+    }
+
+    let status = Command::new(&context.cue_binary_path)
+        .args([
+            "import",
+            "-f",
+            "-o",
+            cue_output_file.to_str().unwrap(),
+            "-p",
+            "metadata",
+            json_output_file.to_str().unwrap(),
+        ])
+        .status()?;
+
+    if !status.success() {
+        bail!(
+            "Failed to import {friendly_name} schema as valid Cue (cue exit status {status}). JSON written to {json_path}.",
+            json_path = json_output_file.display()
+        );
+    }
+
+    info!(
+        "[✓]   Imported {} schema to '{}'.",
+        friendly_name,
+        cue_output_file.display()
+    );
+    Ok(())
+}
+
+fn render_and_import_generated_component_schema(
+    context: &mut SchemaContext,
+    schema_name: &str,
+    component_type: &str,
+) -> Result<()> {
+    let friendly_name = format!("generated {component_type} configuration");
+    let unwrapped = context.unwrap_resolved_schema(schema_name, &friendly_name)?;
+    let cue_path = format!("components/generated/{component_type}s.cue");
+
+    render_and_import_schema(
+        context,
+        Value::Object(unwrapped),
+        &friendly_name,
+        &["generated", "components", &format!("{component_type}s")],
+        &cue_path,
+    )
+}
+
+fn render_and_import_component_schema(
+    context: &mut SchemaContext,
+    schema_name: &str,
+    component_type: &str,
+    component_name: &str,
+) -> Result<()> {
+    let friendly_name = format!("'{component_name}' {component_type} configuration");
+    let unwrapped = context.unwrap_resolved_schema(schema_name, &friendly_name)?;
+    let cue_path = format!("components/{component_type}s/generated/{component_name}.cue");
+
+    render_and_import_schema(
+        context,
+        Value::Object(unwrapped),
+        &friendly_name,
+        &[
+            "generated",
+            "components",
+            &format!("{component_type}s"),
+            component_name,
+        ],
+        &cue_path,
+    )
+}
+
+// Field-to-group mapping. Fields not listed default to "global_options".
+const TOP_LEVEL_FIELD_GROUPS: &[(&str, &str)] = &[
+    ("sources", "pipeline_components"),
+    ("transforms", "pipeline_components"),
+    ("sinks", "pipeline_components"),
+    ("enrichment_tables", "pipeline_components"),
+    ("api", "api"),
+    ("schema", "schema"),
+    ("log_schema", "schema"),
+    ("secret", "secrets"),
+];
+
+fn top_level_group_metadata() -> Value {
+    json!({
+        "global_options": {
+            "title": "Global Options",
+            "description": "Global configuration options that apply to Vector as a whole.",
+            "order": 1,
+        },
+        "pipeline_components": {
+            "title": "Pipeline Components",
+            "description": "Configure sources, transforms, sinks, and enrichment tables for your observability pipeline.",
+            "order": 2,
+        },
+        "api": {
+            "title": "API",
+            "description": "Configure Vector's observability API.",
+            "order": 3,
+        },
+        "schema": {
+            "title": "Schema",
+            "description": "Configure Vector's internal schema system for type tracking and validation.",
+            "order": 4,
+        },
+        "secrets": {
+            "title": "Secrets",
+            "description": "Configure secrets management for secure configuration.",
+            "order": 5,
+        },
+    })
+}
+
+fn resolve_top_level_config_fields(
+    context: &mut SchemaContext,
+    root_schema: &Value,
+) -> Result<serde_json::Map<String, Value>> {
+    // ConfigBuilder uses #[serde(flatten)] for GlobalOptions, so root_schema.allOf
+    // contains multiple subschemas whose properties together form the top-level config.
+    let all_of = root_schema
+        .get("allOf")
+        .and_then(Value::as_array)
+        .ok_or_else(|| anyhow::anyhow!("Could not find ConfigBuilder allOf schemas"))?;
+    if all_of.is_empty() {
+        anyhow::bail!("ConfigBuilder allOf schemas are empty");
+    }
+
+    let mut all_properties: IndexMap<String, Value> = IndexMap::new();
+    for subschema in all_of {
+        if let Some(props) = subschema.get("properties").and_then(Value::as_object) {
+            for (k, v) in props {
+                all_properties.insert(k.clone(), v.clone());
+            }
+        }
+    }
+
+    let mut resolved_fields = serde_json::Map::new();
+    for (field_name, field_schema) in all_properties {
+        if super::schema::get_schema_metadata(&field_schema, "docs::hidden").is_some() {
+            debug!("Skipping '{field_name}' (marked as docs::hidden)");
+            continue;
+        }
+
+        let mut resolved = context.resolve_schema(&field_schema)?;
+        if !resolved.is_object() {
+            continue;
+        }
+
+        let group = TOP_LEVEL_FIELD_GROUPS
+            .iter()
+            .find(|(name, _)| *name == field_name)
+            .map_or("global_options", |(_, g)| *g);
+
+        resolved
+            .as_object_mut()
+            .unwrap()
+            .insert("group".to_string(), Value::String(group.to_string()));
+
+        resolved_fields.insert(field_name, resolved);
+    }
+    Ok(resolved_fields)
+}
+
+fn render_and_import_generated_top_level_config_schema(
+    context: &mut SchemaContext,
+    root_schema: &Value,
+) -> Result<()> {
+    let resolved_fields = resolve_top_level_config_fields(context, root_schema)?;
+
+    let data = json!({
+        "generated": {
+            "configuration": {
+                "configuration": Value::Object(resolved_fields),
+                "groups": top_level_group_metadata(),
+            }
+        }
+    });
+
+    let friendly_name = "configuration";
+    let prefix = "config-schema-base-generated-configuration-";
+
+    let final_json = serde_json::to_string_pretty(&data)?;
+    let json_output_file = write_to_temp_file(prefix, ".json", &final_json)?;
+
+    info!(
+        "[✓]   Wrote {} schema to '{}'. ({} bytes)",
+        friendly_name,
+        json_output_file.display(),
+        final_json.len()
+    );
+
+    info!("[*] Importing {} schema as Cue file...", friendly_name);
+    let cue_output_file =
+        PathBuf::from("website/cue/reference").join("generated/configuration.cue");
+
+    if let Some(parent) = cue_output_file.parent() {
+        fs::create_dir_all(parent)?;
+    }
+
+    let status = Command::new(&context.cue_binary_path)
+        .args([
+            "import",
+            "-f",
+            "-o",
+            cue_output_file.to_str().unwrap(),
+            "-p",
+            "metadata",
+            json_output_file.to_str().unwrap(),
+        ])
+        .status()?;
+
+    if !status.success() {
+        bail!(
+            "Failed to import {friendly_name} schema as valid Cue (cue exit status {status}). JSON written to {json_path}.",
+            json_path = json_output_file.display()
+        );
+    }
+
+    info!(
+        "[✓]   Imported {} schema to '{}'.",
+        friendly_name,
+        cue_output_file.display()
+    );
+    Ok(())
+}
diff --git a/vdev/src/commands/build/component_docs/schema.rs b/vdev/src/commands/build/component_docs/schema.rs
new file mode 100644
index 0000000000000..c4f880671a43e
--- /dev/null
+++ b/vdev/src/commands/build/component_docs/schema.rs
@@ -0,0 +1,190 @@
+#[path = "schema_core.rs"]
+pub mod core;
+#[path = "schema_enum.rs"]
+pub mod r#enum;
+#[path = "schema_resolve.rs"]
+pub mod resolve;
+#[path = "schema_utils.rs"]
+pub mod utils;
+
+use anyhow::{Result, anyhow};
+use indexmap::IndexMap;
+use serde_json::Value;
+use std::env;
+
+pub struct SchemaContext {
+    pub root_schema: Value,
+    pub cue_binary_path: String,
+    pub resolved_schema_cache: IndexMap<String, Value>,
+    pub expanded_schema_cache: IndexMap<String, Value>,
+}
+
+impl SchemaContext {
+    pub fn new(root_schema: Value) -> Result<Self> {
+        let cue_binary_path = find_command_on_path("cue")
+            .ok_or_else(|| anyhow!("Failed to find 'cue' binary on the current path."))?;
+        Ok(Self {
+            root_schema,
+            cue_binary_path,
+            resolved_schema_cache: IndexMap::new(),
+            expanded_schema_cache: IndexMap::new(),
+        })
+    }
+}
+
+pub fn find_command_on_path(command: &str) -> Option<String> {
+    let exts = env::var("PATHEXT")
+        .unwrap_or_else(|_| String::new())
+        .split(';')
+        .map(std::string::ToString::to_string)
+        .collect::<Vec<String>>();
+
+    let path_var = env::var("PATH").unwrap_or_default();
+    let paths = std::env::split_paths(&path_var);
+
+    for path in paths {
+        for ext in &exts {
+            let mut expected = path.join(command);
+            expected.set_extension(ext.replace('.', ""));
+
+            if expected.is_file() {
+                return expected.to_str().map(std::string::ToString::to_string);
+            }
+        }
+    }
+    None
+}
+
+pub fn json_type_str(value: &Value) -> &'static str {
+    match value {
+        Value::String(_) => "string",
+        Value::Number(n) if n.is_f64() => "number",
+        Value::Number(_) => "integer",
+        Value::Bool(_) => "boolean",
+        Value::Array(_) => "array",
+        Value::Object(_) => "object",
+        Value::Null => "null",
+    }
+}
+
+pub fn docs_type_str(value: &Value) -> &'static str {
+    let type_str = json_type_str(value);
+    if type_str == "boolean" {
+        "bool"
+    } else {
+        type_str
+    }
+}
+
+pub fn get_schema_metadata<'a>(schema: &'a Value, key: &str) -> Option<&'a Value> {
+    schema.get("_metadata").and_then(|m| m.get(key))
+}
+
+pub fn get_schema_ref(schema: &Value) -> Option<&str> {
+    schema.get("$ref").and_then(|r| r.as_str())
+}
+
+pub fn nested_merge(base: &mut Value, override_val: &Value) {
+    if override_val.is_null() {
+        return;
+    }
+
+    if base.is_null() {
+        *base = override_val.clone();
+        return;
+    }
+
+    if base.is_object() && override_val.is_object() {
+        let base_obj = base.as_object_mut().unwrap();
+        let over_obj = override_val.as_object().unwrap();
+        for (k, v) in over_obj {
+            let entry = base_obj.entry(k.clone()).or_insert_with(|| Value::Null);
+            nested_merge(entry, v);
+        }
+    } else if base.is_array() && override_val.is_array() {
+        let base_arr = base.as_array_mut().unwrap();
+        let over_arr = override_val.as_array().unwrap();
+        for val in over_arr {
+            if !base_arr.contains(val) {
+                base_arr.push(val.clone());
+            }
+        }
+    } else {
+        *base = override_val.clone();
+    }
+}
+
+pub fn schema_aware_nested_merge(base: &mut Value, override_val: &Value) {
+    if override_val.is_null() {
+        return;
+    }
+
+    if base.is_null() {
+        *base = override_val.clone();
+        return;
+    }
+
+    if base.is_object() && override_val.is_object() {
+        let base_obj = base.as_object_mut().unwrap();
+        let over_obj = override_val.as_object().unwrap();
+
+        for (k, v) in over_obj {
+            if k == "const"
+                && is_const_variant(v)
+                && is_existing_const_variants(base_obj.get("const"))
+            {
+                let base_vals = std::mem::take(base_obj.get_mut("const").unwrap());
+                let mut result = Vec::new();
+
+                push_const_variants(&mut result, base_vals);
+                push_const_variants(&mut result, v.clone());
+
+                base_obj.insert("const".to_string(), Value::Array(result));
+            } else {
+                let entry = base_obj.entry(k.clone()).or_insert_with(|| Value::Null);
+                schema_aware_nested_merge(entry, v);
+            }
+        }
+    } else if base.is_array() && override_val.is_array() {
+        let base_arr = base.as_array_mut().unwrap();
+        let over_arr = override_val.as_array().unwrap();
+        for val in over_arr {
+            if !base_arr.contains(val) {
+                base_arr.push(val.clone());
+            }
+        }
+    } else {
+        *base = override_val.clone();
+    }
+}
+
+/// True for a `{value, ...}` const variant, or an array of such variants.
+fn is_const_variant(value: &Value) -> bool {
+    match value {
+        Value::Object(o) => o.contains_key("value"),
+        Value::Array(arr) => arr.iter().all(is_const_variant),
+        _ => false,
+    }
+}
+
+fn is_existing_const_variants(existing: Option<&Value>) -> bool {
+    existing.is_some_and(is_const_variant)
+}
+
+fn push_const_variants(result: &mut Vec<Value>, value: Value) {
+    match value {
+        Value::Array(arr) => {
+            for item in arr {
+                if !result.contains(&item) {
+                    result.push(item);
+                }
+            }
+        }
+        obj @ Value::Object(_) => {
+            if !result.contains(&obj) {
+                result.push(obj);
+            }
+        }
+        _ => {}
+    }
+}
diff --git a/vdev/src/commands/build/component_docs/schema_core.rs b/vdev/src/commands/build/component_docs/schema_core.rs
new file mode 100644
index 0000000000000..502ae6ccc94e4
--- /dev/null
+++ b/vdev/src/commands/build/component_docs/schema_core.rs
@@ -0,0 +1,131 @@
+use super::{SchemaContext, get_schema_ref, nested_merge};
+use anyhow::{Result, anyhow};
+use serde_json::Value;
+
+impl SchemaContext {
+    pub fn get_json_schema_instance_type<'a>(&self, schema: &'a Value) -> Option<&'a str> {
+        let maybe_type = schema.get("type")?;
+
+        if maybe_type.is_null() || maybe_type.as_str() == Some("null") {
+            return None;
+        }
+
+        if let Value::Array(arr) = maybe_type {
+            let filtered: Vec<_> = arr.iter().filter(|v| v.as_str() != Some("null")).collect();
+            if filtered.len() == 1 {
+                return filtered[0].as_str();
+            }
+        } else if let Some(s) = maybe_type.as_str() {
+            return Some(s);
+        }
+
+        None
+    }
+
+    pub fn get_json_schema_type<'a>(&self, schema: &'a Value) -> Option<&'a str> {
+        if schema.get("allOf").is_some() {
+            Some("all-of")
+        } else if schema.get("oneOf").is_some() {
+            Some("one-of")
+        } else if schema.get("anyOf").is_some() {
+            Some("any-of")
+        } else if schema.get("type").is_some() {
+            self.get_json_schema_instance_type(schema)
+        } else if schema.get("const").is_some() {
+            Some("const")
+        } else if schema.get("enum").is_some() {
+            Some("enum")
+        } else {
+            None
+        }
+    }
+
+    pub fn get_schema_by_name(&self, schema_name: &str) -> Result<Value> {
+        let name = schema_name.replace("#/definitions/", "");
+        let def = self
+            .root_schema
+            .get("definitions")
+            .and_then(|defs| defs.get(&name))
+            .cloned();
+
+        if let Some(d) = def {
+            Ok(d)
+        } else {
+            Err(anyhow!(
+                "Could not find schema definition '{name}' in given schema."
+            ))
+        }
+    }
+
+    pub fn expand_schema_references(&mut self, unexpanded_schema: &Value) -> Result<Value> {
+        let mut schema = unexpanded_schema.clone();
+
+        let original_title = schema.get("title").cloned();
+        let original_description = schema.get("description").cloned();
+
+        let schema_ref = get_schema_ref(&schema).map(String::from);
+        if let Some(r) = schema_ref {
+            let expanded_ref = if let Some(cached) = self.expanded_schema_cache.get(&r) {
+                cached.clone()
+            } else {
+                debug!("Expanding top-level schema ref of '{}'...", r);
+                let unexpanded = self.get_schema_by_name(&r)?;
+                let expanded = self.expand_schema_references(&unexpanded)?;
+                self.expanded_schema_cache
+                    .insert(r.clone(), expanded.clone());
+                expanded
+            };
+
+            let obj = schema.as_object_mut().unwrap();
+            obj.shift_remove("$ref");
+
+            let mut new_schema = expanded_ref.clone();
+            nested_merge(&mut new_schema, &Value::Object(obj.clone()));
+            schema = new_schema;
+        }
+
+        if let Some(items) = schema.get("items").cloned()
+            && items.get("$ref").is_some()
+        {
+            let expanded_items = self.expand_schema_references(&items)?;
+            let items_mut = schema.get_mut("items").unwrap().as_object_mut().unwrap();
+            items_mut.shift_remove("$ref");
+
+            let mut new_items = expanded_items;
+            nested_merge(&mut new_items, &Value::Object(items_mut.clone()));
+            *schema.get_mut("items").unwrap() = new_items;
+        }
+
+        if let Some(Value::Object(properties)) = schema.get_mut("properties") {
+            for (_, prop_schema) in properties.iter_mut() {
+                *prop_schema = self.expand_schema_references(&prop_schema.clone())?;
+            }
+        }
+
+        for key in &["allOf", "oneOf", "anyOf"] {
+            if let Some(Value::Array(arr)) = schema.get_mut(*key) {
+                let mut new_arr = Vec::new();
+                for subschema in arr.iter() {
+                    new_arr.push(self.expand_schema_references(subschema)?);
+                }
+                *arr = new_arr;
+            }
+        }
+
+        if original_title.is_some() || original_description.is_some() {
+            let obj = schema.as_object_mut().unwrap();
+            if let Some(t) = original_title {
+                obj.insert("title".to_string(), t);
+            } else {
+                obj.shift_remove("title");
+            }
+            if let Some(d) = original_description {
+                obj.insert("description".to_string(), d);
+            } else {
+                obj.shift_remove("description");
+            }
+        }
+
+        Ok(schema)
+    }
+}
diff --git a/vdev/src/commands/build/component_docs/schema_enum.rs b/vdev/src/commands/build/component_docs/schema_enum.rs
new file mode 100644
index 0000000000000..0f0467647214b
--- /dev/null
+++ b/vdev/src/commands/build/component_docs/schema_enum.rs
@@ -0,0 +1,413 @@
+use super::{SchemaContext, get_schema_metadata, schema_aware_nested_merge};
+use anyhow::{Result, bail};
+use indexmap::IndexMap;
+use serde_json::{Map, Value, json};
+use std::collections::HashSet;
+
+impl SchemaContext {
+    #[allow(clippy::too_many_lines)]
+    pub fn resolve_enum_schema(&mut self, schema: &Value) -> Result<Value> {
+        let mut subschemas = match (schema.get("oneOf"), schema.get("anyOf")) {
+            (Some(Value::Array(arr)), None) | (None, Some(Value::Array(arr))) => arr.clone(),
+            _ => bail!(
+                "Enum schema had both `oneOf` and `anyOf` specified (or neither). Schema: {schema}"
+            ),
+        };
+
+        let is_optional = get_schema_metadata(schema, "docs::optional")
+            .and_then(serde_json::Value::as_bool)
+            .unwrap_or(false);
+        subschemas.retain(|sub| {
+            sub.get("type").and_then(|t| t.as_str()) != Some("null")
+                && get_schema_metadata(sub, "docs::hidden").is_none()
+        });
+
+        let subschema_count = subschemas.len();
+
+        if is_optional && subschema_count == 1 {
+            let sub = &subschemas[0];
+            if self.get_json_schema_type(sub) == Some("all-of") {
+                debug!("Detected optional all-of schema, unwrapping all-of schema to resolve...");
+                let mut unwrapped = schema.clone();
+                let obj = unwrapped.as_object_mut().unwrap();
+                obj.shift_remove("oneOf");
+                obj.shift_remove("anyOf");
+                obj.insert("allOf".to_string(), sub.get("allOf").unwrap().clone());
+                return Ok(json!({ "_resolved": self.resolve_schema(&unwrapped)? }));
+            }
+            let mut unwrapped = schema.clone();
+            let obj = unwrapped.as_object_mut().unwrap();
+            obj.shift_remove("oneOf");
+            obj.shift_remove("anyOf");
+            schema_aware_nested_merge(&mut unwrapped, sub);
+            return Ok(json!({ "_resolved": self.resolve_schema(&unwrapped)? }));
+        }
+
+        let Some(enum_tagging) =
+            get_schema_metadata(schema, "docs::enum_tagging").and_then(|v| v.as_str())
+        else {
+            bail!(
+                "Enum schemas should never be missing the metadata for the enum tagging mode. Schema: {schema}"
+            );
+        };
+        let enum_tag_field =
+            get_schema_metadata(schema, "docs::enum_tag_field").and_then(|v| v.as_str());
+
+        // Pattern: X or array of X
+        if subschema_count == 2 {
+            let array_idx = subschemas
+                .iter()
+                .position(|s| s.get("type").and_then(|t| t.as_str()) == Some("array"));
+            if let Some(idx) = array_idx {
+                debug!(
+                    "Detected likely 'X or array of X' enum schema, applying further validation..."
+                );
+                let single_idx = usize::from(idx == 0);
+
+                let single_reduced = self.get_reduced_schema(&subschemas[single_idx]);
+                let array_reduced = self.get_reduced_schema(&subschemas[idx]);
+
+                if Some(&single_reduced) == array_reduced.get("items") {
+                    debug!("Reduced schemas match, fully resolving schema for X...");
+                    let mut single_subschema = subschemas[single_idx].clone();
+                    if self.get_json_schema_type(&single_subschema)
+                        == schema.get("default").map(|d| super::json_type_str(d))
+                    {
+                        single_subschema.as_object_mut().unwrap().insert(
+                            "default".to_string(),
+                            schema.get("default").unwrap().clone(),
+                        );
+                    }
+
+                    let resolved_subschema = self.resolve_schema(&single_subschema)?;
+                    debug!("Resolved as 'X or array of X' enum schema.");
+                    return Ok(
+                        json!({ "_resolved": resolved_subschema, "annotations": "single_or_array" }),
+                    );
+                }
+            }
+        }
+
+        // Pattern: simple internally tagged enum with named fields
+        if enum_tagging == "internal" {
+            debug!("Resolving enum subschemas to detect 'object'-ness...");
+            let mut resolved_subschemas = Vec::new();
+            for sub in &subschemas {
+                let resolved = self.resolve_schema(sub)?;
+                if self.resolved_schema_type(&resolved) == Some("object") {
+                    resolved_subschemas.push(resolved);
+                }
+            }
+
+            if resolved_subschemas.len() == subschema_count {
+                debug!("Detected likely 'internally-tagged with named fields' enum schema...");
+                let mut unique_resolved_properties = Map::new();
+                let mut unique_tag_values: IndexMap<String, Value> = IndexMap::new();
+                let tag_field = enum_tag_field.unwrap();
+
+                for resolved_subschema in &mut resolved_subschemas {
+                    let title = resolved_subschema.get("title").cloned();
+                    let desc = resolved_subschema.get("description").cloned();
+
+                    let opts = resolved_subschema
+                        .pointer_mut("/type/object/options")
+                        .unwrap()
+                        .as_object_mut()
+                        .unwrap();
+                    let mut tag_subschema = opts.shift_remove(tag_field).unwrap();
+
+                    if let Some(t) = title {
+                        tag_subschema
+                            .as_object_mut()
+                            .unwrap()
+                            .insert("title".to_string(), t);
+                    }
+                    if let Some(d) = desc {
+                        tag_subschema
+                            .as_object_mut()
+                            .unwrap()
+                            .insert("description".to_string(), d);
+                    }
+
+                    let mut tag_value = None;
+                    for allowed in ["string", "number", "integer", "boolean"] {
+                        if let Some(const_val) =
+                            tag_subschema.pointer(&format!("/type/{allowed}/const/value"))
+                        {
+                            if let Some(s) = const_val.as_str() {
+                                tag_value = Some(s.to_string());
+                            } else {
+                                tag_value = Some(const_val.to_string());
+                            }
+                            break;
+                        }
+                        if let Some(enum_vals) = tag_subschema
+                            .pointer(&format!("/type/{allowed}/enum"))
+                            .and_then(|v| v.as_object())
+                            && let Some(first_key) = enum_vals.keys().next()
+                        {
+                            tag_value = Some(first_key.clone());
+                            break;
+                        }
+                    }
+
+                    let Some(tag_val_str) = tag_value else {
+                        bail!(
+                            "All enum subschemas representing an internally-tagged enum must have the tag field use a const value. Tag field: '{tag_field}', subschema: {tag_subschema}"
+                        );
+                    };
+
+                    if unique_tag_values.contains_key(&tag_val_str) {
+                        bail!(
+                            "Found duplicate tag value '{tag_val_str}' when resolving enum subschemas. Tag field: '{tag_field}'."
+                        );
+                    }
+                    unique_tag_values.insert(tag_val_str.clone(), tag_subschema.clone());
+
+                    for (prop_name, prop_schema) in opts.iter_mut() {
+                        if let Some(existing) = unique_resolved_properties.get_mut(prop_name) {
+                            let reduced_existing = self.get_reduced_resolved_schema(existing);
+                            let reduced_new = self.get_reduced_resolved_schema(prop_schema);
+                            if reduced_existing != reduced_new {
+                                bail!(
+                                    "Had overlapping property '{prop_name}' from resolved enum subschema, but schemas differed. Existing: {reduced_existing}, new: {reduced_new}."
+                                );
+                            }
+                            existing
+                                .get_mut("relevant_when")
+                                .unwrap()
+                                .as_array_mut()
+                                .unwrap()
+                                .push(Value::String(tag_val_str.clone()));
+                        } else {
+                            prop_schema
+                                .as_object_mut()
+                                .unwrap()
+                                .insert("relevant_when".to_string(), json!([tag_val_str.clone()]));
+                            unique_resolved_properties
+                                .insert(prop_name.clone(), prop_schema.clone());
+                        }
+                    }
+                }
+
+                let unique_tags: HashSet<String> = unique_tag_values.keys().cloned().collect();
+                for (_, val) in &mut unique_resolved_properties {
+                    let val_obj = val.as_object_mut().unwrap();
+                    if let Some(Value::Array(relevant)) = val_obj.get("relevant_when") {
+                        let rel_set: HashSet<String> = relevant
+                            .iter()
+                            .map(|v| v.as_str().unwrap().to_string())
+                            .collect();
+                        if rel_set.len() == unique_tags.len() && rel_set == unique_tags {
+                            val_obj.shift_remove("relevant_when");
+                        } else {
+                            let mapped: Vec<String> = relevant
+                                .iter()
+                                .map(|v| format!("{tag_field} = {v}"))
+                                .collect();
+                            val_obj.insert(
+                                "relevant_when".to_string(),
+                                Value::String(mapped.join(" or ")),
+                            );
+                        }
+                    }
+                }
+
+                let mut enum_vals = Map::new();
+                for (k, v) in unique_tag_values {
+                    let desc = self.get_rendered_description_from_schema(&v);
+                    enum_vals.insert(k, Value::String(desc));
+                }
+
+                let mut resolved_tag_property_obj = Map::new();
+                resolved_tag_property_obj.insert("required".to_string(), Value::Bool(true));
+                resolved_tag_property_obj.insert(
+                    "type".to_string(),
+                    json!({ "string": { "enum": enum_vals } }),
+                );
+
+                let Some(tag_desc) = get_schema_metadata(schema, "docs::enum_tag_description")
+                else {
+                    bail!(
+                        "A unique tag description must be specified for enums which are internally tagged. Schema: {schema}"
+                    );
+                };
+                resolved_tag_property_obj.insert("description".to_string(), tag_desc.clone());
+
+                unique_resolved_properties.insert(
+                    tag_field.to_string(),
+                    Value::Object(resolved_tag_property_obj),
+                );
+
+                return Ok(
+                    json!({ "_resolved": { "type": { "object": { "options": unique_resolved_properties } } } }),
+                );
+            }
+        }
+
+        // Schema pattern: simple externally tagged enum with only unit variants.
+        if enum_tagging == "external" {
+            let mut tag_values: IndexMap<String, Value> = IndexMap::new();
+            let mut all_const_strings = true;
+
+            for subschema in &subschemas {
+                if let Some(const_val) = subschema.get("const") {
+                    if let Some(s) = const_val.as_str() {
+                        tag_values.insert(s.to_string(), subschema.clone());
+                    } else {
+                        all_const_strings = false;
+                        break;
+                    }
+                } else {
+                    all_const_strings = false;
+                    break;
+                }
+            }
+
+            if all_const_strings && !tag_values.is_empty() {
+                debug!("Resolved as 'externally-tagged with only unit variants' enum schema.");
+                let mut enum_vals = Map::new();
+                for (k, v) in tag_values {
+                    let desc = self.get_rendered_description_from_schema(&v);
+                    enum_vals.insert(k, Value::String(desc));
+                }
+                return Ok(json!({ "_resolved": { "type": { "string": { "enum": enum_vals } } } }));
+            }
+        }
+
+        // Schema pattern: untagged enum with narrowing constant variants and catch-all free-form variant.
+        if enum_tagging == "untagged" {
+            let mut type_def_kinds: Vec<String> = Vec::new();
+            let mut fixed_subschemas = 0;
+            let mut freeform_subschemas = 0;
+
+            for subschema in &subschemas {
+                let schema_type = self.get_json_schema_type(subschema);
+                match schema_type {
+                    None | Some("all-of" | "one-of") => {
+                        // We don't handle these cases.
+                    }
+                    Some("const") => {
+                        if let Some(const_val) = subschema.get("const") {
+                            type_def_kinds.push(super::docs_type_str(const_val).to_string());
+                        }
+                        fixed_subschemas += 1;
+                    }
+                    Some("enum") => {
+                        if let Some(Value::Array(enum_vals)) = subschema.get("enum") {
+                            for val in enum_vals {
+                                type_def_kinds.push(super::docs_type_str(val).to_string());
+                            }
+                        }
+                        fixed_subschemas += 1;
+                    }
+                    Some(t) => {
+                        type_def_kinds.push(t.to_string());
+                        freeform_subschemas += 1;
+                    }
+                }
+            }
+
+            let unique_kinds: HashSet<_> = type_def_kinds.iter().collect();
+            if unique_kinds.len() == 1 && fixed_subschemas >= 1 && freeform_subschemas == 1 {
+                debug!("Resolved as 'untagged with narrowed free-form' enum schema.");
+                let type_def_kind = type_def_kinds.first().unwrap();
+                return Ok(
+                    json!({ "_resolved": { "type": { type_def_kind: {} } }, "annotations": "narrowed_free_form" }),
+                );
+            }
+        }
+
+        // Schema pattern: simple externally tagged enum with only non-unit variants.
+        if enum_tagging == "external" {
+            let all_objects = subschemas
+                .iter()
+                .all(|s| self.get_json_schema_type(s) == Some("object"));
+
+            if all_objects {
+                let mut aggregated_properties = Map::new();
+
+                for subschema in &subschemas {
+                    let resolved_subschema = self.resolve_schema(subschema)?;
+                    if let Some(Value::Object(resolved_properties)) =
+                        resolved_subschema.pointer("/type/object/options")
+                    {
+                        if resolved_properties.len() != 1 {
+                            bail!(
+                                "Expected exactly 1 property for externally-tagged non-unit enum variant, got {len}. Schema: {subschema}",
+                                len = resolved_properties.len()
+                            );
+                        }
+                        let description = self.get_rendered_description_from_schema(subschema);
+                        for (property_name, property_schema) in resolved_properties {
+                            let mut prop = property_schema.clone();
+                            if !description.is_empty() {
+                                prop.as_object_mut().unwrap().insert(
+                                    "description".to_string(),
+                                    Value::String(description.clone()),
+                                );
+                            }
+                            aggregated_properties.insert(property_name.clone(), prop);
+                        }
+                    }
+                }
+
+                if !aggregated_properties.is_empty() {
+                    debug!(
+                        "Resolved as 'externally-tagged with only non-unit variants' enum schema."
+                    );
+                    return Ok(
+                        json!({ "_resolved": { "type": { "object": { "options": aggregated_properties } } } }),
+                    );
+                }
+            }
+        }
+
+        // Fallback schema pattern: mixed-mode enums.
+        debug!("Resolved as 'fallback mixed-mode' enum schema.");
+        debug!("Tagging mode: {}", enum_tagging);
+
+        let mut resolved_subschemas: Vec<Value> = Vec::new();
+        for subschema in &subschemas {
+            let resolved = self.resolve_schema(subschema)?;
+            if !resolved.is_null() {
+                resolved_subschemas.push(resolved);
+            }
+        }
+
+        if resolved_subschemas.is_empty() {
+            return Ok(json!({ "_resolved": { "type": { "*": {} } } }));
+        }
+
+        let mut type_defs = resolved_subschemas[0].clone();
+        for item in resolved_subschemas.iter().skip(1) {
+            schema_aware_nested_merge(&mut type_defs, item);
+        }
+
+        let mut merged_type = type_defs
+            .get("type")
+            .cloned()
+            .unwrap_or_else(|| json!({ "*": {} }));
+
+        if let Value::Object(type_map) = &mut merged_type {
+            for (_, type_def) in type_map.iter_mut() {
+                if let Value::Object(def) = type_def
+                    && let Some(Value::Array(const_arr)) = def.shift_remove("const")
+                {
+                    let mut enum_map = Map::new();
+                    for const_obj in &const_arr {
+                        if let Some(value) = const_obj.get("value").and_then(|v| v.as_str()) {
+                            let desc = self.get_rendered_description_from_schema(const_obj);
+                            enum_map.insert(value.to_string(), Value::String(desc));
+                        }
+                    }
+                    if !enum_map.is_empty() {
+                        def.insert("enum".to_string(), Value::Object(enum_map));
+                    }
+                }
+            }
+        }
+
+        Ok(json!({ "_resolved": { "type": merged_type }, "annotations": "mixed_mode" }))
+    }
+}
diff --git a/vdev/src/commands/build/component_docs/schema_resolve.rs b/vdev/src/commands/build/component_docs/schema_resolve.rs
new file mode 100644
index 0000000000000..7ad4edc7842a3
--- /dev/null
+++ b/vdev/src/commands/build/component_docs/schema_resolve.rs
@@ -0,0 +1,302 @@
+use super::{SchemaContext, docs_type_str, get_schema_metadata, nested_merge};
+use anyhow::{Result, bail};
+use serde_json::{Value, json};
+
+impl SchemaContext {
+    pub fn resolve_schema_by_name(&mut self, schema_name: &str) -> Result<Value> {
+        if let Some(resolved) = self.resolved_schema_cache.get(schema_name) {
+            return Ok(resolved.clone());
+        }
+
+        let schema = self.get_schema_by_name(schema_name)?;
+        let resolved = self.resolve_schema(&schema)?;
+
+        self.resolved_schema_cache
+            .insert(schema_name.to_string(), resolved.clone());
+        Ok(resolved)
+    }
+
+    pub fn resolve_schema(&mut self, schema: &Value) -> Result<Value> {
+        let expanded = self.expand_schema_references(schema)?;
+
+        if get_schema_metadata(&expanded, "docs::hidden").is_some() {
+            debug!("Instructed to skip resolution for the given schema.");
+            return Ok(Value::Null); // Returning null to indicate skipped
+        }
+
+        if let Some(type_override) =
+            get_schema_metadata(&expanded, "docs::type_override").and_then(|t| t.as_str())
+        {
+            let mut resolved = if type_override == "ascii_char" {
+                if let Some(Value::Number(n)) = expanded.get("default") {
+                    if let Some(c) = n.as_u64() {
+                        #[allow(clippy::cast_possible_truncation)]
+                        let c_char = (c as u8) as char;
+                        json!({ "type": { type_override: { "default": c_char.to_string() } } })
+                    } else {
+                        json!({ "type": { type_override: {} } })
+                    }
+                } else {
+                    json!({ "type": { type_override: {} } })
+                }
+            } else {
+                json!({ "type": { type_override: {} } })
+            };
+
+            let desc = self.get_rendered_description_from_schema(&expanded);
+            if !desc.is_empty() {
+                resolved
+                    .as_object_mut()
+                    .unwrap()
+                    .insert("description".to_string(), Value::String(desc));
+            }
+            return Ok(resolved);
+        }
+
+        let mut resolved = self.resolve_bare_schema(&expanded)?;
+        if resolved.is_null() {
+            return Ok(Value::Null);
+        }
+
+        // Remove description from array items
+        if let Some(items_schema) = resolved.pointer_mut("/type/array/items")
+            && let Value::Object(obj) = items_schema
+        {
+            obj.shift_remove("description");
+        }
+
+        self.apply_schema_default_value(&expanded, &mut resolved)?;
+        self.apply_schema_metadata(&expanded, &mut resolved);
+
+        let desc = self.get_rendered_description_from_schema(&expanded);
+        if !desc.is_empty() {
+            resolved
+                .as_object_mut()
+                .unwrap()
+                .insert("description".to_string(), Value::String(desc));
+        }
+
+        if expanded
+            .get("deprecated")
+            .and_then(serde_json::Value::as_bool)
+            .unwrap_or(false)
+        {
+            resolved
+                .as_object_mut()
+                .unwrap()
+                .insert("deprecated".to_string(), Value::Bool(true));
+            if let Some(msg) = get_schema_metadata(&expanded, "deprecated_message") {
+                resolved
+                    .as_object_mut()
+                    .unwrap()
+                    .insert("deprecated_message".to_string(), msg.clone());
+            }
+        }
+
+        if let Some(common) = get_schema_metadata(&expanded, "docs::common") {
+            resolved
+                .as_object_mut()
+                .unwrap()
+                .insert("common".to_string(), common.clone());
+        }
+
+        if let Some(req) = get_schema_metadata(&expanded, "docs::required") {
+            resolved
+                .as_object_mut()
+                .unwrap()
+                .insert("required".to_string(), req.clone());
+        }
+
+        if let Some(warnings) = get_schema_metadata(&expanded, "docs::warnings") {
+            let warnings_array = if let Some(arr) = warnings.as_array() {
+                Value::Array(arr.clone())
+            } else {
+                Value::Array(vec![warnings.clone()])
+            };
+            resolved
+                .as_object_mut()
+                .unwrap()
+                .insert("warnings".to_string(), warnings_array);
+        }
+
+        SchemaContext::reconcile_resolved_schema(&mut resolved);
+
+        Ok(resolved)
+    }
+
+    #[allow(clippy::too_many_lines)]
+    pub fn resolve_bare_schema(&mut self, schema: &Value) -> Result<Value> {
+        let schema_type = self.get_json_schema_type(schema);
+
+        let res = match schema_type {
+            Some("all-of") => {
+                debug!("Resolving composite schema.");
+                if let Some(Value::Array(all_of)) = schema.get("allOf") {
+                    let mut reduced = Value::Null;
+                    for subschema in all_of {
+                        let sub_res = self.resolve_schema(subschema)?;
+                        if !sub_res.is_null() {
+                            nested_merge(&mut reduced, &sub_res);
+                        }
+                    }
+                    if reduced.is_null() {
+                        return Ok(Value::Null);
+                    }
+                    reduced.get("type").cloned().unwrap_or(Value::Null)
+                } else {
+                    Value::Null
+                }
+            }
+            Some("one-of" | "any-of") => {
+                debug!("Resolving enum schema.");
+                let mut wrapped = self.resolve_enum_schema(schema)?;
+                wrapped
+                    .get_mut("_resolved")
+                    .and_then(|r| r.get_mut("type"))
+                    .cloned()
+                    .unwrap_or(Value::Null)
+            }
+            Some("array") => {
+                debug!("Resolving array schema.");
+                let items_resolved = if let Some(items) = schema.get("items") {
+                    self.resolve_schema(items)?
+                } else {
+                    Value::Null
+                };
+                json!({ "array": { "items": items_resolved } })
+            }
+            Some("object") => {
+                debug!("Resolving object schema.");
+                let properties = schema.get("properties").and_then(|p| p.as_object());
+                let mut options = serde_json::Map::new();
+
+                if let Some(props) = properties {
+                    for (prop_name, prop_schema) in props {
+                        debug!("Resolving object property '{}'...", prop_name);
+                        let mut resolved_property = self.resolve_schema(prop_schema)?;
+                        if !resolved_property.is_null() {
+                            self.apply_object_property_fields(
+                                schema,
+                                prop_schema,
+                                prop_name,
+                                &mut resolved_property,
+                            );
+                            options.insert(prop_name.clone(), resolved_property);
+                        }
+                    }
+                }
+
+                if let Some(addl_props) = schema.get("additionalProperties") {
+                    debug!("Handling additional properties.");
+                    let Some(sing_desc) =
+                        get_schema_metadata(schema, "docs::additional_props_description")
+                    else {
+                        bail!(
+                            "Missing 'docs::additional_props_description' metadata for a wildcard field. Schema: {schema}"
+                        );
+                    };
+
+                    let mut resolved_addl = self.resolve_schema(addl_props)?;
+                    if let Value::Object(ref mut map) = resolved_addl {
+                        map.insert("required".to_string(), Value::Bool(true));
+                        map.insert("description".to_string(), sing_desc.clone());
+                        options.insert("*".to_string(), Value::Object(map.clone()));
+                    }
+                }
+
+                json!({ "object": { "options": options } })
+            }
+            Some("string") => {
+                debug!("Resolving string schema.");
+                let mut def = json!({});
+                if let Some(d) = schema.get("default")
+                    && !d.is_null()
+                {
+                    def.as_object_mut()
+                        .unwrap()
+                        .insert("default".to_string(), d.clone());
+                }
+                json!({ "string": def })
+            }
+            Some("number" | "integer") => {
+                debug!("Resolving number schema.");
+                let num_type = get_schema_metadata(schema, "docs::numeric_type")
+                    .and_then(|n| n.as_str())
+                    .unwrap_or("number");
+
+                let mut def = json!({});
+                if let Some(d) = schema.get("default")
+                    && !d.is_null()
+                {
+                    def.as_object_mut()
+                        .unwrap()
+                        .insert("default".to_string(), d.clone());
+                }
+                json!({ num_type: def })
+            }
+            Some("boolean") => {
+                debug!("Resolving boolean schema.");
+                let mut def = json!({});
+                if let Some(d) = schema.get("default")
+                    && !d.is_null()
+                {
+                    def.as_object_mut()
+                        .unwrap()
+                        .insert("default".to_string(), d.clone());
+                }
+                json!({ "bool": def })
+            }
+            Some("const") => {
+                debug!("Resolving const schema.");
+                let const_val = schema.get("const").unwrap();
+                let type_str = self.get_docs_type_for_value(Some(schema), const_val);
+
+                let mut def = json!({ "value": const_val.clone() });
+                let desc = self.get_rendered_description_from_schema(schema);
+                if !desc.is_empty() {
+                    def.as_object_mut()
+                        .unwrap()
+                        .insert("description".to_string(), Value::String(desc));
+                }
+
+                json!({ type_str: { "const": def } })
+            }
+            Some("enum") => {
+                debug!("Resolving enum const schema.");
+                if let Some(Value::Array(enum_vals)) = schema.get("enum") {
+                    let mut grouped: indexmap::IndexMap<String, Vec<Value>> =
+                        indexmap::IndexMap::new();
+                    for val in enum_vals {
+                        let t = docs_type_str(val);
+                        grouped.entry(t.to_string()).or_default().push(val.clone());
+                    }
+                    self.fix_grouped_enums_if_numeric(&mut grouped);
+
+                    let mut res = serde_json::Map::new();
+                    for (k, v) in grouped {
+                        let mut enum_map = serde_json::Map::new();
+                        for item in v {
+                            let key_str = item
+                                .as_str()
+                                .map_or_else(|| item.to_string(), std::string::ToString::to_string);
+                            // Match the shape every other enum site emits: keys map to a
+                            // string description (empty when the schema doesn't carry one).
+                            enum_map.insert(key_str, Value::String(String::new()));
+                        }
+                        res.insert(k, json!({ "enum": enum_map }));
+                    }
+                    Value::Object(res)
+                } else {
+                    Value::Null
+                }
+            }
+            None => {
+                debug!("Resolving unconstrained schema.");
+                json!({ "*": {} })
+            }
+            _ => bail!("Failed to resolve schema: {schema:?}"),
+        };
+
+        Ok(json!({ "type": res }))
+    }
+}
diff --git a/vdev/src/commands/build/component_docs/schema_utils.rs b/vdev/src/commands/build/component_docs/schema_utils.rs
new file mode 100644
index 0000000000000..e147573d36789
--- /dev/null
+++ b/vdev/src/commands/build/component_docs/schema_utils.rs
@@ -0,0 +1,573 @@
+use super::{SchemaContext, get_schema_metadata};
+use anyhow::Result;
+use serde_json::{Map, Value};
+
+/// Render a JSON Schema `const` scalar (string, number, or bool) as a CUE enum
+/// key. CUE enum keys are strings, so non-string scalars are stringified the
+/// same way `serde_json` would print them. Non-scalar values return `None`.
+fn scalar_const_key(value: &Value) -> Option<String> {
+    match value {
+        Value::String(s) => Some(s.clone()),
+        Value::Number(n) => Some(n.to_string()),
+        Value::Bool(b) => Some(b.to_string()),
+        _ => None,
+    }
+}
+
+impl SchemaContext {
+    pub fn get_rendered_description_from_schema(&self, schema: &Value) -> String {
+        let raw_description = schema
+            .get("description")
+            .and_then(|v| v.as_str())
+            .unwrap_or("");
+        let raw_title = schema.get("title").and_then(|v| v.as_str()).unwrap_or("");
+
+        let description = if raw_title.is_empty() {
+            raw_description.to_string()
+        } else {
+            format!("{raw_title}\n\n{raw_description}")
+        };
+        description.trim().to_string()
+    }
+
+    pub fn unwrap_resolved_schema(
+        &mut self,
+        schema_name: &str,
+        friendly_name: &str,
+    ) -> Result<Map<String, Value>> {
+        info!("[*] Resolving schema definition for {}...", friendly_name);
+
+        let resolved_schema = self.resolve_schema_by_name(schema_name)?;
+
+        let unwrapped_obj = resolved_schema
+            .pointer("/type/object/options")
+            .and_then(Value::as_object)
+            .cloned()
+            .ok_or_else(|| {
+                anyhow::anyhow!(
+                    "Configuration types must always resolve to an object schema; '{schema_name}' did not. Resolved: {resolved_schema}"
+                )
+            })?;
+
+        // Recursively sort the entire schema to match Ruby's `sort_hash_nested` logic
+        Ok(Self::sort_hash_nested(&unwrapped_obj))
+    }
+
+    pub fn fix_grouped_enums_if_numeric(
+        &self,
+        grouped: &mut indexmap::IndexMap<String, Vec<Value>>,
+    ) {
+        let mut numeric_vals = Vec::new();
+        if let Some(ints) = grouped.shift_remove("integer") {
+            numeric_vals.extend(ints);
+        }
+        if let Some(nums) = grouped.shift_remove("number") {
+            numeric_vals.extend(nums);
+        }
+
+        if !numeric_vals.is_empty() {
+            let is_integer = numeric_vals.iter().all(|v| v.is_i64() || v.is_u64());
+            let within_uint = numeric_vals.iter().all(serde_json::Value::is_u64);
+            let contains_signed = numeric_vals
+                .iter()
+                .all(|v| v.is_i64() || v.as_i64().is_some());
+
+            let numeric_type = if !is_integer || (!contains_signed && !within_uint) {
+                "float"
+            } else if within_uint {
+                "uint"
+            } else if contains_signed {
+                "int"
+            } else {
+                "float"
+            };
+
+            grouped.insert(numeric_type.to_string(), numeric_vals);
+        }
+    }
+
+    #[allow(clippy::self_only_used_in_recursion)]
+    pub fn get_reduced_schema(&self, schema: &Value) -> Value {
+        let mut reduced = schema.clone();
+        if let Value::Object(ref mut map) = reduced {
+            let allowed_properties = [
+                "type",
+                "const",
+                "enum",
+                "allOf",
+                "oneOf",
+                "$ref",
+                "items",
+                "properties",
+            ];
+            map.retain(|k, _| allowed_properties.contains(&k.as_str()));
+
+            if let Some(items) = map.get_mut("items") {
+                *items = self.get_reduced_schema(items);
+            }
+
+            if let Some(Value::Object(properties)) = map.get_mut("properties") {
+                for (_, prop) in properties.iter_mut() {
+                    *prop = self.get_reduced_schema(prop);
+                }
+            }
+
+            for key in &["allOf", "oneOf"] {
+                if let Some(Value::Array(arr)) = map.get_mut(*key) {
+                    for sub in arr.iter_mut() {
+                        *sub = self.get_reduced_schema(sub);
+                    }
+                }
+            }
+        }
+        reduced
+    }
+
+    #[allow(clippy::self_only_used_in_recursion)]
+    pub fn get_reduced_resolved_schema(&self, schema: &Value) -> Value {
+        let mut reduced = schema.clone();
+        let allowed_types = [
+            "condition",
+            "object",
+            "array",
+            "enum",
+            "const",
+            "string",
+            "bool",
+            "float",
+            "int",
+            "uint",
+        ];
+
+        if let Value::Object(ref mut map) = reduced {
+            map.retain(|k, _| k == "type");
+
+            if let Some(Value::Object(type_defs)) = map.get_mut("type") {
+                type_defs.retain(|k, _| allowed_types.contains(&k.as_str()));
+
+                for (type_name, type_def) in type_defs.iter_mut() {
+                    if type_name == "object" {
+                        if let Value::Object(def_map) = type_def {
+                            def_map.retain(|k, _| k == "options");
+                            if let Some(Value::Object(opts)) = def_map.get_mut("options") {
+                                for (_, prop) in opts.iter_mut() {
+                                    *prop = self.get_reduced_resolved_schema(prop);
+                                }
+                            }
+                        }
+                    } else if type_name == "array" {
+                        if let Value::Object(def_map) = type_def {
+                            def_map.retain(|k, _| k == "items");
+                            if let Some(items) = def_map.get_mut("items") {
+                                *items = self.get_reduced_resolved_schema(items);
+                            }
+                        }
+                    } else if let Value::Object(def_map) = type_def {
+                        def_map.retain(|k, _| allowed_types.contains(&k.as_str()));
+                    }
+                }
+            }
+        }
+        reduced
+    }
+
+    pub fn find_nested_object_property_schema<'a>(
+        &self,
+        schema: &'a Value,
+        property_name: &str,
+    ) -> Option<&'a Value> {
+        if let Some(prop) = schema.get("properties").and_then(|p| p.get(property_name)) {
+            return Some(prop);
+        }
+
+        // Walk oneOf/anyOf/allOf and collect every subschema's matching property.
+        // We can only confidently apply a default through one of these branches if
+        // they all describe the same shape, so compare reduced forms and bail if
+        // they diverge.
+        let mut matches: Vec<&'a Value> = Vec::new();
+        let mut unvisited: Vec<&'a Value> = Vec::new();
+        for key in &["oneOf", "anyOf", "allOf"] {
+            if let Some(Value::Array(arr)) = schema.get(*key) {
+                unvisited.extend(arr.iter());
+            }
+        }
+
+        while let Some(sub) = unvisited.pop() {
+            if let Some(prop) = sub.get("properties").and_then(|p| p.get(property_name)) {
+                matches.push(prop);
+                continue;
+            }
+            for key in &["oneOf", "anyOf", "allOf"] {
+                if let Some(Value::Array(arr)) = sub.get(*key) {
+                    unvisited.extend(arr.iter());
+                }
+            }
+        }
+
+        let first = matches.first()?;
+        let reduced_first = self.get_reduced_schema(first);
+        for other in matches.iter().skip(1) {
+            if self.get_reduced_schema(other) != reduced_first {
+                return None;
+            }
+        }
+        Some(first)
+    }
+
+    pub fn apply_schema_default_value(
+        &self,
+        source_schema: &Value,
+        resolved_schema: &mut Value,
+    ) -> Result<()> {
+        debug!("Applying schema default values.");
+
+        let default_value = match source_schema.get("default") {
+            Some(v) if !v.is_null() => v.clone(),
+            _ => return Ok(()),
+        };
+
+        let default_value_type = self.get_docs_type_for_value(Some(source_schema), &default_value);
+
+        // The resolved schema must declare a type definition matching the default
+        // value's type. Anything else is a schema generation bug, so surface it
+        // loudly rather than silently dropping the default.
+        if resolved_schema
+            .pointer(&format!("/type/{default_value_type}"))
+            .is_none()
+        {
+            anyhow::bail!(
+                "Schema has default value declared that does not match type of resolved schema:\n\
+                 Source schema: {}\n\
+                 Default value: {} (type: {})\n\
+                 Resolved schema: {}",
+                serde_json::to_string_pretty(source_schema)?,
+                serde_json::to_string_pretty(&default_value)?,
+                default_value_type,
+                serde_json::to_string_pretty(resolved_schema)?,
+            );
+        }
+
+        if default_value_type == "object" {
+            let Value::Object(def_obj) = default_value else {
+                anyhow::bail!("Default value typed 'object' was not a JSON object");
+            };
+            let props = resolved_schema
+                .pointer_mut("/type/object/options")
+                .and_then(Value::as_object_mut)
+                .ok_or_else(|| {
+                    anyhow::anyhow!("Resolved object schema is missing /type/object/options")
+                })?;
+
+            for (prop_name, prop_default_value) in def_obj {
+                if prop_default_value.is_null() {
+                    continue;
+                }
+                let Some(resolved_prop) = props.get_mut(&prop_name) else {
+                    continue;
+                };
+
+                if let Some(source_prop) =
+                    self.find_nested_object_property_schema(source_schema, &prop_name)
+                {
+                    let mut source_with_default = source_prop.clone();
+                    source_with_default
+                        .as_object_mut()
+                        .unwrap()
+                        .insert("default".to_string(), prop_default_value);
+                    self.apply_schema_default_value(&source_with_default, resolved_prop)?;
+                } else {
+                    let value_type = self.get_docs_type_for_value(None, &prop_default_value);
+                    if let Some(Value::Object(type_obj)) = resolved_prop.get_mut("type")
+                        && let Some(Value::Object(type_def)) = type_obj.get_mut(value_type)
+                    {
+                        type_def.insert("default".to_string(), prop_default_value);
+                    }
+                }
+                resolved_prop
+                    .as_object_mut()
+                    .unwrap()
+                    .insert("required".to_string(), Value::Bool(false));
+            }
+        } else {
+            let type_def = resolved_schema
+                .pointer_mut(&format!("/type/{default_value_type}"))
+                .and_then(Value::as_object_mut)
+                .expect("/type/{default_value_type} existence verified above");
+            type_def.insert("default".to_string(), default_value);
+        }
+        Ok(())
+    }
+
+    pub fn apply_schema_metadata(&self, source_schema: &Value, resolved_schema: &mut Value) {
+        let is_templateable = get_schema_metadata(source_schema, "docs::templateable")
+            .and_then(Value::as_bool)
+            .unwrap_or(false);
+
+        if let Some(Value::Object(types)) = resolved_schema.get_mut("type")
+            && let Some(Value::Object(string_def)) = types.get_mut("string")
+            && is_templateable
+        {
+            string_def.insert("syntax".to_string(), Value::String("template".to_string()));
+        }
+
+        if let Some(examples) = get_schema_metadata(source_schema, "docs::examples") {
+            let mut flattened_examples = match examples {
+                Value::Array(arr) => arr.clone(),
+                v => vec![v.clone()],
+            };
+
+            for ex in &mut flattened_examples {
+                if let Value::Object(obj) = ex {
+                    let sorted_obj = Self::sort_hash_nested(obj);
+                    *ex = Value::Object(sorted_obj);
+                }
+            }
+
+            if let Some(Value::Object(type_obj)) = resolved_schema.get_mut("type") {
+                for (type_name, def) in type_obj.iter_mut() {
+                    if let Value::Object(def_map) = def {
+                        if type_name == "array" {
+                            if let Some(Value::Object(items_obj)) = def_map.get_mut("items")
+                                && let Some(Value::Object(subtypes)) = items_obj.get_mut("type")
+                            {
+                                for (subtype_name, subtype_def) in subtypes.iter_mut() {
+                                    if subtype_name != "array"
+                                        && let Value::Object(s_def) = subtype_def
+                                    {
+                                        s_def.insert(
+                                            "examples".to_string(),
+                                            Value::Array(flattened_examples.clone()),
+                                        );
+                                    }
+                                }
+                            }
+                        } else {
+                            def_map.insert(
+                                "examples".to_string(),
+                                Value::Array(flattened_examples.clone()),
+                            );
+                        }
+                    }
+                }
+            }
+        }
+
+        if let Some(type_unit) = get_schema_metadata(source_schema, "docs::type_unit") {
+            let unit_str = match type_unit {
+                Value::String(s) => s.clone(),
+                v => v.to_string(),
+            };
+            if let Some(schema_type) = self.numeric_schema_type(resolved_schema)
+                && let Some(Value::Object(types)) = resolved_schema.get_mut("type")
+                && let Some(Value::Object(def)) = types.get_mut(schema_type)
+            {
+                def.insert("unit".to_string(), Value::String(unit_str));
+            }
+        }
+
+        if let Some(syntax_override) = get_schema_metadata(source_schema, "docs::syntax_override") {
+            let syntax_str = match syntax_override {
+                Value::String(s) => s.clone(),
+                v => v.to_string(),
+            };
+            if self.resolved_schema_type(resolved_schema) == Some("string")
+                && let Some(Value::Object(types)) = resolved_schema.get_mut("type")
+                && let Some(Value::Object(string_def)) = types.get_mut("string")
+            {
+                string_def.insert("syntax".to_string(), Value::String(syntax_str));
+            }
+        }
+    }
+
+    pub fn sort_hash_nested(
+        input: &serde_json::Map<String, Value>,
+    ) -> serde_json::Map<String, Value> {
+        let mut sorted = serde_json::Map::new();
+        let mut keys: Vec<&String> = input.keys().collect();
+        keys.sort();
+        for key in keys {
+            let val = input.get(key).unwrap();
+            let new_val = if let Value::Object(obj) = val {
+                Value::Object(Self::sort_hash_nested(obj))
+            } else {
+                val.clone()
+            };
+            sorted.insert(key.clone(), new_val);
+        }
+        sorted
+    }
+
+    pub fn apply_object_property_fields(
+        &self,
+        parent_schema: &Value,
+        property_schema: &Value,
+        property_name: &str,
+        property: &mut Value,
+    ) {
+        let required_properties = parent_schema.get("required").and_then(|r| r.as_array());
+
+        let has_self_default_value = property_schema.get("default").is_some_and(|v| !v.is_null());
+        let has_parent_default_value = parent_schema
+            .get("default")
+            .and_then(|d| d.get(property_name))
+            .is_some_and(|v| !v.is_null());
+        let has_default_value = has_self_default_value || has_parent_default_value;
+
+        let is_required = required_properties
+            .is_some_and(|reqs| reqs.contains(&Value::String(property_name.to_string())))
+            || property_schema
+                .get("required")
+                .and_then(Value::as_bool)
+                .unwrap_or(false);
+
+        property.as_object_mut().unwrap().insert(
+            "required".to_string(),
+            Value::Bool(is_required && !has_default_value),
+        );
+    }
+
+    pub fn reconcile_resolved_schema(resolved: &mut Value) {
+        let Some(type_obj) = resolved.get("type").and_then(Value::as_object) else {
+            return;
+        };
+
+        if let Some(options) = type_obj
+            .get("object")
+            .and_then(|o| o.get("options"))
+            .and_then(Value::as_object)
+        {
+            let property_keys: Vec<String> = options.keys().cloned().collect();
+            for key in property_keys {
+                if let Some(prop) = resolved
+                    .pointer_mut(&format!("/type/object/options/{key}"))
+                    .filter(|v| v.is_object())
+                {
+                    Self::reconcile_resolved_schema(prop);
+                }
+            }
+            return;
+        }
+
+        let is_required = resolved
+            .get("required")
+            .and_then(Value::as_bool)
+            .unwrap_or(false);
+        if is_required {
+            let type_field_keys: Vec<String> = type_obj.keys().cloned().collect();
+            for type_field in &type_field_keys {
+                let pointer = format!("/type/{type_field}");
+                if let Some(Value::Object(field)) = resolved.pointer_mut(&pointer)
+                    && let Some(Value::Null) = field.get("default")
+                {
+                    field.shift_remove("default");
+                }
+            }
+        }
+
+        let schema_description = resolved
+            .get("description")
+            .and_then(Value::as_str)
+            .map(str::to_owned);
+
+        let type_field_keys: Vec<String> = resolved
+            .get("type")
+            .and_then(Value::as_object)
+            .map(|o| o.keys().cloned().collect())
+            .unwrap_or_default();
+
+        for type_field in &type_field_keys {
+            let const_pointer = format!("/type/{type_field}/const");
+            let Some(const_value) = resolved.pointer(&const_pointer).cloned() else {
+                continue;
+            };
+
+            let entries = match &const_value {
+                Value::Array(items) => items
+                    .iter()
+                    .filter_map(|item| {
+                        let key = scalar_const_key(item.get("value")?)?;
+                        let desc = item
+                            .get("description")
+                            .and_then(Value::as_str)
+                            .unwrap_or("")
+                            .to_string();
+                        Some((key, desc))
+                    })
+                    .collect::<Vec<_>>(),
+                Value::Object(single) => {
+                    let Some(key) = single.get("value").and_then(scalar_const_key) else {
+                        continue;
+                    };
+                    let desc = single
+                        .get("description")
+                        .and_then(Value::as_str)
+                        .map(str::to_owned)
+                        .or_else(|| schema_description.clone())
+                        .unwrap_or_default();
+                    vec![(key, desc)]
+                }
+                _ => continue,
+            };
+
+            let mut enum_map = Map::new();
+            for (key, desc) in entries {
+                enum_map.insert(key, Value::String(desc));
+            }
+
+            if let Some(Value::Object(field)) = resolved.pointer_mut(&format!("/type/{type_field}"))
+            {
+                field.shift_remove("const");
+                field.insert("enum".to_string(), Value::Object(enum_map));
+            }
+        }
+    }
+
+    pub fn numeric_schema_type(&self, resolved_schema: &Value) -> Option<&'static str> {
+        let schema_type = self.resolved_schema_type(resolved_schema)?;
+        if matches!(schema_type, "uint" | "int" | "float") {
+            Some(schema_type)
+        } else {
+            None
+        }
+    }
+
+    pub fn resolved_schema_type(&self, resolved_schema: &Value) -> Option<&'static str> {
+        if let Some(Value::Object(types)) = resolved_schema.get("type")
+            && types.len() == 1
+        {
+            let type_name = types.keys().next().unwrap();
+            return match type_name.as_str() {
+                "object" => Some("object"),
+                "array" => Some("array"),
+                "string" => Some("string"),
+                "bool" => Some("bool"),
+                "uint" => Some("uint"),
+                "int" => Some("int"),
+                "float" => Some("float"),
+                "condition" => Some("condition"),
+                "enum" => Some("enum"),
+                "const" => Some("const"),
+                "*" => Some("*"),
+                _ => None,
+            };
+        }
+        None
+    }
+
+    pub fn get_docs_type_for_value(&self, schema: Option<&Value>, value: &Value) -> &'static str {
+        let value_type = super::json_type_str(value);
+        if matches!(value_type, "number" | "integer")
+            && let Some(s) = schema
+            && let Some(numeric_type) =
+                get_schema_metadata(s, "docs::numeric_type").and_then(|n| n.as_str())
+        {
+            return match numeric_type {
+                "uint" => "uint",
+                "int" => "int",
+                "float" => "float",
+                _ => super::docs_type_str(value),
+            };
+        }
+        super::docs_type_str(value)
+    }
+}
diff --git a/vdev/src/commands/build/mod.rs b/vdev/src/commands/build/mod.rs
index f46d8a8ae210c..6edd74dcf13a5 100644
--- a/vdev/src/commands/build/mod.rs
+++ b/vdev/src/commands/build/mod.rs
@@ -1,3 +1,4 @@
+mod component_docs;
 mod licenses;
 mod publish_metadata;
 mod vector;
@@ -16,10 +17,6 @@ crate::cli_subcommands! {
     vrl_wasm,
 }
 
-crate::script_wrapper! {
-    component_docs = "Build component documentation"
-        => "generate-component-docs.rb"
-}
 crate::script_wrapper! {
     manifests = "Build Kubernetes manifests from latest Helm chart"
         => "generate-manifests.sh"
diff --git a/website/cue/reference/components/sinks/generated/greptimedb_logs.cue b/website/cue/reference/components/sinks/generated/greptimedb_logs.cue
index ae7e4a444700c..5ec0bd5524e08 100644
--- a/website/cue/reference/components/sinks/generated/greptimedb_logs.cue
+++ b/website/cue/reference/components/sinks/generated/greptimedb_logs.cue
@@ -152,13 +152,10 @@ generated: components: sinks: greptimedb_logs: configuration: {
 			Note that these headers will override the existing headers.
 			"""
 		required: false
-		type: object: {
-			examples: [{}]
-			options: "*": {
-				description: "Extra header key-value pairs."
-				required:    true
-				type: string: {}
-			}
+		type: object: options: "*": {
+			description: "Extra header key-value pairs."
+			required:    true
+			type: string: {}
 		}
 	}
 	extra_params: {

From e109afcff7b4d0d58bf710c797b5028c2d067250 Mon Sep 17 00:00:00 2001
From: st-omarkhalid <omar.khalid@startree.ai>
Date: Wed, 6 May 2026 10:19:22 -0500
Subject: [PATCH 201/326] docs(external): add docker run example in
 distribution README (#25268)

* docs(external): add docker run example in distribution README

Closes #22616.

The "Configuring" section referenced an example via "As shown above..."
that didn't exist. Replace the dangling reference with a concrete
`docker run` invocation that mounts a host config file and passes it
to Vector via the `-c` flag.

* Remove changelog

---------

Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 distribution/docker/README.md | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/distribution/docker/README.md b/distribution/docker/README.md
index 71cef83c6a4e8..e8c28e1c449a6 100644
--- a/distribution/docker/README.md
+++ b/distribution/docker/README.md
@@ -33,9 +33,18 @@ observability data with Vector.
 
 ## Configuring
 
-As shown above, you can pass a custom
-[Vector configuration file][docs.setup.configuration] via the `-c` flag. You'll want
-to do this since the
+You can pass a custom
+[Vector configuration file][docs.setup.configuration] to the container via the
+`-c` flag, mounting the file from the host:
+
+```bash
+docker run \
+  -v "$PWD/vector.yaml:/etc/vector/vector.yaml:ro" \
+  timberio/vector:latest-alpine \
+  -c /etc/vector/vector.yaml
+```
+
+You'll want to do this since the
 [default `/etc/vector/vector.yaml` configuration file][urls.default_configuration]
 doesn't do anything.
 

From 66e25a90bec1e3b3def56f0c00ae49d8e71260e5 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 6 May 2026 11:23:25 -0400
Subject: [PATCH 202/326] fix(tests): use single agent to fix e2e
 datadog-metrics histogram flakiness (#25363)

fix(tests): use single agent with additional_endpoints to fix e2e datadog-metrics histogram flakiness
---
 tests/e2e/datadog-metrics/README.md           | 15 +++----
 tests/e2e/datadog-metrics/config/compose.yaml | 39 ++++++-------------
 .../data/{agent_only.yaml => agent.yaml}      |  7 +++-
 .../datadog-metrics/data/agent_vector.yaml    | 29 --------------
 4 files changed, 26 insertions(+), 64 deletions(-)
 rename tests/e2e/datadog-metrics/data/{agent_only.yaml => agent.yaml} (63%)
 delete mode 100644 tests/e2e/datadog-metrics/data/agent_vector.yaml

diff --git a/tests/e2e/datadog-metrics/README.md b/tests/e2e/datadog-metrics/README.md
index 07f0361f9ac6a..e9ec3f66a2d7f 100644
--- a/tests/e2e/datadog-metrics/README.md
+++ b/tests/e2e/datadog-metrics/README.md
@@ -4,15 +4,16 @@ This e2e test covers the `datadog_agent` source, and the
 An emitter compose service runs a python DogStatsD program,
 to generate various metric types for the test cases.
 
-Two Agent containers are spun up to receive the metrics, one
-for the Agent only case and one for the Agent -> Vector case.
+A single Agent container receives the metrics and forwards them to two
+destinations simultaneously via `dd_url` and `additional_endpoints`:
 
-In the Agent only case, the Agent sends the metrics to `fakeintake`
-(another service) directly. This is the baseline.
+1. `fakeintake-agent` directly — the baseline.
+2. `vector`, which then forwards to `fakeintake-vector` — the compare case.
 
-In the Agent-Vector case, the Agent send the metrics to the vector
-service, and the `datadog_metrics` sink sends to a separate
-`fakeintake` service. This is the compare case.
+Using a single agent ensures both paths receive the same computed metric
+values from the same flush window, making histogram statistics (avg, median,
+percentiles) directly comparable. Previously, two independent agents could
+compute different histogram values due to offset flush boundaries.
 
 The two sets of data should be shaped the same in terms of when
 the events were received, and the content of the events, but the
diff --git a/tests/e2e/datadog-metrics/config/compose.yaml b/tests/e2e/datadog-metrics/config/compose.yaml
index 6a317c156182f..e82aa31e5fd67 100644
--- a/tests/e2e/datadog-metrics/config/compose.yaml
+++ b/tests/e2e/datadog-metrics/config/compose.yaml
@@ -1,47 +1,32 @@
 version: "3"
 
 services:
-  # Emits metrics to the Agent only path
-  dogstatsd-client-agent:
+  # Emits metrics to the Agent
+  dogstatsd-client:
     build: ../dogstatsd_client
     environment:
       - STATSD_HOST=datadog-agent
     depends_on:
       - datadog-agent
 
-  # Emits metrics to the Agent-Vector path
-  dogstatsd-client-vector:
-    build: ../dogstatsd_client
-    environment:
-      - STATSD_HOST=datadog-agent-vector
-    depends_on:
-      - datadog-agent-vector
-
-  # Sends metric data received from the Emitter to the `fakeintake-agent` service
+  # Receives DogStatsD metrics and forwards them to two destinations:
+  #   1. fakeintake-agent directly (dd_url) — the baseline
+  #   2. vector (additional_endpoints) — which then forwards to fakeintake-vector
+  # Using a single agent ensures both paths see the same computed values
+  # (same flush window, identical histogram statistics).
   datadog-agent:
     image: docker.io/datadog/agent:${CONFIG_AGENT_VERSION}
     depends_on:
       - fakeintake-agent
-    environment:
-      - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
-      - DD_HOSTNAME=datadog-agent
-    volumes:
-      # The Agent config file
-      - ../data/agent_only.yaml:/etc/datadog-agent/datadog.yaml
-
-  # Sends metric data received from the Emitter to the `vector` service
-  datadog-agent-vector:
-    image: docker.io/datadog/agent:${CONFIG_AGENT_VERSION}
-    depends_on:
       - vector
     environment:
       - DD_API_KEY=${TEST_DATADOG_API_KEY:?TEST_DATADOG_API_KEY required}
-      - DD_HOSTNAME=datadog-agent-vector
+      - DD_HOSTNAME=datadog-agent
     volumes:
       # The Agent config file
-      - ../data/agent_vector.yaml:/etc/datadog-agent/datadog.yaml
+      - ../data/agent.yaml:/etc/datadog-agent/datadog.yaml
 
-  # Receives metric data from the `datadog-agent-vector` service and sends
+  # Receives metric data from the `datadog-agent` via additional_endpoints and sends
   # to the `fakeintake-vector` service.
   vector:
     depends_on:
@@ -61,13 +46,13 @@ services:
     volumes:
       - ../../../..:/home/vector
 
-  # Receives metric data from the `datadog-agent` service. Is queried by the test runner
+  # Receives metric data from the `datadog-agent` directly. Is queried by the test runner
   # which does the validation of consistency with the other fakeintake service.
   fakeintake-agent:
     # TODO: temporarily pegging the image as latest results in failures
     image: docker.io/datadog/fakeintake:v77a06f2b
 
-  # Receives metric data from the `datadog-agent-vector` service. Is queried by the test runner
+  # Receives metric data from the `vector` service. Is queried by the test runner
   # which does the validation of consistency with the other fakeintake service.
   fakeintake-vector:
     # TODO: temporarily pegging the image as latest results in failures
diff --git a/tests/e2e/datadog-metrics/data/agent_only.yaml b/tests/e2e/datadog-metrics/data/agent.yaml
similarity index 63%
rename from tests/e2e/datadog-metrics/data/agent_only.yaml
rename to tests/e2e/datadog-metrics/data/agent.yaml
index 6b69a11cdf2cc..f721db7051122 100644
--- a/tests/e2e/datadog-metrics/data/agent_only.yaml
+++ b/tests/e2e/datadog-metrics/data/agent.yaml
@@ -22,5 +22,10 @@ logs_enabled: false
 use_dogstatsd: true
 dogstatsd_non_local_traffic: true
 
-# configure metrics
+# Send metrics directly to fakeintake-agent as the baseline, and also forward
+# the same payloads to Vector so both paths receive identical computed values
+# (same flush window, same histogram statistics).
 dd_url: http://fakeintake-agent:80
+additional_endpoints:
+  "http://vector:8181":
+    - DEADBEEF
diff --git a/tests/e2e/datadog-metrics/data/agent_vector.yaml b/tests/e2e/datadog-metrics/data/agent_vector.yaml
deleted file mode 100644
index 22709586bbd7b..0000000000000
--- a/tests/e2e/datadog-metrics/data/agent_vector.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-api_key: DEADBEEF
-log_level: "warn"
-
-# disable bunch of stuff we don't need
-inventories_configuration_enabled: false
-enable_gohai: false
-cloud_provider_metadata: []
-
-apm_config:
-  enabled: false
-
-process_config:
-  container_collection:
-    enabled: false
-  process_discovery:
-    enabled: false
-  disable_realtime_checks: true
-
-logs_enabled: false
-
-# configure dogstatsd
-use_dogstatsd: true
-dogstatsd_non_local_traffic: true
-
-# send to vector
-vector:
-  metrics:
-    enabled: true
-    url: "http://vector:8181"

From e6c0e3f6c46dd38b3c601c473149e07f5b71eb9e Mon Sep 17 00:00:00 2001
From: Flavio Cruz <87035001+flaviofcruz@users.noreply.github.com>
Date: Wed, 6 May 2026 11:38:07 -0400
Subject: [PATCH 203/326] feat(sinks): add new databricks_zerobus for
 Databricks ingestion (#24840)

* feat(databricks zerobus): add new databricks_zerobus for ingesting data into Databricks

* Some cosmetic changes

* Add generated file

* Force direct connection when proxy is disabled to avoid the sdk to pick up the environment variables

* Throw a config error is proxy url is invalid. Use direct connection if no URL is set up

* Add test to confirm we always cap at 10MB for the batch size

* Bump the zerobus SDK

* Bump the zerobus SDK again

* Use the new zerobus sdk builder

* Address pront's comments

* Try to fix Cargo.lock

* Ensure we always close the stream even when we get retryable errors

* Always wait for acknowledgments from the SDK

* Use 2.1 UC API

* Bump VRL which was downgraded due to the cargo proxy

* Do not downgrade rustls-webpki

* Update docs to address comments

* Bump Zerobus SDK SHA to avoid log noisiness
---
 .github/actions/spelling/expect.txt           |   2 +
 Cargo.lock                                    | 205 ++++-
 Cargo.toml                                    |   5 +
 LICENSE-3rdparty.csv                          |   2 +
 .../24840_databricks_zerobus_sink.feature.md  |   3 +
 lib/codecs/src/encoding/encoder.rs            |  68 +-
 lib/codecs/src/encoding/format/arrow.rs       |  13 +
 lib/codecs/src/encoding/format/mod.rs         |   2 +
 lib/codecs/src/encoding/format/proto_batch.rs | 284 +++++++
 lib/codecs/src/encoding/mod.rs                |   9 +-
 lib/codecs/src/encoding/serializer.rs         |  18 +-
 src/sinks/aws_s3/config.rs                    |   6 +-
 src/sinks/databricks_zerobus/config.rs        | 444 +++++++++++
 src/sinks/databricks_zerobus/error.rs         | 173 +++++
 src/sinks/databricks_zerobus/mod.rs           |  12 +
 src/sinks/databricks_zerobus/service.rs       | 725 ++++++++++++++++++
 src/sinks/databricks_zerobus/sink.rs          | 123 +++
 .../nested_structs_complete_schema.json       | 127 +++
 .../unity_catalog_schema.rs                   | 478 ++++++++++++
 src/sinks/mod.rs                              |   2 +
 src/sinks/util/encoding.rs                    |   2 -
 .../configuration/sinks/databricks_zerobus.md |  14 +
 .../components/sinks/databricks_zerobus.cue   | 167 ++++
 .../sinks/generated/databricks_zerobus.cue    | 323 ++++++++
 .../reference/services/databricks_zerobus.cue |  10 +
 website/cue/reference/urls.cue                |   2 +
 26 files changed, 3187 insertions(+), 32 deletions(-)
 create mode 100644 changelog.d/24840_databricks_zerobus_sink.feature.md
 create mode 100644 lib/codecs/src/encoding/format/proto_batch.rs
 create mode 100644 src/sinks/databricks_zerobus/config.rs
 create mode 100644 src/sinks/databricks_zerobus/error.rs
 create mode 100644 src/sinks/databricks_zerobus/mod.rs
 create mode 100644 src/sinks/databricks_zerobus/service.rs
 create mode 100644 src/sinks/databricks_zerobus/sink.rs
 create mode 100644 src/sinks/databricks_zerobus/tests/fixtures/nested_structs_complete_schema.json
 create mode 100644 src/sinks/databricks_zerobus/unity_catalog_schema.rs
 create mode 100644 website/content/en/docs/reference/configuration/sinks/databricks_zerobus.md
 create mode 100644 website/cue/reference/components/sinks/databricks_zerobus.cue
 create mode 100644 website/cue/reference/components/sinks/generated/databricks_zerobus.cue
 create mode 100644 website/cue/reference/services/databricks_zerobus.cue

diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index 353de8bdf6f91..beee750db8d5b 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -124,6 +124,7 @@ customizability
 CVS
 cwl
 daschl
+databricks
 dataflows
 datafuselabs
 datasources
@@ -678,6 +679,7 @@ ytt
 YXRR
 yyy
 zieme
+zerobus
 zoog
 zork
 zorp
diff --git a/Cargo.lock b/Cargo.lock
index cb014b2cd372a..afb56a107803f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2067,7 +2067,7 @@ dependencies = [
  "bitflags 2.10.0",
  "cexpr",
  "clang-sys",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "regex",
@@ -3515,6 +3515,32 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "databricks-zerobus-ingest-sdk"
+version = "1.2.0"
+source = "git+https://github.com/databricks/zerobus-sdk-rs?rev=273efe09130a7554e6b34d20b95df50289e58524#273efe09130a7554e6b34d20b95df50289e58524"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "hyper-http-proxy",
+ "hyper-util",
+ "prost 0.13.5",
+ "prost-types 0.13.5",
+ "protoc-bin-vendored",
+ "reqwest 0.12.28",
+ "serde",
+ "serde_json",
+ "smallvec",
+ "thiserror 1.0.68",
+ "tokio",
+ "tokio-retry",
+ "tokio-stream",
+ "tokio-util",
+ "tonic 0.13.1",
+ "tonic-build 0.13.1",
+ "tracing 0.1.44",
+]
+
 [[package]]
 name = "dbl"
 version = "0.3.2"
@@ -4952,13 +4978,28 @@ checksum = "06683b93020a07e3dbcf5f8c0f6d40080d725bea7936fc01ad345c01b97dc270"
 dependencies = [
  "base64 0.21.7",
  "bytes",
- "headers-core",
+ "headers-core 0.2.0",
  "http 0.2.12",
  "httpdate",
  "mime",
  "sha1",
 ]
 
+[[package]]
+name = "headers"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3314d5adb5d94bcdf56771f2e50dbbc80bb4bdf88967526706205ac9eff24eb"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "headers-core 0.3.0",
+ "http 1.3.1",
+ "httpdate",
+ "mime",
+ "sha1",
+]
+
 [[package]]
 name = "headers-core"
 version = "0.2.0"
@@ -4968,6 +5009,15 @@ dependencies = [
  "http 0.2.12",
 ]
 
+[[package]]
+name = "headers-core"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4"
+dependencies = [
+ "http 1.3.1",
+]
+
 [[package]]
 name = "heck"
 version = "0.4.1"
@@ -5426,6 +5476,26 @@ dependencies = [
  "want",
 ]
 
+[[package]]
+name = "hyper-http-proxy"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ad4b0a1e37510028bc4ba81d0e38d239c39671b0f0ce9e02dfa93a8133f7c08"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "headers 0.4.1",
+ "http 1.3.1",
+ "hyper 1.7.0",
+ "hyper-rustls 0.27.5",
+ "hyper-util",
+ "pin-project-lite",
+ "rustls-native-certs 0.7.0",
+ "tokio",
+ "tokio-rustls 0.26.2",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-named-pipe"
 version = "0.1.0"
@@ -5486,7 +5556,7 @@ checksum = "ca815a891b24fdfb243fa3239c86154392b0953ee584aa1a2a1f66d20cbe75cc"
 dependencies = [
  "bytes",
  "futures",
- "headers",
+ "headers 0.3.9",
  "http 0.2.12",
  "hyper 0.14.32",
  "openssl",
@@ -7884,7 +7954,7 @@ dependencies = [
  "prost 0.12.6",
  "prost-build 0.12.6",
  "tonic 0.11.0",
- "tonic-build",
+ "tonic-build 0.11.0",
  "vector-core",
  "vector-lookup",
  "vrl",
@@ -8679,7 +8749,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
  "heck 0.5.0",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "log",
  "multimap",
  "once_cell",
@@ -8712,7 +8782,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
@@ -8725,7 +8795,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
@@ -8772,6 +8842,70 @@ dependencies = [
  "prost 0.14.3",
 ]
 
+[[package]]
+name = "protoc-bin-vendored"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1c381df33c98266b5f08186583660090a4ffa0889e76c7e9a5e175f645a67fa"
+dependencies = [
+ "protoc-bin-vendored-linux-aarch_64",
+ "protoc-bin-vendored-linux-ppcle_64",
+ "protoc-bin-vendored-linux-s390_64",
+ "protoc-bin-vendored-linux-x86_32",
+ "protoc-bin-vendored-linux-x86_64",
+ "protoc-bin-vendored-macos-aarch_64",
+ "protoc-bin-vendored-macos-x86_64",
+ "protoc-bin-vendored-win32",
+]
+
+[[package]]
+name = "protoc-bin-vendored-linux-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c350df4d49b5b9e3ca79f7e646fde2377b199e13cfa87320308397e1f37e1a4c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-ppcle_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55a63e6c7244f19b5c6393f025017eb5d793fd5467823a099740a7a4222440c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-s390_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dba5565db4288e935d5330a07c264a4ee8e4a5b4a4e6f4e83fad824cc32f3b0"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8854774b24ee28b7868cd71dccaae8e02a2365e67a4a87a6cd11ee6cdbdf9cf5"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b38b07546580df720fa464ce124c4b03630a6fb83e05c336fea2a241df7e5d78"
+
+[[package]]
+name = "protoc-bin-vendored-macos-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89278a9926ce312e51f1d999fee8825d324d603213344a9a706daa009f1d8092"
+
+[[package]]
+name = "protoc-bin-vendored-macos-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81745feda7ccfb9471d7a4de888f0652e806d5795b61480605d4943176299756"
+
+[[package]]
+name = "protoc-bin-vendored-win32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3"
+
 [[package]]
 name = "psl"
 version = "2.1.22"
@@ -11783,6 +11917,7 @@ dependencies = [
  "futures-core",
  "futures-io",
  "futures-sink",
+ "futures-util",
  "pin-project-lite",
  "slab",
  "tokio",
@@ -11958,6 +12093,37 @@ dependencies = [
  "tracing 0.1.44",
 ]
 
+[[package]]
+name = "tonic"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e581ba15a835f4d9ea06c55ab1bd4dce26fc53752c69a04aac00703bfb49ba9"
+dependencies = [
+ "async-trait",
+ "axum 0.8.9",
+ "base64 0.22.1",
+ "bytes",
+ "h2 0.4.13",
+ "http 1.3.1",
+ "http-body 1.0.1",
+ "http-body-util",
+ "hyper 1.7.0",
+ "hyper-timeout 0.5.1",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "prost 0.13.5",
+ "rustls-native-certs 0.8.1",
+ "socket2 0.5.10",
+ "tokio",
+ "tokio-rustls 0.26.2",
+ "tokio-stream",
+ "tower 0.5.3",
+ "tower-layer",
+ "tower-service",
+ "tracing 0.1.44",
+]
+
 [[package]]
 name = "tonic"
 version = "0.14.5"
@@ -12003,6 +12169,20 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "tonic-build"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eac6f67be712d12f0b41328db3137e0d0757645d8904b4cb7d51cd9c2279e847"
+dependencies = [
+ "prettyplease",
+ "proc-macro2 1.0.106",
+ "prost-build 0.13.5",
+ "prost-types 0.13.5",
+ "quote 1.0.45",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "tonic-health"
 version = "0.11.0"
@@ -12805,6 +12985,7 @@ dependencies = [
  "criterion",
  "csv",
  "databend-client",
+ "databricks-zerobus-ingest-sdk",
  "deadpool 0.13.0",
  "derivative",
  "dirs-next",
@@ -12827,7 +13008,7 @@ dependencies = [
  "h2 0.4.13",
  "hash_hasher",
  "hashbrown 0.14.5",
- "headers",
+ "headers 0.3.9",
  "heim",
  "hex",
  "hickory-proto 0.26.1",
@@ -12931,7 +13112,7 @@ dependencies = [
  "tokio-util",
  "toml",
  "tonic 0.11.0",
- "tonic-build",
+ "tonic-build 0.11.0",
  "tonic-health",
  "tonic-reflection",
  "tower 0.5.3",
@@ -12974,7 +13155,7 @@ dependencies = [
  "tokio",
  "tokio-stream",
  "tonic 0.11.0",
- "tonic-build",
+ "tonic-build 0.11.0",
  "tonic-health",
 ]
 
@@ -13131,7 +13312,7 @@ dependencies = [
  "float_eq",
  "futures",
  "futures-util",
- "headers",
+ "headers 0.3.9",
  "http 0.2.12",
  "hyper-proxy",
  "indexmap 2.12.0",
@@ -13556,7 +13737,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "headers",
+ "headers 0.3.9",
  "http 0.2.12",
  "hyper 0.14.32",
  "log",
diff --git a/Cargo.toml b/Cargo.toml
index f28e8feabbfd5..5810b5940ddcc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -332,6 +332,9 @@ prost = { workspace = true, optional = true }
 prost-reflect = { workspace = true, optional = true }
 prost-types = { workspace = true, optional = true }
 
+# Databricks Zerobus
+databricks-zerobus-ingest-sdk = { git = "https://github.com/databricks/zerobus-sdk-rs", rev = "273efe09130a7554e6b34d20b95df50289e58524", optional = true }
+
 # GCP
 goauth = { version = "0.16.0", optional = true }
 smpl_jwt = { version = "0.8.0", default-features = false, optional = true }
@@ -828,6 +831,7 @@ sinks-logs = [
   "sinks-clickhouse",
   "sinks-console",
   "sinks-databend",
+  "sinks-databricks-zerobus",
   "sinks-datadog_events",
   "sinks-datadog_logs",
   "sinks-datadog_traces",
@@ -896,6 +900,7 @@ sinks-chronicle = []
 sinks-clickhouse = ["dep:nom", "dep:rust_decimal", "codecs-arrow"]
 sinks-console = []
 sinks-databend = ["dep:databend-client"]
+sinks-databricks-zerobus = ["dep:databricks-zerobus-ingest-sdk", "dep:prost-reflect", "dep:base64"]
 sinks-datadog_events = []
 sinks-datadog_logs = []
 sinks-datadog_metrics = ["protobuf-build", "dep:prost", "dep:prost-reflect"]
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 311b35452684c..7fa52a3e51141 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -218,6 +218,7 @@ dashmap,https://github.com/xacrimon/dashmap,MIT,Acrimon <joel.wejdenstal@gmail.c
 data-encoding,https://github.com/ia0/data-encoding,MIT,Julien Cretin <git@ia0.eu>
 data-url,https://github.com/servo/rust-url,MIT OR Apache-2.0,Simon Sapin <simon.sapin@exyr.org>
 databend-client,https://github.com/databendlabs/bendsql,Apache-2.0,Databend Authors <opensource@databend.com>
+databricks-zerobus-ingest-sdk,https://github.com/databricks/zerobus-sdk,Apache-2.0,Databricks
 dbl,https://github.com/RustCrypto/utils,MIT OR Apache-2.0,RustCrypto Developers
 deadpool,https://github.com/deadpool-rs/deadpool,MIT OR Apache-2.0,Michael P. Jung <michael.jung@terreon.de>
 deadpool-runtime,https://github.com/deadpool-rs/deadpool,MIT OR Apache-2.0,Michael P. Jung <michael.jung@terreon.de>
@@ -353,6 +354,7 @@ httparse,https://github.com/seanmonstar/httparse,MIT OR Apache-2.0,Sean McArthur
 httpdate,https://github.com/pyfisch/httpdate,MIT OR Apache-2.0,Pyfisch <pyfisch@posteo.org>
 humantime,https://github.com/chronotope/humantime,MIT OR Apache-2.0,The humantime Authors
 hyper,https://github.com/hyperium/hyper,MIT,Sean McArthur <sean@seanmonstar.com>
+hyper-http-proxy,https://github.com/metalbear-co/hyper-http-proxy,MIT,MetalBear Tech LTD <hi@metalbear.co>
 hyper-named-pipe,https://github.com/fussybeaver/hyper-named-pipe,Apache-2.0,The hyper-named-pipe Authors
 hyper-openssl,https://github.com/sfackler/hyper-openssl,MIT OR Apache-2.0,Steven Fackler <sfackler@gmail.com>
 hyper-proxy,https://github.com/tafia/hyper-proxy,MIT,Johann Tuffe <tafia973@gmail.com>
diff --git a/changelog.d/24840_databricks_zerobus_sink.feature.md b/changelog.d/24840_databricks_zerobus_sink.feature.md
new file mode 100644
index 0000000000000..34a8ecb1c9224
--- /dev/null
+++ b/changelog.d/24840_databricks_zerobus_sink.feature.md
@@ -0,0 +1,3 @@
+Add a new `databricks_zerobus` sink that streams log data to Databricks Unity Catalog tables via the Zerobus ingestion service. Supports OAuth 2.0 authentication, automatic schema fetching from Unity Catalog, and protobuf batch encoding.
+
+authors: flaviocruz
diff --git a/lib/codecs/src/encoding/encoder.rs b/lib/codecs/src/encoding/encoder.rs
index b3ca9a00216ec..7aac89ed1e100 100644
--- a/lib/codecs/src/encoding/encoder.rs
+++ b/lib/codecs/src/encoding/encoder.rs
@@ -8,10 +8,24 @@ use crate::encoding::ArrowStreamSerializer;
 #[cfg(feature = "parquet")]
 use crate::encoding::ParquetSerializer;
 use crate::{
-    encoding::{Error, Framer, Serializer},
+    encoding::{Error, Framer, ProtoBatchSerializer, Serializer},
     internal_events::{EncoderFramingError, EncoderSerializeError},
 };
 
+/// The output of a batch encoding operation.
+///
+/// Different batch serializers produce different output types:
+/// - Arrow serializer produces a `RecordBatch`
+/// - Proto serializer produces individual byte buffers per event
+#[derive(Debug)]
+pub enum BatchOutput {
+    /// An Arrow RecordBatch containing all events encoded as columnar data.
+    #[cfg(feature = "arrow")]
+    Arrow(arrow::record_batch::RecordBatch),
+    /// A list of individually-serialized records (one per event).
+    Records(Vec<Vec<u8>>),
+}
+
 /// Serializers that support batch encoding (encoding all events at once).
 #[derive(Debug, Clone)]
 pub enum BatchSerializer {
@@ -21,6 +35,8 @@ pub enum BatchSerializer {
     /// Parquet format serializer.
     #[cfg(feature = "parquet")]
     Parquet(Box<ParquetSerializer>),
+    /// Protobuf batch serializer that encodes each event individually.
+    ProtoBatch(ProtoBatchSerializer),
 }
 
 /// An encoder that encodes batches of events.
@@ -41,12 +57,47 @@ impl BatchEncoder {
     }
 
     /// Get the HTTP content type.
+    ///
+    /// Returns `None` for serializers that do not produce a single HTTP body
+    /// (e.g. `ProtoBatch`, which emits one record per event for an out-of-band
+    /// transport rather than an HTTP payload).
     #[cfg(any(feature = "arrow", feature = "parquet"))]
-    pub const fn content_type(&self) -> &'static str {
+    pub const fn content_type(&self) -> Option<&'static str> {
         match &self.serializer {
-            BatchSerializer::Arrow(_) => "application/vnd.apache.arrow.stream",
+            #[cfg(feature = "arrow")]
+            BatchSerializer::Arrow(_) => Some("application/vnd.apache.arrow.stream"),
+            #[cfg(feature = "parquet")]
+            BatchSerializer::Parquet(_) => Some("application/vnd.apache.parquet"),
+            BatchSerializer::ProtoBatch(_) => None,
+        }
+    }
+
+    /// Encode a batch of events into a `BatchOutput`.
+    pub fn encode_batch(&self, events: &[Event]) -> Result<BatchOutput, Error> {
+        match &self.serializer {
+            #[cfg(feature = "arrow")]
+            BatchSerializer::Arrow(serializer) => {
+                let record_batch = serializer.encode_to_record_batch(events).map_err(|err| {
+                    use crate::encoding::ArrowEncodingError;
+                    match err {
+                        ArrowEncodingError::NullConstraint { .. } => {
+                            Error::SchemaConstraintViolation(Box::new(err))
+                        }
+                        _ => Error::SerializingError(Box::new(err)),
+                    }
+                })?;
+                Ok(BatchOutput::Arrow(record_batch))
+            }
+            BatchSerializer::ProtoBatch(serializer) => {
+                let records = serializer
+                    .encode_batch(events)
+                    .map_err(|err| Error::SerializingError(Box::new(err)))?;
+                Ok(BatchOutput::Records(records))
+            }
             #[cfg(feature = "parquet")]
-            BatchSerializer::Parquet(_) => "application/vnd.apache.parquet",
+            BatchSerializer::Parquet(_) => Err(Error::SerializingError(Box::from(
+                "Parquet serializer does not support encode_batch; use the tokio Encoder interface instead",
+            ))),
         }
     }
 }
@@ -56,7 +107,6 @@ impl tokio_util::codec::Encoder<Vec<Event>> for BatchEncoder {
 
     #[allow(unused_variables)]
     fn encode(&mut self, events: Vec<Event>, buffer: &mut BytesMut) -> Result<(), Self::Error> {
-        #[allow(unreachable_patterns)]
         match &mut self.serializer {
             #[cfg(feature = "arrow")]
             BatchSerializer::Arrow(serializer) => {
@@ -74,19 +124,19 @@ impl tokio_util::codec::Encoder<Vec<Event>> for BatchEncoder {
             BatchSerializer::Parquet(serializer) => serializer
                 .encode(events, buffer)
                 .map_err(Error::SerializingError),
-            #[allow(unreachable_patterns)]
-            _ => unreachable!("BatchSerializer cannot be constructed without encode()"),
+            BatchSerializer::ProtoBatch(_) => Err(Error::SerializingError(Box::from(
+                "ProtoBatch serializer does not support the tokio Encoder interface; use BatchEncoder::encode_batch() instead",
+            ))),
         }
     }
 }
 
-/// An wrapper that supports both framed and batch encoding modes.
+/// A wrapper that supports both framed and batch encoding modes.
 #[derive(Debug, Clone)]
 pub enum EncoderKind {
     /// Uses framing to encode individual events
     Framed(Box<Encoder<Framer>>),
     /// Encodes events in batches without framing
-    #[cfg(any(feature = "arrow", feature = "parquet"))]
     Batch(BatchEncoder),
 }
 
diff --git a/lib/codecs/src/encoding/format/arrow.rs b/lib/codecs/src/encoding/format/arrow.rs
index e4b3ca565887f..0c67317b7f926 100644
--- a/lib/codecs/src/encoding/format/arrow.rs
+++ b/lib/codecs/src/encoding/format/arrow.rs
@@ -93,6 +93,19 @@ pub struct ArrowStreamSerializer {
 }
 
 impl ArrowStreamSerializer {
+    /// Encode events into a `RecordBatch` without writing to IPC stream format.
+    pub fn encode_to_record_batch(
+        &self,
+        events: &[Event],
+    ) -> Result<RecordBatch, ArrowEncodingError> {
+        let values = vector_log_events_to_json_values(events).map_err(|e| {
+            ArrowEncodingError::RecordBatchCreation {
+                source: arrow::error::ArrowError::JsonError(e.to_string()),
+            }
+        })?;
+        build_record_batch(self.schema.clone(), &values)
+    }
+
     /// Create a new ArrowStreamSerializer with the given configuration
     pub fn new(config: ArrowStreamSerializerConfig) -> Result<Self, ArrowEncodingError> {
         let schema = config.schema.ok_or(ArrowEncodingError::MissingSchema)?;
diff --git a/lib/codecs/src/encoding/format/mod.rs b/lib/codecs/src/encoding/format/mod.rs
index f760ea5c8dd83..33030fd41ff2e 100644
--- a/lib/codecs/src/encoding/format/mod.rs
+++ b/lib/codecs/src/encoding/format/mod.rs
@@ -18,6 +18,7 @@ mod native_json;
 mod otlp;
 #[cfg(feature = "parquet")]
 mod parquet;
+mod proto_batch;
 mod protobuf;
 mod raw_message;
 #[cfg(feature = "syslog")]
@@ -45,6 +46,7 @@ pub use native::{NativeSerializer, NativeSerializerConfig};
 pub use native_json::{NativeJsonSerializer, NativeJsonSerializerConfig};
 #[cfg(feature = "opentelemetry")]
 pub use otlp::{OtlpSerializer, OtlpSerializerConfig};
+pub use proto_batch::{ProtoBatchEncodingError, ProtoBatchSerializer, ProtoBatchSerializerConfig};
 pub use protobuf::{ProtobufSerializer, ProtobufSerializerConfig, ProtobufSerializerOptions};
 pub use raw_message::{RawMessageSerializer, RawMessageSerializerConfig};
 #[cfg(feature = "syslog")]
diff --git a/lib/codecs/src/encoding/format/proto_batch.rs b/lib/codecs/src/encoding/format/proto_batch.rs
new file mode 100644
index 0000000000000..12fea52d02a25
--- /dev/null
+++ b/lib/codecs/src/encoding/format/proto_batch.rs
@@ -0,0 +1,284 @@
+//! Protobuf batch serializer for encoding events as individual protobuf records.
+//!
+//! Encodes each event in a batch independently into protobuf bytes, producing
+//! a `Vec<Vec<u8>>` where each element is a single serialized protobuf message.
+
+use prost_reflect::{MessageDescriptor, prost::Message as _};
+use snafu::Snafu;
+use std::sync::Arc;
+use vector_config::configurable_component;
+use vector_core::{config::DataType, event::Event, schema};
+use vrl::protobuf::encode::{Options, encode_message};
+
+/// Errors that can occur during protobuf batch encoding
+#[derive(Debug, Snafu)]
+pub enum ProtoBatchEncodingError {
+    /// No events provided
+    #[snafu(display("Cannot encode an empty batch"))]
+    NoEvents,
+
+    /// Unsupported event type
+    #[snafu(display("Unsupported event type: only Log events are supported"))]
+    UnsupportedEventType,
+
+    /// Protobuf encoding failed
+    #[snafu(display("Protobuf encoding failed: {}", source))]
+    EncodingFailed {
+        /// The underlying encoding error
+        source: vector_common::Error,
+    },
+
+    /// Protobuf prost encoding failed
+    #[snafu(display("Protobuf prost encoding failed: {}", source))]
+    ProstEncodingFailed {
+        /// The underlying prost error
+        source: prost_reflect::prost::EncodeError,
+    },
+}
+
+/// Configuration for protobuf batch serialization
+#[configurable_component]
+#[derive(Clone, Default)]
+pub struct ProtoBatchSerializerConfig {
+    /// The protobuf message descriptor to use for encoding.
+    #[serde(skip)]
+    #[configurable(derived)]
+    pub descriptor: Option<MessageDescriptor>,
+}
+
+impl std::fmt::Debug for ProtoBatchSerializerConfig {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ProtoBatchSerializerConfig")
+            .field(
+                "descriptor",
+                &self.descriptor.as_ref().map(|d| d.full_name().to_string()),
+            )
+            .finish()
+    }
+}
+
+impl ProtoBatchSerializerConfig {
+    /// Create a new ProtoBatchSerializerConfig with a message descriptor
+    pub fn new(descriptor: MessageDescriptor) -> Self {
+        Self {
+            descriptor: Some(descriptor),
+        }
+    }
+
+    /// The data type of events that are accepted by this serializer.
+    pub fn input_type(&self) -> DataType {
+        DataType::Log
+    }
+
+    /// The schema required by the serializer.
+    pub fn schema_requirement(&self) -> schema::Requirement {
+        schema::Requirement::empty()
+    }
+}
+
+/// Protobuf batch serializer that encodes each event into individual protobuf bytes.
+#[derive(Clone, Debug)]
+pub struct ProtoBatchSerializer {
+    descriptor: Arc<MessageDescriptor>,
+    options: Options,
+}
+
+impl ProtoBatchSerializer {
+    /// Create a new ProtoBatchSerializer with the given configuration.
+    pub fn new(config: ProtoBatchSerializerConfig) -> Result<Self, vector_common::Error> {
+        let descriptor = config.descriptor.ok_or_else(|| {
+            vector_common::Error::from("Proto batch serializer requires a message descriptor.")
+        })?;
+
+        Ok(Self {
+            descriptor: Arc::new(descriptor),
+            options: Options {
+                use_json_names: false,
+            },
+        })
+    }
+
+    /// Encode a batch of events into individual protobuf byte buffers.
+    pub fn encode_batch(&self, events: &[Event]) -> Result<Vec<Vec<u8>>, ProtoBatchEncodingError> {
+        if events.is_empty() {
+            return Err(ProtoBatchEncodingError::NoEvents);
+        }
+
+        let mut records = Vec::with_capacity(events.len());
+
+        for event in events {
+            let dynamic_message = match event {
+                Event::Log(log) => {
+                    encode_message(&self.descriptor, log.value().clone(), &self.options)
+                }
+                Event::Trace(_) | Event::Metric(_) => {
+                    return Err(ProtoBatchEncodingError::UnsupportedEventType);
+                }
+            }
+            .map_err(|source| ProtoBatchEncodingError::EncodingFailed {
+                source: source.into(),
+            })?;
+
+            records.push(dynamic_message.encode_to_vec());
+        }
+
+        Ok(records)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use prost_reflect::{
+        DescriptorPool, DynamicMessage, Value as ProstValue,
+        prost_types::{
+            DescriptorProto, FieldDescriptorProto, FileDescriptorProto, FileDescriptorSet,
+            field_descriptor_proto::{Label, Type},
+        },
+    };
+    use vector_core::event::{LogEvent, Metric, MetricKind, MetricValue, TraceEvent, Value};
+    use vrl::btreemap;
+
+    fn build_descriptor() -> MessageDescriptor {
+        // message Inner { string label = 1; }
+        let inner = DescriptorProto {
+            name: Some("Inner".to_string()),
+            field: vec![FieldDescriptorProto {
+                name: Some("label".to_string()),
+                number: Some(1),
+                label: Some(Label::Optional as i32),
+                r#type: Some(Type::String as i32),
+                ..Default::default()
+            }],
+            ..Default::default()
+        };
+
+        // message Outer { string name = 1; int64 count = 2; Inner inner = 3; }
+        let outer = DescriptorProto {
+            name: Some("Outer".to_string()),
+            field: vec![
+                FieldDescriptorProto {
+                    name: Some("name".to_string()),
+                    number: Some(1),
+                    label: Some(Label::Optional as i32),
+                    r#type: Some(Type::String as i32),
+                    ..Default::default()
+                },
+                FieldDescriptorProto {
+                    name: Some("count".to_string()),
+                    number: Some(2),
+                    label: Some(Label::Optional as i32),
+                    r#type: Some(Type::Int64 as i32),
+                    ..Default::default()
+                },
+                FieldDescriptorProto {
+                    name: Some("inner".to_string()),
+                    number: Some(3),
+                    label: Some(Label::Optional as i32),
+                    r#type: Some(Type::Message as i32),
+                    type_name: Some(".test.Inner".to_string()),
+                    ..Default::default()
+                },
+            ],
+            nested_type: vec![],
+            ..Default::default()
+        };
+
+        let file = FileDescriptorProto {
+            name: Some("test.proto".to_string()),
+            package: Some("test".to_string()),
+            message_type: vec![outer, inner],
+            syntax: Some("proto3".to_string()),
+            ..Default::default()
+        };
+
+        let pool = DescriptorPool::from_file_descriptor_set(FileDescriptorSet { file: vec![file] })
+            .expect("descriptor pool builds");
+        pool.get_message_by_name("test.Outer")
+            .expect("Outer message exists")
+    }
+
+    fn make_serializer() -> ProtoBatchSerializer {
+        ProtoBatchSerializer::new(ProtoBatchSerializerConfig::new(build_descriptor()))
+            .expect("serializer builds")
+    }
+
+    #[test]
+    fn empty_batch_returns_no_events_error() {
+        let serializer = make_serializer();
+        let err = serializer
+            .encode_batch(&[])
+            .expect_err("empty batch errors");
+        assert!(matches!(err, ProtoBatchEncodingError::NoEvents));
+    }
+
+    #[test]
+    fn metric_event_is_rejected() {
+        let serializer = make_serializer();
+        let metric = Event::Metric(Metric::new(
+            "test",
+            MetricKind::Absolute,
+            MetricValue::Counter { value: 1.0 },
+        ));
+        let err = serializer
+            .encode_batch(&[metric])
+            .expect_err("metric event errors");
+        assert!(matches!(err, ProtoBatchEncodingError::UnsupportedEventType));
+    }
+
+    #[test]
+    fn trace_event_is_rejected() {
+        let serializer = make_serializer();
+        let trace = Event::Trace(TraceEvent::default());
+        let err = serializer
+            .encode_batch(&[trace])
+            .expect_err("trace event errors");
+        assert!(matches!(err, ProtoBatchEncodingError::UnsupportedEventType));
+    }
+
+    #[test]
+    fn round_trip_decode_preserves_field_mapping() {
+        let descriptor = build_descriptor();
+        let serializer =
+            ProtoBatchSerializer::new(ProtoBatchSerializerConfig::new(descriptor.clone()))
+                .expect("serializer builds");
+
+        let event = Event::Log(LogEvent::from(btreemap! {
+            "name" => Value::from("hello"),
+            "count" => Value::from(42_i64),
+            "inner" => Value::from(btreemap! {
+                "label" => Value::from("nested"),
+            }),
+        }));
+
+        let records = serializer
+            .encode_batch(&[event])
+            .expect("encoding succeeds");
+        assert_eq!(records.len(), 1);
+
+        let decoded =
+            DynamicMessage::decode(descriptor, records[0].as_slice()).expect("decode succeeds");
+
+        let name_field = decoded
+            .get_field_by_name("name")
+            .expect("name field present");
+        assert_eq!(name_field.as_str(), Some("hello"));
+
+        let count_field = decoded
+            .get_field_by_name("count")
+            .expect("count field present");
+        assert_eq!(count_field.as_i64(), Some(42));
+
+        let inner_field = decoded
+            .get_field_by_name("inner")
+            .expect("inner field present");
+        let inner_msg = match &*inner_field {
+            ProstValue::Message(m) => m,
+            other => panic!("expected nested message, got {:?}", other),
+        };
+        let label = inner_msg
+            .get_field_by_name("label")
+            .expect("label field present");
+        assert_eq!(label.as_str(), Some("nested"));
+    }
+}
diff --git a/lib/codecs/src/encoding/mod.rs b/lib/codecs/src/encoding/mod.rs
index a9f698f79153d..2c8b485a49d8f 100644
--- a/lib/codecs/src/encoding/mod.rs
+++ b/lib/codecs/src/encoding/mod.rs
@@ -10,7 +10,7 @@ pub mod serializer;
 mod transformer;
 pub use chunking::{Chunker, Chunking, GelfChunker};
 pub use config::{EncodingConfig, EncodingConfigWithFraming, SinkType};
-pub use encoder::{BatchEncoder, BatchSerializer, Encoder, EncoderKind};
+pub use encoder::{BatchEncoder, BatchOutput, BatchSerializer, Encoder, EncoderKind};
 #[cfg(feature = "arrow")]
 pub use format::{
     ArrowEncodingError, ArrowStreamSerializer, ArrowStreamSerializerConfig, SchemaProvider,
@@ -21,7 +21,8 @@ pub use format::{
     CefSerializerConfig, CsvSerializer, CsvSerializerConfig, GelfSerializer, GelfSerializerConfig,
     JsonSerializer, JsonSerializerConfig, JsonSerializerOptions, LogfmtSerializer,
     LogfmtSerializerConfig, NativeJsonSerializer, NativeJsonSerializerConfig, NativeSerializer,
-    NativeSerializerConfig, ProtobufSerializer, ProtobufSerializerConfig,
+    NativeSerializerConfig, ProtoBatchEncodingError, ProtoBatchSerializer,
+    ProtoBatchSerializerConfig, ProtobufSerializer, ProtobufSerializerConfig,
     ProtobufSerializerOptions, RawMessageSerializer, RawMessageSerializerConfig, TextSerializer,
     TextSerializerConfig,
 };
@@ -40,9 +41,7 @@ pub use framing::{
     NewlineDelimitedEncoderConfig, VarintLengthDelimitedEncoder,
     VarintLengthDelimitedEncoderConfig,
 };
-#[cfg(feature = "arrow")]
-pub use serializer::BatchSerializerConfig;
-pub use serializer::{Serializer, SerializerConfig};
+pub use serializer::{BatchSerializerConfig, Serializer, SerializerConfig};
 pub use transformer::{TimestampFormat, Transformer};
 
 /// An error that occurred while building an encoder.
diff --git a/lib/codecs/src/encoding/serializer.rs b/lib/codecs/src/encoding/serializer.rs
index c6081e3e2f274..0a7b07a00fd04 100644
--- a/lib/codecs/src/encoding/serializer.rs
+++ b/lib/codecs/src/encoding/serializer.rs
@@ -10,6 +10,7 @@ use super::format::{ArrowStreamSerializer, ArrowStreamSerializerConfig};
 use super::format::{OtlpSerializer, OtlpSerializerConfig};
 #[cfg(feature = "parquet")]
 use super::format::{ParquetSerializer, ParquetSerializerConfig};
+use super::format::{ProtoBatchSerializer, ProtoBatchSerializerConfig};
 #[cfg(feature = "syslog")]
 use super::format::{SyslogSerializer, SyslogSerializerConfig};
 use super::{
@@ -168,15 +169,24 @@ pub enum BatchSerializerConfig {
     #[cfg(feature = "parquet")]
     #[serde(rename = "parquet")]
     Parquet(ParquetSerializerConfig),
+
+    /// Encodes each event individually as a [Protocol Buffers][protobuf] message.
+    ///
+    /// Each event in the batch is serialized to protobuf bytes independently,
+    /// producing a list of byte buffers (one per event).
+    ///
+    /// [protobuf]: https://protobuf.dev/
+    #[serde(rename = "proto_batch")]
+    ProtoBatch(ProtoBatchSerializerConfig),
 }
 
-#[cfg(any(feature = "arrow", feature = "parquet"))]
 impl BatchSerializerConfig {
     /// Build the batch serializer from this configuration.
     pub fn build_batch_serializer(
         &self,
     ) -> Result<super::BatchSerializer, Box<dyn std::error::Error + Send + Sync + 'static>> {
         match self {
+            #[cfg(feature = "arrow")]
             BatchSerializerConfig::ArrowStream(arrow_config) => {
                 let serializer = ArrowStreamSerializer::new(arrow_config.clone())?;
                 Ok(super::BatchSerializer::Arrow(serializer))
@@ -186,6 +196,10 @@ impl BatchSerializerConfig {
                 let serializer = ParquetSerializer::new(parquet_config.clone())?;
                 Ok(super::BatchSerializer::Parquet(Box::new(serializer)))
             }
+            BatchSerializerConfig::ProtoBatch(proto_config) => {
+                let serializer = ProtoBatchSerializer::new(proto_config.clone())?;
+                Ok(super::BatchSerializer::ProtoBatch(serializer))
+            }
         }
     }
 
@@ -196,6 +210,7 @@ impl BatchSerializerConfig {
             BatchSerializerConfig::ArrowStream(arrow_config) => arrow_config.input_type(),
             #[cfg(feature = "parquet")]
             BatchSerializerConfig::Parquet(parquet_config) => parquet_config.input_type(),
+            BatchSerializerConfig::ProtoBatch(proto_config) => proto_config.input_type(),
         }
     }
 
@@ -206,6 +221,7 @@ impl BatchSerializerConfig {
             BatchSerializerConfig::ArrowStream(arrow_config) => arrow_config.schema_requirement(),
             #[cfg(feature = "parquet")]
             BatchSerializerConfig::Parquet(parquet_config) => parquet_config.schema_requirement(),
+            BatchSerializerConfig::ProtoBatch(proto_config) => proto_config.schema_requirement(),
         }
     }
 }
diff --git a/src/sinks/aws_s3/config.rs b/src/sinks/aws_s3/config.rs
index 05055e6ea0167..6853c57360ac4 100644
--- a/src/sinks/aws_s3/config.rs
+++ b/src/sinks/aws_s3/config.rs
@@ -298,7 +298,7 @@ impl S3SinkConfig {
             // override via `options.content_type`; we only set it when unset.
             let mut api_options = self.options.clone();
             if api_options.content_type.is_none() {
-                api_options.content_type = Some(batch_encoder.content_type().to_string());
+                api_options.content_type = batch_encoder.content_type().map(|s| s.to_string());
             }
 
             let encoder = EncoderKind::Batch(batch_encoder);
@@ -456,7 +456,7 @@ mod tests {
 
         let mut api_options = config.options.clone();
         if api_options.content_type.is_none() {
-            api_options.content_type = Some(batch_encoder.content_type().to_string());
+            api_options.content_type = batch_encoder.content_type().map(|s| s.to_string());
         }
 
         assert_eq!(
@@ -497,7 +497,7 @@ mod tests {
 
         let mut api_options = config.options.clone();
         if api_options.content_type.is_none() {
-            api_options.content_type = Some(batch_encoder.content_type().to_string());
+            api_options.content_type = batch_encoder.content_type().map(|s| s.to_string());
         }
 
         assert_eq!(
diff --git a/src/sinks/databricks_zerobus/config.rs b/src/sinks/databricks_zerobus/config.rs
new file mode 100644
index 0000000000000..275d2c16a251e
--- /dev/null
+++ b/src/sinks/databricks_zerobus/config.rs
@@ -0,0 +1,444 @@
+//! Configuration for the Zerobus sink.
+
+use vector_lib::configurable::configurable_component;
+use vector_lib::sensitive_string::SensitiveString;
+
+use crate::config::{AcknowledgementsConfig, GenerateConfig, Input, SinkConfig, SinkContext};
+use crate::sinks::{
+    prelude::*,
+    util::{BatchConfig, RealtimeSizeBasedDefaultBatchSettings},
+};
+
+use vector_lib::codecs::encoding::{
+    BatchEncoder, BatchSerializerConfig, ProtoBatchSerializerConfig,
+};
+
+use super::{
+    error::ZerobusSinkError,
+    service::{StreamMode, ZerobusService},
+    sink::ZerobusSink,
+};
+
+/// Authentication configuration for Databricks.
+#[configurable_component]
+#[derive(Clone, Debug)]
+#[serde(tag = "strategy", rename_all = "snake_case")]
+#[configurable(metadata(
+    docs::enum_tag_description = "The authentication strategy to use for Databricks."
+))]
+pub enum DatabricksAuthentication {
+    /// Authenticate using OAuth 2.0 client credentials.
+    #[serde(rename = "oauth")]
+    OAuth {
+        /// OAuth 2.0 client ID.
+        #[configurable(metadata(docs::examples = "${DATABRICKS_CLIENT_ID}"))]
+        #[configurable(metadata(docs::examples = "abc123..."))]
+        client_id: SensitiveString,
+
+        /// OAuth 2.0 client secret.
+        #[configurable(metadata(docs::examples = "${DATABRICKS_CLIENT_SECRET}"))]
+        #[configurable(metadata(docs::examples = "secret123..."))]
+        client_secret: SensitiveString,
+    },
+}
+
+impl DatabricksAuthentication {
+    /// Extract the client ID and client secret as string references.
+    pub fn credentials(&self) -> (&str, &str) {
+        match self {
+            DatabricksAuthentication::OAuth {
+                client_id,
+                client_secret,
+            } => (client_id.inner(), client_secret.inner()),
+        }
+    }
+}
+
+/// Zerobus stream configuration options.
+///
+/// This is a thin wrapper around the SDK's `StreamConfigurationOptions` with Vector-specific
+/// configuration attributes and custom defaults suitable for Vector's use case.
+#[configurable_component]
+#[derive(Clone, Debug)]
+#[serde(deny_unknown_fields)]
+pub struct ZerobusStreamOptions {
+    /// Timeout in milliseconds for flush operations.
+    #[serde(default = "default_flush_timeout_ms")]
+    #[configurable(metadata(docs::examples = 30000))]
+    pub flush_timeout_ms: u64,
+
+    /// Timeout in milliseconds for server acknowledgements.
+    #[serde(default = "default_server_ack_timeout_ms")]
+    #[configurable(metadata(docs::examples = 60000))]
+    pub server_lack_of_ack_timeout_ms: u64,
+}
+
+impl Default for ZerobusStreamOptions {
+    fn default() -> Self {
+        Self {
+            flush_timeout_ms: default_flush_timeout_ms(),
+            server_lack_of_ack_timeout_ms: default_server_ack_timeout_ms(),
+        }
+    }
+}
+
+/// Configuration for the Databricks Zerobus sink.
+#[configurable_component(sink(
+    "databricks_zerobus",
+    "Stream observability data to Databricks Unity Catalog via Zerobus."
+))]
+#[derive(Clone, Debug)]
+#[serde(deny_unknown_fields)]
+pub struct ZerobusSinkConfig {
+    /// The Zerobus ingestion endpoint URL.
+    ///
+    /// This should be the full URL to the Zerobus ingestion service.
+    #[configurable(metadata(docs::examples = "https://ingest.dev.databricks.com"))]
+    #[configurable(metadata(docs::examples = "https://ingest.prod.databricks.com"))]
+    pub ingestion_endpoint: String,
+
+    /// The Unity Catalog table name to write to.
+    ///
+    /// This should be in the format `catalog.schema.table`.
+    #[configurable(metadata(docs::examples = "logging_platform.my_team.logs"))]
+    #[configurable(metadata(docs::examples = "main.default.vector_logs"))]
+    pub table_name: String,
+
+    /// The Unity Catalog endpoint URL.
+    ///
+    /// This is used for authentication and table metadata.
+    #[configurable(metadata(
+        docs::examples = "https://dbc-e2f0eb31-2b0e.staging.cloud.databricks.com"
+    ))]
+    #[configurable(metadata(docs::examples = "https://your-workspace.cloud.databricks.com"))]
+    pub unity_catalog_endpoint: String,
+
+    /// Databricks authentication configuration.
+    #[configurable(derived)]
+    pub auth: DatabricksAuthentication,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub stream_options: ZerobusStreamOptions,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub batch: BatchConfig<RealtimeSizeBasedDefaultBatchSettings>,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub request: TowerRequestConfig,
+
+    #[configurable(derived)]
+    #[serde(
+        default,
+        deserialize_with = "crate::serde::bool_or_struct",
+        skip_serializing_if = "crate::serde::is_default"
+    )]
+    pub acknowledgements: AcknowledgementsConfig,
+}
+
+impl GenerateConfig for ZerobusSinkConfig {
+    fn generate_config() -> toml::Value {
+        toml::Value::try_from(Self {
+            ingestion_endpoint: "https://ingest.dev.databricks.com".to_string(),
+            table_name: "catalog.schema.table".to_string(),
+            unity_catalog_endpoint: "https://your-workspace.cloud.databricks.com".to_string(),
+            auth: DatabricksAuthentication::OAuth {
+                client_id: SensitiveString::from("${DATABRICKS_CLIENT_ID}".to_string()),
+                client_secret: SensitiveString::from("${DATABRICKS_CLIENT_SECRET}".to_string()),
+            },
+            stream_options: ZerobusStreamOptions::default(),
+            batch: BatchConfig::default(),
+            request: TowerRequestConfig::default(),
+            acknowledgements: AcknowledgementsConfig::default(),
+        })
+        .unwrap()
+    }
+}
+
+#[async_trait::async_trait]
+#[typetag::serde(name = "databricks_zerobus")]
+impl SinkConfig for ZerobusSinkConfig {
+    async fn build(&self, cx: SinkContext) -> crate::Result<(VectorSink, Healthcheck)> {
+        self.validate()?;
+
+        let descriptor = ZerobusService::resolve_descriptor(self, cx.proxy()).await?;
+
+        // The zerobus sink always encodes in proto_batch form — the stream
+        // descriptor is the one we just resolved from Unity Catalog.
+        let descriptor_proto = std::sync::Arc::new(descriptor.descriptor_proto().clone());
+        let stream_mode = StreamMode::Proto { descriptor_proto };
+
+        let proto_config = ProtoBatchSerializerConfig {
+            descriptor: Some(descriptor),
+        };
+        let batch_serializer = BatchSerializerConfig::ProtoBatch(proto_config)
+            .build_batch_serializer()
+            .map_err(|e| format!("Failed to build batch serializer: {}", e))?;
+        let encoder = BatchEncoder::new(batch_serializer);
+
+        let service = ZerobusService::new(self.clone(), stream_mode, cx.proxy()).await?;
+        let healthcheck_service = service.clone();
+
+        let request_limits = self.request.into_settings();
+
+        let sink = ZerobusSink::new(service, request_limits, self.batch, encoder)?;
+
+        let healthcheck = async move {
+            healthcheck_service
+                .ensure_stream()
+                .await
+                .map_err(|e| e.into())
+        };
+
+        Ok((
+            VectorSink::from_event_streamsink(sink),
+            Box::pin(healthcheck),
+        ))
+    }
+
+    fn input(&self) -> Input {
+        Input::log()
+    }
+
+    fn acknowledgements(&self) -> &AcknowledgementsConfig {
+        &self.acknowledgements
+    }
+}
+
+impl ZerobusSinkConfig {
+    pub fn validate(&self) -> Result<(), ZerobusSinkError> {
+        if self.ingestion_endpoint.is_empty() {
+            return Err(ZerobusSinkError::ConfigError {
+                message: "ingestion_endpoint cannot be empty".to_string(),
+            });
+        }
+
+        if self.table_name.is_empty() {
+            return Err(ZerobusSinkError::ConfigError {
+                message: "table_name cannot be empty".to_string(),
+            });
+        }
+
+        let parts: Vec<&str> = self.table_name.split('.').collect();
+        if parts.len() != 3 || parts.iter().any(|p| p.is_empty()) {
+            return Err(ZerobusSinkError::ConfigError {
+                message: "table_name must be in format 'catalog.schema.table' (exactly 3 non-empty parts)"
+                    .to_string(),
+            });
+        }
+
+        if self.unity_catalog_endpoint.is_empty() {
+            return Err(ZerobusSinkError::ConfigError {
+                message: "unity_catalog_endpoint cannot be empty".to_string(),
+            });
+        }
+
+        // Validate authentication credentials
+        match &self.auth {
+            DatabricksAuthentication::OAuth {
+                client_id,
+                client_secret,
+            } => {
+                if client_id.inner().is_empty() {
+                    return Err(ZerobusSinkError::ConfigError {
+                        message: "OAuth client_id cannot be empty".to_string(),
+                    });
+                }
+                if client_secret.inner().is_empty() {
+                    return Err(ZerobusSinkError::ConfigError {
+                        message: "OAuth client_secret cannot be empty".to_string(),
+                    });
+                }
+            }
+        }
+
+        if let Some(max_bytes) = self.batch.max_bytes {
+            // Zerobus SDK limits max bytes to 10MB. This cap is a conservative safety limit:
+            // it's measured against Vector's pre-serialization sizing, not the protobuf bytes
+            // the SDK actually sends. Vector's pre-serialization size is generally larger than
+            // the SDK's protobuf-encoded size, so enforcing the 10MB cap here ensures the SDK's
+            // 10MB limit cannot be exceeded at runtime.
+            if max_bytes > 10_000_000 {
+                return Err(ZerobusSinkError::ConfigError {
+                    message: "max_bytes must be less than or equal to 10MB".to_string(),
+                });
+            }
+        }
+
+        Ok(())
+    }
+}
+
+// Default value functions
+const fn default_flush_timeout_ms() -> u64 {
+    30000
+}
+
+const fn default_server_ack_timeout_ms() -> u64 {
+    60000
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use vector_lib::sensitive_string::SensitiveString;
+
+    fn create_test_config() -> ZerobusSinkConfig {
+        ZerobusSinkConfig {
+            ingestion_endpoint: "https://test.databricks.com".to_string(),
+            table_name: "test.default.logs".to_string(),
+            unity_catalog_endpoint: "https://test-workspace.databricks.com".to_string(),
+            auth: DatabricksAuthentication::OAuth {
+                client_id: SensitiveString::from("test-client-id".to_string()),
+                client_secret: SensitiveString::from("test-client-secret".to_string()),
+            },
+            stream_options: ZerobusStreamOptions::default(),
+            batch: Default::default(),
+            request: Default::default(),
+            acknowledgements: Default::default(),
+        }
+    }
+
+    #[test]
+    fn test_config_validation_success() {
+        let config = create_test_config();
+        assert!(config.validate().is_ok());
+    }
+
+    #[test]
+    fn test_config_validation_empty_endpoint() {
+        let mut config = create_test_config();
+        config.ingestion_endpoint = "".to_string();
+
+        let result = config.validate();
+        assert!(result.is_err());
+
+        if let Err(crate::sinks::databricks_zerobus::error::ZerobusSinkError::ConfigError {
+            message,
+        }) = result
+        {
+            assert!(message.contains("ingestion_endpoint cannot be empty"));
+        } else {
+            panic!("Expected ConfigError for empty ingestion_endpoint");
+        }
+    }
+
+    #[test]
+    fn test_config_validation_empty_table_name() {
+        let mut config = create_test_config();
+        config.table_name = "".to_string();
+
+        let result = config.validate();
+        assert!(result.is_err());
+
+        if let Err(crate::sinks::databricks_zerobus::error::ZerobusSinkError::ConfigError {
+            message,
+        }) = result
+        {
+            assert!(message.contains("table_name cannot be empty"));
+        } else {
+            panic!("Expected ConfigError for empty table_name");
+        }
+    }
+
+    #[test]
+    fn test_config_validation_invalid_table_name() {
+        let mut config = create_test_config();
+        config.table_name = "invalid_table".to_string(); // Missing dots
+
+        let result = config.validate();
+        assert!(result.is_err());
+
+        if let Err(crate::sinks::databricks_zerobus::error::ZerobusSinkError::ConfigError {
+            message,
+        }) = result
+        {
+            assert!(message.contains("catalog.schema.table"));
+        } else {
+            panic!("Expected ConfigError for invalid table_name format");
+        }
+    }
+
+    #[test]
+    fn test_config_validation_table_name_empty_segments() {
+        for bad in [
+            "catalog..table",
+            ".schema.table",
+            "catalog.schema.",
+            "..",
+            "catalog.schema.table.extra",
+        ] {
+            let mut config = create_test_config();
+            config.table_name = bad.to_string();
+            let result = config.validate();
+            assert!(result.is_err(), "expected error for table_name={bad:?}");
+            if let Err(crate::sinks::databricks_zerobus::error::ZerobusSinkError::ConfigError {
+                message,
+            }) = result
+            {
+                assert!(message.contains("catalog.schema.table"));
+            } else {
+                panic!("Expected ConfigError for table_name={bad:?}");
+            }
+        }
+    }
+
+    #[test]
+    fn test_config_validation_empty_unity_catalog_endpoint() {
+        let mut config = create_test_config();
+        config.unity_catalog_endpoint = "".to_string();
+
+        let result = config.validate();
+        assert!(result.is_err());
+
+        if let Err(crate::sinks::databricks_zerobus::error::ZerobusSinkError::ConfigError {
+            message,
+        }) = result
+        {
+            assert!(message.contains("unity_catalog_endpoint cannot be empty"));
+        } else {
+            panic!("Expected ConfigError for empty unity_catalog_endpoint");
+        }
+    }
+
+    #[test]
+    fn test_config_validation_empty_oauth_credentials() {
+        let mut config = create_test_config();
+        config.auth = DatabricksAuthentication::OAuth {
+            client_id: SensitiveString::from("".to_string()),
+            client_secret: SensitiveString::from("test-secret".to_string()),
+        };
+
+        let result = config.validate();
+        assert!(result.is_err());
+
+        if let Err(crate::sinks::databricks_zerobus::error::ZerobusSinkError::ConfigError {
+            message,
+        }) = result
+        {
+            assert!(message.contains("OAuth client_id cannot be empty"));
+        } else {
+            panic!("Expected ConfigError for empty OAuth client_id");
+        }
+    }
+
+    /// When `batch.max_bytes` is `None` (user omitted the field or set it to `null`),
+    /// `into_batcher_settings()` must merge it against
+    /// `RealtimeSizeBasedDefaultBatchSettings::MAX_BYTES` (10MB) — never unbounded.
+    /// This guarantees the Zerobus SDK's 10MB limit cannot be exceeded at runtime
+    /// even without an explicit user cap.
+    #[test]
+    fn test_batch_max_bytes_none_defaults_to_10mb() {
+        let mut config = create_test_config();
+        config.batch.max_bytes = None;
+
+        let settings = config
+            .batch
+            .into_batcher_settings()
+            .expect("batch settings should build");
+
+        assert_eq!(settings.size_limit, 10_000_000);
+    }
+}
diff --git a/src/sinks/databricks_zerobus/error.rs b/src/sinks/databricks_zerobus/error.rs
new file mode 100644
index 0000000000000..e4dedddea00c8
--- /dev/null
+++ b/src/sinks/databricks_zerobus/error.rs
@@ -0,0 +1,173 @@
+//! Error types for the Zerobus sink.
+
+use databricks_zerobus_ingest_sdk::ZerobusError;
+use snafu::Snafu;
+use vector_lib::event::EventStatus;
+
+/// Errors that can occur when using the Zerobus sink.
+#[derive(Debug, Snafu)]
+#[allow(clippy::enum_variant_names)]
+pub enum ZerobusSinkError {
+    /// Configuration validation failed.
+    #[snafu(display("Configuration error: {}", message))]
+    ConfigError { message: String },
+
+    /// Event encoding failed.
+    #[snafu(display("Encoding error: {}", message))]
+    EncodingError { message: String },
+
+    /// Zerobus SDK error.
+    #[snafu(display("Zerobus error: {}", source))]
+    ZerobusError { source: ZerobusError },
+
+    /// Stream initialization failed.
+    #[snafu(display("Stream initialization failed: {}", source))]
+    StreamInitError { source: ZerobusError },
+
+    /// Record ingestion failed.
+    #[snafu(display("Record ingestion failed: {}", source))]
+    IngestionError { source: ZerobusError },
+
+    /// The SDK returned no offset to wait on, so server acceptance of the
+    /// batch cannot be confirmed. Treated as non-retryable.
+    #[snafu(display("Zerobus ingest returned no offset; cannot confirm server acceptance"))]
+    MissingAckOffset,
+
+    /// The shared stream was closed concurrently (by shutdown or retry-driven
+    /// replacement) before this ingest could run. Retryable: the next attempt
+    /// will create a fresh stream via `get_or_create_stream`.
+    #[snafu(display("Zerobus stream was closed concurrently"))]
+    StreamClosed,
+}
+
+impl From<ZerobusError> for ZerobusSinkError {
+    fn from(error: ZerobusError) -> Self {
+        ZerobusSinkError::ZerobusError { source: error }
+    }
+}
+
+/// Convert Zerobus errors to Vector event status.
+impl From<ZerobusSinkError> for EventStatus {
+    fn from(error: ZerobusSinkError) -> Self {
+        match error {
+            ZerobusSinkError::ConfigError { .. }
+            | ZerobusSinkError::EncodingError { .. }
+            | ZerobusSinkError::MissingAckOffset => EventStatus::Rejected,
+            ZerobusSinkError::StreamClosed => EventStatus::Errored,
+            ZerobusSinkError::ZerobusError { source }
+            | ZerobusSinkError::StreamInitError { source }
+            | ZerobusSinkError::IngestionError { source } => {
+                if source.is_retryable() {
+                    EventStatus::Errored
+                } else {
+                    EventStatus::Rejected
+                }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::sinks::databricks_zerobus::service::ZerobusRetryLogic;
+    use crate::sinks::util::retries::RetryLogic;
+
+    fn retryable_error() -> ZerobusError {
+        // ChannelCreationError is always retryable
+        ZerobusError::ChannelCreationError("connection reset".to_string())
+    }
+
+    fn non_retryable_error() -> ZerobusError {
+        // InvalidArgument is never retryable
+        ZerobusError::InvalidArgument("bad field".to_string())
+    }
+
+    #[test]
+    fn retryable_ingestion_error_maps_to_errored() {
+        let error = ZerobusSinkError::IngestionError {
+            source: retryable_error(),
+        };
+        assert_eq!(EventStatus::from(error), EventStatus::Errored);
+    }
+
+    #[test]
+    fn non_retryable_ingestion_error_maps_to_rejected() {
+        let error = ZerobusSinkError::IngestionError {
+            source: non_retryable_error(),
+        };
+        assert_eq!(EventStatus::from(error), EventStatus::Rejected);
+    }
+
+    #[test]
+    fn retryable_stream_init_error_maps_to_errored() {
+        let error = ZerobusSinkError::StreamInitError {
+            source: retryable_error(),
+        };
+        assert_eq!(EventStatus::from(error), EventStatus::Errored);
+    }
+
+    #[test]
+    fn non_retryable_stream_init_error_maps_to_rejected() {
+        let error = ZerobusSinkError::StreamInitError {
+            source: non_retryable_error(),
+        };
+        assert_eq!(EventStatus::from(error), EventStatus::Rejected);
+    }
+
+    #[test]
+    fn config_error_maps_to_rejected() {
+        let error = ZerobusSinkError::ConfigError {
+            message: "bad config".to_string(),
+        };
+        assert_eq!(EventStatus::from(error), EventStatus::Rejected);
+    }
+
+    #[test]
+    fn encoding_error_maps_to_rejected() {
+        let error = ZerobusSinkError::EncodingError {
+            message: "encode failed".to_string(),
+        };
+        assert_eq!(EventStatus::from(error), EventStatus::Rejected);
+    }
+
+    #[test]
+    fn retry_logic_retryable_errors() {
+        let logic = ZerobusRetryLogic;
+
+        let error = ZerobusSinkError::IngestionError {
+            source: retryable_error(),
+        };
+        assert!(logic.is_retriable_error(&error));
+
+        let error = ZerobusSinkError::StreamInitError {
+            source: retryable_error(),
+        };
+        assert!(logic.is_retriable_error(&error));
+
+        let error = ZerobusSinkError::ZerobusError {
+            source: retryable_error(),
+        };
+        assert!(logic.is_retriable_error(&error));
+    }
+
+    #[test]
+    fn retry_logic_non_retryable_errors() {
+        let logic = ZerobusRetryLogic;
+
+        let error = ZerobusSinkError::IngestionError {
+            source: non_retryable_error(),
+        };
+        assert!(!logic.is_retriable_error(&error));
+
+        let error = ZerobusSinkError::ConfigError {
+            message: "bad".to_string(),
+        };
+        assert!(!logic.is_retriable_error(&error));
+
+        let error = ZerobusSinkError::EncodingError {
+            message: "bad".to_string(),
+        };
+        assert!(!logic.is_retriable_error(&error));
+    }
+}
diff --git a/src/sinks/databricks_zerobus/mod.rs b/src/sinks/databricks_zerobus/mod.rs
new file mode 100644
index 0000000000000..19419b3216e4d
--- /dev/null
+++ b/src/sinks/databricks_zerobus/mod.rs
@@ -0,0 +1,12 @@
+//! The Zerobus sink.
+//!
+//! This sink streams observability data to Databricks Unity Catalog tables
+//! via the Zerobus/Shinkansen ingestion service.
+
+mod config;
+mod error;
+mod service;
+mod sink;
+mod unity_catalog_schema;
+
+pub use config::ZerobusSinkConfig;
diff --git a/src/sinks/databricks_zerobus/service.rs b/src/sinks/databricks_zerobus/service.rs
new file mode 100644
index 0000000000000..0da433699d9c2
--- /dev/null
+++ b/src/sinks/databricks_zerobus/service.rs
@@ -0,0 +1,725 @@
+//! Zerobus service wrapper for Vector sink integration.
+
+use crate::config::ProxyConfig;
+use crate::sinks::util::retries::RetryLogic;
+use databricks_zerobus_ingest_sdk::{ConnectorFactory, ProxyConnector, ZerobusSdk, ZerobusStream};
+use futures::future::BoxFuture;
+use std::sync::Arc;
+use tokio::sync::{Mutex, RwLock};
+use tower::Service;
+use tracing::warn;
+use vector_lib::finalization::{EventFinalizers, Finalizable};
+use vector_lib::request_metadata::{GroupedCountByteSize, MetaDescriptive, RequestMetadata};
+use vector_lib::stream::DriverResponse;
+
+use super::{config::ZerobusSinkConfig, error::ZerobusSinkError, unity_catalog_schema};
+
+/// Build a connector factory that routes Zerobus gRPC traffic through
+/// Vector's configured proxy, honoring `no_proxy` rules.
+///
+/// The Zerobus endpoint is always HTTPS gRPC, so the `https` proxy is
+/// preferred; the `http` proxy is used as a fallback if only that is set.
+/// The returned factory fully replaces the SDK's default env-var proxy
+/// detection — Vector's `ProxyConfig` has already merged the process
+/// environment at a higher layer and is the single source of truth.
+///
+/// When proxying is disabled or no proxy URL is configured, returns a
+/// factory that unconditionally yields `None`, forcing direct connections.
+/// Returns an error if the configured proxy URL is malformed, so the
+/// problem surfaces at sink startup rather than per-connection.
+fn build_connector_factory(proxy: &ProxyConfig) -> Result<ConnectorFactory, ZerobusSinkError> {
+    let proxy_url = if proxy.enabled {
+        proxy.https.clone().or_else(|| proxy.http.clone())
+    } else {
+        None
+    };
+    let Some(proxy_url) = proxy_url else {
+        return Ok(Arc::new(|_host: &str| None));
+    };
+    // Validate the proxy URL once up-front so a malformed value surfaces at
+    // sink startup rather than per-connection.
+    ProxyConnector::new(&proxy_url).map_err(|e| ZerobusSinkError::ConfigError {
+        message: format!("Invalid proxy URL '{}': {}", proxy_url, e),
+    })?;
+    let no_proxy = proxy.no_proxy.clone();
+    Ok(Arc::new(move |host: &str| {
+        if no_proxy.matches(host) {
+            return None;
+        }
+        ProxyConnector::new(&proxy_url).ok()
+    }))
+}
+
+/// The payload for a Zerobus request.
+///
+/// The zerobus sink only supports proto-encoded records.
+#[derive(Clone, Debug)]
+pub enum ZerobusPayload {
+    /// Pre-encoded protobuf records (one byte buffer per event).
+    Records(Vec<Vec<u8>>),
+}
+
+/// Request type for the Zerobus service.
+#[derive(Clone, Debug)]
+pub struct ZerobusRequest {
+    pub payload: ZerobusPayload,
+    pub metadata: RequestMetadata,
+    pub finalizers: EventFinalizers,
+}
+
+/// Response type for the Zerobus service.
+#[derive(Debug)]
+pub struct ZerobusResponse {
+    pub events_byte_size: GroupedCountByteSize,
+}
+
+impl DriverResponse for ZerobusResponse {
+    fn event_status(&self) -> vector_lib::event::EventStatus {
+        vector_lib::event::EventStatus::Delivered
+    }
+
+    fn events_sent(&self) -> &GroupedCountByteSize {
+        &self.events_byte_size
+    }
+}
+
+impl Finalizable for ZerobusRequest {
+    fn take_finalizers(&mut self) -> EventFinalizers {
+        std::mem::take(&mut self.finalizers)
+    }
+}
+
+impl MetaDescriptive for ZerobusRequest {
+    fn get_metadata(&self) -> &RequestMetadata {
+        &self.metadata
+    }
+
+    fn metadata_mut(&mut self) -> &mut RequestMetadata {
+        &mut self.metadata
+    }
+}
+
+/// Determines what kind of stream the service creates and how payloads are ingested.
+///
+/// The sink only supports proto streams today; this is kept as an enum to
+/// leave room for future stream modes without reshaping all the call sites.
+#[derive(Clone)]
+pub enum StreamMode {
+    /// Proto stream using `ZerobusStream::ingest_records_offset`.
+    Proto {
+        descriptor_proto: Arc<prost_reflect::prost_types::DescriptorProto>,
+    },
+}
+
+/// The active stream.
+///
+/// The SDK's `ZerobusStream::close()` requires `&mut self`, but ingests need
+/// shared access to call `&self` methods concurrently. We resolve this with an
+/// `RwLock`: ingests hold a read guard across `ingest_records_offset`, and
+/// `close()` takes the write guard, pulls the stream out of the `Option`, and
+/// awaits its SDK-level close on the owned value. Any holder of an `Arc` can
+/// invoke `close()`, so the graceful path always runs — there is no
+/// `try_unwrap`/`get_mut` race.
+enum ActiveStream {
+    Proto(RwLock<Option<Box<ZerobusStream>>>),
+    /// Test-only variant that returns a pre-configured error on ingest.
+    #[cfg(test)]
+    Mock(MockStream),
+}
+
+impl ActiveStream {
+    fn proto(stream: ZerobusStream) -> Self {
+        ActiveStream::Proto(RwLock::new(Some(Box::new(stream))))
+    }
+
+    /// Gracefully flush and close the underlying SDK stream.
+    ///
+    /// Waits for any in-flight ingests (read-lock holders) to complete, then
+    /// pulls the stream out of the slot and runs the SDK's awaitable `close()`
+    /// on the owned value (released-lock so further ingests fail fast with
+    /// `StreamClosed` rather than blocking).
+    ///
+    /// Idempotent: a second call after the stream has been taken is a no-op.
+    /// The SDK's own `Drop` is also a no-op once close has run.
+    async fn close(&self) {
+        let result = match self {
+            ActiveStream::Proto(lock) => {
+                let taken = lock.write().await.take();
+                match taken {
+                    Some(mut stream) => stream.close().await,
+                    None => return,
+                }
+            }
+            #[cfg(test)]
+            ActiveStream::Mock(m) => {
+                m.closed.store(true, std::sync::atomic::Ordering::Relaxed);
+                Ok(())
+            }
+        };
+        if let Err(e) = result {
+            warn!(message = "Failed to close Zerobus stream.", error = %e);
+        }
+    }
+}
+
+/// A mock stream that returns a configurable error on the next ingest call.
+#[cfg(test)]
+pub struct MockStream {
+    /// When `Some`, the next ingest returns this error; when `None`, ingest succeeds.
+    next_error: std::sync::Mutex<Option<databricks_zerobus_ingest_sdk::ZerobusError>>,
+    /// Shared flag set to `true` when `ActiveStream::close()` is called.
+    closed: Arc<std::sync::atomic::AtomicBool>,
+    /// Optional gate: when set, each ingest call signals `started` and then
+    /// waits to acquire a `release` permit before returning. Lets tests
+    /// deterministically force two ingests to overlap (each holding an `Arc`
+    /// clone of the `ActiveStream`) before they fail.
+    gate: Option<MockGate>,
+}
+
+#[cfg(test)]
+struct MockGate {
+    started: Arc<tokio::sync::Semaphore>,
+    release: Arc<tokio::sync::Semaphore>,
+}
+
+#[cfg(test)]
+#[derive(Clone)]
+pub struct MockGateHandle {
+    started: Arc<tokio::sync::Semaphore>,
+    release: Arc<tokio::sync::Semaphore>,
+}
+
+#[cfg(test)]
+impl MockGateHandle {
+    /// Wait until `n` ingests have entered the gated region.
+    pub async fn wait_for_started(&self, n: u32) {
+        let permit = self.started.acquire_many(n).await.unwrap();
+        permit.forget();
+    }
+
+    /// Release `n` queued ingests so they can return their result.
+    pub fn release(&self, n: u32) {
+        self.release.add_permits(n as usize);
+    }
+}
+
+#[cfg(test)]
+impl MockStream {
+    pub fn succeeding() -> Self {
+        Self {
+            next_error: std::sync::Mutex::new(None),
+            closed: Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            gate: None,
+        }
+    }
+
+    pub fn failing(error: databricks_zerobus_ingest_sdk::ZerobusError) -> Self {
+        Self {
+            next_error: std::sync::Mutex::new(Some(error)),
+            closed: Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            gate: None,
+        }
+    }
+
+    /// Install a gate so ingests block until the test releases them.
+    /// Returns a handle the test uses to coordinate.
+    pub fn with_gate(mut self) -> (Self, MockGateHandle) {
+        let started = Arc::new(tokio::sync::Semaphore::new(0));
+        let release = Arc::new(tokio::sync::Semaphore::new(0));
+        self.gate = Some(MockGate {
+            started: Arc::clone(&started),
+            release: Arc::clone(&release),
+        });
+        (self, MockGateHandle { started, release })
+    }
+
+    /// Returns a shared handle to the closed flag for test assertions.
+    pub fn closed_flag(&self) -> Arc<std::sync::atomic::AtomicBool> {
+        Arc::clone(&self.closed)
+    }
+
+    /// Set the error that will be returned on the next ingest call.
+    pub fn set_next_error(&self, error: databricks_zerobus_ingest_sdk::ZerobusError) {
+        *self.next_error.lock().unwrap() = Some(error);
+    }
+
+    async fn try_ingest(&self) -> Result<(), databricks_zerobus_ingest_sdk::ZerobusError> {
+        if let Some(gate) = &self.gate {
+            gate.started.add_permits(1);
+            // Acquire and immediately forget — we don't need to release the
+            // permit on drop, the test's `release()` call hands them out.
+            gate.release.acquire().await.unwrap().forget();
+        }
+        match self.next_error.lock().unwrap().take() {
+            Some(e) => Err(e),
+            None => Ok(()),
+        }
+    }
+}
+
+/// Service for handling Zerobus requests.
+pub struct ZerobusService {
+    sdk: Arc<ZerobusSdk>,
+    config: Arc<ZerobusSinkConfig>,
+    stream: Arc<Mutex<Option<Arc<ActiveStream>>>>,
+    stream_mode: StreamMode,
+}
+
+impl ZerobusService {
+    pub async fn new(
+        config: ZerobusSinkConfig,
+        stream_mode: StreamMode,
+        proxy: &ProxyConfig,
+    ) -> Result<Self, ZerobusSinkError> {
+        let mut builder = ZerobusSdk::builder()
+            .endpoint(&config.ingestion_endpoint)
+            .unity_catalog_url(&config.unity_catalog_endpoint);
+        builder = builder.connector_factory(build_connector_factory(proxy)?);
+        let sdk = builder.build().map_err(|e| ZerobusSinkError::ConfigError {
+            message: format!("Failed to create Zerobus SDK: {}", e),
+        })?;
+
+        Ok(Self {
+            sdk: Arc::new(sdk),
+            config: Arc::new(config),
+            stream: Arc::new(Mutex::new(None)),
+            stream_mode,
+        })
+    }
+
+    /// Resolve the protobuf message descriptor from the schema configuration.
+    pub async fn resolve_descriptor(
+        config: &ZerobusSinkConfig,
+        proxy: &crate::config::ProxyConfig,
+    ) -> Result<prost_reflect::MessageDescriptor, ZerobusSinkError> {
+        let (client_id, client_secret) = config.auth.credentials();
+
+        let table_schema = unity_catalog_schema::fetch_table_schema(
+            &config.unity_catalog_endpoint,
+            &config.table_name,
+            client_id,
+            client_secret,
+            proxy,
+        )
+        .await?;
+
+        unity_catalog_schema::generate_descriptor_from_schema(&table_schema)
+    }
+
+    /// Ensure we have an active stream, creating one if necessary.
+    ///
+    /// Also used as the healthcheck: eagerly creating a stream verifies
+    /// OAuth credentials, endpoint connectivity, and table validity.
+    pub async fn ensure_stream(&self) -> Result<(), ZerobusSinkError> {
+        self.get_or_create_stream().await.map(|_| ())
+    }
+
+    /// Return an `Arc` handle to the active stream, creating one if needed.
+    ///
+    /// The lock is held only while checking/creating the stream; callers can
+    /// then use the returned `Arc` without holding the lock.
+    async fn get_or_create_stream(&self) -> Result<Arc<ActiveStream>, ZerobusSinkError> {
+        let mut stream_guard = self.stream.lock().await;
+
+        if stream_guard.is_none() {
+            let (client_id, client_secret) = self.config.auth.credentials();
+            let (client_id, client_secret) = (client_id.to_string(), client_secret.to_string());
+
+            let active_stream = match &self.stream_mode {
+                StreamMode::Proto { descriptor_proto } => {
+                    let stream_options = &self.config.stream_options;
+                    let stream = self
+                        .sdk
+                        .stream_builder()
+                        .table(self.config.table_name.clone())
+                        .oauth(client_id, client_secret)
+                        .compiled_proto((**descriptor_proto).clone())
+                        .server_lack_of_ack_timeout_ms(stream_options.server_lack_of_ack_timeout_ms)
+                        .flush_timeout_ms(stream_options.flush_timeout_ms)
+                        .build()
+                        .await
+                        .map_err(|e| ZerobusSinkError::StreamInitError { source: e })?;
+                    ActiveStream::proto(stream)
+                }
+            };
+
+            *stream_guard = Some(Arc::new(active_stream));
+        }
+
+        Ok(Arc::clone(stream_guard.as_ref().unwrap()))
+    }
+
+    /// Gracefully close and remove the active stream.
+    ///
+    /// `ActiveStream::close()` takes `&self`, so this works regardless of how
+    /// many `Arc` clones are still in flight: the inner write lock waits for
+    /// any concurrent ingests to release their read guards before the SDK
+    /// flush + close runs. The slot lock is released before close starts so
+    /// concurrent `get_or_create_stream` calls aren't blocked on the SDK
+    /// shutdown path.
+    pub async fn close_stream(&self) {
+        let stream = self.stream.lock().await.take();
+        if let Some(stream) = stream {
+            stream.close().await;
+        }
+    }
+
+    /// Ingest a payload (proto records or Arrow batch).
+    ///
+    /// Obtains an `Arc` handle to the stream (creating one if needed) and
+    /// then releases the lock before calling into the SDK so that concurrent
+    /// ingests are not serialized.
+    ///
+    /// On retryable errors the active stream is removed from the slot so that
+    /// the next attempt (driven by Tower retry) creates a fresh one.
+    pub async fn ingest(
+        &self,
+        payload: ZerobusPayload,
+        events_byte_size: GroupedCountByteSize,
+    ) -> Result<ZerobusResponse, ZerobusSinkError> {
+        let stream = self.get_or_create_stream().await?;
+
+        // Slot lock is not held here — concurrent ingests acquire read guards
+        // on the inner `RwLock` and run truly in parallel.
+        let result = match (payload, stream.as_ref()) {
+            (ZerobusPayload::Records(records), ActiveStream::Proto(lock)) => {
+                let guard = lock.read().await;
+                let Some(s) = guard.as_ref() else {
+                    return Err(ZerobusSinkError::StreamClosed);
+                };
+                match s.ingest_records_offset(records).await {
+                    Ok(Some(offset)) => s.wait_for_offset(offset).await.map(|_| ()),
+                    Ok(None) => {
+                        return Err(ZerobusSinkError::MissingAckOffset);
+                    }
+                    Err(e) => Err(e),
+                }
+            }
+            #[cfg(test)]
+            (ZerobusPayload::Records(_), ActiveStream::Mock(mock)) => mock.try_ingest().await,
+        };
+
+        match result {
+            Ok(()) => Ok(ZerobusResponse { events_byte_size }),
+            Err(e) => {
+                if e.is_retryable() {
+                    // Clear the slot so the next attempt creates a fresh stream,
+                    // but only if it still points to the same stream that failed —
+                    // a concurrent task may have already replaced it.
+                    {
+                        let mut guard = self.stream.lock().await;
+                        if guard.as_ref().is_some_and(|s| Arc::ptr_eq(s, &stream)) {
+                            guard.take();
+                        }
+                    }
+                    // `close()` takes `&self`, so we can always run the graceful
+                    // path here regardless of how many other `Arc` clones are in
+                    // flight. The write lock will wait for any concurrent ingests
+                    // holding read guards to drain before flushing.
+                    stream.close().await;
+                }
+                Err(ZerobusSinkError::IngestionError { source: e })
+            }
+        }
+    }
+}
+
+impl Service<ZerobusRequest> for ZerobusService {
+    type Response = ZerobusResponse;
+    type Error = ZerobusSinkError;
+    type Future = BoxFuture<'static, Result<Self::Response, Self::Error>>;
+
+    fn poll_ready(
+        &mut self,
+        _cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<Result<(), Self::Error>> {
+        std::task::Poll::Ready(Ok(()))
+    }
+
+    fn call(&mut self, mut request: ZerobusRequest) -> Self::Future {
+        let service = self.clone();
+        let events_byte_size =
+            std::mem::take(request.metadata_mut()).into_events_estimated_json_encoded_byte_size();
+
+        Box::pin(async move { service.ingest(request.payload, events_byte_size).await })
+    }
+}
+
+impl Clone for ZerobusService {
+    fn clone(&self) -> Self {
+        Self {
+            sdk: Arc::clone(&self.sdk),
+            config: Arc::clone(&self.config),
+            stream: Arc::clone(&self.stream),
+            stream_mode: self.stream_mode.clone(),
+        }
+    }
+}
+
+/// Retry logic for the Zerobus service.
+///
+/// For SDK errors (`ZerobusError`), delegates to the SDK's `is_retryable()` which
+/// correctly marks transient errors (stream closed, channel issues) as retriable
+/// and permanent errors (invalid table name, invalid argument, invalid endpoint)
+/// as non-retriable.
+#[derive(Debug, Default, Clone)]
+pub struct ZerobusRetryLogic;
+
+#[cfg(test)]
+impl ZerobusService {
+    /// Create a service with a mock stream already installed for testing.
+    pub async fn new_with_mock(
+        config: ZerobusSinkConfig,
+        mock: MockStream,
+    ) -> Result<Self, ZerobusSinkError> {
+        config.validate()?;
+
+        let sdk = ZerobusSdk::builder()
+            .endpoint(&config.ingestion_endpoint)
+            .unity_catalog_url(&config.unity_catalog_endpoint)
+            .build()
+            .map_err(|e| ZerobusSinkError::ConfigError {
+                message: format!("Failed to create Zerobus SDK: {}", e),
+            })?;
+
+        Ok(Self {
+            sdk: Arc::new(sdk),
+            config: Arc::new(config),
+            stream: Arc::new(Mutex::new(Some(Arc::new(ActiveStream::Mock(mock))))),
+            stream_mode: StreamMode::Proto {
+                descriptor_proto: Arc::new(Default::default()),
+            },
+        })
+    }
+
+    /// Returns true if the service currently has an active stream.
+    pub async fn has_active_stream(&self) -> bool {
+        self.stream.lock().await.is_some()
+    }
+}
+
+impl RetryLogic for ZerobusRetryLogic {
+    type Error = ZerobusSinkError;
+    type Request = ZerobusRequest;
+    type Response = ZerobusResponse;
+
+    fn is_retriable_error(&self, error: &Self::Error) -> bool {
+        match error {
+            ZerobusSinkError::ZerobusError { source }
+            | ZerobusSinkError::StreamInitError { source }
+            | ZerobusSinkError::IngestionError { source } => source.is_retryable(),
+            ZerobusSinkError::StreamClosed => true,
+            ZerobusSinkError::ConfigError { .. }
+            | ZerobusSinkError::EncodingError { .. }
+            | ZerobusSinkError::MissingAckOffset => false,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::sinks::databricks_zerobus::config::{
+        DatabricksAuthentication, ZerobusStreamOptions,
+    };
+    use databricks_zerobus_ingest_sdk::ZerobusError;
+    use vector_lib::sensitive_string::SensitiveString;
+
+    fn test_config() -> ZerobusSinkConfig {
+        ZerobusSinkConfig {
+            ingestion_endpoint: "https://127.0.0.1:1".to_string(),
+            table_name: "test.default.logs".to_string(),
+            unity_catalog_endpoint: "https://127.0.0.1:1".to_string(),
+            auth: DatabricksAuthentication::OAuth {
+                client_id: SensitiveString::from("id".to_string()),
+                client_secret: SensitiveString::from("secret".to_string()),
+            },
+            stream_options: ZerobusStreamOptions::default(),
+            batch: Default::default(),
+            request: Default::default(),
+            acknowledgements: Default::default(),
+        }
+    }
+
+    fn dummy_payload() -> ZerobusPayload {
+        ZerobusPayload::Records(vec![vec![1, 2, 3]])
+    }
+
+    #[tokio::test]
+    async fn ingest_succeeds_with_mock_stream() {
+        let service = ZerobusService::new_with_mock(test_config(), MockStream::succeeding())
+            .await
+            .unwrap();
+
+        let result = service
+            .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+            .await;
+
+        assert!(result.is_ok());
+        assert!(service.has_active_stream().await);
+    }
+
+    #[tokio::test]
+    async fn retryable_error_clears_stream() {
+        let mock = MockStream::failing(ZerobusError::ChannelCreationError(
+            "connection reset".to_string(),
+        ));
+        let service = ZerobusService::new_with_mock(test_config(), mock)
+            .await
+            .unwrap();
+
+        assert!(service.has_active_stream().await);
+
+        let err = service
+            .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+            .await
+            .unwrap_err();
+
+        assert!(matches!(err, ZerobusSinkError::IngestionError { .. }));
+        assert!(ZerobusRetryLogic.is_retriable_error(&err));
+        // Stream must have been cleared for the next retry.
+        assert!(!service.has_active_stream().await);
+    }
+
+    #[tokio::test]
+    async fn non_retryable_error_keeps_stream() {
+        let mock = MockStream::failing(ZerobusError::InvalidArgument("bad field".to_string()));
+        let service = ZerobusService::new_with_mock(test_config(), mock)
+            .await
+            .unwrap();
+
+        assert!(service.has_active_stream().await);
+
+        let err = service
+            .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+            .await
+            .unwrap_err();
+
+        assert!(matches!(err, ZerobusSinkError::IngestionError { .. }));
+        assert!(!ZerobusRetryLogic.is_retriable_error(&err));
+        // Stream should NOT be cleared for non-retryable errors.
+        assert!(service.has_active_stream().await);
+    }
+
+    #[tokio::test]
+    async fn stream_recovers_after_retryable_failure() {
+        // Simulate: success → retryable failure → success again.
+        let mock = MockStream::succeeding();
+        let service = ZerobusService::new_with_mock(test_config(), mock)
+            .await
+            .unwrap();
+
+        // First ingest succeeds.
+        assert!(
+            service
+                .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+                .await
+                .is_ok()
+        );
+        assert!(service.has_active_stream().await);
+
+        // Inject a retryable error for the next call.
+        {
+            let guard = service.stream.lock().await;
+            if let Some(arc) = guard.as_ref()
+                && let ActiveStream::Mock(mock) = arc.as_ref()
+            {
+                mock.set_next_error(ZerobusError::ChannelCreationError("reset".to_string()));
+            }
+        }
+
+        // Second ingest fails and clears the stream.
+        let err = service
+            .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+            .await
+            .unwrap_err();
+        assert!(ZerobusRetryLogic.is_retriable_error(&err));
+        assert!(!service.has_active_stream().await);
+
+        // Simulate Tower retry: re-inject a fresh mock stream
+        // (in production, ensure_stream() would create a new real stream).
+        *service.stream.lock().await = Some(Arc::new(ActiveStream::Mock(MockStream::succeeding())));
+
+        // Third ingest succeeds on the new stream.
+        assert!(
+            service
+                .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+                .await
+                .is_ok()
+        );
+        assert!(service.has_active_stream().await);
+    }
+
+    #[tokio::test]
+    async fn close_stream_calls_close_on_active_stream() {
+        let mock = MockStream::succeeding();
+        let closed = mock.closed_flag();
+
+        let service = ZerobusService::new_with_mock(test_config(), mock)
+            .await
+            .unwrap();
+
+        assert!(service.has_active_stream().await);
+        assert!(!closed.load(std::sync::atomic::Ordering::Relaxed));
+
+        service.close_stream().await;
+
+        assert!(!service.has_active_stream().await);
+        assert!(closed.load(std::sync::atomic::Ordering::Relaxed));
+    }
+
+    /// Regression test for the "silent abort-only Drop" issue: when two
+    /// ingests are in flight (each holding an `Arc<ActiveStream>`) and one
+    /// fails retryably, the failing task must still run the graceful close
+    /// path. Under the previous design `Arc::get_mut` returned `None` here
+    /// because the second task held a clone, so close was skipped and the
+    /// stream fell to abort-only Drop.
+    #[tokio::test]
+    async fn retryable_failure_with_concurrent_ingest_still_closes() {
+        let (mock, gate) = MockStream::failing(ZerobusError::ChannelCreationError(
+            "connection reset".to_string(),
+        ))
+        .with_gate();
+        let closed = mock.closed_flag();
+
+        let service = ZerobusService::new_with_mock(test_config(), mock)
+            .await
+            .unwrap();
+
+        // Spawn two concurrent ingests. Each will obtain its own `Arc` clone
+        // from `get_or_create_stream`, then block in the gate.
+        let s1 = service.clone();
+        let t1 = tokio::spawn(async move {
+            s1.ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+                .await
+        });
+        let s2 = service.clone();
+        let t2 = tokio::spawn(async move {
+            s2.ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+                .await
+        });
+
+        // Wait until both ingests are inside the gate (both `Arc`s alive).
+        gate.wait_for_started(2).await;
+
+        // Release both. The failing one will go through the retry-cleanup
+        // path while the other still holds an `Arc`. Under the old design
+        // `Arc::get_mut` would return `None` and close would be skipped.
+        gate.release(2);
+
+        let r1 = t1.await.unwrap();
+        let r2 = t2.await.unwrap();
+
+        // At least one task observed the retryable error (the mock only
+        // produces a single error, but ordering between tasks is undefined).
+        assert!(r1.is_err() || r2.is_err());
+
+        // The graceful close path must have run despite concurrent `Arc`s.
+        assert!(
+            closed.load(std::sync::atomic::Ordering::Relaxed),
+            "graceful close did not run; stream would have leaked under old design"
+        );
+        // And the slot was cleared so the next ingest creates a fresh stream.
+        assert!(!service.has_active_stream().await);
+    }
+}
diff --git a/src/sinks/databricks_zerobus/sink.rs b/src/sinks/databricks_zerobus/sink.rs
new file mode 100644
index 0000000000000..30b473c2c041b
--- /dev/null
+++ b/src/sinks/databricks_zerobus/sink.rs
@@ -0,0 +1,123 @@
+//! The main Zerobus sink implementation.
+
+use std::num::NonZeroUsize;
+use std::sync::Arc;
+
+use futures::stream::BoxStream;
+
+use vector_lib::codecs::encoding::{BatchEncoder, BatchOutput};
+use vector_lib::event::EventStatus;
+use vector_lib::finalization::Finalizable;
+
+use crate::sinks::prelude::*;
+use crate::sinks::util::metadata::RequestMetadataBuilder;
+use crate::sinks::util::request_builder::default_request_builder_concurrency_limit;
+use crate::sinks::util::{RealtimeSizeBasedDefaultBatchSettings, TowerRequestSettings};
+
+use super::service::{ZerobusPayload, ZerobusRequest, ZerobusRetryLogic, ZerobusService};
+
+/// The main Zerobus sink.
+pub struct ZerobusSink {
+    service: ZerobusService,
+    request_limits: TowerRequestSettings,
+    batch_settings: BatcherSettings,
+    encoder: BatchEncoder,
+}
+
+impl ZerobusSink {
+    pub fn new(
+        service: ZerobusService,
+        request_limits: TowerRequestSettings,
+        batch_config: BatchConfig<RealtimeSizeBasedDefaultBatchSettings>,
+        encoder: BatchEncoder,
+    ) -> Result<Self, crate::Error> {
+        let batch_settings = batch_config.into_batcher_settings()?;
+
+        Ok(Self {
+            service,
+            request_limits,
+            batch_settings,
+            encoder,
+        })
+    }
+
+    fn encode_batch(
+        encoder: &BatchEncoder,
+        mut events: Vec<Event>,
+    ) -> Result<ZerobusRequest, String> {
+        let finalizers = events.take_finalizers();
+        let metadata_builder = RequestMetadataBuilder::from_events(&events);
+
+        let batch_output = match encoder.encode_batch(&events) {
+            Ok(output) => output,
+            Err(e) => {
+                finalizers.update_status(EventStatus::Rejected);
+                return Err(format!("Failed to encode batch: {}", e));
+            }
+        };
+
+        let (payload, byte_size) = match batch_output {
+            BatchOutput::Records(records) => {
+                let size = records.iter().map(|r| r.len()).sum::<usize>();
+                (ZerobusPayload::Records(records), size)
+            }
+            // The sink only builds a proto-batch encoder, so this arm is
+            // only reachable if the shared codec adds a new `BatchOutput`
+            // variant without a corresponding zerobus payload type.
+            #[cfg(feature = "codecs-arrow")]
+            BatchOutput::Arrow(_) => {
+                finalizers.update_status(EventStatus::Rejected);
+                return Err("The Databricks Zerobus sink only supports proto-batch output.".into());
+            }
+        };
+
+        let request_size = NonZeroUsize::new(byte_size).unwrap_or(NonZeroUsize::MIN);
+        let metadata = metadata_builder.with_request_size(request_size);
+
+        Ok(ZerobusRequest {
+            payload,
+            metadata,
+            finalizers,
+        })
+    }
+
+    async fn run_inner(self: Box<Self>, input: BoxStream<'_, Event>) -> Result<(), ()> {
+        let encoder = Arc::new(self.encoder.clone());
+
+        let result = {
+            let tower_service = ServiceBuilder::new()
+                .settings(self.request_limits, ZerobusRetryLogic)
+                .service(self.service.clone());
+
+            input
+                .batched(self.batch_settings.as_byte_size_config())
+                .concurrent_map(default_request_builder_concurrency_limit(), move |events| {
+                    let encoder = Arc::clone(&encoder);
+                    Box::pin(async move { Self::encode_batch(&encoder, events) })
+                })
+                .filter_map(|result| async move {
+                    match result {
+                        Err(error) => {
+                            emit!(SinkRequestBuildError { error });
+                            None
+                        }
+                        Ok(req) => Some(req),
+                    }
+                })
+                .into_driver(tower_service)
+                .run()
+                .await
+        };
+
+        self.service.close_stream().await;
+
+        result
+    }
+}
+
+#[async_trait::async_trait]
+impl StreamSink<Event> for ZerobusSink {
+    async fn run(self: Box<Self>, input: BoxStream<'_, Event>) -> Result<(), ()> {
+        self.run_inner(input).await
+    }
+}
diff --git a/src/sinks/databricks_zerobus/tests/fixtures/nested_structs_complete_schema.json b/src/sinks/databricks_zerobus/tests/fixtures/nested_structs_complete_schema.json
new file mode 100644
index 0000000000000..f30f749d13230
--- /dev/null
+++ b/src/sinks/databricks_zerobus/tests/fixtures/nested_structs_complete_schema.json
@@ -0,0 +1,127 @@
+{
+  "name": "nested_structs_table",
+  "catalog_name": "test_catalog",
+  "schema_name": "test_schema",
+  "columns": [
+    {
+      "name": "field_001",
+      "type_text": "bigint",
+      "type_name": "LONG",
+      "position": 0,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_001\",\"type\":\"long\",\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_002",
+      "type_text": "string",
+      "type_name": "STRING",
+      "position": 1,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_002\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_003",
+      "type_text": "string",
+      "type_name": "STRING",
+      "position": 2,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_003\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_004",
+      "type_text": "string",
+      "type_name": "STRING",
+      "position": 3,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_004\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_005",
+      "type_text": "string",
+      "type_name": "STRING",
+      "position": 4,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_005\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_006",
+      "type_text": "bigint",
+      "type_name": "LONG",
+      "position": 5,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_006\",\"type\":\"long\",\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_007",
+      "type_text": "bigint",
+      "type_name": "LONG",
+      "position": 6,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_007\",\"type\":\"long\",\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_008",
+      "type_text": "struct<field_009:struct<field_010:bigint,field_011:bigint>,field_012:struct<field_013:string>,field_014:struct<field_015:string>,field_016:struct<field_017:bigint>>",
+      "type_name": "STRUCT",
+      "position": 7,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_008\",\"type\":{\"type\":\"struct\",\"fields\":[{\"name\":\"field_009\",\"type\":{\"type\":\"struct\",\"fields\":[{\"name\":\"field_010\",\"type\":\"long\",\"nullable\":true,\"metadata\":{}},{\"name\":\"field_011\",\"type\":\"long\",\"nullable\":true,\"metadata\":{}}]},\"nullable\":true,\"metadata\":{}},{\"name\":\"field_012\",\"type\":{\"type\":\"struct\",\"fields\":[{\"name\":\"field_013\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}}]},\"nullable\":true,\"metadata\":{}},{\"name\":\"field_014\",\"type\":{\"type\":\"struct\",\"fields\":[{\"name\":\"field_015\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}}]},\"nullable\":true,\"metadata\":{}},{\"name\":\"field_016\",\"type\":{\"type\":\"struct\",\"fields\":[{\"name\":\"field_017\",\"type\":\"long\",\"nullable\":true,\"metadata\":{}}]},\"nullable\":true,\"metadata\":{}}]},\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_018",
+      "type_text": "struct<field_019:string,field_020:string>",
+      "type_name": "STRUCT",
+      "position": 8,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_018\",\"type\":{\"type\":\"struct\",\"fields\":[{\"name\":\"field_019\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}},{\"name\":\"field_020\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}}]},\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_021",
+      "type_text": "struct<field_022:string,field_023:string,field_020:string,field_024:string,field_025:string,field_026:int>",
+      "type_name": "STRUCT",
+      "position": 9,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_021\",\"type\":{\"type\":\"struct\",\"fields\":[{\"name\":\"field_022\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}},{\"name\":\"field_023\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}},{\"name\":\"field_020\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}},{\"name\":\"field_024\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}},{\"name\":\"field_025\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}},{\"name\":\"field_026\",\"type\":\"integer\",\"nullable\":true,\"metadata\":{}}]},\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_027",
+      "type_text": "array<bigint>",
+      "type_name": "ARRAY",
+      "position": 10,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_027\",\"type\":{\"type\":\"array\",\"elementType\":\"long\",\"containsNull\":true},\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_028",
+      "type_text": "boolean",
+      "type_name": "BOOLEAN",
+      "position": 11,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_028\",\"type\":\"boolean\",\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_029",
+      "type_text": "string",
+      "type_name": "STRING",
+      "position": 12,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_029\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_030",
+      "type_text": "string",
+      "type_name": "STRING",
+      "position": 13,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_030\",\"type\":\"string\",\"nullable\":true,\"metadata\":{}}"
+    },
+    {
+      "name": "field_031",
+      "type_text": "boolean",
+      "type_name": "BOOLEAN",
+      "position": 14,
+      "nullable": true,
+      "type_json": "{\"name\":\"field_031\",\"type\":\"boolean\",\"nullable\":true,\"metadata\":{}}"
+    }
+  ]
+}
diff --git a/src/sinks/databricks_zerobus/unity_catalog_schema.rs b/src/sinks/databricks_zerobus/unity_catalog_schema.rs
new file mode 100644
index 0000000000000..0343848f1cefe
--- /dev/null
+++ b/src/sinks/databricks_zerobus/unity_catalog_schema.rs
@@ -0,0 +1,478 @@
+//! Unity Catalog schema fetching and protobuf descriptor generation.
+//!
+//! The UC-to-protobuf conversion is delegated to
+//! [`databricks_zerobus_ingest_sdk::schema`]; this module only wraps it with
+//! the HTTP fetching + descriptor-pool assembly that the sink needs.
+
+use bytes::Buf;
+use databricks_zerobus_ingest_sdk::schema::descriptor_from_uc_schema;
+use http::{Request, Uri};
+use http_body::Body as HttpBody;
+use hyper::Body;
+use percent_encoding::{NON_ALPHANUMERIC, percent_encode};
+use prost_reflect::prost_types;
+use serde::Deserialize;
+
+use super::error::ZerobusSinkError;
+use crate::config::ProxyConfig;
+use crate::http::HttpClient;
+use crate::tls::TlsSettings;
+
+// Alias the SDK types under the names the rest of the sink already uses.
+#[cfg(test)]
+use databricks_zerobus_ingest_sdk::schema::UcColumn as UnityCatalogColumn;
+pub use databricks_zerobus_ingest_sdk::schema::UcTableSchema as UnityCatalogTableSchema;
+
+/// OAuth token response from Databricks
+#[derive(Debug, Deserialize)]
+struct OAuthTokenResponse {
+    access_token: String,
+}
+
+/// Fetch table schema from Unity Catalog API
+pub async fn fetch_table_schema(
+    unity_catalog_endpoint: &str,
+    table_name: &str,
+    client_id: &str,
+    client_secret: &str,
+    proxy: &ProxyConfig,
+) -> Result<UnityCatalogTableSchema, ZerobusSinkError> {
+    let http_client = HttpClient::new(TlsSettings::default(), proxy).map_err(|e| {
+        ZerobusSinkError::ConfigError {
+            message: format!("Failed to create HTTP client: {}", e),
+        }
+    })?;
+
+    // First, get OAuth token
+    let token = get_oauth_token(
+        &http_client,
+        unity_catalog_endpoint,
+        client_id,
+        client_secret,
+    )
+    .await?;
+
+    // Fetch table schema.
+    // Encode each segment of the fully-qualified table name (catalog.schema.table)
+    // so that reserved URI characters in quoted Unity Catalog identifiers (spaces,
+    // #, /, etc.) don't break URI parsing or hit the wrong endpoint.
+    let encoded_table_name: String = table_name
+        .split('.')
+        .map(|seg| percent_encode(seg.as_bytes(), NON_ALPHANUMERIC).to_string())
+        .collect::<Vec<_>>()
+        .join(".");
+    let url = format!(
+        "{}/api/2.1/unity-catalog/tables/{}",
+        unity_catalog_endpoint.trim_end_matches('/'),
+        encoded_table_name
+    );
+
+    let uri: Uri = url.parse().map_err(|e| ZerobusSinkError::ConfigError {
+        message: format!("Invalid Unity Catalog endpoint URL: {}", e),
+    })?;
+
+    let request = Request::get(uri)
+        .header("Authorization", format!("Bearer {}", token))
+        .header("Content-Type", "application/json")
+        .body(Body::empty())
+        .map_err(|e| ZerobusSinkError::ConfigError {
+            message: format!("Failed to build request: {}", e),
+        })?;
+
+    let response = http_client
+        .send(request)
+        .await
+        .map_err(|e| ZerobusSinkError::ConfigError {
+            message: format!("Failed to fetch table schema: {}", e),
+        })?;
+
+    let status = response.status();
+    if !status.is_success() {
+        let body_bytes = response
+            .into_body()
+            .collect()
+            .await
+            .map(|c| c.to_bytes())
+            .unwrap_or_default();
+        let error_text = String::from_utf8_lossy(&body_bytes);
+        return Err(ZerobusSinkError::ConfigError {
+            message: format!(
+                "Unity Catalog API returned error {}: {}",
+                status, error_text
+            ),
+        });
+    }
+
+    let body_bytes = response
+        .into_body()
+        .collect()
+        .await
+        .map(|c| c.to_bytes())
+        .map_err(|e| ZerobusSinkError::ConfigError {
+            message: format!("Failed to read response body: {}", e),
+        })?;
+
+    let schema: UnityCatalogTableSchema =
+        serde_json::from_reader(body_bytes.reader()).map_err(|e| {
+            ZerobusSinkError::ConfigError {
+                message: format!("Failed to parse table schema response: {}", e),
+            }
+        })?;
+
+    Ok(schema)
+}
+
+/// Get OAuth token from Databricks
+async fn get_oauth_token(
+    http_client: &HttpClient,
+    unity_catalog_endpoint: &str,
+    client_id: &str,
+    client_secret: &str,
+) -> Result<String, ZerobusSinkError> {
+    let token_url = format!(
+        "{}/oidc/v1/token",
+        unity_catalog_endpoint.trim_end_matches('/')
+    );
+
+    let uri: Uri = token_url
+        .parse()
+        .map_err(|e| ZerobusSinkError::ConfigError {
+            message: format!("Invalid token endpoint URL: {}", e),
+        })?;
+
+    // Build form-encoded body
+    let form_body = format!(
+        "grant_type=client_credentials&client_id={}&client_secret={}&scope=all-apis",
+        percent_encode(client_id.as_bytes(), NON_ALPHANUMERIC),
+        percent_encode(client_secret.as_bytes(), NON_ALPHANUMERIC)
+    );
+
+    let request = Request::post(uri)
+        .header("Content-Type", "application/x-www-form-urlencoded")
+        .body(Body::from(form_body))
+        .map_err(|e| ZerobusSinkError::ConfigError {
+            message: format!("Failed to build OAuth request: {}", e),
+        })?;
+
+    let response = http_client
+        .send(request)
+        .await
+        .map_err(|e| ZerobusSinkError::ConfigError {
+            message: format!("Failed to get OAuth token: {}", e),
+        })?;
+
+    let status = response.status();
+    if !status.is_success() {
+        let body_bytes = response
+            .into_body()
+            .collect()
+            .await
+            .map(|c| c.to_bytes())
+            .unwrap_or_default();
+        let error_text = String::from_utf8_lossy(&body_bytes);
+        return Err(ZerobusSinkError::ConfigError {
+            message: format!("OAuth token request failed {}: {}", status, error_text),
+        });
+    }
+
+    let body_bytes = response
+        .into_body()
+        .collect()
+        .await
+        .map(|c| c.to_bytes())
+        .map_err(|e| ZerobusSinkError::ConfigError {
+            message: format!("Failed to read OAuth response body: {}", e),
+        })?;
+
+    let token_response: OAuthTokenResponse =
+        serde_json::from_reader(body_bytes.reader()).map_err(|e| {
+            ZerobusSinkError::ConfigError {
+                message: format!("Failed to parse OAuth token response: {}", e),
+            }
+        })?;
+
+    Ok(token_response.access_token)
+}
+
+/// Format a protobuf MessageDescriptor as a .proto file string for logging
+fn format_descriptor_as_proto(descriptor: &prost_reflect::MessageDescriptor) -> String {
+    let mut output = String::new();
+    format_message_as_proto(descriptor, &mut output, 0);
+    output
+}
+
+/// Recursively format a message and its nested types
+fn format_message_as_proto(
+    descriptor: &prost_reflect::MessageDescriptor,
+    output: &mut String,
+    indent_level: usize,
+) {
+    let indent = "  ".repeat(indent_level);
+
+    // Write message header
+    output.push_str(&format!("{}message {} {{\n", indent, descriptor.name()));
+
+    // Write fields
+    for field in descriptor.fields() {
+        let field_indent = "  ".repeat(indent_level + 1);
+        let field_type = format_field_type(&field);
+        let field_number = field.number();
+        output.push_str(&format!(
+            "{}{}{} = {};\n",
+            field_indent,
+            field_type,
+            field.name(),
+            field_number
+        ));
+    }
+
+    output.push_str(&format!("{}}}\n", indent));
+
+    // Write nested message types
+    for nested in descriptor.child_messages() {
+        output.push('\n');
+        format_message_as_proto(&nested, output, indent_level);
+    }
+}
+
+/// Format a field's type declaration
+fn format_field_type(field: &prost_reflect::FieldDescriptor) -> String {
+    use prost_reflect::Kind;
+
+    if field.is_map() {
+        // Map fields: map<key_type, value_type> field_name
+        if let Kind::Message(map_entry) = field.kind() {
+            let key_field = map_entry.fields().find(|f| f.name() == "key").unwrap();
+            let value_field = map_entry.fields().find(|f| f.name() == "value").unwrap();
+            let key_type = format_scalar_type(&key_field);
+            let value_type = format_scalar_type(&value_field);
+            return format!("map<{}, {}> ", key_type, value_type);
+        }
+    }
+
+    let base_type = match field.kind() {
+        Kind::Message(msg) => msg.name().to_string(),
+        kind => format_kind_type(&kind),
+    };
+
+    if field.is_list() {
+        format!("repeated {} ", base_type)
+    } else {
+        format!("{} ", base_type)
+    }
+}
+
+/// Format a scalar field type (for map keys/values)
+fn format_scalar_type(field: &prost_reflect::FieldDescriptor) -> String {
+    match field.kind() {
+        prost_reflect::Kind::Message(msg) => msg.name().to_string(),
+        kind => format_kind_type(&kind),
+    }
+}
+
+/// Map Kind enum to proto type string
+fn format_kind_type(kind: &prost_reflect::Kind) -> String {
+    use prost_reflect::Kind;
+    match kind {
+        Kind::Double => "double".into(),
+        Kind::Float => "float".into(),
+        Kind::Int32 => "int32".into(),
+        Kind::Int64 => "int64".into(),
+        Kind::Uint32 => "uint32".into(),
+        Kind::Uint64 => "uint64".into(),
+        Kind::Sint32 => "sint32".into(),
+        Kind::Sint64 => "sint64".into(),
+        Kind::Fixed32 => "fixed32".into(),
+        Kind::Fixed64 => "fixed64".into(),
+        Kind::Sfixed32 => "sfixed32".into(),
+        Kind::Sfixed64 => "sfixed64".into(),
+        Kind::Bool => "bool".into(),
+        Kind::String => "string".into(),
+        Kind::Bytes => "bytes".into(),
+        Kind::Message(msg) => msg.name().to_string(),
+        Kind::Enum(e) => e.name().to_string(),
+    }
+}
+
+/// Generate a protobuf message descriptor from a Unity Catalog table schema.
+///
+/// The core UC-type → protobuf conversion lives in
+/// [`databricks_zerobus_ingest_sdk::schema::descriptor_from_uc_schema`]; this
+/// wrapper adds the `FileDescriptorProto` / `DescriptorPool` plumbing that
+/// Vector needs to get a `prost_reflect::MessageDescriptor` usable for
+/// dynamic message encoding.
+pub fn generate_descriptor_from_schema(
+    schema: &UnityCatalogTableSchema,
+) -> Result<prost_reflect::MessageDescriptor, ZerobusSinkError> {
+    let message_proto =
+        descriptor_from_uc_schema(schema).map_err(|e| ZerobusSinkError::ConfigError {
+            message: format!("Failed to convert Unity Catalog schema to protobuf: {}", e),
+        })?;
+
+    let message_name = message_proto.name().to_string();
+    let package_name = sanitize_package_name(&schema.catalog_name);
+
+    let file_proto = prost_types::FileDescriptorProto {
+        name: Some(format!("{}.proto", message_name)),
+        package: Some(package_name.clone()),
+        message_type: vec![message_proto],
+        ..Default::default()
+    };
+
+    let file_descriptor_set = prost_types::FileDescriptorSet {
+        file: vec![file_proto],
+    };
+
+    let pool = prost_reflect::DescriptorPool::from_file_descriptor_set(file_descriptor_set)
+        .map_err(|e| ZerobusSinkError::ConfigError {
+            message: format!("Failed to build descriptor pool: {}", e),
+        })?;
+
+    let full_message_name = format!("{}.{}", package_name, message_name);
+    let message_descriptor = pool
+        .get_message_by_name(&full_message_name)
+        .ok_or_else(|| ZerobusSinkError::ConfigError {
+            message: format!("Failed to get message descriptor for {}", full_message_name),
+        })?;
+
+    if tracing::enabled!(tracing::Level::INFO) {
+        let proto_schema = format_descriptor_as_proto(&message_descriptor);
+        info!(
+            "Inferred protobuf schema from Unity Catalog table {}.{}.{}:\n{}",
+            schema.catalog_name, schema.schema_name, schema.name, proto_schema
+        );
+    }
+
+    Ok(message_descriptor)
+}
+
+/// Default prefix for package name segments that start with a non-letter.
+const PACKAGE_SEGMENT_PREFIX: char = 'p';
+
+/// Sanitize a string for use as a protobuf package name.
+///
+/// Package identifiers allow `[a-zA-Z][a-zA-Z0-9_]*` segments separated by `.`.
+/// Invalid characters are replaced with `_` and each segment is ensured to start
+/// with a letter.
+fn sanitize_package_name(name: &str) -> String {
+    name.split('.')
+        .map(|segment| {
+            let mut s: String = segment
+                .chars()
+                .map(|c| {
+                    if c.is_ascii_alphanumeric() || c == '_' {
+                        c
+                    } else {
+                        '_'
+                    }
+                })
+                .collect();
+            if s.is_empty() || !s.starts_with(|c: char| c.is_ascii_alphabetic()) {
+                s.insert(0, PACKAGE_SEGMENT_PREFIX);
+            }
+            s
+        })
+        .collect::<Vec<_>>()
+        .join(".")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Smoke test: the wrapper calls into the SDK and builds a usable
+    /// `MessageDescriptor` via the descriptor pool.
+    #[test]
+    fn test_generate_descriptor_simple_schema() {
+        let schema = UnityCatalogTableSchema {
+            name: "test_table".to_string(),
+            catalog_name: "test_catalog".to_string(),
+            schema_name: "test_schema".to_string(),
+            columns: vec![
+                UnityCatalogColumn {
+                    name: "id".to_string(),
+                    type_text: "bigint".to_string(),
+                    type_name: "BIGINT".to_string(),
+                    position: 1,
+                    nullable: false,
+                    type_json: "{}".to_string(),
+                },
+                UnityCatalogColumn {
+                    name: "body".to_string(),
+                    type_text: "string".to_string(),
+                    type_name: "STRING".to_string(),
+                    position: 2,
+                    nullable: true,
+                    type_json: "{}".to_string(),
+                },
+            ],
+        };
+
+        let descriptor =
+            generate_descriptor_from_schema(&schema).expect("descriptor should be generated");
+        assert_eq!(descriptor.fields().len(), 2);
+        assert!(descriptor.get_field_by_name("id").is_some());
+        assert!(descriptor.get_field_by_name("body").is_some());
+    }
+
+    /// Snapshot test for the proto-text formatter used in info logging.
+    /// The UC→proto conversion itself is covered by the SDK's own tests;
+    /// this guards the local `format_descriptor_as_proto` rendering.
+    #[test]
+    fn test_proto_schema_snapshot() {
+        let json = include_str!("tests/fixtures/nested_structs_complete_schema.json");
+        let schema: UnityCatalogTableSchema =
+            serde_json::from_str(json).expect("Failed to parse nested_structs_complete schema");
+
+        let descriptor =
+            generate_descriptor_from_schema(&schema).expect("Failed to generate descriptor");
+
+        let proto_text = format_descriptor_as_proto(&descriptor);
+
+        assert!(
+            proto_text.contains("message TestSchemaNestedStructsTable"),
+            "Proto should have main message definition"
+        );
+        assert!(
+            proto_text.contains("string field_003"),
+            "Proto should have field_003 (string)"
+        );
+        assert!(
+            proto_text.contains("int64 field_007"),
+            "Proto should have field_007 (int64)"
+        );
+        assert!(
+            proto_text.contains("repeated int64 field_027"),
+            "Proto should have field_027 as repeated int64"
+        );
+        assert!(
+            proto_text.contains("message Field018"),
+            "Proto should have Field018 nested message"
+        );
+        assert!(
+            proto_text.contains("message Field021"),
+            "Proto should have Field021 nested message"
+        );
+        assert!(
+            proto_text.contains("message Field008"),
+            "Proto should have Field008 nested message"
+        );
+    }
+
+    #[test]
+    fn test_sanitize_package_name_non_ascii() {
+        // Non-ASCII alphanumeric characters (e.g. accented letters, CJK) are
+        // valid for `char::is_alphanumeric` but not for protobuf identifiers,
+        // so they must be replaced with `_`.
+        assert_eq!(sanitize_package_name("café"), "caf_");
+        assert_eq!(sanitize_package_name("日本.tbl"), "p__.tbl");
+        assert_eq!(sanitize_package_name("naïve.schema"), "na_ve.schema");
+    }
+
+    #[test]
+    fn test_sanitize_package_name_ascii_preserved() {
+        assert_eq!(sanitize_package_name("main.default_v2"), "main.default_v2");
+        assert_eq!(sanitize_package_name("1abc"), "p1abc");
+        assert_eq!(sanitize_package_name("_x"), "p_x");
+    }
+}
diff --git a/src/sinks/mod.rs b/src/sinks/mod.rs
index e5584de61dd02..95967c645aa16 100644
--- a/src/sinks/mod.rs
+++ b/src/sinks/mod.rs
@@ -40,6 +40,8 @@ pub mod clickhouse;
 pub mod console;
 #[cfg(feature = "sinks-databend")]
 pub mod databend;
+#[cfg(feature = "sinks-databricks-zerobus")]
+pub mod databricks_zerobus;
 #[cfg(any(
     feature = "sinks-datadog_events",
     feature = "sinks-datadog_logs",
diff --git a/src/sinks/util/encoding.rs b/src/sinks/util/encoding.rs
index 63f8407cef53b..b07e439bd0c88 100644
--- a/src/sinks/util/encoding.rs
+++ b/src/sinks/util/encoding.rs
@@ -99,7 +99,6 @@ impl Encoder<Event> for (Transformer, vector_lib::codecs::Encoder<()>) {
     }
 }
 
-#[cfg(feature = "codecs-arrow")]
 impl Encoder<Vec<Event>> for (Transformer, vector_lib::codecs::BatchEncoder) {
     fn encode_input(
         &self,
@@ -156,7 +155,6 @@ impl Encoder<Vec<Event>> for (Transformer, vector_lib::codecs::EncoderKind) {
             vector_lib::codecs::EncoderKind::Framed(encoder) => {
                 (self.0.clone(), *encoder.clone()).encode_input(events, writer)
             }
-            #[cfg(feature = "codecs-arrow")]
             vector_lib::codecs::EncoderKind::Batch(encoder) => {
                 (self.0.clone(), encoder.clone()).encode_input(events, writer)
             }
diff --git a/website/content/en/docs/reference/configuration/sinks/databricks_zerobus.md b/website/content/en/docs/reference/configuration/sinks/databricks_zerobus.md
new file mode 100644
index 0000000000000..70275b4141504
--- /dev/null
+++ b/website/content/en/docs/reference/configuration/sinks/databricks_zerobus.md
@@ -0,0 +1,14 @@
+---
+title: Databricks Zerobus
+description: Stream observability data to Databricks Unity Catalog via Zerobus
+component_kind: sink
+layout: component
+tags: ["databricks", "component", "sink", "logs"]
+---
+
+{{/*
+This doc is generated using:
+
+1. The template in layouts/docs/component.html
+2. The relevant CUE data in cue/reference/components/...
+*/}}
diff --git a/website/cue/reference/components/sinks/databricks_zerobus.cue b/website/cue/reference/components/sinks/databricks_zerobus.cue
new file mode 100644
index 0000000000000..f9510774dfe16
--- /dev/null
+++ b/website/cue/reference/components/sinks/databricks_zerobus.cue
@@ -0,0 +1,167 @@
+package metadata
+
+components: sinks: databricks_zerobus: {
+	title: "Databricks Zerobus"
+
+	classes: {
+		commonly_used: false
+		delivery:      "at_least_once"
+		development:   "beta"
+		egress_method: "batch"
+		service_providers: ["Databricks"]
+		stateful: false
+	}
+
+	features: {
+		auto_generated:   true
+		acknowledgements: true
+		healthcheck: enabled: true
+		send: {
+			batch: {
+				enabled:      true
+				common:       false
+				max_bytes:    10_000_000
+				timeout_secs: 1.0
+			}
+			compression: enabled: false
+			encoding: enabled:    false
+			proxy: enabled:       true
+			request: {
+				enabled: true
+				headers: false
+			}
+			tls: enabled: false
+			to: {
+				service: services.databricks_zerobus
+
+				interface: {
+					socket: {
+						api: {
+							title: "Databricks Zerobus Ingestion API"
+							url:   urls.databricks
+						}
+						direction: "outgoing"
+						protocols: ["http"]
+						ssl: "required"
+					}
+				}
+			}
+		}
+	}
+
+	support: {
+		requirements: [
+			"""
+				A [Databricks](\(urls.databricks)) workspace with [Unity Catalog](\(urls.databricks_unity_catalog)) enabled.
+				""",
+			"""
+				OAuth 2.0 client credentials (client ID and client secret) with permissions to write to the target table.
+				""",
+		]
+		warnings: []
+		notices: []
+	}
+
+	configuration: generated.components.sinks.databricks_zerobus.configuration
+
+	input: {
+		logs:    true
+		metrics: null
+		traces:  false
+	}
+
+	how_it_works: {
+		authentication: {
+			title: "Authentication"
+			body: """
+				The Databricks Zerobus sink authenticates using OAuth 2.0 client credentials.
+				You must provide a `client_id` and `client_secret` that have been granted
+				permissions to write to the target Unity Catalog table.
+				"""
+		}
+
+		schema: {
+			title: "Schema"
+			body: """
+				The sink requires a schema to encode events into protobuf format.
+
+				The sink automatically fetches the table schema from the Unity Catalog API
+				at startup using the configured `table_name` and `unity_catalog_endpoint`,
+				ensuring the schema always matches the target table. No additional schema
+				configuration is required.
+				"""
+		}
+
+		batching: {
+			title: "Batching"
+			body: """
+				Events are batched before being sent to Zerobus. Each event is individually
+				serialized as a protobuf message, and the batch is sent as a single request.
+				The maximum batch size is 10MB, enforced by the Zerobus SDK.
+
+				Vector sizes batches against `batch.max_bytes` using the *uncompressed,
+				pre-serialization* event size, while the SDK's 10MB cap applies to the
+				*encoded protobuf* size. For most schemas the protobuf encoding is smaller
+				than (or comparable to) the source event, but for numeric-heavy schemas
+				(many integer or float fields) the encoded form can be larger — so a batch
+				configured right at the 10MB boundary may exceed the SDK limit and the
+				ingest call will fail. If you see SDK-side size errors, lower
+				`batch.max_bytes` to leave headroom (for example, 8MB).
+				"""
+		}
+
+		error_handling: {
+			title: "Error Handling & Retries"
+			body: """
+				The sink classifies errors from the Zerobus SDK into retryable and non-retryable
+				categories:
+
+				- **Retryable errors** (connection failures, stream closed, channel errors): The
+				  sink automatically discards the current gRPC stream and creates a fresh one on
+				  the next retry attempt. This ensures recovery from transient network issues
+				  without manual intervention.
+
+				- **Non-retryable errors** (invalid table, invalid endpoint, invalid arguments):
+				  Events are rejected permanently and the existing stream is kept alive.
+
+				Retry behavior (backoff, concurrency, timeouts) is controlled by the standard
+				`request` configuration options.
+				"""
+		}
+
+		proxy: {
+			title: "Proxy"
+			body: """
+				Both the Zerobus gRPC ingestion channel and the Unity Catalog schema
+				discovery requests honor Vector's `proxy` configuration (`proxy.http`,
+				`proxy.https`, `proxy.no_proxy`), which itself is merged with the standard
+				`HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables.
+
+				Because the Zerobus endpoint is always HTTPS gRPC, the `proxy.https` URL is
+				used when set; `proxy.http` is used as a fallback only if `proxy.https` is
+				not configured. Hosts matching `proxy.no_proxy` bypass the proxy. Both
+				`http://` and `https://` proxy URIs are supported — for HTTPS proxies, the
+				client-to-proxy hop does its own TLS handshake using the system trust store.
+
+				Setting `proxy.enabled = false` disables proxying entirely, including the
+				SDK's built-in env-var fallback.
+				"""
+		}
+
+		acknowledgements: {
+			title: "Acknowledgements"
+			body: """
+				The sink always waits for a per-batch server-side offset acknowledgement
+				from Zerobus before considering a batch delivered, regardless of whether
+				Vector's end-to-end `acknowledgements` are enabled. This guarantees that
+				data has been durably accepted by the Zerobus service before the sink
+				reports success.
+
+				Vector's `acknowledgements.enabled` setting only controls whether that
+				delivery confirmation is propagated back to upstream sources that support
+				end-to-end acknowledgements; it does not weaken the sink's own per-batch
+				durability guarantee.
+				"""
+		}
+	}
+}
diff --git a/website/cue/reference/components/sinks/generated/databricks_zerobus.cue b/website/cue/reference/components/sinks/generated/databricks_zerobus.cue
new file mode 100644
index 0000000000000..f01f2785bdd97
--- /dev/null
+++ b/website/cue/reference/components/sinks/generated/databricks_zerobus.cue
@@ -0,0 +1,323 @@
+package metadata
+
+generated: components: sinks: databricks_zerobus: configuration: {
+	acknowledgements: {
+		description: """
+			Controls how acknowledgements are handled for this sink.
+
+			See [End-to-end Acknowledgements][e2e_acks] for more information on how event acknowledgement is handled.
+
+			[e2e_acks]: https://vector.dev/docs/architecture/end-to-end-acknowledgements/
+			"""
+		required: false
+		type: object: options: enabled: {
+			description: """
+				Controls whether or not end-to-end acknowledgements are enabled.
+
+				When enabled for a sink, any source that supports end-to-end
+				acknowledgements that is connected to that sink waits for events
+				to be acknowledged by **all connected sinks** before acknowledging them at the source.
+
+				Enabling or disabling acknowledgements at the sink level takes precedence over any global
+				[`acknowledgements`][global_acks] configuration.
+
+				[global_acks]: https://vector.dev/docs/reference/configuration/global-options/#acknowledgements
+				"""
+			required: false
+			type: bool: {}
+		}
+	}
+	auth: {
+		description: "Databricks authentication configuration."
+		required:    true
+		type: object: options: {
+			client_id: {
+				description: "OAuth 2.0 client ID."
+				required:    true
+				type: string: examples: ["${DATABRICKS_CLIENT_ID}", "abc123..."]
+			}
+			client_secret: {
+				description: "OAuth 2.0 client secret."
+				required:    true
+				type: string: examples: ["${DATABRICKS_CLIENT_SECRET}", "secret123..."]
+			}
+			strategy: {
+				description: "The authentication strategy to use for Databricks."
+				required:    true
+				type: string: enum: oauth: "Authenticate using OAuth 2.0 client credentials."
+			}
+		}
+	}
+	batch: {
+		description: "Event batching behavior."
+		required:    false
+		type: object: options: {
+			max_bytes: {
+				description: """
+					The maximum size of a batch that is processed by a sink.
+
+					This is based on the uncompressed size of the batched events, before they are
+					serialized or compressed.
+					"""
+				required: false
+				type: uint: {
+					default: 10000000
+					unit:    "bytes"
+				}
+			}
+			max_events: {
+				description: "The maximum size of a batch before it is flushed."
+				required:    false
+				type: uint: unit: "events"
+			}
+			timeout_secs: {
+				description: "The maximum age of a batch before it is flushed."
+				required:    false
+				type: float: {
+					default: 1.0
+					unit:    "seconds"
+				}
+			}
+		}
+	}
+	ingestion_endpoint: {
+		description: """
+			The Zerobus ingestion endpoint URL.
+
+			This should be the full URL to the Zerobus ingestion service.
+			"""
+		required: true
+		type: string: examples: ["https://ingest.dev.databricks.com", "https://ingest.prod.databricks.com"]
+	}
+	request: {
+		description: """
+			Middleware settings for outbound requests.
+
+			Various settings can be configured, such as concurrency and rate limits, timeouts, and retry behavior.
+
+			Note that the retry backoff policy follows the Fibonacci sequence.
+			"""
+		required: false
+		type: object: options: {
+			adaptive_concurrency: {
+				description: """
+					Configuration of adaptive concurrency parameters.
+
+					These parameters typically do not require changes from the default, and incorrect values can lead to meta-stable or
+					unstable performance and sink behavior. Proceed with caution.
+					"""
+				required: false
+				type: object: options: {
+					decrease_ratio: {
+						description: """
+																The fraction of the current value to set the new concurrency limit when decreasing the limit.
+
+																Valid values are greater than `0` and less than `1`. Smaller values cause the algorithm to scale back rapidly
+																when latency increases.
+
+																**Note**: The new limit is rounded down after applying this ratio.
+																"""
+						required: false
+						type: float: default: 0.9
+					}
+					ewma_alpha: {
+						description: """
+																The weighting of new measurements compared to older measurements.
+
+																Valid values are greater than `0` and less than `1`.
+
+																ARC uses an exponentially weighted moving average (EWMA) of past RTT measurements as a reference to compare with
+																the current RTT. Smaller values cause this reference to adjust more slowly, which may be useful if a service has
+																unusually high response variability.
+																"""
+						required: false
+						type: float: default: 0.4
+					}
+					initial_concurrency: {
+						description: """
+																The initial concurrency limit to use. If not specified, the initial limit is 1 (no concurrency).
+
+																Datadog recommends setting this value to your service's average limit if you're seeing that it takes a
+																long time to ramp up adaptive concurrency after a restart. You can find this value by looking at the
+																`adaptive_concurrency_limit` metric.
+																"""
+						required: false
+						type: uint: default: 1
+					}
+					max_concurrency_limit: {
+						description: """
+																The maximum concurrency limit.
+
+																The adaptive request concurrency limit does not go above this bound. This is put in place as a safeguard.
+																"""
+						required: false
+						type: uint: default: 200
+					}
+					rtt_deviation_scale: {
+						description: """
+																Scale of RTT deviations which are not considered anomalous.
+
+																Valid values are greater than or equal to `0`, and reasonable values range from `1.0` to `3.0`.
+
+																When calculating the past RTT average, a secondary “deviation” value is also computed that indicates how variable
+																those values are. That deviation is used when comparing the past RTT average to the current measurements, so we
+																can ignore increases in RTT that are within an expected range. This factor is used to scale up the deviation to
+																an appropriate range. Larger values cause the algorithm to ignore larger increases in the RTT.
+																"""
+						required: false
+						type: float: default: 2.5
+					}
+				}
+			}
+			concurrency: {
+				description: """
+					Configuration for outbound request concurrency.
+
+					This can be set either to one of the below enum values or to a positive integer, which denotes
+					a fixed concurrency limit.
+					"""
+				required: false
+				type: {
+					string: {
+						default: "adaptive"
+						enum: {
+							adaptive: """
+															Concurrency is managed by Vector's [Adaptive Request Concurrency][arc] feature.
+
+															[arc]: https://vector.dev/docs/architecture/arc/
+															"""
+							none: """
+															A fixed concurrency of 1.
+
+															Only one request can be outstanding at any given time.
+															"""
+						}
+					}
+					uint: {}
+				}
+			}
+			rate_limit_duration_secs: {
+				description: "The time window used for the `rate_limit_num` option."
+				required:    false
+				type: uint: {
+					default: 1
+					unit:    "seconds"
+				}
+			}
+			rate_limit_num: {
+				description: "The maximum number of requests allowed within the `rate_limit_duration_secs` time window."
+				required:    false
+				type: uint: {
+					default: 9223372036854775807
+					unit:    "requests"
+				}
+			}
+			retry_attempts: {
+				description: "The maximum number of retries to make for failed requests."
+				required:    false
+				type: uint: {
+					default: 9223372036854775807
+					unit:    "retries"
+				}
+			}
+			retry_initial_backoff_secs: {
+				description: """
+					The amount of time to wait before attempting the first retry for a failed request.
+
+					After the first retry has failed, the Fibonacci sequence is used to select future backoffs.
+					"""
+				required: false
+				type: uint: {
+					default: 1
+					unit:    "seconds"
+				}
+			}
+			retry_jitter_mode: {
+				description: "The jitter mode to use for retry backoff behavior."
+				required:    false
+				type: string: {
+					default: "Full"
+					enum: {
+						Full: """
+															Full jitter.
+
+															The random delay is anywhere from 0 up to the maximum current delay calculated by the backoff
+															strategy.
+
+															Incorporating full jitter into your backoff strategy can greatly reduce the likelihood
+															of creating accidental denial of service (DoS) conditions against your own systems when
+															many clients are recovering from a failure state.
+															"""
+						None: "No jitter."
+					}
+				}
+			}
+			retry_max_duration_secs: {
+				description: "The maximum amount of time to wait between retries."
+				required:    false
+				type: uint: {
+					default: 30
+					unit:    "seconds"
+				}
+			}
+			timeout_secs: {
+				description: """
+					The time a request can take before being aborted.
+
+					Datadog highly recommends that you do not lower this value below the service's internal timeout, as this could
+					create orphaned requests, pile on retries, and result in duplicate data downstream.
+					"""
+				required: false
+				type: uint: {
+					default: 60
+					unit:    "seconds"
+				}
+			}
+		}
+	}
+	stream_options: {
+		description: """
+			Zerobus stream configuration options.
+
+			This is a thin wrapper around the SDK's `StreamConfigurationOptions` with Vector-specific
+			configuration attributes and custom defaults suitable for Vector's use case.
+			"""
+		required: false
+		type: object: options: {
+			flush_timeout_ms: {
+				description: "Timeout in milliseconds for flush operations."
+				required:    false
+				type: uint: {
+					default: 30000
+					examples: [30000]
+				}
+			}
+			server_lack_of_ack_timeout_ms: {
+				description: "Timeout in milliseconds for server acknowledgements."
+				required:    false
+				type: uint: {
+					default: 60000
+					examples: [60000]
+				}
+			}
+		}
+	}
+	table_name: {
+		description: """
+			The Unity Catalog table name to write to.
+
+			This should be in the format `catalog.schema.table`.
+			"""
+		required: true
+		type: string: examples: ["logging_platform.my_team.logs", "main.default.vector_logs"]
+	}
+	unity_catalog_endpoint: {
+		description: """
+			The Unity Catalog endpoint URL.
+
+			This is used for authentication and table metadata.
+			"""
+		required: true
+		type: string: examples: ["https://dbc-e2f0eb31-2b0e.staging.cloud.databricks.com", "https://your-workspace.cloud.databricks.com"]
+	}
+}
diff --git a/website/cue/reference/services/databricks_zerobus.cue b/website/cue/reference/services/databricks_zerobus.cue
new file mode 100644
index 0000000000000..1091c215a5d68
--- /dev/null
+++ b/website/cue/reference/services/databricks_zerobus.cue
@@ -0,0 +1,10 @@
+package metadata
+
+services: databricks_zerobus: {
+	name:     "Databricks Zerobus"
+	thing:    "a \(name) ingestion stream"
+	url:      urls.databricks
+	versions: null
+
+	description: "[Databricks](\(urls.databricks)) is a unified analytics platform. The Zerobus sink streams observability data to Databricks Unity Catalog tables via the Zerobus ingestion service, using protobuf encoding for efficient data transfer."
+}
diff --git a/website/cue/reference/urls.cue b/website/cue/reference/urls.cue
index 239599effed75..0133e581f82e5 100644
--- a/website/cue/reference/urls.cue
+++ b/website/cue/reference/urls.cue
@@ -124,6 +124,8 @@ urls: {
 	cue:                                        "https://cuelang.org/"
 	csv:                                        "\(wikipedia)/wiki/Comma-separated_values"
 	dag:                                        "\(wikipedia)/wiki/Directed_acyclic_graph"
+	databricks:                                 "https://www.databricks.com"
+	databricks_unity_catalog:                   "https://docs.databricks.com/en/data-governance/unity-catalog/index.html"
 	databend:                                   "https://databend.rs"
 	databend_rest:                              "https://databend.rs/doc/integrations/api/rest"
 	databend_cloud:                             "https://www.databend.com"

From 5112e0ae334120465b333c1777da38593a4b8c60 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 6 May 2026 14:00:21 -0400
Subject: [PATCH 204/326] chore(deps): bump openssl from 0.10.78 to 0.10.79
 (#25380)

Bumps [openssl](https://github.com/rust-openssl/rust-openssl) from 0.10.78 to 0.10.79.
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.78...openssl-v0.10.79)

---
updated-dependencies:
- dependency-name: openssl
  dependency-version: 0.10.79
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock                 | 17 ++++++++---------
 lib/vector-core/Cargo.toml |  2 +-
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index afb56a107803f..641e0da9e4541 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2067,7 +2067,7 @@ dependencies = [
  "bitflags 2.10.0",
  "cexpr",
  "clang-sys",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "regex",
@@ -7890,15 +7890,14 @@ dependencies = [
 
 [[package]]
 name = "openssl"
-version = "0.10.78"
+version = "0.10.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f38c4372413cdaaf3cc79dd92d29d7d9f5ab09b51b10dded508fb90bb70b9222"
+checksum = "bf0b434746ee2832f4f0baf10137e1cabb18cbe6912c69e2e33263c45250f542"
 dependencies = [
  "bitflags 2.10.0",
  "cfg-if",
  "foreign-types",
  "libc",
- "once_cell",
  "openssl-macros",
  "openssl-sys",
 ]
@@ -7931,9 +7930,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.114"
+version = "0.9.115"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13ce1245cd07fcc4cfdb438f7507b0c7e4f3849a69fd84d52374c66d83741bb6"
+checksum = "158fe5b292746440aa6e7a7e690e55aeb72d41505e2804c23c6973ad0e9c9781"
 dependencies = [
  "cc",
  "libc",
@@ -8749,7 +8748,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
  "heck 0.5.0",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "log",
  "multimap",
  "once_cell",
@@ -8782,7 +8781,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
@@ -8795,7 +8794,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index edf7b43a4a74f..caf2735d45166 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -34,7 +34,7 @@ metrics-util.workspace = true
 mlua = { version = "0.10.5", default-features = false, features = ["lua54", "send", "vendored"], optional = true }
 no-proxy = { version = "0.3.6", default-features = false, features = ["serialize"] }
 ordered-float.workspace = true
-openssl = { version = "0.10.78", default-features = false, features = ["vendored"] }
+openssl = { version = "0.10.79", default-features = false, features = ["vendored"] }
 parking_lot = { version = "0.12.5", default-features = false }
 pin-project.workspace = true
 proptest = { workspace = true, optional = true }

From 27e74de2d2daa8368e4b073fa90d443eb7974ba2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 6 May 2026 16:34:22 -0400
Subject: [PATCH 205/326] chore(ci): bump docker/login-action from 4.0.0 to
 4.1.0 (#25349)

Bumps [docker/login-action](https://github.com/docker/login-action) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/b45d80f862d83dbcd57f89517bcf500b2ab88fb2...4907a6ddec9925e35a0a9e82d7399ccc52663121)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build-test-runner.yml | 2 +-
 .github/workflows/environment.yml       | 2 +-
 .github/workflows/publish.yml           | 4 ++--
 .github/workflows/regression.yml        | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build-test-runner.yml b/.github/workflows/build-test-runner.yml
index ca8e51b0b6944..c5c4f1c95c7d7 100644
--- a/.github/workflows/build-test-runner.yml
+++ b/.github/workflows/build-test-runner.yml
@@ -36,7 +36,7 @@ jobs:
           vdev: true
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/environment.yml b/.github/workflows/environment.yml
index de519e0cbc955..a989886548df6 100644
--- a/.github/workflows/environment.yml
+++ b/.github/workflows/environment.yml
@@ -45,7 +45,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
       - name: Login to DockerHub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         if: env.SHOULD_PUBLISH == 'true'
         with:
           username: ${{ secrets.CI_DOCKER_USERNAME }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7e8455b60de58..2f313a30459f7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -331,12 +331,12 @@ jobs:
         with:
           ref: ${{ inputs.git_ref }}
       - name: Login to DockerHub
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           username: ${{ secrets.CI_DOCKER_USERNAME }}
           password: ${{ secrets.CI_DOCKER_PASSWORD }}
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 94b47333a8ed8..d30d74fae716a 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -331,7 +331,7 @@ jobs:
         uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
 
       - name: Docker Login to ECR
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ${{ steps.login-ecr.outputs.registry }}
 
@@ -374,7 +374,7 @@ jobs:
         uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
 
       - name: Docker Login to ECR
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ${{ steps.login-ecr.outputs.registry }}
 

From 8105f31eef65e4e3d823f382d05d63e433394777 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 6 May 2026 17:26:46 -0400
Subject: [PATCH 206/326] chore(ci): add code coverage collection for
 integration and e2e test suites (#25088)

* Run IT suite with coveraged on a scheduled basis

* Add trigger

* fix(ci): add run_all input to integration.yml to force all tests when called from coverage workflow

* Format

* fix(ci): require all test suites to pass before coverage upload

* fix(ci): pass ref to integration workflow for consistent coverage builds

* Format

* fix(ci): preserve coverage across multi-environment integration tests

* fix(ci): always mount coverage volume in test runner container

* fix(ci): clear stale combined coverage on retry and fix COVERAGE docs

* chore(ci): document E2E coverage instrumentation limitation

* fix(ci): write per-environment coverage files to prevent overwrites

* fix(ci): address PR review on coverage suite

* fix(ci): scope CLI test filter to root vector package

* fix(ci): skip make test when no nextest suites are selected

* fix(ci): remove stale lcov.info before merging per-env coverage

* chore(ci): fix component-validation input and add OS-based FEATURES default

* Add DD_ENV/DD_API_KEY to unit-tests.yml

* chore(ci): grant id-token: write to coverage caller jobs

* chore(ci): grant id-token: write to coverage job in ci-review-trigger
---
 .github/workflows/ci-review-trigger.yml  | 14 ++++
 .github/workflows/coverage.yml           | 96 +++++++++++++++++++-----
 .github/workflows/integration.yml        | 62 ++++++++++++---
 .github/workflows/unit-tests.yml         | 39 ++++++++--
 Makefile                                 | 21 +++++-
 scripts/run-integration-test.sh          | 35 ++++++++-
 tests/e2e/Dockerfile                     |  2 +-
 vdev/src/commands/compose_tests/start.rs |  2 +-
 vdev/src/commands/compose_tests/stop.rs  |  2 +-
 vdev/src/commands/compose_tests/test.rs  | 41 +++++++++-
 vdev/src/commands/e2e/test.rs            |  5 ++
 vdev/src/commands/integration/test.rs    |  5 ++
 vdev/src/commands/test.rs                |  2 +
 vdev/src/testing/integration.rs          |  9 +++
 vdev/src/testing/runner.rs               | 64 +++++++++++++++-
 15 files changed, 353 insertions(+), 46 deletions(-)

diff --git a/.github/workflows/ci-review-trigger.yml b/.github/workflows/ci-review-trigger.yml
index 9cd2a1d67e3f5..ade6cf9c8c8c8 100644
--- a/.github/workflows/ci-review-trigger.yml
+++ b/.github/workflows/ci-review-trigger.yml
@@ -9,6 +9,7 @@
 #
 # The available triggers are:
 #
+# /ci-run-coverage            : runs full coverage suite (unit + int + e2e) — NOT included in /ci-run-all (covered by others)
 # /ci-run-all                 : runs all of the below
 # /ci-run-cli                 : runs CLI - Linux
 # /ci-run-test-vector-api     : runs make test-vector-api
@@ -63,6 +64,7 @@ jobs:
       || startsWith(github.event.review.body, '/ci-run-test-docs')
       || startsWith(github.event.review.body, '/ci-run-deny')
       || startsWith(github.event.review.body, '/ci-run-component-features')
+      || startsWith(github.event.review.body, '/ci-run-coverage')
       || startsWith(github.event.review.body, '/ci-run-cross')
       || startsWith(github.event.review.body, '/ci-run-unit-mac')
       || startsWith(github.event.review.body, '/ci-run-unit-windows')
@@ -194,3 +196,15 @@ jobs:
     with:
       ref: ${{ github.event.review.commit_id }}
     secrets: inherit
+
+  coverage:
+    needs: validate
+    if: contains(github.event.review.body, '/ci-run-coverage')
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/coverage.yml
+    with:
+      ref: ${{ github.event.review.commit_id }}
+    secrets: inherit
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 8ca10e1127a0d..5af2787d2b90f 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -1,43 +1,105 @@
-name: Code Coverage
+# Coverage
+#
+# Runs all test suites (unit, component validation, CLI, API, behavior,
+# integration) with code coverage instrumentation on a single commit. Results
+# are merged into one lcov report and uploaded to Datadog. Also runs on a
+# weekly schedule to ensure full baseline coverage is always fresh.
+#
+# Limitation: integration and E2E coverage only instruments the test runner
+# (cargo-nextest), not the separately-launched Vector binary inside compose
+# services. Instrumenting the service binary would require building it with
+# cargo-llvm-cov and merging its runtime profdata, which is out of scope here.
+
+name: Coverage
 
 on:
-  push:
-    branches:
-      - master
-  workflow_dispatch: # Allow manual trigger from GitHub UI
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref to checkout"
+        required: false
+        type: string
+
+  schedule:
+    - cron: "0 2 * * 0" # 2 AM UTC every Sunday
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 env:
-  CI: true
   CARGO_INCREMENTAL: "0" # Disable incremental compilation for coverage
+  CI: true
 
 jobs:
-  coverage:
+  tests:
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/unit-tests.yml
+    with:
+      ref: ${{ inputs.ref }}
+      default: true
+      coverage: true
+      cli: true
+      vector-api: true
+
+  integration-tests:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/integration.yml
+    with:
+      run_all: true
+      coverage: true
+      ref: ${{ inputs.ref }}
+    secrets: inherit
+
+  coverage-upload:
+    name: Merge and Upload Coverage
     runs-on: ubuntu-24.04
+    needs:
+      - tests
+      - integration-tests
+    if: ${{ !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled') }}
     permissions:
       contents: read
       id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref }}
+
+      - name: Download all coverage artifacts
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
+        with:
+          pattern: coverage-*
+          path: coverage-artifacts
+          merge-multiple: false
+
+      - name: Merge coverage reports
+        run: |
+          sudo apt-get install -y --no-install-recommends lcov
+
+          mapfile -t FILES < <(find coverage-artifacts -name '*.info')
+          echo "Merging ${#FILES[@]} coverage file(s)"
+
+          ARGS=()
+          for f in "${FILES[@]}"; do
+            ARGS+=("--add-tracefile" "$f")
+          done
+          lcov "${ARGS[@]}" --output-file merged-lcov.info
 
       - uses: ./.github/actions/setup
         with:
-          rust: true
-          libsasl2: true
-          protoc: true
-          cargo-llvm-cov: true
-          cargo-nextest: true
+          vdev: false
           datadog-ci: true
 
-      - name: "Generate code coverage"
-        run: cargo llvm-cov nextest --workspace --lcov --output-path lcov.info
-
       - uses: ./.github/actions/dd-token
 
-      - name: "Upload coverage to Datadog"
+      - name: Upload to Datadog
         env:
           DD_SITE: datadoghq.com
           DD_ENV: ci
-        run: datadog-ci coverage upload lcov.info
+        run: datadog-ci coverage upload merged-lcov.info
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 833a7ae13d5de..a4b2bf1b07b2d 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -7,14 +7,31 @@
 name: Integration Test Suite
 
 on:
+  workflow_call:
+    inputs:
+      run_all:
+        description: "Run all integration and e2e tests regardless of changed files"
+        required: false
+        type: boolean
+        default: false
+      coverage:
+        description: "Collect code coverage (outputs target/coverage/lcov.info per service)"
+        required: false
+        type: boolean
+        default: false
+      ref:
+        description: "Git ref to checkout (defaults to github.sha)"
+        required: false
+        type: string
   workflow_dispatch:
   pull_request:
   merge_group:
     types: [checks_requested]
 
 concurrency:
-  # `github.event.number` exists for pull requests, otherwise fall back to SHA for merge queue
-  group: ${{ github.workflow }}-${{ github.event.number || github.event.merge_group.head_sha }}
+  # `github.event.number` exists for pull requests, otherwise fall back to SHA for merge queue.
+  # For workflow_call (e.g. weekly coverage), use run_id so each caller gets its own group.
+  group: ${{ github.workflow }}-${{ github.event.number || github.event.merge_group.head_sha || github.run_id }}
   cancel-in-progress: true
 
 permissions:
@@ -51,6 +68,8 @@ jobs:
     if: ${{
       always() &&
       (github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'workflow_call' ||
+      inputs.run_all == true ||
       (github.event_name == 'merge_group' &&
       needs.changes.result == 'success' &&
       (needs.changes.outputs.dependencies == 'true' ||
@@ -60,7 +79,8 @@ jobs:
       }}
     uses: ./.github/workflows/build-test-runner.yml
     with:
-      commit_sha: ${{ github.sha }}
+      commit_sha: ${{ inputs.ref || github.sha }}
+      checkout_ref: ${{ inputs.ref }}
 
   integration-tests:
     runs-on: ubuntu-24.04-8core
@@ -72,8 +92,9 @@ jobs:
       - build-test-runner
 
     if: ${{ always() && !failure() && !cancelled() && needs.build-test-runner.result == 'success' &&
-      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch') }}
+      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) }}
     strategy:
+      fail-fast: false
       matrix:
         # TODO: Add "splunk" back once https://github.com/vectordotdev/vector/issues/23474 is fixed.
         # If you modify this list, please also update the `int_tests` job in changes.yml.
@@ -126,6 +147,8 @@ jobs:
         id: check
         run: |
           if [[ "${{ github.event_name }}" == "workflow_dispatch" || \
+                "${{ github.event_name }}" == "workflow_call" || \
+                "${{ inputs.run_all }}" == "true" || \
                 "${{ needs.changes.outputs.dependencies }}" == "true" || \
                 "${{ needs.changes.outputs.integration-yml }}" == "true" ]]; then
             echo "should_run=true" >> "$GITHUB_OUTPUT"
@@ -142,6 +165,7 @@ jobs:
         if: steps.check.outputs.should_run == 'true'
         with:
           submodules: "recursive"
+          ref: ${{ inputs.ref || github.sha }}
 
       - uses: ./.github/actions/dd-token
         if: steps.check.outputs.should_run == 'true'
@@ -159,7 +183,7 @@ jobs:
         uses: ./.github/actions/pull-test-runner
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          commit_sha: ${{ github.sha }}
+          commit_sha: ${{ inputs.ref || github.sha }}
 
       - name: Run Integration Tests for ${{ matrix.service }}
         if: steps.check.outputs.should_run == 'true'
@@ -168,7 +192,15 @@ jobs:
           timeout_minutes: 30
           max_attempts: 3
           command: |
-            bash scripts/run-integration-test.sh int ${{ matrix.service }}
+            bash scripts/run-integration-test.sh ${{ inputs.coverage && '-c' || '' }} int ${{ matrix.service }}
+
+      - name: Upload coverage artifact
+        if: inputs.coverage && always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: coverage-int-${{ matrix.service }}
+          path: target/coverage/lcov.info
+          if-no-files-found: ignore
 
   e2e-tests:
     runs-on: ubuntu-24.04-8core
@@ -179,8 +211,9 @@ jobs:
       - changes
       - build-test-runner
     if: ${{ always() && !failure() && !cancelled() && needs.build-test-runner.result == 'success' &&
-      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch') }}
+      (github.event_name == 'merge_group' || github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || inputs.run_all == true) }}
     strategy:
+      fail-fast: false
       matrix:
         service: ["datadog-logs", "datadog-metrics", "opentelemetry-logs", "opentelemetry-metrics"]
     timeout-minutes: 90
@@ -196,6 +229,8 @@ jobs:
         id: check
         run: |
           if [[ "${{ github.event_name }}" == "workflow_dispatch" || \
+                "${{ github.event_name }}" == "workflow_call" || \
+                "${{ inputs.run_all }}" == "true" || \
                 "${{ needs.changes.outputs.dependencies }}" == "true" || \
                 "${{ needs.changes.outputs.integration-yml }}" == "true" ]]; then
             echo "should_run=true" >> "$GITHUB_OUTPUT"
@@ -212,6 +247,7 @@ jobs:
         if: steps.check.outputs.should_run == 'true'
         with:
           submodules: "recursive"
+          ref: ${{ inputs.ref || github.sha }}
 
       - uses: ./.github/actions/dd-token
         if: steps.check.outputs.should_run == 'true'
@@ -229,7 +265,7 @@ jobs:
         uses: ./.github/actions/pull-test-runner
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          commit_sha: ${{ github.sha }}
+          commit_sha: ${{ inputs.ref || github.sha }}
 
       - name: Run E2E Tests for ${{ matrix.service }}
         if: steps.check.outputs.should_run == 'true'
@@ -238,7 +274,15 @@ jobs:
           timeout_minutes: 30
           max_attempts: 3
           command: |
-            bash scripts/run-integration-test.sh e2e ${{ matrix.service }}
+            bash scripts/run-integration-test.sh ${{ inputs.coverage && '-c' || '' }} e2e ${{ matrix.service }}
+
+      - name: Upload coverage artifact
+        if: inputs.coverage && always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: coverage-e2e-${{ matrix.service }}
+          path: target/coverage/lcov.info
+          if-no-files-found: ignore
 
   integration-test-suite:
     name: Integration Test Suite
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 63c9de7d19351..3f95e9262a21f 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -4,10 +4,13 @@
 # validation. Callers can enable additional suites (CLI, Vector API, behavior)
 # via boolean inputs.
 #
-# When `default` is true, all nextest-based suites run in a single `make test`
-# invocation with the relevant features enabled. When `default` is false, only
-# the explicitly enabled suites run, using a nextest filter expression to
-# select the matching tests.
+# With coverage: false (default), plain cargo-nextest; uploads test results to Datadog.
+# With coverage: true, cargo-llvm-cov (COVERAGE=true); uploads an lcov artifact named "coverage-unit".
+#
+# When `default` is true (the default), all nextest-based suites run in a
+# single `make test` invocation with the relevant features enabled. When
+# `default` is false, only the explicitly enabled suites run, using a nextest
+# filter expression to select the matching tests.
 
 name: Tests
 
@@ -18,6 +21,11 @@ on:
         description: "Git ref to checkout"
         required: false
         type: string
+      coverage:
+        description: "Collect code coverage (sets COVERAGE=true for make targets)"
+        required: false
+        type: boolean
+        default: false
       default:
         description: "Run the full default unit test suite (--workspace with default features)"
         required: true
@@ -38,7 +46,7 @@ on:
         type: boolean
         default: false
       behavior:
-        description: "Include behavior tests"
+        description: "Include behavior tests (cargo run based, no coverage)"
         required: false
         type: boolean
         default: false
@@ -69,7 +77,8 @@ jobs:
         with:
           rust: true
           cargo-nextest: true
-          datadog-ci: true
+          cargo-llvm-cov: ${{ inputs.coverage }}
+          datadog-ci: ${{ !inputs.coverage }}
           protoc: true
           libsasl2: true
 
@@ -112,11 +121,27 @@ jobs:
           else
             echo "No nextest suites selected; skipping 'make test'"
           fi
+        env:
+          COVERAGE: ${{ inputs.coverage }}
 
       - name: Behavior tests
         if: ${{ inputs.behavior }}
         run: make test-behavior
 
       - name: Upload test results to Datadog
-        if: ${{ always() }}
+        if: ${{ !inputs.coverage && always() }}
         run: scripts/upload-test-results.sh
+
+      - name: Generate lcov report
+        if: ${{ inputs.coverage }}
+        run: |
+          make coverage-report
+          # Normalize absolute source paths to relative so they merge cleanly with
+          # coverage from the containerized integration tests (which use SF:src/...).
+          sed -i "s|SF:$(pwd)/|SF:|g" lcov.info
+
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        if: ${{ inputs.coverage }}
+        with:
+          name: coverage-unit
+          path: lcov.info
diff --git a/Makefile b/Makefile
index 5421a62eed83e..d4465e861194f 100644
--- a/Makefile
+++ b/Makefile
@@ -17,6 +17,15 @@ else
     export DNSTAP_BENCHES := dnstap-benches
 endif
 
+# When COVERAGE=true, swap cargo-nextest for cargo-llvm-cov so test targets collect
+# coverage data. Run `make coverage-report` afterwards to emit the lcov file.
+export COVERAGE ?= false
+ifeq ($(COVERAGE), true)
+TEST_RUNNER := cargo llvm-cov nextest --no-report
+else
+TEST_RUNNER := cargo nextest run
+endif
+
 # Override this with any scopes for testing/benching.
 export SCOPE ?=
 # Override this with any extra flags for cargo bench
@@ -360,7 +369,7 @@ target/%/vector.tar.gz: target/%/vector CARGO_HANDLES_FRESHNESS
 # https://github.com/rust-lang/cargo/issues/6454
 .PHONY: test
 test: ## Run the unit test suite
-	${MAYBE_ENVIRONMENT_EXEC} cargo nextest run --workspace --no-fail-fast --no-default-features --features "${FEATURES}" ${SCOPE}
+	${MAYBE_ENVIRONMENT_EXEC} ${TEST_RUNNER} --workspace --no-fail-fast --no-default-features --features "${FEATURES}" ${SCOPE}
 
 .PHONY: test-docs
 test-docs: ## Run the docs test suite
@@ -423,15 +432,19 @@ test-e2e-kubernetes: ## Runs Kubernetes E2E tests (Sorry, no `ENVIRONMENT=true`
 
 .PHONY: test-cli
 test-cli: ## Runs cli tests
-	${MAYBE_ENVIRONMENT_EXEC} cargo nextest run --no-fail-fast --no-default-features --features cli-tests --test integration --test-threads 4
+	${MAYBE_ENVIRONMENT_EXEC} ${TEST_RUNNER} --no-fail-fast --no-default-features --features cli-tests --test integration --test-threads 4
 
 .PHONY: test-vector-api
 test-vector-api: ## Runs vector API tests (top and tap)
-	${MAYBE_ENVIRONMENT_EXEC} cargo nextest run --no-fail-fast --no-default-features --features vector-api-tests --test vector_api
+	${MAYBE_ENVIRONMENT_EXEC} ${TEST_RUNNER} --no-fail-fast --no-default-features --features vector-api-tests --test vector_api
 
 .PHONY: test-component-validation
 test-component-validation: ## Runs component validation tests
-	${MAYBE_ENVIRONMENT_EXEC} cargo nextest run --no-fail-fast --no-default-features --features component-validation-tests --status-level pass --test-threads 4 --lib components::validation::tests
+	${MAYBE_ENVIRONMENT_EXEC} ${TEST_RUNNER} --no-fail-fast --no-default-features --features component-validation-tests --status-level pass --test-threads 4 --lib components::validation::tests
+
+.PHONY: coverage-report
+coverage-report: ## Generate lcov report after running tests with COVERAGE=true (outputs lcov.info)
+	cargo llvm-cov report --lcov --output-path lcov.info
 
 ##@ Benching (Supports `ENVIRONMENT=true`)
 
diff --git a/scripts/run-integration-test.sh b/scripts/run-integration-test.sh
index a1b22ce4d6c4c..2657116eeb2e6 100755
--- a/scripts/run-integration-test.sh
+++ b/scripts/run-integration-test.sh
@@ -34,6 +34,7 @@ Options:
   -v         Increase verbosity; repeat for more (e.g. -vv or -vvv)
   -e <ENV>   One or more environments to run (repeatable or comma-separated).
              If provided, these are used as TEST_ENVIRONMENTS instead of auto-discovery.
+  -c         Collect code coverage (outputs target/coverage/lcov.info)
 
 Notes:
   - All existing two-argument invocations remain compatible:
@@ -45,7 +46,8 @@ USAGE
 # Parse options
 # Note: options must come before positional args (standard getopts behavior)
 TEST_ENV=""
-while getopts ":hr:v:e:" opt; do
+COVERAGE=false
+while getopts ":hr:v:e:c" opt; do
   case "$opt" in
     h)
       usage
@@ -64,6 +66,9 @@ while getopts ":hr:v:e:" opt; do
     e)
       TEST_ENV="$OPTARG"
       ;;
+    c)
+      COVERAGE=true
+      ;;
     \?)
       echo "ERROR: unknown option: -$OPTARG" >&2
       usage
@@ -113,6 +118,10 @@ else
   fi
 fi
 
+# Remove stale combined coverage from a previous (possibly failed) attempt so
+# retries via nick-fields/retry don't append to leftover data.
+rm -f target/coverage/lcov-combined.info
+
 for TEST_ENV in "${TEST_ENVIRONMENTS[@]}"; do
   # Execution flow for each environment:
   # 1. Clean up previous test output
@@ -134,10 +143,27 @@ for TEST_ENV in "${TEST_ENVIRONMENTS[@]}"; do
   print_compose_logs_on_failure "$START_RET"
 
   if [[ "$START_RET" -eq 0 ]]; then
-    $vdev_cmd "${VERBOSITY}" "${TEST_TYPE}" test --retries "$RETRIES" "${TEST_NAME}" "${TEST_ENV}"
+    COVERAGE_FLAG=""
+    [[ "$COVERAGE" == "true" ]] && COVERAGE_FLAG="--coverage"
+
+    $vdev_cmd "${VERBOSITY}" "${TEST_TYPE}" test --retries "$RETRIES" ${COVERAGE_FLAG} "${TEST_NAME}" "${TEST_ENV}"
     RET=$?
     print_compose_logs_on_failure "$RET"
 
+    # Normalize source paths in coverage report so they are relative to the repo root.
+    # The test runner container mounts source at /home/vector; strip that prefix so
+    # Datadog can resolve files against the repository root (e.g. SF:src/foo.rs).
+    # Append each environment's coverage to a combined file so multi-env services
+    # preserve all coverage data (not just the last environment).
+    if [[ "$COVERAGE" == "true" && "$RET" -eq 0 ]]; then
+      LCOV_FILE="target/coverage/lcov.info"
+      if [[ -f "$LCOV_FILE" ]]; then
+        sed -i 's|SF:/home/vector/|SF:|g' "$LCOV_FILE"
+        cat "$LCOV_FILE" >> target/coverage/lcov-combined.info
+        rm "$LCOV_FILE"
+      fi
+    fi
+
     # Upload test results only if the vdev test step ran
     ./scripts/upload-test-results.sh
   else
@@ -154,4 +180,9 @@ for TEST_ENV in "${TEST_ENVIRONMENTS[@]}"; do
   fi
 done
 
+# Promote combined coverage file to the expected output path
+if [[ "$COVERAGE" == "true" && -f target/coverage/lcov-combined.info ]]; then
+  mv target/coverage/lcov-combined.info target/coverage/lcov.info
+fi
+
 exit 0
diff --git a/tests/e2e/Dockerfile b/tests/e2e/Dockerfile
index dd564544e480b..1e7cda7fc696b 100644
--- a/tests/e2e/Dockerfile
+++ b/tests/e2e/Dockerfile
@@ -30,7 +30,7 @@ COPY scripts/environment/release-flags.sh /
 WORKDIR /vector
 COPY rust-toolchain.toml .
 
-RUN bash /prepare.sh --modules=cargo-nextest
+RUN bash /prepare.sh --modules=cargo-nextest,cargo-llvm-cov
 RUN bash /install-protoc.sh
 
 COPY . .
diff --git a/vdev/src/commands/compose_tests/start.rs b/vdev/src/commands/compose_tests/start.rs
index 51a4a3c4b2237..b96df10255921 100644
--- a/vdev/src/commands/compose_tests/start.rs
+++ b/vdev/src/commands/compose_tests/start.rs
@@ -20,5 +20,5 @@ pub(crate) fn exec(
         env.clone()
     };
     debug!("Selected environment: {environment:#?}");
-    ComposeTest::generate(local_config, integration, environment, 0)?.start()
+    ComposeTest::generate(local_config, integration, environment, 0, false)?.start()
 }
diff --git a/vdev/src/commands/compose_tests/stop.rs b/vdev/src/commands/compose_tests/stop.rs
index 188b428a71019..ee6af325cdc5e 100644
--- a/vdev/src/commands/compose_tests/stop.rs
+++ b/vdev/src/commands/compose_tests/stop.rs
@@ -13,7 +13,7 @@ pub(crate) fn exec(local_config: ComposeTestLocalConfig, test_name: &str) -> Res
         find_active_environment_for_integration(local_config.directory, test_name, &config)?;
 
     if let Some(environment) = active_environment {
-        ComposeTest::generate(local_config, test_name, environment, 0)?.stop()
+        ComposeTest::generate(local_config, test_name, environment, 0, false)?.stop()
     } else {
         println!("No environment for {test_name} is active.");
         Ok(())
diff --git a/vdev/src/commands/compose_tests/test.rs b/vdev/src/commands/compose_tests/test.rs
index e2fb51d006c23..e78b4c3413a03 100644
--- a/vdev/src/commands/compose_tests/test.rs
+++ b/vdev/src/commands/compose_tests/test.rs
@@ -5,6 +5,7 @@ use anyhow::{Result, bail};
 use crate::testing::{
     config::ComposeTestConfig,
     integration::{ComposeTest, ComposeTestLocalConfig},
+    runner::{LOCAL_COVERAGE_OUTPUT_DIR, coverage_filename},
 };
 
 use super::active_projects::find_active_environment_for_integration;
@@ -15,6 +16,7 @@ pub fn exec(
     environment: Option<&String>,
     retries: u8,
     args: &[String],
+    coverage: bool,
 ) -> Result<()> {
     let (_test_dir, config) = ComposeTestConfig::load(local_config.directory, integration)?;
     let envs = config.environments();
@@ -32,9 +34,46 @@ pub fn exec(
         (None, None) => Box::new(envs.keys()),
     };
 
+    let mut ran_environments: Vec<String> = Vec::new();
     for environment in environments {
-        ComposeTest::generate(local_config, integration, environment, retries)?
+        ComposeTest::generate(local_config, integration, environment, retries, coverage)?
             .test(args.to_owned())?;
+        if coverage {
+            ran_environments.push(environment.clone());
+        }
+    }
+
+    // Consolidate per-environment coverage files into the canonical lcov.info
+    // so callers get a single, predictable output path regardless of how many
+    // environments ran.
+    if coverage && !ran_environments.is_empty() {
+        let coverage_dir = std::path::Path::new(LOCAL_COVERAGE_OUTPUT_DIR);
+        let merged_path = coverage_dir.join(coverage_filename(None));
+        // Remove any stale lcov.info from a previous run so callers never pick
+        // up outdated data if the merge below fails to read a per-env file.
+        let _ = std::fs::remove_file(&merged_path);
+        let mut merged = String::new();
+        for env_name in &ran_environments {
+            let env_file = coverage_dir.join(coverage_filename(Some(env_name)));
+            match std::fs::read_to_string(&env_file) {
+                Ok(contents) => {
+                    merged.push_str(&contents);
+                    let _ = std::fs::remove_file(&env_file);
+                }
+                Err(e) => {
+                    warn!("Could not read coverage file {}: {e}", env_file.display());
+                }
+            }
+        }
+        if !merged.is_empty() {
+            std::fs::write(&merged_path, merged)?;
+            info!(
+                "Wrote coverage for {} environment(s) to {}",
+                ran_environments.len(),
+                merged_path.display()
+            );
+        }
     }
+
     Ok(())
 }
diff --git a/vdev/src/commands/e2e/test.rs b/vdev/src/commands/e2e/test.rs
index b9d0149afbe65..e83c70e5f6518 100644
--- a/vdev/src/commands/e2e/test.rs
+++ b/vdev/src/commands/e2e/test.rs
@@ -24,6 +24,10 @@ pub struct Cli {
     #[arg(short = 'r', long)]
     retries: Option<u8>,
 
+    /// Collect code coverage using cargo-llvm-cov (outputs target/coverage/lcov.info)
+    #[arg(long)]
+    coverage: bool,
+
     /// Extra test command arguments
     args: Vec<String>,
 }
@@ -36,6 +40,7 @@ impl Cli {
             self.environment.as_ref(),
             self.retries.unwrap_or_default(),
             &self.args,
+            self.coverage,
         )
     }
 }
diff --git a/vdev/src/commands/integration/test.rs b/vdev/src/commands/integration/test.rs
index 05ac2d4df1347..66da5c009b262 100644
--- a/vdev/src/commands/integration/test.rs
+++ b/vdev/src/commands/integration/test.rs
@@ -24,6 +24,10 @@ pub struct Cli {
     #[arg(short = 'r', long)]
     retries: Option<u8>,
 
+    /// Collect code coverage using cargo-llvm-cov (outputs target/coverage/lcov.info)
+    #[arg(long)]
+    coverage: bool,
+
     /// Extra test command arguments
     args: Vec<String>,
 }
@@ -36,6 +40,7 @@ impl Cli {
             self.environment.as_ref(),
             self.retries.unwrap_or_default(),
             &self.args,
+            self.coverage,
         )
     }
 }
diff --git a/vdev/src/commands/test.rs b/vdev/src/commands/test.rs
index c00274cfcfccf..deb89c19b4fa6 100644
--- a/vdev/src/commands/test.rs
+++ b/vdev/src/commands/test.rs
@@ -53,6 +53,8 @@ impl Cli {
             None,
             &args,
             false, // Don't pre-build Vector for direct test runs
+            false,
+            None,
         )
     }
 }
diff --git a/vdev/src/testing/integration.rs b/vdev/src/testing/integration.rs
index 127346cb3206f..a5618f39ddac2 100644
--- a/vdev/src/testing/integration.rs
+++ b/vdev/src/testing/integration.rs
@@ -76,6 +76,7 @@ pub(crate) struct ComposeTest {
     compose: Option<Compose>,
     env_config: Environment,
     retries: u8,
+    coverage: bool,
 }
 
 impl ComposeTest {
@@ -84,6 +85,7 @@ impl ComposeTest {
         test_name: impl Into<String>,
         environment: impl Into<String>,
         retries: u8,
+        coverage: bool,
     ) -> Result<ComposeTest> {
         let test_name: String = test_name.into();
         let environment = environment.into();
@@ -127,6 +129,7 @@ impl ComposeTest {
             compose,
             env_config: rename_environment_keys(&env_config),
             retries,
+            coverage,
         };
         trace!("Generated {compose_test:#?}");
         Ok(compose_test)
@@ -230,6 +233,12 @@ impl ComposeTest {
             Some(&self.config.features),
             &args,
             self.local_config.kind == ComposeTestKind::E2E,
+            self.coverage,
+            if self.coverage {
+                Some(self.environment.as_str())
+            } else {
+                None
+            },
         )?;
 
         Ok(())
diff --git a/vdev/src/testing/runner.rs b/vdev/src/testing/runner.rs
index cce1c28d2d251..1e338b64797ab 100644
--- a/vdev/src/testing/runner.rs
+++ b/vdev/src/testing/runner.rs
@@ -29,6 +29,17 @@ const TEST_COMMAND: &[&str] = &[
     "--no-fail-fast",
     "--no-default-features",
 ];
+const COVERAGE_COMMAND: &[&str] = &[
+    "cargo",
+    "llvm-cov",
+    "nextest",
+    "--no-fail-fast",
+    "--no-default-features",
+];
+/// Coverage output path inside the test runner container.
+const COVERAGE_OUTPUT_DIR: &str = "/coverage";
+/// Coverage output path on the host (relative to project root).
+pub(crate) const LOCAL_COVERAGE_OUTPUT_DIR: &str = "target/coverage";
 // The upstream container we publish artifacts to on a successful master build.
 const UPSTREAM_IMAGE: &str = "docker.io/timberio/vector-dev:latest";
 
@@ -52,6 +63,7 @@ pub fn get_agent_test_runner(container: bool) -> Result<Box<dyn TestRunner>> {
 }
 
 pub trait TestRunner {
+    #[allow(clippy::too_many_arguments)]
     fn test(
         &self,
         outer_env: &Environment,
@@ -59,9 +71,19 @@ pub trait TestRunner {
         features: Option<&[String]>,
         args: &[String],
         build: bool,
+        coverage: bool,
+        coverage_env: Option<&str>,
     ) -> Result<()>;
 }
 
+/// Return the coverage output filename, optionally scoped to an environment.
+pub(crate) fn coverage_filename(coverage_env: Option<&str>) -> String {
+    match coverage_env {
+        Some(env) => format!("lcov-{env}.info"),
+        None => "lcov.info".to_string(),
+    }
+}
+
 pub trait ContainerTestRunner: TestRunner {
     fn container_name(&self) -> String;
 
@@ -237,6 +259,8 @@ where
         features: Option<&[String]>,
         args: &[String],
         build: bool,
+        coverage: bool,
+        coverage_env: Option<&str>,
     ) -> Result<()> {
         self.ensure_running(features, config_environment_variables, build)?;
 
@@ -256,8 +280,20 @@ where
         append_environment_variables(&mut command, config_environment_variables);
 
         command.arg(self.container_name());
-        command.args(TEST_COMMAND);
+        command.args(if coverage {
+            COVERAGE_COMMAND
+        } else {
+            TEST_COMMAND
+        });
         command.args(args);
+        if coverage {
+            let filename = coverage_filename(coverage_env);
+            command.args([
+                "--lcov",
+                "--output-path",
+                &format!("{COVERAGE_OUTPUT_DIR}/{filename}"),
+            ]);
+        }
 
         command.check_run()
     }
@@ -286,6 +322,12 @@ impl IntegrationTestRunner {
 
         volumes.push(format!("{VOLUME_TARGET}:/output"));
 
+        // Always mount the coverage directory so the container can be reused
+        // for coverage runs without needing to be recreated.
+        let coverage_dir = std::path::Path::new(app::path()).join(LOCAL_COVERAGE_OUTPUT_DIR);
+        std::fs::create_dir_all(&coverage_dir)?;
+        volumes.push(format!("{}:{COVERAGE_OUTPUT_DIR}", coverage_dir.display()));
+
         Ok(Self {
             integration,
             needs_docker_socket: config.needs_docker_socket,
@@ -402,10 +444,26 @@ impl TestRunner for LocalTestRunner {
         _features: Option<&[String]>,
         args: &[String],
         _build: bool,
+        coverage: bool,
+        coverage_env: Option<&str>,
     ) -> Result<()> {
-        let mut command = Command::new(TEST_COMMAND[0]);
-        command.args(&TEST_COMMAND[1..]);
+        let test_cmd = if coverage {
+            COVERAGE_COMMAND
+        } else {
+            TEST_COMMAND
+        };
+        let mut command = Command::new(test_cmd[0]);
+        command.args(&test_cmd[1..]);
         command.args(args);
+        if coverage {
+            std::fs::create_dir_all(LOCAL_COVERAGE_OUTPUT_DIR)?;
+            let filename = coverage_filename(coverage_env);
+            command.args([
+                "--lcov",
+                "--output-path",
+                &format!("{LOCAL_COVERAGE_OUTPUT_DIR}/{filename}"),
+            ]);
+        }
 
         for (key, value) in outer_env {
             if let Some(value) = value {

From bfeb76986acc74ad7c28acd2c60053d3cbdeb2bd Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 7 May 2026 11:26:32 -0400
Subject: [PATCH 207/326] feat(splunk_hec source): support second-stage framing
 and decoding (#25312)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(splunk_hec source): support second-stage framing and decoding

* preserve original send_event/ack ordering when no decoder is set

* Add authors to changelog

* Format

* refactor(splunk_hec source): split codec config into per-endpoint event/raw blocks

* fix(splunk_hec source): include legacy log shape in schema when only one endpoint has a decoder

* address review: schema InsertIfEmpty parity + apply splunk_hec_token from decode_payload

* feat(codecs): add Deserializer::parse_with_secrets and Decoder::with_secrets_template

Allows sources to forward per-request secrets (e.g. authentication tokens) into
the Deserializer pipeline so user-authored programs like VRL decoders can read
them via get_secret!() during decoding.

VrlDeserializer overrides parse_with_secrets to inject the secrets into the
synthetic event before the VRL program executes, making them visible as
%vector.secrets.* at runtime. All other Deserializer implementations use the
default implementation which merges the template onto each emitted event after
parsing, with the codec's own values taking priority.

* refactor: move metadata_template to VrlDeserializer only; no Decoder/trait changes

* feat(codecs): add inject_metadata to VRL decoder; wire up in exec source

Adds VrlDeserializerOptions.inject_metadata. When true, the source can call
Decoder::with_metadata_template to pre-populate the synthetic event before VRL
executes, making source context readable via % paths (e.g. %exec.host,
%exec.command). VRL-produced values always win over injected values on collision.

The exec source is the first consumer: it injects hostname and command into the
decoder template at build time. Zero overhead when inject_metadata is false.

* fix(exec source): preserve VRL-written metadata; add DeserializerConfig::inject_metadata_enabled

Move the inject_metadata check to DeserializerConfig::inject_metadata_enabled() so
sources don't need VRL-specific knowledge. In handle_event, use try_insert for the
vector-namespace metadata paths (host, command) when inject_metadata is enabled, so
any value the VRL program wrote to %exec.host or %exec.command survives
post-decode enrichment. No behavior change for Legacy namespace or when
inject_metadata is false.

* fmt

* Add authors line to changelog

* refactor(codecs): remove inject_metadata flag; with_metadata_template always applies; revert exec source wiring

The inject_metadata: bool config option on VrlDeserializerOptions is removed —
sources decide whether to inject by calling with_metadata_template, no user flag
needed. DeserializerConfig::inject_metadata_enabled replaced by is_vrl(). Exec
source wiring reverted; splunk_hec will be the first consumer.

* feat(splunk_hec source): inject envelope metadata into VRL decoder before execution

When the second-stage decoder is VRL, build an EventMetadata template from the
current HEC envelope context (host, source, sourcetype, index, channel, token) and
attach it via Decoder::with_metadata_template. VRL programs running as the decoder
can now read %splunk_hec.host, %splunk_hec.channel, get_secret!("splunk_hec_token"),
etc. before the program executes. Post-decode enrichment still applies with
InsertIfEmpty semantics. No-op for non-VRL decoders.

* fmt

* fix(splunk_hec source): use InsertIfEmpty semantics for Vector-namespace metadata in decoder path

After the VRL decoder runs, post-decode metadata overlay (channel, fields, and
DefaultExtractor calls for host/source/sourcetype/index) now uses try-insert
semantics for the Vector-namespace metadata paths, matching the existing
InsertIfEmpty behavior for Legacy-namespace event fields. This ensures
decoder-produced %splunk_hec.* values survive post-decode enrichment in both
namespaces.

* refactor: replace get-then-insert with log.try_insert for metadata InsertIfEmpty

* fix(splunk_hec source): reject empty event field in decoder path; skip ack on partial envelope error

* fix(splunk_hec source): only write splunk_hec.timestamp for /event decoder, not /raw

* test(splunk_hec source): add VRL decoder end-to-end test covering envelope metadata injection

* fix fmt + clippy

* fmt

* fix(splunk_hec source): per-endpoint schema strategy without metadata widening

* fix(splunk_hec source): apply extractors before fields in decoder path to preserve top-level envelope precedence

* Avoid roundtrip json parsing during decoding

* Fix stale documentation

* Fix clippy by building DecodePayloadContext

* refactor(splunk_hec source): extract validate_event_field and use raw JSON bytes in decoder path

* Update documentation

* Address docs review

* fix(splunk_hec source): pass string events as raw bytes to decoder

* refactor(splunk_hec source): extract register_ack helper to reduce indentation

* EndpointCodecConfig -> CodecConfig

* simplify docs

* Remove VrlDeserializer doc comment from `with_metadata_template`
---
 .../splunk_hec_source_codec.enhancement.md    |   20 +
 lib/codecs/src/decoding/decoder.rs            |   12 +-
 lib/codecs/src/decoding/format/vrl.rs         |   86 +-
 lib/codecs/src/decoding/mod.rs                |   19 +-
 lib/vector-core/src/event/mod.rs              |    2 +-
 src/sources/splunk_hec/mod.rs                 | 1733 +++++++++++++++--
 .../sources/generated/splunk_hec.cue          | 1030 ++++++++++
 7 files changed, 2683 insertions(+), 219 deletions(-)
 create mode 100644 changelog.d/splunk_hec_source_codec.enhancement.md

diff --git a/changelog.d/splunk_hec_source_codec.enhancement.md b/changelog.d/splunk_hec_source_codec.enhancement.md
new file mode 100644
index 0000000000000..93c3bfe86f522
--- /dev/null
+++ b/changelog.d/splunk_hec_source_codec.enhancement.md
@@ -0,0 +1,20 @@
+The `splunk_hec` source now accepts optional per-endpoint codec configuration via `event: { framing, decoding }` and `raw: { framing, decoding }`. When `decoding` is set on an endpoint, Vector applies a second decoding pass after the HEC envelope is parsed: on `/services/collector/event` the envelope's `event` field is fed through the codec, and on `/services/collector/raw` the request body is fed through the codec directly. A single payload can fan out to multiple events.
+
+For example, to decode JSON payloads in `/event` requests while splitting `/raw` bodies on newlines:
+
+```yaml
+sources:
+  hec:
+    type: splunk_hec
+    address: 0.0.0.0:8088
+    event:
+      decoding:
+        codec: json
+    raw:
+      framing:
+        method: newline_delimited
+      decoding:
+        codec: bytes
+```
+
+authors: thomasqueirozb
diff --git a/lib/codecs/src/decoding/decoder.rs b/lib/codecs/src/decoding/decoder.rs
index 85a0fce42148e..0ba05c32283e3 100644
--- a/lib/codecs/src/decoding/decoder.rs
+++ b/lib/codecs/src/decoding/decoder.rs
@@ -1,7 +1,10 @@
 use bytes::{Bytes, BytesMut};
 use smallvec::SmallVec;
 use vector_common::internal_event::emit;
-use vector_core::{config::LogNamespace, event::Event};
+use vector_core::{
+    config::LogNamespace,
+    event::{Event, EventMetadata},
+};
 
 use crate::{
     decoding::format::Deserializer as _,
@@ -53,6 +56,13 @@ impl Decoder {
         self
     }
 
+    /// Attaches a per-decode-call metadata template to the inner deserializer,
+    /// allowing deserializers to read from and write to event metadata.
+    pub fn with_metadata_template(mut self, metadata: EventMetadata) -> Self {
+        self.deserializer = self.deserializer.with_metadata_template(metadata);
+        self
+    }
+
     /// Handles the framing result and parses it into a structured event, if
     /// possible.
     ///
diff --git a/lib/codecs/src/decoding/format/vrl.rs b/lib/codecs/src/decoding/format/vrl.rs
index 6b6a20be3be55..6920b912a087c 100644
--- a/lib/codecs/src/decoding/format/vrl.rs
+++ b/lib/codecs/src/decoding/format/vrl.rs
@@ -13,7 +13,9 @@ use vrl::{
     value::Kind,
 };
 
-use crate::{BytesDeserializerConfig, decoding::format::Deserializer};
+use vector_core::event::EventMetadata;
+
+use crate::decoding::format::Deserializer;
 
 /// Config used to build a `VrlDeserializer`.
 #[configurable_component]
@@ -64,6 +66,7 @@ impl VrlDeserializerConfig {
             Ok(result) => Ok(VrlDeserializer {
                 program: result.program,
                 timezone: self.vrl.timezone.unwrap_or(TimeZone::Local),
+                metadata_template: None,
             }),
             Err(diagnostics) => Err(Formatter::new(&self.vrl.source, diagnostics)
                 .to_string()
@@ -94,9 +97,28 @@ impl VrlDeserializerConfig {
 pub struct VrlDeserializer {
     program: Program,
     timezone: TimeZone,
+    /// Per-call metadata template set by the source before decoding. When
+    /// present, every `%`-prefixed path in the template is accessible from
+    /// within the VRL program (e.g. `%splunk_hec.host`, `%vector.secrets.*`).
+    metadata_template: Option<EventMetadata>,
+}
+
+impl VrlDeserializer {
+    /// Attach a metadata template that will be pre-populated on each synthetic
+    /// event before the VRL program runs.
+    ///
+    /// Sources call this once per decode call with the per-request context they
+    /// have assembled (envelope fields, auth tokens, etc.). VRL can then read
+    /// those values via `%`-prefixed paths.
+    #[must_use]
+    pub fn with_metadata_template(mut self, metadata: EventMetadata) -> Self {
+        self.metadata_template = Some(metadata);
+        self
+    }
 }
 
 fn parse_bytes(bytes: Bytes, log_namespace: LogNamespace) -> Event {
+    use crate::BytesDeserializerConfig;
     let bytes_deserializer = BytesDeserializerConfig::new().build();
     let log_event = bytes_deserializer.parse_single(bytes, log_namespace);
     Event::from(log_event)
@@ -108,11 +130,14 @@ impl Deserializer for VrlDeserializer {
         bytes: Bytes,
         log_namespace: LogNamespace,
     ) -> vector_common::Result<SmallVec<[Event; 1]>> {
-        let event = parse_bytes(bytes, log_namespace);
-        match self.run_vrl(event, log_namespace) {
-            Ok(events) => Ok(events),
-            Err(e) => Err(e),
+        let mut event = parse_bytes(bytes, log_namespace);
+        if let Some(template) = &self.metadata_template {
+            // Pre-populate the synthetic event with the source-assembled metadata so
+            // every `%`-prefixed path is in scope when VRL executes. This lets
+            // user programs read `%splunk_hec.host`, `%vector.secrets.*`, etc.
+            *event.metadata_mut() = template.clone();
         }
+        self.run_vrl(event, log_namespace)
     }
 }
 
@@ -320,4 +345,55 @@ mod tests {
             .to_string();
         assert!(error.contains("aborted"));
     }
+
+    fn metadata_with_secret(key: &str, value: &str) -> EventMetadata {
+        let mut metadata = EventMetadata::default();
+        metadata.secrets_mut().insert(key, value);
+        metadata
+    }
+
+    /// A VRL program that uses `get_secret!()` can read a secret injected via
+    /// `with_metadata_template`.
+    #[test]
+    fn test_with_metadata_template_vrl_can_read_secret() {
+        // VRL program copies the injected secret into an event field so we can
+        // assert on its value. The input bytes become `.message` (Legacy namespace)
+        // and we add `.secret_value` alongside it.
+        let decoder = make_decoder(r#".secret_value = get_secret!("my_token")"#)
+            .with_metadata_template(metadata_with_secret("my_token", "super-secret"));
+
+        let bytes = Bytes::from(r#"hello"#);
+        let events = decoder
+            .parse(bytes, LogNamespace::Legacy)
+            .expect("parse should succeed");
+
+        assert_eq!(events.len(), 1);
+        assert_eq!(
+            *events[0].as_log().get("secret_value").unwrap(),
+            Value::from("super-secret")
+        );
+    }
+
+    /// Secrets explicitly set by the VRL program win over the template because
+    /// `set_secret!` runs after the template is pre-populated.
+    #[test]
+    fn test_with_metadata_template_codec_wins_on_collision() {
+        let decoder = make_decoder(r#"set_secret!("my_token", "codec-wins")"#)
+            .with_metadata_template(metadata_with_secret("my_token", "template-loses"));
+
+        let bytes = Bytes::from(r#"hello"#);
+        let events = decoder
+            .parse(bytes, LogNamespace::Legacy)
+            .expect("parse should succeed");
+
+        assert_eq!(
+            events[0]
+                .metadata()
+                .secrets()
+                .get("my_token")
+                .unwrap()
+                .as_ref(),
+            "codec-wins"
+        );
+    }
 }
diff --git a/lib/codecs/src/decoding/mod.rs b/lib/codecs/src/decoding/mod.rs
index c87337856454a..bab1521e92f0a 100644
--- a/lib/codecs/src/decoding/mod.rs
+++ b/lib/codecs/src/decoding/mod.rs
@@ -37,7 +37,7 @@ use smallvec::SmallVec;
 use vector_config::configurable_component;
 use vector_core::{
     config::{DataType, LogNamespace},
-    event::Event,
+    event::{Event, EventMetadata},
     schema,
 };
 
@@ -426,6 +426,12 @@ impl DeserializerConfig {
         }
     }
 
+    /// Returns `true` when this is a VRL deserializer.
+    /// Sources can use this to decide whether to call `Decoder::with_metadata_template`.
+    pub fn is_vrl(&self) -> bool {
+        matches!(self, DeserializerConfig::Vrl(_))
+    }
+
     /// Return the type of event build by this deserializer.
     pub fn output_type(&self) -> DataType {
         match self {
@@ -542,6 +548,17 @@ pub enum Deserializer {
     Vrl(VrlDeserializer),
 }
 
+impl Deserializer {
+    /// Attaches a metadata template to the inner deserializer, if it supports
+    /// one.
+    pub fn with_metadata_template(self, metadata: EventMetadata) -> Self {
+        match self {
+            Deserializer::Vrl(d) => Deserializer::Vrl(d.with_metadata_template(metadata)),
+            other => other,
+        }
+    }
+}
+
 impl format::Deserializer for Deserializer {
     fn parse(
         &self,
diff --git a/lib/vector-core/src/event/mod.rs b/lib/vector-core/src/event/mod.rs
index e70ebc4335c9d..fd9d9c7c88bbd 100644
--- a/lib/vector-core/src/event/mod.rs
+++ b/lib/vector-core/src/event/mod.rs
@@ -7,7 +7,7 @@ pub use finalization::{
     Finalizable,
 };
 pub use log_event::LogEvent;
-pub use metadata::{DatadogMetricOriginMetadata, EventMetadata, WithMetadata};
+pub use metadata::{DatadogMetricOriginMetadata, EventMetadata, Secrets, WithMetadata};
 pub use metric::{Metric, MetricKind, MetricTags, MetricValue, StatisticKind};
 pub use r#ref::{EventMutRef, EventRef};
 use serde::{Deserialize, Serialize};
diff --git a/src/sources/splunk_hec/mod.rs b/src/sources/splunk_hec/mod.rs
index b020383b9fbda..2a04b14d68d33 100644
--- a/src/sources/splunk_hec/mod.rs
+++ b/src/sources/splunk_hec/mod.rs
@@ -7,7 +7,7 @@ use std::{
     time::Duration,
 };
 
-use bytes::{Buf, Bytes};
+use bytes::{Buf, Bytes, BytesMut};
 use chrono::{DateTime, TimeZone, Utc};
 use flate2::read::MultiGzDecoder;
 use futures::FutureExt;
@@ -20,22 +20,32 @@ use serde_json::{
 };
 use snafu::Snafu;
 use tokio::net::TcpStream;
+use tokio_util::codec::Decoder as _;
 use tower::ServiceBuilder;
 use tracing::Span;
 use vector_lib::{
     EstimatedJsonEncodedSizeOf,
+    codecs::{
+        Decoder, StreamDecodingError,
+        decoding::{DeserializerConfig, FramingConfig},
+    },
     config::{LegacyKey, LogNamespace},
     configurable::configurable_component,
-    event::BatchNotifier,
-    internal_event::{CountByteSize, InternalEventHandle as _, Registered},
-    lookup::{self, event_path, lookup_v2::OptionalValuePath, owned_value_path},
+    event::{BatchNotifier, BatchStatusReceiver, EventMetadata},
+    internal_event::{
+        ComponentEventsDropped, CountByteSize, InternalEventHandle as _, Registered, UNINTENTIONAL,
+    },
+    lookup::{
+        self, OwnedValuePath, event_path, lookup_v2::OptionalValuePath, metadata_path,
+        owned_value_path,
+    },
     schema::meaning,
     sensitive_string::SensitiveString,
     source_sender::SendError,
     tls::MaybeTlsIncomingStream,
 };
 use vrl::{
-    path::OwnedTargetPath,
+    path::{OwnedTargetPath, PathPrefix, ValuePath as _},
     value::{Kind, kind::Collection},
 };
 use warp::{
@@ -56,6 +66,7 @@ use self::{
 };
 use crate::{
     SourceSender,
+    codecs::DecodingConfig,
     config::{DataType, Resource, SourceConfig, SourceContext, SourceOutput, log_schema},
     event::{Event, LogEvent, Value},
     http::{KeepaliveConfig, MaxConnectionAgeLayer, build_http_trace_layer},
@@ -126,6 +137,75 @@ pub struct SplunkConfig {
     #[configurable(derived)]
     #[serde(default)]
     keepalive: KeepaliveConfig,
+
+    /// Codec configuration applied to events received on `/services/collector/event`.
+    ///
+    /// When `decoding` is set, Vector applies a second decoding pass after parsing the
+    /// HEC envelope. The envelope's `event` field is passed through the codec,
+    /// and a single envelope can fan out to multiple events. Decode failures are
+    /// swallowed and do not return an error to the Splunk client.
+    ///
+    /// The VRL codec can access HEC envelope metadata, such as host, sourcetype, and,
+    /// channel, and the authentication token via `%splunk_hec.*` paths and
+    /// `get_secret!("splunk_hec_token")` before the program executes.
+    #[configurable(derived)]
+    #[configurable(metadata(docs::advanced))]
+    #[serde(default)]
+    pub event: CodecConfig,
+
+    /// Codec configuration applied to events received on `/services/collector/raw`.
+    ///
+    /// When `decoding` is set, the (decompressed) request body is fed through the
+    /// codec instead of being emitted as a single event. Decode failures are
+    /// swallowed and do not return an error to the Splunk client. When unset, the
+    /// endpoint preserves its existing behavior of one event per request body.
+    #[configurable(derived)]
+    #[configurable(metadata(docs::advanced))]
+    #[serde(default)]
+    pub raw: CodecConfig,
+}
+
+/// Codec configuration applied to one of the `splunk_hec` endpoints.
+#[configurable_component]
+#[derive(Clone, Debug, Default)]
+#[serde(deny_unknown_fields, default)]
+pub struct CodecConfig {
+    /// Framing configuration applied to the payload.
+    ///
+    /// Only used when `decoding` is also set. Defaults to a per-codec choice
+    /// (typically `bytes`) that produces one event per payload.
+    #[configurable(derived)]
+    #[configurable(metadata(docs::advanced))]
+    #[serde(default)]
+    pub framing: Option<FramingConfig>,
+
+    /// Decoding configuration applied to the payload.
+    ///
+    /// When unset, the endpoint preserves its existing per-endpoint default
+    /// behavior. When set, the endpoint-selected payload is processed through
+    /// `framing` and `decoding`, and a single payload can fan out to multiple
+    /// events.
+    #[configurable(derived)]
+    #[configurable(metadata(docs::advanced))]
+    #[serde(default)]
+    pub decoding: Option<DeserializerConfig>,
+}
+
+impl CodecConfig {
+    fn build_decoder(&self, log_namespace: LogNamespace) -> crate::Result<Option<Decoder>> {
+        match &self.decoding {
+            Some(decoding) => {
+                let framing = self
+                    .framing
+                    .clone()
+                    .unwrap_or_else(|| decoding.default_message_based_framing());
+                Ok(Some(
+                    DecodingConfig::new(framing, decoding.clone(), log_namespace).build()?,
+                ))
+            }
+            None => Ok(None),
+        }
+    }
 }
 
 impl_generate_config_from_default!(SplunkConfig);
@@ -141,6 +221,8 @@ impl Default for SplunkConfig {
             store_hec_token: false,
             log_namespace: None,
             keepalive: Default::default(),
+            event: CodecConfig::default(),
+            raw: CodecConfig::default(),
         }
     }
 }
@@ -156,7 +238,16 @@ impl SourceConfig for SplunkConfig {
         let tls = MaybeTlsSettings::from_config(self.tls.as_ref(), true)?;
         let shutdown = cx.shutdown.clone();
         let out = cx.out.clone();
-        let source = SplunkSource::new(self, tls.http_protocol_name(), cx);
+        let log_namespace = cx.log_namespace(self.log_namespace);
+        let event_decoder = self.event.build_decoder(log_namespace)?;
+        let raw_decoder = self.raw.build_decoder(log_namespace)?;
+        let source = SplunkSource::new(
+            self,
+            tls.http_protocol_name(),
+            event_decoder,
+            raw_decoder,
+            cx,
+        );
 
         let event_service = source.event_service(out.clone());
         let raw_service = source.raw_service(out);
@@ -212,7 +303,11 @@ impl SourceConfig for SplunkConfig {
     fn outputs(&self, global_log_namespace: LogNamespace) -> Vec<SourceOutput> {
         let log_namespace = global_log_namespace.merge(self.log_namespace);
 
-        let schema_definition = match log_namespace {
+        // Build schemas per endpoint, then merge them. Each endpoint decides at
+        // runtime whether source metadata overwrites event fields or defers to a
+        // decoder-produced value, so applying one global strategy would make mixed
+        // decoder/no-decoder configurations advertise the wrong contract.
+        let legacy_base = || match log_namespace {
             LogNamespace::Legacy => {
                 let definition = vector_lib::schema::Definition::empty_legacy_namespace()
                     .with_event_field(
@@ -238,52 +333,108 @@ impl SourceConfig for SplunkConfig {
                 [log_namespace],
             )
             .with_meaning(OwnedTargetPath::event_root(), meaning::MESSAGE),
-        }
-        .with_standard_vector_source_metadata()
-        .with_source_metadata(
-            SplunkConfig::NAME,
-            log_schema()
-                .host_key()
-                .cloned()
-                .map(LegacyKey::InsertIfEmpty),
-            &owned_value_path!("host"),
-            Kind::bytes(),
-            Some(meaning::HOST),
-        )
-        .with_source_metadata(
-            SplunkConfig::NAME,
-            Some(LegacyKey::Overwrite(owned_value_path!(CHANNEL))),
-            &owned_value_path!("channel"),
-            Kind::bytes(),
-            None,
-        )
-        .with_source_metadata(
-            SplunkConfig::NAME,
-            Some(LegacyKey::Overwrite(owned_value_path!(INDEX))),
-            &owned_value_path!("index"),
-            Kind::bytes(),
-            None,
-        )
-        .with_source_metadata(
-            SplunkConfig::NAME,
-            Some(LegacyKey::Overwrite(owned_value_path!(SOURCE))),
-            &owned_value_path!("source"),
-            Kind::bytes(),
-            Some(meaning::SERVICE),
-        )
-        // Not to be confused with `source_type`.
-        .with_source_metadata(
-            SplunkConfig::NAME,
-            Some(LegacyKey::Overwrite(owned_value_path!(SOURCETYPE))),
-            &owned_value_path!("sourcetype"),
-            Kind::bytes(),
-            None,
+        };
+
+        let endpoint_base = |decoding: &Option<DeserializerConfig>| match decoding {
+            Some(decoding) => decoding.schema_definition(log_namespace),
+            None => legacy_base(),
+        };
+
+        let splunk_legacy_key = |path: OwnedValuePath, has_decoder: bool| {
+            if has_decoder {
+                LegacyKey::InsertIfEmpty(path)
+            } else {
+                LegacyKey::Overwrite(path)
+            }
+        };
+
+        let add_common_metadata = |definition: vector_lib::schema::Definition| {
+            definition
+                .with_standard_vector_source_metadata()
+                .with_source_metadata(
+                    SplunkConfig::NAME,
+                    log_schema()
+                        .host_key()
+                        .cloned()
+                        .map(LegacyKey::InsertIfEmpty),
+                    &owned_value_path!("host"),
+                    Kind::bytes(),
+                    Some(meaning::HOST),
+                )
+        };
+
+        let add_channel_metadata = |definition: vector_lib::schema::Definition,
+                                    has_decoder: bool| {
+            definition.with_source_metadata(
+                SplunkConfig::NAME,
+                Some(splunk_legacy_key(owned_value_path!(CHANNEL), has_decoder)),
+                &owned_value_path!("channel"),
+                Kind::bytes(),
+                None,
+            )
+        };
+
+        let event_has_decoder = self.event.decoding.is_some();
+        let raw_has_decoder = self.raw.decoding.is_some();
+
+        // Merge the per-endpoint base schemas (event root kind + standard Vector
+        // metadata). Splunk-specific fields are added once afterward with
+        // per-field decoder flags, avoiding the widening that occurs when the
+        // raw schema's open `metadata_kind.unknown` overrides specific fields
+        // from the event schema during merge.
+        let merged_base = add_common_metadata(
+            endpoint_base(&self.event.decoding).merge(endpoint_base(&self.raw.decoding)),
         );
 
-        vec![SourceOutput::new_maybe_logs(
-            DataType::Log,
-            schema_definition,
-        )]
+        // `index`, `source`, `sourcetype` are only written by the /event endpoint.
+        // `channel` is written by both; use Overwrite if either endpoint has no
+        // decoder (some events still overwrite it).
+        let channel_has_decoder = event_has_decoder && raw_has_decoder;
+        let schema_definition = add_channel_metadata(
+            merged_base
+                .with_source_metadata(
+                    SplunkConfig::NAME,
+                    Some(splunk_legacy_key(
+                        owned_value_path!(INDEX),
+                        event_has_decoder,
+                    )),
+                    &owned_value_path!("index"),
+                    Kind::bytes(),
+                    None,
+                )
+                .with_source_metadata(
+                    SplunkConfig::NAME,
+                    Some(splunk_legacy_key(
+                        owned_value_path!(SOURCE),
+                        event_has_decoder,
+                    )),
+                    &owned_value_path!("source"),
+                    Kind::bytes(),
+                    Some(meaning::SERVICE),
+                )
+                // Not to be confused with `source_type`.
+                .with_source_metadata(
+                    SplunkConfig::NAME,
+                    Some(splunk_legacy_key(
+                        owned_value_path!(SOURCETYPE),
+                        event_has_decoder,
+                    )),
+                    &owned_value_path!("sourcetype"),
+                    Kind::bytes(),
+                    None,
+                ),
+            channel_has_decoder,
+        );
+
+        // Output type is the union of both endpoints' decoder output types
+        // (logs from a JSON codec, metrics from native, etc.). The legacy path
+        // always emits logs, so when an endpoint has no decoder we OR `Log` in.
+        let output_type = match (&self.event.decoding, &self.raw.decoding) {
+            (None, None) => DataType::Log,
+            (Some(d), None) | (None, Some(d)) => d.output_type() | DataType::Log,
+            (Some(de), Some(dr)) => de.output_type() | dr.output_type(),
+        };
+        vec![SourceOutput::new_maybe_logs(output_type, schema_definition)]
     }
 
     fn resources(&self) -> Vec<Resource> {
@@ -303,10 +454,18 @@ struct SplunkSource {
     store_hec_token: bool,
     log_namespace: LogNamespace,
     events_received: Registered<EventsReceived>,
+    event_decoder: Option<Decoder>,
+    raw_decoder: Option<Decoder>,
 }
 
 impl SplunkSource {
-    fn new(config: &SplunkConfig, protocol: &'static str, cx: SourceContext) -> Self {
+    fn new(
+        config: &SplunkConfig,
+        protocol: &'static str,
+        event_decoder: Option<Decoder>,
+        raw_decoder: Option<Decoder>,
+        cx: SourceContext,
+    ) -> Self {
         let log_namespace = cx.log_namespace(config.log_namespace);
         let acknowledgements = cx.do_acknowledgements(config.acknowledgements.enabled.into());
         let shutdown = cx.shutdown;
@@ -332,6 +491,8 @@ impl SplunkSource {
             store_hec_token: config.store_hec_token,
             log_namespace,
             events_received: register!(EventsReceived),
+            event_decoder,
+            raw_decoder,
         }
     }
 
@@ -349,6 +510,7 @@ impl SplunkSource {
         let store_hec_token = self.store_hec_token;
         let log_namespace = self.log_namespace;
         let events_received = self.events_received.clone();
+        let decoder = self.event_decoder.clone();
 
         warp::post()
             .and(
@@ -375,6 +537,7 @@ impl SplunkSource {
                     let mut out = out.clone();
                     let idx_ack = idx_ack.clone();
                     let events_received = events_received.clone();
+                    let decoder = decoder.clone();
 
                     async move {
                         if idx_ack.is_some() && channel.is_none() {
@@ -396,36 +559,44 @@ impl SplunkSource {
                             protocol,
                         });
 
-                        let (batch, receiver) =
+                        let (batch, mut receiver) =
                             BatchNotifier::maybe_new_with_receiver(idx_ack.is_some());
-                        let maybe_ack_id = match (idx_ack, receiver, channel.clone()) {
-                            (Some(idx_ack), Some(receiver), Some(channel_id)) => {
-                                match idx_ack.get_ack_id_from_channel(channel_id, receiver).await {
-                                    Ok(ack_id) => Some(ack_id),
-                                    Err(rej) => return Err(rej),
-                                }
-                            }
-                            _ => None,
-                        };
+                        let decoder_in_use = decoder.is_some();
+
+                        // Without a decoder, register the ack id BEFORE iteration so
+                        // capacity-exhaustion (`ServiceUnavailable`) short-circuits
+                        // the request without parsing the body - byte-for-byte parity
+                        // with the pre-decoder behavior.
+                        let mut maybe_ack_id = None;
+                        if !decoder_in_use {
+                            maybe_ack_id =
+                                register_ack(idx_ack.clone(), receiver.take(), channel.clone())
+                                    .await?;
+                        }
 
                         let mut error = None;
                         let mut events = Vec::new();
+                        let mut had_decode_errors = false;
 
                         let iter: EventIterator<'_, StrRead<'_>> = EventIteratorGenerator {
                             deserializer: Deserializer::from_str(&body).into_iter::<JsonValue>(),
-                            channel,
+                            channel: channel.clone(),
                             remote,
                             remote_addr,
                             batch,
                             token: token.filter(|_| store_hec_token).map(Into::into),
                             log_namespace,
                             events_received,
+                            decoder,
                         }
                         .into();
 
                         for result in iter {
                             match result {
-                                Ok(event) => events.push(event),
+                                Ok((chunk, errored)) => {
+                                    events.extend(chunk);
+                                    had_decode_errors |= errored;
+                                }
                                 Err(err) => {
                                     error = Some(err);
                                     break;
@@ -433,6 +604,22 @@ impl SplunkSource {
                             }
                         }
 
+                        // With a decoder, defer ack registration until we know whether
+                        // the codec emitted anything *and* whether it dropped any
+                        // frames. Also skip ack registration when a later envelope
+                        // errored even if earlier ones produced events: the client
+                        // gets a 400 and never sees the ack id, so registering it
+                        // only leaks pending-ack capacity.
+                        if decoder_in_use {
+                            maybe_ack_id =
+                                if events.is_empty() || had_decode_errors || error.is_some() {
+                                    drop(receiver);
+                                    None
+                                } else {
+                                    register_ack(idx_ack, receiver, channel).await?
+                                };
+                        }
+
                         if !events.is_empty() {
                             match out.send_batch(events).await {
                                 Ok(()) => (),
@@ -463,6 +650,7 @@ impl SplunkSource {
         let store_hec_token = self.store_hec_token;
         let events_received = self.events_received.clone();
         let log_namespace = self.log_namespace;
+        let decoder = self.raw_decoder.clone();
 
         warp::post()
             .and(path!("raw" / "1.0").or(path!("raw")))
@@ -485,6 +673,7 @@ impl SplunkSource {
                     let mut out = out.clone();
                     let idx_ack = idx_ack.clone();
                     let events_received = events_received.clone();
+                    let decoder = decoder.clone();
                     emit!(HttpBytesReceived {
                         byte_size: body.len(),
                         http_path: path.as_str(),
@@ -494,29 +683,79 @@ impl SplunkSource {
                     async move {
                         let (batch, receiver) =
                             BatchNotifier::maybe_new_with_receiver(idx_ack.is_some());
-                        let maybe_ack_id = match (idx_ack, receiver) {
-                            (Some(idx_ack), Some(receiver)) => Some(
-                                idx_ack
-                                    .get_ack_id_from_channel(channel_id.clone(), receiver)
-                                    .await?,
-                            ),
-                            _ => None,
+
+                        // No-decoder path: byte-for-byte identical to the pre-decoder
+                        // code - register ack first (fast-fail under capacity
+                        // exhaustion), build a single event, send via `send_event`
+                        // (avoids `send_batch_latency` emission).
+                        let Some(decoder) = decoder else {
+                            let maybe_ack_id =
+                                register_ack(idx_ack, receiver, Some(channel_id.clone())).await?;
+                            let (mut events, _) = raw_event(
+                                body,
+                                gzip,
+                                channel_id,
+                                remote,
+                                xff,
+                                batch,
+                                log_namespace,
+                                &events_received,
+                                None,
+                                None,
+                            )?;
+                            // raw_event with no decoder always produces exactly one
+                            // event.
+                            let mut event = events.pop().expect(
+                                "raw_event always produces a single event when no decoder is set",
+                            );
+                            if let Some(token) = token.filter(|_| store_hec_token) {
+                                event.metadata_mut().set_splunk_hec_token(token.into());
+                            }
+                            let res = out.send_event(event).await;
+                            return res
+                                .map(|_| maybe_ack_id)
+                                .map_err(|_| Rejection::from(ApiError::ServerShutdown));
                         };
-                        let mut event = raw_event(
+
+                        // Decoder path: pass the optional HEC token into raw_event so
+                        // it's stamped on each event the moment it leaves the codec
+                        // (rather than after the whole payload is decoded).
+                        let token: Option<Arc<str>> =
+                            token.filter(|_| store_hec_token).map(Arc::from);
+                        let (events, had_decode_errors) = raw_event(
                             body,
                             gzip,
-                            channel_id,
+                            channel_id.clone(),
                             remote,
                             xff,
                             batch,
                             log_namespace,
                             &events_received,
+                            Some(decoder),
+                            token,
                         )?;
-                        if let Some(token) = token.filter(|_| store_hec_token) {
-                            event.metadata_mut().set_splunk_hec_token(token.into());
+
+                        if events.is_empty() || had_decode_errors {
+                            // With newline framing, `valid \n invalid \n valid`
+                            // decodes to two events plus one dropped frame; returning
+                            // an ack id there would let `/services/collector/ack`
+                            // report success for data Vector silently lost.
+                            drop(receiver);
+                            if events.is_empty() {
+                                return Ok(None);
+                            }
+                            // Forward the partial events with no ack so the source's
+                            // existing partial-delivery semantics still apply.
+                            let res = out.send_batch(events).await;
+                            return res
+                                .map(|_| None)
+                                .map_err(|_| Rejection::from(ApiError::ServerShutdown));
                         }
 
-                        let res = out.send_event(event).await;
+                        let maybe_ack_id =
+                            register_ack(idx_ack, receiver, Some(channel_id)).await?;
+
+                        let res = out.send_batch(events).await;
                         res.map(|_| maybe_ack_id)
                             .map_err(|_| Rejection::from(ApiError::ServerShutdown))
                     }
@@ -672,8 +911,11 @@ impl SplunkSource {
 struct EventIterator<'de, R: JsonRead<'de>> {
     /// Remaining request with JSON events
     deserializer: serde_json::StreamDeserializer<'de, R, JsonValue>,
-    /// Count of sent events
-    events: usize,
+    /// Count of HEC envelopes (not fan-out events) processed so far. Used both as the
+    /// `InvalidEventNumber` index in Splunk error responses (zero-indexed: subtract 1
+    /// for build-time errors, use as-is for parse errors that haven't entered build)
+    /// and as the "did we see any envelope?" check that gates the `NoData` error.
+    envelopes_processed: usize,
     /// Optional channel from headers
     channel: Option<Value>,
     /// Default time
@@ -688,6 +930,9 @@ struct EventIterator<'de, R: JsonRead<'de>> {
     log_namespace: LogNamespace,
     /// handle to EventsReceived registry
     events_received: Registered<EventsReceived>,
+    /// Optional second-stage decoder applied to the envelope payload after HEC
+    /// envelope parsing.
+    decoder: Option<Decoder>,
 }
 
 /// Intermediate struct to generate an `EventIterator`
@@ -700,13 +945,24 @@ struct EventIteratorGenerator<'de, R: JsonRead<'de>> {
     events_received: Registered<EventsReceived>,
     remote: Option<SocketAddr>,
     remote_addr: Option<String>,
+    decoder: Option<Decoder>,
 }
 
 impl<'de, R: JsonRead<'de>> From<EventIteratorGenerator<'de, R>> for EventIterator<'de, R> {
     fn from(f: EventIteratorGenerator<'de, R>) -> Self {
+        // The host field can collide with decoder-produced output in legacy namespace
+        // (its legacy key is `log_schema().host_key()`, typically `"host"`). When a
+        // decoder is configured, prefer the decoder's value over the envelope's so the
+        // user's parsed view wins on conflict. With no decoder configured, behavior is
+        // unchanged: every extractor uses `Overwrite`.
+        let extractor_strategy = if f.decoder.is_some() {
+            LegacyKeyStrategy::InsertIfEmpty
+        } else {
+            LegacyKeyStrategy::Overwrite
+        };
         Self {
             deserializer: f.deserializer,
-            events: 0,
+            envelopes_processed: 0,
             channel: f.channel.map(Value::from),
             time: Time::Now(Utc::now()),
             extractors: [
@@ -721,25 +977,73 @@ impl<'de, R: JsonRead<'de>> From<EventIteratorGenerator<'de, R>> for EventIterat
                         .or_else(|| f.remote.map(|addr| addr.to_string()))
                         .map(Value::from),
                     f.log_namespace,
-                ),
-                DefaultExtractor::new("index", OptionalValuePath::new(INDEX), f.log_namespace),
-                DefaultExtractor::new("source", OptionalValuePath::new(SOURCE), f.log_namespace),
+                )
+                .with_legacy_key_strategy(extractor_strategy),
+                DefaultExtractor::new("index", OptionalValuePath::new(INDEX), f.log_namespace)
+                    .with_legacy_key_strategy(extractor_strategy),
+                DefaultExtractor::new("source", OptionalValuePath::new(SOURCE), f.log_namespace)
+                    .with_legacy_key_strategy(extractor_strategy),
                 DefaultExtractor::new(
                     "sourcetype",
                     OptionalValuePath::new(SOURCETYPE),
                     f.log_namespace,
-                ),
+                )
+                .with_legacy_key_strategy(extractor_strategy),
             ],
             batch: f.batch,
             token: f.token,
             log_namespace: f.log_namespace,
             events_received: f.events_received,
+            decoder: f.decoder,
         }
     }
 }
 
 impl<'de, R: JsonRead<'de>> EventIterator<'de, R> {
+    /// Process the envelope's `time` field, updating `self.time` (sticky across envelopes
+    /// when not explicitly provided).
+    fn process_time(&mut self, json: &mut JsonValue) -> Result<(), Rejection> {
+        let parsed_time = match json.get_mut("time").map(JsonValue::take) {
+            Some(JsonValue::Number(time)) => Some(Some(time)),
+            Some(JsonValue::String(time)) => Some(time.parse::<serde_json::Number>().ok()),
+            _ => None,
+        };
+
+        match parsed_time {
+            None => Ok(()),
+            Some(Some(t)) => {
+                if let Some(t) = t.as_u64() {
+                    let time = parse_timestamp(t as i64).ok_or(ApiError::InvalidDataFormat {
+                        event: self.envelopes_processed.saturating_sub(1),
+                    })?;
+                    self.time = Time::Provided(time);
+                    Ok(())
+                } else if let Some(t) = t.as_f64() {
+                    self.time = Time::Provided(
+                        Utc.timestamp_opt(
+                            t.floor() as i64,
+                            (t.fract() * 1000.0 * 1000.0 * 1000.0) as u32,
+                        )
+                        .single()
+                        .expect("invalid timestamp"),
+                    );
+                    Ok(())
+                } else {
+                    Err(ApiError::InvalidDataFormat {
+                        event: self.envelopes_processed.saturating_sub(1),
+                    }
+                    .into())
+                }
+            }
+            Some(None) => Err(ApiError::InvalidDataFormat {
+                event: self.envelopes_processed.saturating_sub(1),
+            }
+            .into()),
+        }
+    }
+
     fn build_event(&mut self, mut json: JsonValue) -> Result<Event, Rejection> {
+        self.envelopes_processed += 1;
         // Construct Event from parsed json event
         let mut log = match self.log_namespace {
             LogNamespace::Vector => self.build_log_vector(&mut json)?,
@@ -787,36 +1091,7 @@ impl<'de, R: JsonRead<'de>> EventIterator<'de, R> {
             }
         }
 
-        // Process time field
-        let parsed_time = match json.get_mut("time").map(JsonValue::take) {
-            Some(JsonValue::Number(time)) => Some(Some(time)),
-            Some(JsonValue::String(time)) => Some(time.parse::<serde_json::Number>().ok()),
-            _ => None,
-        };
-
-        match parsed_time {
-            None => (),
-            Some(Some(t)) => {
-                if let Some(t) = t.as_u64() {
-                    let time = parse_timestamp(t as i64)
-                        .ok_or(ApiError::InvalidDataFormat { event: self.events })?;
-
-                    self.time = Time::Provided(time);
-                } else if let Some(t) = t.as_f64() {
-                    self.time = Time::Provided(
-                        Utc.timestamp_opt(
-                            t.floor() as i64,
-                            (t.fract() * 1000.0 * 1000.0 * 1000.0) as u32,
-                        )
-                        .single()
-                        .expect("invalid timestamp"),
-                    );
-                } else {
-                    return Err(ApiError::InvalidDataFormat { event: self.events }.into());
-                }
-            }
-            Some(None) => return Err(ApiError::InvalidDataFormat { event: self.events }.into()),
-        }
+        self.process_time(&mut json)?;
 
         // Add time field
         let timestamp = match self.time.clone() {
@@ -846,36 +1121,247 @@ impl<'de, R: JsonRead<'de>> EventIterator<'de, R> {
             log = log.with_batch_notifier(&batch);
         }
 
-        self.events += 1;
-
         Ok(log.into())
     }
 
+    /// Build an `EventMetadata` template from the current envelope context so
+    /// that VRL decoders can read source-supplied values via `%`-prefixed paths
+    /// before the decoder program executes.
+    ///
+    /// Peeks at the envelope `json` without consuming any fields (consumption
+    /// happens later in `build_events_decoded`). Falls back to sticky extractor
+    /// state for fields not present in the current envelope.
+    fn build_vrl_metadata(&self, json: &JsonValue) -> EventMetadata {
+        let mut metadata = EventMetadata::default();
+
+        // Splunk HEC token as a secret so VRL can read it via get_secret!()
+        if let Some(token) = &self.token {
+            metadata.set_splunk_hec_token(Arc::clone(token));
+        }
+
+        // Envelope host/source/sourcetype/index: peek current value; fall back
+        // to sticky extractor state.
+        let fields: &[(&str, &str)] = &[
+            ("host", "splunk_hec.host"),
+            ("source", "splunk_hec.source"),
+            ("sourcetype", "splunk_hec.sourcetype"),
+            ("index", "splunk_hec.index"),
+        ];
+        for (json_key, meta_path) in fields {
+            let val = json
+                .get(json_key)
+                .and_then(|v| v.as_str())
+                .map(|s| Value::from(s.to_string()))
+                .or_else(|| {
+                    self.extractors
+                        .iter()
+                        .find(|e| e.field == *json_key)
+                        .and_then(|e| e.value.clone())
+                });
+            if let Some(v) = val {
+                metadata.value_mut().insert(*meta_path, v);
+            }
+        }
+
+        // Channel: envelope field or header default
+        let channel = json
+            .get("channel")
+            .and_then(|v| v.as_str())
+            .map(|s| Value::from(s.to_string()))
+            .or_else(|| self.channel.clone());
+        if let Some(ch) = channel {
+            metadata.value_mut().insert("splunk_hec.channel", ch);
+        }
+
+        metadata
+    }
+
+    /// Decoded path: extract the envelope's `event` field as bytes (preserving shape),
+    /// run it through the second-stage decoder, and overlay envelope metadata so that
+    /// decoder-produced fields win on conflict. Returns the events along with a flag
+    /// indicating whether the codec hit any errors (so the caller can refuse to ack
+    /// a request that lost data).
+    fn build_events_decoded(
+        &mut self,
+        mut json: JsonValue,
+        decoder: Decoder,
+    ) -> Result<(Vec<Event>, bool), Rejection> {
+        self.envelopes_processed += 1;
+        let event = self.validate_event_field(&json)?;
+        // Strings are passed as raw bytes so decoders see the bare content
+        // (e.g. a JSON string event containing `{"foo":"bar"}` arrives at the
+        // decoder as `{"foo":"bar"}`, not `"{\"foo\":\"bar\"}"` ). All other
+        // JSON values (objects, arrays, numbers, bools) are serialized to JSON.
+        let payload = if let Some(s) = event.as_str() {
+            s.as_bytes().to_vec()
+        } else {
+            match serde_json::to_vec(event) {
+                Ok(bytes) => bytes,
+                Err(error) => {
+                    let error: vector_lib::Error = Box::new(error);
+                    emit!(
+                        vector_lib::codecs::internal_events::DecoderDeserializeError {
+                            error: &error
+                        }
+                    );
+                    emit!(ComponentEventsDropped::<UNINTENTIONAL> {
+                        count: 1,
+                        reason: "Failed to serialize event field to bytes.",
+                    });
+                    return Ok((vec![], true));
+                }
+            }
+        };
+
+        self.process_time(&mut json)?;
+
+        // Always forward a fallback timestamp so events without an explicit envelope
+        // `time` field still get one (matches the legacy /event behavior, which always
+        // wrote a timestamp). `decode_message` uses `try_insert`, so a decoder-supplied
+        // timestamp still wins on conflict.
+        let fallback_time = match self.time {
+            Time::Provided(t) | Time::Now(t) => t,
+        };
+
+        // Build a metadata template so VRL decoders can read envelope context
+        // via `%`-prefixed paths (e.g. `%splunk_hec.host`, `%vector.secrets.*`).
+        // For non-VRL decoders `with_metadata_template` is a no-op.
+        let decoder = decoder.with_metadata_template(self.build_vrl_metadata(&json));
+
+        let (decoded, had_decode_errors) = decode_payload(
+            decoder,
+            &payload,
+            Some(fallback_time),
+            true, // /event: write %splunk_hec.timestamp
+            DecodePayloadContext {
+                batch: &self.batch,
+                log_namespace: self.log_namespace,
+                events_received: &self.events_received,
+                splunk_hec_token: self.token.as_ref(),
+            },
+        );
+
+        // Snapshot envelope metadata that has to apply uniformly to every decoded event.
+        let envelope_channel: Option<Value> = match json.get_mut("channel").map(JsonValue::take) {
+            Some(JsonValue::String(guid)) => Some(guid.into()),
+            _ => None,
+        };
+        let envelope_fields: Option<serde_json::Map<String, JsonValue>> =
+            match json.get_mut("fields").map(JsonValue::take) {
+                Some(JsonValue::Object(object)) => Some(object),
+                _ => None,
+            };
+        let channel_path = owned_value_path!(CHANNEL);
+
+        let mut out = Vec::with_capacity(decoded.len());
+        for mut event in decoded {
+            if let Event::Log(log) = &mut event {
+                // channel: envelope value beats header default. Use `InsertIfEmpty`
+                // for legacy event fields, and `try_insert` for the Vector metadata
+                // path so a decoder-produced `%splunk_hec.channel` survives.
+                if let Some(channel_val) = envelope_channel.clone().or_else(|| self.channel.clone())
+                {
+                    match self.log_namespace {
+                        LogNamespace::Legacy => {
+                            self.log_namespace.insert_source_metadata(
+                                SplunkConfig::NAME,
+                                log,
+                                Some(LegacyKey::InsertIfEmpty(&channel_path)),
+                                lookup::path!(CHANNEL),
+                                channel_val,
+                            );
+                        }
+                        LogNamespace::Vector => {
+                            log.try_insert(
+                                metadata_path!(SplunkConfig::NAME, CHANNEL),
+                                channel_val,
+                            );
+                        }
+                    }
+                }
+
+                // Top-level envelope fields (host/index/source/sourcetype) must be
+                // applied before `fields.*` so top-level beats `fields.*` when both
+                // are present — matching the non-decoder runtime precedence. Both
+                // still use InsertIfEmpty so the decoder's output wins over all
+                // envelope metadata. Order: decoder > top-level > fields.
+                for de in self.extractors.iter_mut() {
+                    de.extract(log, &mut json);
+                }
+
+                // fields: use `InsertIfEmpty` / `try_insert` to preserve decoder-wins
+                // and extractor-wins semantics (fields fill only what neither the
+                // decoder nor the top-level envelope keys have already set).
+                if let Some(ref fields) = envelope_fields {
+                    for (key, value) in fields {
+                        match self.log_namespace {
+                            LogNamespace::Legacy => {
+                                self.log_namespace.insert_source_metadata(
+                                    SplunkConfig::NAME,
+                                    log,
+                                    Some(LegacyKey::InsertIfEmpty(&owned_value_path!(
+                                        key.as_str()
+                                    ))),
+                                    lookup::path!(key.as_str()),
+                                    value.clone(),
+                                );
+                            }
+                            LogNamespace::Vector => {
+                                log.try_insert(
+                                    metadata_path!(SplunkConfig::NAME, key.as_str()),
+                                    value.clone(),
+                                );
+                            }
+                        }
+                    }
+                }
+            }
+            // `splunk_hec_token` is set inside `decode_payload` so the metadata is
+            // attached at the moment each event leaves the codec. Don't overwrite it
+            // here.
+            out.push(event);
+        }
+
+        Ok((out, had_decode_errors))
+    }
+
+    /// Validate the `event` field of a HEC envelope, returning a reference to the
+    /// validated value or an error if it is missing, null, or (for string values)
+    /// empty. Shared between the decoder path and the legacy/vector construction
+    /// paths so they all enforce the same HEC protocol contract.
+    fn validate_event_field<'a>(&self, json: &'a JsonValue) -> Result<&'a JsonValue, Rejection> {
+        let event_idx = self.envelopes_processed.saturating_sub(1);
+        match json.get("event") {
+            None | Some(JsonValue::Null) => {
+                Err(ApiError::MissingEventField { event: event_idx }.into())
+            }
+            Some(JsonValue::String(s)) if s.is_empty() => {
+                Err(ApiError::EmptyEventField { event: event_idx }.into())
+            }
+            Some(event) => Ok(event),
+        }
+    }
+
     /// Build the log event for the vector namespace.
     /// In this namespace the log event is created entirely from the event field.
     /// No renaming of the `line` field is done.
     fn build_log_vector(&mut self, json: &mut JsonValue) -> Result<LogEvent, Rejection> {
-        match json.get("event") {
-            Some(event) => {
-                let event: Value = event.into();
-                let mut log = LogEvent::from(event);
+        let event: Value = self.validate_event_field(json)?.into();
+        let mut log = LogEvent::from(event);
 
-                // EstimatedJsonSizeOf must be calculated before enrichment
-                self.events_received
-                    .emit(CountByteSize(1, log.estimated_json_encoded_size_of()));
+        // EstimatedJsonSizeOf must be calculated before enrichment
+        self.events_received
+            .emit(CountByteSize(1, log.estimated_json_encoded_size_of()));
 
-                // The timestamp is extracted from the message for the Legacy namespace.
-                self.log_namespace.insert_vector_metadata(
-                    &mut log,
-                    log_schema().timestamp_key(),
-                    lookup::path!("ingest_timestamp"),
-                    chrono::Utc::now(),
-                );
+        // The timestamp is extracted from the message for the Legacy namespace.
+        self.log_namespace.insert_vector_metadata(
+            &mut log,
+            log_schema().timestamp_key(),
+            lookup::path!("ingest_timestamp"),
+            chrono::Utc::now(),
+        );
 
-                Ok(log)
-            }
-            None => Err(ApiError::MissingEventField { event: self.events }.into()),
-        }
+        Ok(log)
     }
 
     /// Build the log event for the legacy namespace.
@@ -883,41 +1369,45 @@ impl<'de, R: JsonRead<'de>> EventIterator<'de, R> {
     /// (the docker splunk logger places the message in the event.line field) that string
     /// is placed in the message field.
     fn build_log_legacy(&mut self, json: &mut JsonValue) -> Result<LogEvent, Rejection> {
+        // validate_event_field checks for missing/null/empty-string
+        self.validate_event_field(json)?;
         let mut log = LogEvent::default();
-        match json.get_mut("event") {
-            Some(event) => match event.take() {
-                JsonValue::String(string) => {
-                    if string.is_empty() {
-                        return Err(ApiError::EmptyEventField { event: self.events }.into());
+        match json["event"].take() {
+            JsonValue::String(string) => {
+                log.maybe_insert(log_schema().message_key_target_path(), string);
+            }
+            JsonValue::Object(mut object) => {
+                if object.is_empty() {
+                    return Err(ApiError::EmptyEventField {
+                        event: self.envelopes_processed.saturating_sub(1),
                     }
-                    log.maybe_insert(log_schema().message_key_target_path(), string);
+                    .into());
                 }
-                JsonValue::Object(mut object) => {
-                    if object.is_empty() {
-                        return Err(ApiError::EmptyEventField { event: self.events }.into());
-                    }
 
-                    // Add 'line' value as 'event::schema().message_key'
-                    if let Some(line) = object.remove("line") {
-                        match line {
-                            // This don't quite fit the meaning of a event::schema().message_key
-                            JsonValue::Array(_) | JsonValue::Object(_) => {
-                                log.insert(event_path!("line"), line);
-                            }
-                            _ => {
-                                log.maybe_insert(log_schema().message_key_target_path(), line);
-                            }
+                // Add 'line' value as 'event::schema().message_key'
+                if let Some(line) = object.remove("line") {
+                    match line {
+                        // This don't quite fit the meaning of a event::schema().message_key
+                        JsonValue::Array(_) | JsonValue::Object(_) => {
+                            log.insert(event_path!("line"), line);
+                        }
+                        _ => {
+                            log.maybe_insert(log_schema().message_key_target_path(), line);
                         }
                     }
+                }
 
-                    for (key, value) in object {
-                        log.insert(event_path!(key.as_str()), value);
-                    }
+                for (key, value) in object {
+                    log.insert(event_path!(key.as_str()), value);
                 }
-                _ => return Err(ApiError::InvalidDataFormat { event: self.events }.into()),
-            },
-            None => return Err(ApiError::MissingEventField { event: self.events }.into()),
-        };
+            }
+            _ => {
+                return Err(ApiError::InvalidDataFormat {
+                    event: self.envelopes_processed.saturating_sub(1),
+                }
+                .into());
+            }
+        }
 
         // EstimatedJsonSizeOf must be calculated before enrichment
         self.events_received
@@ -928,13 +1418,23 @@ impl<'de, R: JsonRead<'de>> EventIterator<'de, R> {
 }
 
 impl<'de, R: JsonRead<'de>> Iterator for EventIterator<'de, R> {
-    type Item = Result<Event, Rejection>;
+    /// Each item is `(events, had_decode_errors)` for one envelope - the boolean is
+    /// only ever `true` in the decoder path. Callers OR these together across the
+    /// whole request to decide whether ack registration is safe.
+    type Item = Result<(Vec<Event>, bool), Rejection>;
 
     fn next(&mut self) -> Option<Self::Item> {
         match self.deserializer.next() {
-            Some(Ok(json)) => Some(self.build_event(json)),
+            Some(Ok(json)) => {
+                let result = if let Some(decoder) = self.decoder.clone() {
+                    self.build_events_decoded(json, decoder)
+                } else {
+                    self.build_event(json).map(|event| (vec![event], false))
+                };
+                Some(result)
+            }
             None => {
-                if self.events == 0 {
+                if self.envelopes_processed == 0 {
                     Some(Err(ApiError::NoData.into()))
                 } else {
                     None
@@ -944,12 +1444,112 @@ impl<'de, R: JsonRead<'de>> Iterator for EventIterator<'de, R> {
                 emit!(SplunkHecRequestBodyInvalidError {
                     error: error.into()
                 });
-                Some(Err(
-                    ApiError::InvalidDataFormat { event: self.events }.into()
-                ))
+                // The deserializer failed to parse the next envelope, so the failing
+                // envelope's index is the count of envelopes already processed (not
+                // `envelopes_processed - 1`, which is what build-time errors use).
+                Some(Err(ApiError::InvalidDataFormat {
+                    event: self.envelopes_processed,
+                }
+                .into()))
+            }
+        }
+    }
+}
+
+struct DecodePayloadContext<'a> {
+    batch: &'a Option<BatchNotifier>,
+    log_namespace: LogNamespace,
+    events_received: &'a Registered<EventsReceived>,
+    splunk_hec_token: Option<&'a Arc<str>>,
+}
+
+/// Run a payload through the configured `framing` + `decoding` codec.
+///
+/// Returns the decoded events along with a flag indicating whether any decode error
+/// occurred. The shared `crate::sources::util::decode_message` helper swallows
+/// decode errors silently, which is fine for sources without ack semantics, but for
+/// `splunk_hec` we need to know about errors so we can refuse to acknowledge a
+/// request that lost data mid-stream.
+///
+/// On each decoded event this helper sets `source_type`, `vector.ingest_timestamp`,
+/// the optional `splunk_hec.timestamp` (only when `set_source_timestamp` is `true`,
+/// i.e. for the `/event` endpoint which carries an HEC envelope `time` field), and
+/// the optional Splunk HEC token. Pass `set_source_timestamp = false` for `/raw`,
+/// which has no envelope timestamp and should only receive `%vector.ingest_timestamp`.
+fn decode_payload(
+    mut decoder: Decoder,
+    payload: &[u8],
+    fallback_timestamp: Option<DateTime<Utc>>,
+    set_source_timestamp: bool,
+    ctx: DecodePayloadContext<'_>,
+) -> (Vec<Event>, bool) {
+    let DecodePayloadContext {
+        batch,
+        log_namespace,
+        events_received,
+        splunk_hec_token,
+    } = ctx;
+    let mut buffer = BytesMut::with_capacity(payload.len());
+    buffer.extend_from_slice(payload);
+    let now = Utc::now();
+    let mut events: Vec<Event> = Vec::new();
+    let mut had_errors = false;
+
+    loop {
+        match decoder.decode_eof(&mut buffer) {
+            Ok(Some((decoded, _))) => {
+                for mut event in decoded {
+                    if let Event::Log(log) = &mut event {
+                        log_namespace.insert_vector_metadata(
+                            log,
+                            log_schema().source_type_key(),
+                            lookup::path!("source_type"),
+                            Bytes::from_static(SplunkConfig::NAME.as_bytes()),
+                        );
+                        match log_namespace {
+                            LogNamespace::Vector => {
+                                // Only write %splunk_hec.timestamp for the /event
+                                // endpoint, which has a real HEC envelope timestamp.
+                                // /raw has no envelope time and should only get the
+                                // standard %vector.ingest_timestamp below.
+                                if set_source_timestamp && let Some(timestamp) = fallback_timestamp
+                                {
+                                    log.try_insert(
+                                        metadata_path!(SplunkConfig::NAME, "timestamp"),
+                                        timestamp,
+                                    );
+                                }
+                                log.insert(metadata_path!("vector", "ingest_timestamp"), now);
+                            }
+                            LogNamespace::Legacy => {
+                                if let Some(timestamp) = fallback_timestamp
+                                    && let Some(timestamp_key) = log_schema().timestamp_key()
+                                {
+                                    log.try_insert((PathPrefix::Event, timestamp_key), timestamp);
+                                }
+                            }
+                        }
+                    }
+                    if let Some(token) = splunk_hec_token {
+                        event.metadata_mut().set_splunk_hec_token(Arc::clone(token));
+                    }
+                    events_received.emit(CountByteSize(1, event.estimated_json_encoded_size_of()));
+                    events.push(event.with_batch_notifier_option(batch));
+                }
+            }
+            Ok(None) => break,
+            Err(error) => {
+                // The decoder logs its own error; record that one occurred so the
+                // caller can refuse to ack a request that lost data.
+                had_errors = true;
+                if !error.can_continue() {
+                    break;
+                }
             }
         }
     }
+
+    (events, had_errors)
 }
 
 /// Parse a `i64` unix timestamp that can either be in seconds, milliseconds or
@@ -986,12 +1586,20 @@ fn parse_timestamp(t: i64) -> Option<DateTime<Utc>> {
     Some(ts)
 }
 
+/// How to write the legacy key when `DefaultExtractor::extract` applies a value.
+#[derive(Clone, Copy)]
+enum LegacyKeyStrategy {
+    Overwrite,
+    InsertIfEmpty,
+}
+
 /// Maintains last known extracted value of field and uses it in the absence of field.
 struct DefaultExtractor {
     field: &'static str,
     to_field: OptionalValuePath,
     value: Option<Value>,
     log_namespace: LogNamespace,
+    legacy_key_strategy: LegacyKeyStrategy,
 }
 
 impl DefaultExtractor {
@@ -1005,6 +1613,7 @@ impl DefaultExtractor {
             to_field,
             value: None,
             log_namespace,
+            legacy_key_strategy: LegacyKeyStrategy::Overwrite,
         }
     }
 
@@ -1019,9 +1628,18 @@ impl DefaultExtractor {
             to_field,
             value: value.into(),
             log_namespace,
+            legacy_key_strategy: LegacyKeyStrategy::Overwrite,
         }
     }
 
+    /// Set the strategy used when writing this extractor's legacy key. Defaults to
+    /// `Overwrite`; the decoder path uses `InsertIfEmpty` for fields that may collide
+    /// with decoder-produced output (e.g. `host`).
+    const fn with_legacy_key_strategy(mut self, strategy: LegacyKeyStrategy) -> Self {
+        self.legacy_key_strategy = strategy;
+        self
+    }
+
     fn extract(&mut self, log: &mut LogEvent, value: &mut JsonValue) {
         // Process json_field
         if let Some(JsonValue::String(new_value)) = value.get_mut(self.field).map(JsonValue::take) {
@@ -1032,13 +1650,33 @@ impl DefaultExtractor {
         if let Some(index) = self.value.as_ref()
             && let Some(metadata_key) = self.to_field.path.as_ref()
         {
-            self.log_namespace.insert_source_metadata(
-                SplunkConfig::NAME,
-                log,
-                Some(LegacyKey::Overwrite(metadata_key)),
-                &self.to_field.path.clone().unwrap_or(owned_value_path!("")),
-                index.clone(),
-            )
+            // For Vector namespace + InsertIfEmpty (decoder mode): check the metadata
+            // value tree before inserting so VRL-produced values aren't overwritten.
+            // `insert_source_metadata` for Vector ns always calls `insert`, not
+            // `try_insert`, so we replicate its path construction here.
+            if matches!(self.log_namespace, LogNamespace::Vector)
+                && matches!(self.legacy_key_strategy, LegacyKeyStrategy::InsertIfEmpty)
+            {
+                log.try_insert(
+                    (
+                        PathPrefix::Metadata,
+                        lookup::path!(SplunkConfig::NAME).concat(metadata_key),
+                    ),
+                    index.clone(),
+                );
+            } else {
+                let legacy_key = match self.legacy_key_strategy {
+                    LegacyKeyStrategy::Overwrite => LegacyKey::Overwrite(metadata_key),
+                    LegacyKeyStrategy::InsertIfEmpty => LegacyKey::InsertIfEmpty(metadata_key),
+                };
+                self.log_namespace.insert_source_metadata(
+                    SplunkConfig::NAME,
+                    log,
+                    Some(legacy_key),
+                    &self.to_field.path.clone().unwrap_or(owned_value_path!("")),
+                    index.clone(),
+                );
+            }
         }
     }
 }
@@ -1052,7 +1690,13 @@ enum Time {
     Provided(DateTime<Utc>),
 }
 
-/// Creates event from raw request
+/// Creates events from a raw HEC request body.
+///
+/// Without a decoder, returns a single event whose message is the (decompressed)
+/// request body. With a decoder, the body is fed through the configured framing +
+/// decoding pipeline and one or more events are returned. The boolean second tuple
+/// element is `true` when the decoder hit any (recoverable or non-recoverable)
+/// errors during the request, so the caller can refuse to acknowledge the request.
 #[allow(clippy::too_many_arguments)]
 fn raw_event(
     bytes: Bytes,
@@ -1063,42 +1707,23 @@ fn raw_event(
     batch: Option<BatchNotifier>,
     log_namespace: LogNamespace,
     events_received: &Registered<EventsReceived>,
-) -> Result<Event, Rejection> {
+    decoder: Option<Decoder>,
+    splunk_hec_token: Option<Arc<str>>,
+) -> Result<(Vec<Event>, bool), Rejection> {
     // Process gzip
-    let message: Value = if gzip {
+    let body_bytes: Bytes = if gzip {
         let mut data = Vec::new();
         match MultiGzDecoder::new(bytes.reader()).read_to_end(&mut data) {
             Ok(0) => return Err(ApiError::NoData.into()),
-            Ok(_) => Value::from(Bytes::from(data)),
+            Ok(_) => Bytes::from(data),
             Err(error) => {
                 emit!(SplunkHecRequestBodyInvalidError { error });
                 return Err(ApiError::InvalidDataFormat { event: 0 }.into());
             }
         }
     } else {
-        bytes.into()
-    };
-
-    // Construct event
-    let mut log = match log_namespace {
-        LogNamespace::Vector => LogEvent::from(message),
-        LogNamespace::Legacy => {
-            let mut log = LogEvent::default();
-            log.maybe_insert(log_schema().message_key_target_path(), message);
-            log
-        }
+        bytes
     };
-    // We need to calculate the estimated json size of the event BEFORE enrichment.
-    events_received.emit(CountByteSize(1, log.estimated_json_encoded_size_of()));
-
-    // Add channel
-    log_namespace.insert_source_metadata(
-        SplunkConfig::NAME,
-        &mut log,
-        Some(LegacyKey::Overwrite(&owned_value_path!(CHANNEL))),
-        lookup::path!(CHANNEL),
-        channel,
-    );
 
     // host-field priority for raw endpoint:
     // - x-forwarded-for is set to `host` field first, if present. If not present:
@@ -1109,23 +1734,105 @@ fn raw_event(
         remote.map(|remote| remote.to_string())
     };
 
-    if let Some(host) = host {
-        log_namespace.insert_source_metadata(
-            SplunkConfig::NAME,
+    let decoder_in_use = decoder.is_some();
+    let (mut events, had_decode_errors): (Vec<Event>, bool) = if let Some(decoder) = decoder {
+        // Build a metadata template so VRL decoders can read raw-endpoint context
+        // via `%`-prefixed paths (e.g. `%splunk_hec.channel`, `%splunk_hec.host`,
+        // `%vector.secrets.splunk_hec_token`). No-op for non-VRL decoders.
+        let decoder = {
+            let mut meta = EventMetadata::default();
+            if let Some(token) = splunk_hec_token.as_ref() {
+                meta.set_splunk_hec_token(Arc::clone(token));
+            }
+            if let Some(ref h) = host {
+                meta.value_mut().insert("splunk_hec.host", h.clone());
+            }
+            meta.value_mut()
+                .insert("splunk_hec.channel", channel.clone());
+            decoder.with_metadata_template(meta)
+        };
+
+        // Pass ingest time as the fallback timestamp so decoded events always have
+        // one - matches `insert_standard_vector_source_metadata` in the legacy raw
+        // path. `decode_payload` uses `try_insert`, so a decoder-supplied timestamp
+        // still wins on conflict.
+        decode_payload(
+            decoder,
+            &body_bytes,
+            Some(Utc::now()),
+            false, // /raw: no HEC envelope timestamp; only %vector.ingest_timestamp
+            DecodePayloadContext {
+                batch: &batch,
+                log_namespace,
+                events_received,
+                splunk_hec_token: splunk_hec_token.as_ref(),
+            },
+        )
+    } else {
+        let message: Value = body_bytes.into();
+        let mut log = match log_namespace {
+            LogNamespace::Vector => LogEvent::from(message),
+            LogNamespace::Legacy => {
+                let mut log = LogEvent::default();
+                log.maybe_insert(log_schema().message_key_target_path(), message);
+                log
+            }
+        };
+        // We need to calculate the estimated json size of the event BEFORE enrichment.
+        events_received.emit(CountByteSize(1, log.estimated_json_encoded_size_of()));
+
+        log_namespace.insert_standard_vector_source_metadata(
             &mut log,
-            log_schema().host_key().map(LegacyKey::InsertIfEmpty),
-            lookup::path!("host"),
-            host,
+            SplunkConfig::NAME,
+            Utc::now(),
         );
-    }
 
-    log_namespace.insert_standard_vector_source_metadata(&mut log, SplunkConfig::NAME, Utc::now());
+        if let Some(batch) = batch.clone() {
+            log = log.with_batch_notifier(&batch);
+        }
+        (vec![Event::from(log)], false)
+    };
 
-    if let Some(batch) = batch {
-        log = log.with_batch_notifier(&batch);
+    let channel_path = owned_value_path!(CHANNEL);
+    for event in &mut events {
+        if let Event::Log(log) = event {
+            // With a decoder configured, defer to anything it produced at the legacy
+            // When a decoder is in use, preserve decoder-wins semantics for Vector ns
+            // by using `try_insert` on the metadata path (insert_source_metadata for
+            // Vector ns always overwrites). Without a decoder the log is freshly
+            // constructed so overwriting is correct.
+            if decoder_in_use && matches!(log_namespace, LogNamespace::Vector) {
+                log.try_insert(metadata_path!(SplunkConfig::NAME, CHANNEL), channel.clone());
+                if let Some(ref h) = host {
+                    log.try_insert(metadata_path!(SplunkConfig::NAME, "host"), h.clone());
+                }
+            } else {
+                let channel_legacy_key = if decoder_in_use {
+                    LegacyKey::InsertIfEmpty(&channel_path)
+                } else {
+                    LegacyKey::Overwrite(&channel_path)
+                };
+                log_namespace.insert_source_metadata(
+                    SplunkConfig::NAME,
+                    log,
+                    Some(channel_legacy_key),
+                    lookup::path!(CHANNEL),
+                    channel.clone(),
+                );
+                if let Some(ref host) = host {
+                    log_namespace.insert_source_metadata(
+                        SplunkConfig::NAME,
+                        log,
+                        log_schema().host_key().map(LegacyKey::InsertIfEmpty),
+                        lookup::path!("host"),
+                        host.clone(),
+                    );
+                }
+            }
+        }
     }
 
-    Ok(Event::from(log))
+    Ok((events, had_decode_errors))
 }
 
 #[derive(Clone, Copy, Debug, Snafu)]
@@ -1219,6 +1926,17 @@ mod splunk_response {
     pub const ACK_IS_DISABLED: HecResponse = HecResponse::new(HecStatusCode::AckIsDisabled);
 }
 
+async fn register_ack(
+    idx_ack: Option<Arc<IndexerAcknowledgement>>,
+    receiver: Option<BatchStatusReceiver>,
+    channel: Option<String>,
+) -> Result<Option<u64>, Rejection> {
+    match (idx_ack, receiver, channel) {
+        (Some(ack), Some(rx), Some(ch)) => Ok(Some(ack.get_ack_id_from_channel(ch, rx).await?)),
+        _ => Ok(None),
+    }
+}
+
 fn finish_ok(maybe_ack_id: Option<u64>) -> Response {
     let body = if let Some(ack_id) = maybe_ack_id {
         HecResponse::new(HecStatusCode::Success).with_metadata(HecResponseMetadata::AckId(ack_id))
@@ -1311,7 +2029,10 @@ mod tests {
     use vector_lib::{
         codecs::{
             BytesDecoderConfig, JsonSerializerConfig, TextSerializerConfig,
-            decoding::DeserializerConfig,
+            decoding::{
+                DeserializerConfig,
+                format::{VrlDeserializerConfig, VrlDeserializerOptions},
+            },
         },
         event::EventStatus,
         schema::Definition,
@@ -1383,6 +2104,8 @@ mod tests {
                 store_hec_token,
                 log_namespace: None,
                 keepalive: Default::default(),
+                event: CodecConfig::default(),
+                raw: CodecConfig::default(),
             }
             .build(cx)
             .await
@@ -2629,6 +3352,594 @@ mod tests {
         );
     }
 
+    async fn source_with_codec(
+        event: CodecConfig,
+        raw: CodecConfig,
+    ) -> (
+        impl Stream<Item = Event> + Unpin + use<>,
+        SocketAddr,
+        PortGuard,
+    ) {
+        let (sender, recv) = SourceSender::new_test_finalize(EventStatus::Delivered);
+        let (_guard, address) = next_addr();
+        let cx = SourceContext::new_test(sender, None);
+        tokio::spawn(async move {
+            SplunkConfig {
+                address,
+                token: Some(TOKEN.to_owned().into()),
+                valid_tokens: None,
+                tls: None,
+                acknowledgements: Default::default(),
+                store_hec_token: false,
+                log_namespace: None,
+                keepalive: Default::default(),
+                event,
+                raw,
+            }
+            .build(cx)
+            .await
+            .unwrap()
+            .await
+            .unwrap()
+        });
+        wait_for_tcp(address).await;
+        (recv, address, _guard)
+    }
+
+    /// Codec config that just sets `decoding` (default framing).
+    fn codec_decoding(decoding: DeserializerConfig) -> CodecConfig {
+        CodecConfig {
+            framing: None,
+            decoding: Some(decoding),
+        }
+    }
+
+    /// Codec config that sets both `framing` and `decoding`.
+    fn codec_full(
+        framing: Option<FramingConfig>,
+        decoding: Option<DeserializerConfig>,
+    ) -> CodecConfig {
+        CodecConfig { framing, decoding }
+    }
+
+    #[tokio::test]
+    async fn decoder_event_endpoint_json_string() {
+        assert_source_compliance(&HTTP_PUSH_SOURCE_TAGS, async {
+            let (source, address, _guard) = source_with_codec(
+                codec_decoding(vector_lib::codecs::JsonDeserializerConfig::default().into()),
+                CodecConfig::default(),
+            )
+            .await;
+            let envelope =
+                r#"{"event":"{\"foo\":\"bar\",\"n\":42}","host":"client-host","sourcetype":"my-app"}"#;
+            assert_eq!(
+                200,
+                post(address, "services/collector/event", envelope).await
+            );
+
+            let event = collect_n(source, 1).await.remove(0);
+            let log = event.as_log();
+            assert_eq!(log["foo"], "bar".into());
+            assert_eq!(log["n"], 42.into());
+            assert_eq!(
+                log[log_schema().host_key().unwrap().to_string().as_str()],
+                "client-host".into()
+            );
+            assert_eq!(log[&super::SOURCETYPE], "my-app".into());
+        })
+        .await;
+    }
+
+    #[tokio::test]
+    async fn decoder_event_endpoint_json_object_round_trip() {
+        assert_source_compliance(&HTTP_PUSH_SOURCE_TAGS, async {
+            let (source, address, _guard) = source_with_codec(
+                codec_decoding(vector_lib::codecs::JsonDeserializerConfig::default().into()),
+                CodecConfig::default(),
+            )
+            .await;
+            let envelope = r#"{"event":{"foo":"bar","nested":{"k":1}},"host":"h"}"#;
+            assert_eq!(
+                200,
+                post(address, "services/collector/event", envelope).await
+            );
+
+            let event = collect_n(source, 1).await.remove(0);
+            let log = event.as_log();
+            assert_eq!(log["foo"], "bar".into());
+            assert_eq!(*log.get("nested.k").unwrap(), 1.into());
+            assert_eq!(
+                log[log_schema().host_key().unwrap().to_string().as_str()],
+                "h".into()
+            );
+        })
+        .await;
+    }
+
+    #[tokio::test]
+    async fn decoder_event_endpoint_all_envelope_fields_yield_to_decoder() {
+        // The decoded path must defer to the codec for `splunk_channel`,
+        // `splunk_index`, `splunk_source`, and `splunk_sourcetype` in legacy ns -
+        // not just `host`. Otherwise the changelog's "decoder wins on conflict"
+        // promise is broken for HEC envelope metadata.
+        assert_source_compliance(&HTTP_PUSH_SOURCE_TAGS, async {
+            let (source, address, _guard) = source_with_codec(
+                codec_decoding(vector_lib::codecs::JsonDeserializerConfig::default().into()),
+                CodecConfig::default(),
+            )
+            .await;
+            // The string `event` decodes to a JSON object that pre-populates each
+            // legacy splunk_* field. The envelope sets conflicting values for the
+            // same fields and must lose.
+            let envelope = r#"{
+                "event":"{\"splunk_channel\":\"decoder-channel\",\"splunk_index\":\"decoder-index\",\"splunk_source\":\"decoder-source\",\"splunk_sourcetype\":\"decoder-sourcetype\"}",
+                "index":"envelope-index",
+                "source":"envelope-source",
+                "sourcetype":"envelope-sourcetype"
+            }"#;
+            assert_eq!(
+                200,
+                post(address, "services/collector/event", envelope).await
+            );
+
+            let event = collect_n(source, 1).await.remove(0);
+            let log = event.as_log();
+            assert_eq!(log[&super::CHANNEL], "decoder-channel".into());
+            assert_eq!(log[&super::INDEX], "decoder-index".into());
+            assert_eq!(log[&super::SOURCE], "decoder-source".into());
+            assert_eq!(log[&super::SOURCETYPE], "decoder-sourcetype".into());
+        })
+        .await;
+    }
+
+    #[tokio::test]
+    async fn decoder_event_endpoint_decoder_field_wins_over_envelope() {
+        assert_source_compliance(&HTTP_PUSH_SOURCE_TAGS, async {
+            let (source, address, _guard) = source_with_codec(
+                codec_decoding(vector_lib::codecs::JsonDeserializerConfig::default().into()),
+                CodecConfig::default(),
+            )
+            .await;
+            // The string `event` decodes to {host: "decoder-host"}; the envelope sets
+            // host: "envelope-host". The decoder's value must win.
+            let envelope = r#"{"event":"{\"host\":\"decoder-host\"}","host":"envelope-host"}"#;
+            assert_eq!(
+                200,
+                post(address, "services/collector/event", envelope).await
+            );
+
+            let event = collect_n(source, 1).await.remove(0);
+            let log = event.as_log();
+            assert_eq!(
+                log[log_schema().host_key().unwrap().to_string().as_str()],
+                "decoder-host".into()
+            );
+        })
+        .await;
+    }
+
+    #[tokio::test]
+    async fn decoder_event_endpoint_decode_failure_returns_200() {
+        // A malformed inner JSON must not surface as an HTTP error to the Splunk
+        // client - decode failures are swallowed by the codec like other Vector
+        // sources do.
+        let (_source, address, _guard) = source_with_codec(
+            codec_decoding(vector_lib::codecs::JsonDeserializerConfig::default().into()),
+            CodecConfig::default(),
+        )
+        .await;
+        let envelope = r#"{"event":"not valid json {","host":"h"}"#;
+        assert_eq!(
+            200,
+            post(address, "services/collector/event", envelope).await
+        );
+    }
+
+    #[tokio::test]
+    async fn decoder_raw_endpoint_newline_delimited() {
+        assert_source_compliance(&HTTP_PUSH_SOURCE_TAGS, async {
+            let (source, address, _guard) = source_with_codec(
+                CodecConfig::default(),
+                codec_full(
+                    Some(FramingConfig::NewlineDelimited(Default::default())),
+                    Some(DeserializerConfig::Bytes),
+                ),
+            )
+            .await;
+            let body = "line1\nline2\nline3";
+            assert_eq!(200, post(address, "services/collector/raw", body).await);
+
+            let events = collect_n(source, 3).await;
+            assert_eq!(events.len(), 3);
+            let messages: Vec<String> = events
+                .iter()
+                .map(|e| {
+                    e.as_log()[log_schema().message_key().unwrap().to_string()]
+                        .to_string_lossy()
+                        .into_owned()
+                })
+                .collect();
+            assert!(messages.contains(&"line1".to_string()));
+            assert!(messages.contains(&"line2".to_string()));
+            assert!(messages.contains(&"line3".to_string()));
+
+            // All events share the channel from the request header.
+            for event in &events {
+                assert_eq!(event.as_log()[&super::CHANNEL], "channel".into());
+            }
+        })
+        .await;
+    }
+
+    #[tokio::test]
+    async fn decoder_event_endpoint_envelope_without_time_has_fallback_timestamp() {
+        // Regression: with a decoder set, an envelope that omits `time` must still
+        // produce events with a timestamp (the legacy /event path always wrote one).
+        assert_source_compliance(&HTTP_PUSH_SOURCE_TAGS, async {
+            let (source, address, _guard) = source_with_codec(
+                codec_decoding(vector_lib::codecs::JsonDeserializerConfig::default().into()),
+                CodecConfig::default(),
+            )
+            .await;
+            let envelope = r#"{"event":"{\"foo\":\"bar\"}"}"#;
+            assert_eq!(
+                200,
+                post(address, "services/collector/event", envelope).await
+            );
+
+            let event = collect_n(source, 1).await.remove(0);
+            assert!(
+                event.as_log().get_timestamp().is_some(),
+                "decoded event from envelope without `time` field is missing a timestamp"
+            );
+        })
+        .await;
+    }
+
+    #[tokio::test]
+    async fn decoder_independent_per_endpoint_codecs() {
+        // /event and /raw can be configured with completely different codecs and
+        // each endpoint applies only its own. Here /event uses JSON decoding (so a
+        // string `event` field decodes to fields) and /raw uses newline framing
+        // with a bytes decoder (so a multi-line body fans out to N events).
+        assert_source_compliance(&HTTP_PUSH_SOURCE_TAGS, async {
+            let (source, address, _guard) = source_with_codec(
+                codec_decoding(vector_lib::codecs::JsonDeserializerConfig::default().into()),
+                codec_full(
+                    Some(FramingConfig::NewlineDelimited(Default::default())),
+                    Some(DeserializerConfig::Bytes),
+                ),
+            )
+            .await;
+
+            // /event: JSON decoder turns the inner string into structured fields.
+            assert_eq!(
+                200,
+                post(
+                    address,
+                    "services/collector/event",
+                    r#"{"event":"{\"foo\":\"bar\"}"}"#
+                )
+                .await
+            );
+            // /raw: newline framing splits the body into three events.
+            assert_eq!(
+                200,
+                post(address, "services/collector/raw", "a\nb\nc").await
+            );
+
+            let events = collect_n(source, 4).await;
+            assert_eq!(events.len(), 4);
+
+            // The /event request produces one log with `foo=bar`.
+            let event_log = events
+                .iter()
+                .find(|e| e.as_log().contains("foo"))
+                .expect("expected /event request to produce a log with `foo` set");
+            assert_eq!(event_log.as_log()["foo"], "bar".into());
+
+            // The /raw request produces three logs whose messages are the lines.
+            let raw_messages: Vec<String> = events
+                .iter()
+                .filter(|e| !e.as_log().contains("foo"))
+                .map(|e| {
+                    e.as_log()[log_schema().message_key().unwrap().to_string()]
+                        .to_string_lossy()
+                        .into_owned()
+                })
+                .collect();
+            assert_eq!(raw_messages.len(), 3);
+            assert!(raw_messages.contains(&"a".to_string()));
+            assert!(raw_messages.contains(&"b".to_string()));
+            assert!(raw_messages.contains(&"c".to_string()));
+        })
+        .await;
+    }
+
+    /// End-to-end test for the second-stage VRL decoder on `/services/collector/event`.
+    ///
+    /// Validates the core use case from PR #25312: a VRL program decodes the
+    /// inner `event` payload *and* reads HEC envelope metadata injected before
+    /// decoding via `%splunk_hec.*` paths.
+    #[tokio::test]
+    async fn decoder_vrl_reads_envelope_metadata() {
+        assert_source_compliance(&HTTP_PUSH_SOURCE_TAGS, async {
+            let vrl_source = r#"
+                # Read envelope metadata injected before this VRL program runs.
+                .envelope_host = string!(%splunk_hec.host)
+                .envelope_sourcetype = string!(%splunk_hec.sourcetype)
+
+                # Decode the inner JSON payload (the bytes of the `event` string).
+                . = merge!(parse_json!(string!(.message)), .)
+            "#;
+
+            let event_codec = codec_decoding(
+                DeserializerConfig::Vrl(VrlDeserializerConfig {
+                    vrl: VrlDeserializerOptions {
+                        source: vrl_source.into(),
+                        timezone: None,
+                    },
+                }),
+            );
+
+            let (source, address, _guard) =
+                source_with_codec(event_codec, CodecConfig::default()).await;
+
+            // Send a HEC event whose `event` field is a JSON-encoded string.
+            // The VRL decoder should parse it and also read the envelope host/sourcetype.
+            let payload = r#"{"event":"{\"level\":\"info\",\"msg\":\"hello\"}","host":"splunk-host","sourcetype":"my-app"}"#;
+            assert_eq!(
+                200,
+                post(address, "services/collector/event", payload).await
+            );
+
+            let event = collect_n(source, 1).await.remove(0);
+            let log = event.as_log();
+
+            // Inner JSON decoded correctly.
+            assert_eq!(log["level"], "info".into());
+            assert_eq!(log["msg"], "hello".into());
+
+            // VRL read envelope metadata via %splunk_hec.* and wrote it to event fields.
+            assert_eq!(log["envelope_host"], "splunk-host".into());
+            assert_eq!(log["envelope_sourcetype"], "my-app".into());
+
+            // Post-decode splunk_hec metadata still applied (host, sourcetype).
+            assert_eq!(
+                log[log_schema().host_key().unwrap().to_string().as_str()],
+                "splunk-host".into()
+            );
+            assert_eq!(log[&super::SOURCETYPE], "my-app".into());
+        })
+        .await;
+    }
+
+    #[tokio::test]
+    async fn decoder_raw_endpoint_event_has_fallback_timestamp() {
+        // Regression: decoded /raw events must carry an ingest timestamp like the
+        // legacy raw_event path did via `insert_standard_vector_source_metadata`.
+        assert_source_compliance(&HTTP_PUSH_SOURCE_TAGS, async {
+            let (source, address, _guard) = source_with_codec(
+                CodecConfig::default(),
+                codec_full(None, Some(DeserializerConfig::Bytes)),
+            )
+            .await;
+            let body = "hello";
+            assert_eq!(200, post(address, "services/collector/raw", body).await);
+
+            let event = collect_n(source, 1).await.remove(0);
+            assert!(
+                event.as_log().get_timestamp().is_some(),
+                "decoded /raw event is missing a timestamp"
+            );
+        })
+        .await;
+    }
+
+    #[tokio::test]
+    async fn decoder_raw_endpoint_empty_decode_does_not_ack() {
+        // Regression: when the decoder produces zero events from a raw payload and
+        // acknowledgements are enabled, the response must not include an `ackId`
+        // because /services/collector/ack would otherwise report success for data
+        // Vector silently dropped.
+        let ack_config = HecAcknowledgementsConfig {
+            enabled: Some(true),
+            ..Default::default()
+        };
+        let (sender, _recv) = SourceSender::new_test_finalize(EventStatus::Delivered);
+        let (_guard, address) = next_addr();
+        let cx = SourceContext::new_test(sender, None);
+        tokio::spawn(async move {
+            SplunkConfig {
+                address,
+                token: Some(TOKEN.to_owned().into()),
+                valid_tokens: None,
+                tls: None,
+                acknowledgements: ack_config,
+                store_hec_token: false,
+                log_namespace: None,
+                keepalive: Default::default(),
+                event: CodecConfig::default(),
+                raw: codec_decoding(vector_lib::codecs::JsonDeserializerConfig::default().into()),
+            }
+            .build(cx)
+            .await
+            .unwrap()
+            .await
+            .unwrap()
+        });
+        wait_for_tcp(address).await;
+
+        let opts = SendWithOpts {
+            channel: Some(Channel::Header("guid")),
+            forwarded_for: None,
+        };
+        // A body the JSON decoder cannot parse - codec drops it, no events emitted.
+        let body = "not json {";
+        let response = send_with_response(address, "services/collector/raw", body, TOKEN, &opts)
+            .await
+            .json::<serde_json::Value>()
+            .await
+            .unwrap();
+
+        assert_eq!(response["code"].as_u64(), Some(0), "response: {response:?}");
+        assert!(
+            response.get("ackId").is_none(),
+            "expected no ackId in response when decoder produced zero events, got: {response:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn decoder_raw_endpoint_partial_decode_does_not_ack() {
+        // Regression: a request whose body decodes into some valid frames AND some
+        // dropped frames (e.g., `valid \n invalid \n valid` under newline framing
+        // with a JSON decoder) must not return an `ackId`. Otherwise
+        // /services/collector/ack reports success for data Vector silently dropped.
+        let ack_config = HecAcknowledgementsConfig {
+            enabled: Some(true),
+            ..Default::default()
+        };
+        let (sender, _recv) = SourceSender::new_test_finalize(EventStatus::Delivered);
+        let (_guard, address) = next_addr();
+        let cx = SourceContext::new_test(sender, None);
+        tokio::spawn(async move {
+            SplunkConfig {
+                address,
+                token: Some(TOKEN.to_owned().into()),
+                valid_tokens: None,
+                tls: None,
+                acknowledgements: ack_config,
+                store_hec_token: false,
+                log_namespace: None,
+                keepalive: Default::default(),
+                event: CodecConfig::default(),
+                raw: codec_full(
+                    Some(FramingConfig::NewlineDelimited(Default::default())),
+                    Some(vector_lib::codecs::JsonDeserializerConfig::default().into()),
+                ),
+            }
+            .build(cx)
+            .await
+            .unwrap()
+            .await
+            .unwrap()
+        });
+        wait_for_tcp(address).await;
+
+        let opts = SendWithOpts {
+            channel: Some(Channel::Header("guid")),
+            forwarded_for: None,
+        };
+        // Two valid JSON frames bracketing one invalid frame.
+        let body = "{\"valid\":1}\nnot json\n{\"valid\":2}";
+        let response = send_with_response(address, "services/collector/raw", body, TOKEN, &opts)
+            .await
+            .json::<serde_json::Value>()
+            .await
+            .unwrap();
+
+        assert_eq!(response["code"].as_u64(), Some(0), "response: {response:?}");
+        assert!(
+            response.get("ackId").is_none(),
+            "expected no ackId when the decoder dropped a frame mid-request, got: {response:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn decoder_event_endpoint_error_index_matches_envelope_not_fanout() {
+        // Regression: with the decoder fanning out one envelope into many events,
+        // `InvalidEventNumber` in error responses must still report the failing
+        // envelope's zero-indexed position, not the cumulative event count.
+        let (source, address, _guard) = source_with_codec(
+            codec_full(
+                Some(FramingConfig::NewlineDelimited(Default::default())),
+                Some(DeserializerConfig::Bytes),
+            ),
+            CodecConfig::default(),
+        )
+        .await;
+        // Envelope 0 has an `event` string with three lines: with newline framing
+        // and a bytes decoder, that fans out to three events. Envelope 1 omits
+        // `event`, so the decoded path returns `MissingEventField { event: 1 }`.
+        let body = "{\"event\":\"a\\nb\\nc\"}{\"foo\":\"bar\"}";
+
+        let opts = SendWithOpts {
+            channel: Some(Channel::Header("guid")),
+            forwarded_for: None,
+        };
+        let response =
+            send_with_response(address, "services/collector/event", body, TOKEN, &opts).await;
+        let status = response.status();
+        let body: serde_json::Value = response.json().await.unwrap();
+
+        assert_eq!(status.as_u16(), 400, "body: {body:?}");
+        assert_eq!(
+            body["invalid-event-number"].as_u64(),
+            Some(1),
+            "expected envelope index 1 (the failing envelope), not a fan-out event index. body: {body:?}"
+        );
+        // Drain the partially-emitted events so the source task doesn't block.
+        let _ = collect_n(source, 3).await;
+    }
+
+    #[test]
+    fn output_schema_definition_with_decoder_vector_namespace() {
+        let config = SplunkConfig {
+            log_namespace: Some(true),
+            event: codec_decoding(vector_lib::codecs::JsonDeserializerConfig::default().into()),
+            ..Default::default()
+        };
+        let definition = config
+            .outputs(LogNamespace::Vector)
+            .remove(0)
+            .schema_definition(true);
+
+        // The decoder's schema produces `Kind::json()` at the root, the source
+        // layers its envelope metadata fields on top, and the legacy log shape is
+        // unioned in (since /raw has no decoder and still emits legacy events) -
+        // contributing the `message` meaning at root.
+        let expected_definition =
+            Definition::new_with_default_metadata(Kind::json(), [LogNamespace::Vector])
+                .with_meaning(OwnedTargetPath::event_root(), meaning::MESSAGE)
+                .with_metadata_field(
+                    &owned_value_path!("vector", "source_type"),
+                    Kind::bytes(),
+                    None,
+                )
+                .with_metadata_field(
+                    &owned_value_path!("vector", "ingest_timestamp"),
+                    Kind::timestamp(),
+                    None,
+                )
+                .with_metadata_field(
+                    &owned_value_path!("splunk_hec", "host"),
+                    Kind::bytes(),
+                    Some("host"),
+                )
+                .with_metadata_field(
+                    &owned_value_path!("splunk_hec", "index"),
+                    Kind::bytes(),
+                    None,
+                )
+                .with_metadata_field(
+                    &owned_value_path!("splunk_hec", "source"),
+                    Kind::bytes(),
+                    Some("service"),
+                )
+                .with_metadata_field(
+                    &owned_value_path!("splunk_hec", "channel"),
+                    Kind::bytes(),
+                    None,
+                )
+                .with_metadata_field(
+                    &owned_value_path!("splunk_hec", "sourcetype"),
+                    Kind::bytes(),
+                    None,
+                );
+
+        assert_eq!(definition, Some(expected_definition));
+    }
+
     #[test]
     fn output_schema_definition_vector_namespace() {
         let config = SplunkConfig {
diff --git a/website/cue/reference/components/sources/generated/splunk_hec.cue b/website/cue/reference/components/sources/generated/splunk_hec.cue
index 519d879bf4200..d5fc8b762dc8a 100644
--- a/website/cue/reference/components/sources/generated/splunk_hec.cue
+++ b/website/cue/reference/components/sources/generated/splunk_hec.cue
@@ -72,6 +72,523 @@ generated: components: sources: splunk_hec: configuration: {
 		required: false
 		type: string: default: "0.0.0.0:8088"
 	}
+	event: {
+		description: """
+			Codec configuration applied to events received on `/services/collector/event`.
+
+			When `decoding` is set, Vector applies a second decoding pass after parsing the
+			HEC envelope. The envelope's `event` field is passed through the codec,
+			and a single envelope can fan out to multiple events. Decode failures are
+			swallowed and do not return an error to the Splunk client.
+
+			The VRL codec can access HEC envelope metadata, such as host, sourcetype, and,
+			channel, and the authentication token via `%splunk_hec.*` paths and
+			`get_secret!("splunk_hec_token")` before the program executes.
+			"""
+		required: false
+		type: object: options: {
+			decoding: {
+				description: """
+					Decoding configuration applied to the payload.
+
+					When unset, the endpoint preserves its existing per-endpoint default
+					behavior. When set, the endpoint-selected payload is processed through
+					`framing` and `decoding`, and a single payload can fan out to multiple
+					events.
+					"""
+				required: false
+				type: object: options: {
+					avro: {
+						description:   "Apache Avro-specific encoder options."
+						relevant_when: "codec = \"avro\""
+						required:      true
+						type: object: options: {
+							schema: {
+								description: """
+																				The Avro schema definition.
+																				**Note**: The following [`apache_avro::types::Value`] variants are *not* supported:
+																				* `Date`
+																				* `Decimal`
+																				* `Duration`
+																				* `Fixed`
+																				* `TimeMillis`
+																				"""
+								required: true
+								type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
+							}
+							strip_schema_id_prefix: {
+								description: """
+																				For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
+																				According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
+																				"""
+								required: true
+								type: bool: {}
+							}
+						}
+					}
+					codec: {
+						description: "The codec to use for decoding events."
+						required:    true
+						type: string: enum: {
+							avro: """
+																			Decodes the raw bytes as as an [Apache Avro][apache_avro] message.
+
+																			[apache_avro]: https://avro.apache.org/
+																			"""
+							bytes: "Uses the raw bytes as-is."
+							gelf: """
+																			Decodes the raw bytes as a [GELF][gelf] message.
+
+																			This codec is experimental for the following reason:
+
+																			The GELF specification is more strict than the actual Graylog receiver.
+																			Vector's decoder adheres more strictly to the GELF spec, with
+																			the exception that some characters such as `@`  are allowed in field names.
+
+																			Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
+																			by Graylog, and is much more relaxed than the GELF spec.
+
+																			Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
+																			the codec may continue to relax the enforcement of specification.
+
+																			[gelf]: https://docs.graylog.org/docs/gelf
+																			[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
+																			"""
+							influxdb: """
+																			Decodes the raw bytes as an [Influxdb Line Protocol][influxdb] message.
+
+																			[influxdb]: https://docs.influxdata.com/influxdb/cloud/reference/syntax/line-protocol
+																			"""
+							json: """
+																			Decodes the raw bytes as [JSON][json].
+
+																			[json]: https://www.json.org/
+																			"""
+							native: """
+																			Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
+
+																			This decoder can output all types of events (logs, metrics, traces).
+
+																			This codec is **[experimental][experimental]**.
+
+																			[vector_native_protobuf]: https://github.com/vectordotdev/vector/blob/master/lib/vector-core/proto/event.proto
+																			[experimental]: https://vector.dev/highlights/2022-03-31-native-event-codecs
+																			"""
+							native_json: """
+																			Decodes the raw bytes as [native JSON format][vector_native_json].
+
+																			This decoder can output all types of events (logs, metrics, traces).
+
+																			This codec is **[experimental][experimental]**.
+
+																			[vector_native_json]: https://github.com/vectordotdev/vector/blob/master/lib/codecs/tests/data/native_encoding/schema.cue
+																			[experimental]: https://vector.dev/highlights/2022-03-31-native-event-codecs
+																			"""
+							otlp: """
+																			Decodes the raw bytes as [OTLP (OpenTelemetry Protocol)][otlp] protobuf format.
+
+																			This decoder handles the three OTLP signal types: logs, metrics, and traces.
+																			It automatically detects which type of OTLP message is being decoded.
+
+																			[otlp]: https://opentelemetry.io/docs/specs/otlp/
+																			"""
+							protobuf: """
+																			Decodes the raw bytes as [protobuf][protobuf].
+
+																			[protobuf]: https://protobuf.dev/
+																			"""
+							syslog: """
+																			Decodes the raw bytes as a Syslog message.
+
+																			Decodes either as the [RFC 3164][rfc3164]-style format ("old" style) or the
+																			[RFC 5424][rfc5424]-style format ("new" style, includes structured data).
+
+																			[rfc3164]: https://www.ietf.org/rfc/rfc3164.txt
+																			[rfc5424]: https://www.ietf.org/rfc/rfc5424.txt
+																			"""
+							vrl: """
+																			Decodes the raw bytes as a string and passes them as input to a [VRL][vrl] program.
+
+																			[vrl]: https://vector.dev/docs/reference/vrl
+																			"""
+						}
+					}
+					gelf: {
+						description:   "GELF-specific decoding options."
+						relevant_when: "codec = \"gelf\""
+						required:      false
+						type: object: options: {
+							lossy: {
+								description: """
+																				Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+																				When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+																				[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+																				"""
+								required: false
+								type: bool: default: true
+							}
+							validation: {
+								description: "Configures the decoding validation mode."
+								required:    false
+								type: string: {
+									default: "strict"
+									enum: {
+										relaxed: """
+																							Uses more relaxed validation that skips strict GELF specification checks.
+
+																							This mode will not treat specification violations as errors, allowing the decoder
+																							to accept messages from sources that don't strictly follow the GELF spec.
+																							"""
+										strict: "Uses strict validation that closely follows the GELF spec."
+									}
+								}
+							}
+						}
+					}
+					influxdb: {
+						description:   "Influxdb-specific decoding options."
+						relevant_when: "codec = \"influxdb\""
+						required:      false
+						type: object: options: lossy: {
+							description: """
+																				Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+																				When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+																				[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+																				"""
+							required: false
+							type: bool: default: true
+						}
+					}
+					json: {
+						description:   "JSON-specific decoding options."
+						relevant_when: "codec = \"json\""
+						required:      false
+						type: object: options: lossy: {
+							description: """
+																				Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+																				When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+																				[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+																				"""
+							required: false
+							type: bool: default: true
+						}
+					}
+					native_json: {
+						description:   "Vector's native JSON-specific decoding options."
+						relevant_when: "codec = \"native_json\""
+						required:      false
+						type: object: options: lossy: {
+							description: """
+																				Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+																				When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+																				[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+																				"""
+							required: false
+							type: bool: default: true
+						}
+					}
+					protobuf: {
+						description:   "Protobuf-specific decoding options."
+						relevant_when: "codec = \"protobuf\""
+						required:      false
+						type: object: options: {
+							desc_file: {
+								description: """
+																				The path to the protobuf descriptor set file.
+
+																				This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
+
+																				You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																				"""
+								required: false
+								type: string: default: ""
+							}
+							message_type: {
+								description: "The name of the message type to use for serializing."
+								required:    false
+								type: string: {
+									default: ""
+									examples: ["package.Message"]
+								}
+							}
+							use_json_names: {
+								description: """
+																				Use JSON field names (camelCase) instead of protobuf field names (snake_case).
+
+																				When enabled, the deserializer will output fields using their JSON names as defined
+																				in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+
+																				This is useful when working with data that needs to be converted to JSON or
+																				when interfacing with systems that use JSON naming conventions.
+																				"""
+								required: false
+								type: bool: default: false
+							}
+						}
+					}
+					signal_types: {
+						description: """
+																Signal types to attempt parsing, in priority order.
+
+																The deserializer will try parsing in the order specified. This allows you to optimize
+																performance when you know the expected signal types. For example, if you only receive
+																traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
+
+																If not specified, defaults to trying all types in order: logs, metrics, traces.
+																Duplicate signal types are automatically removed while preserving order.
+																"""
+						relevant_when: "codec = \"otlp\""
+						required:      false
+						type: array: {
+							default: ["logs", "metrics", "traces"]
+							items: type: string: enum: {
+								logs:    "OTLP logs signal (ExportLogsServiceRequest)"
+								metrics: "OTLP metrics signal (ExportMetricsServiceRequest)"
+								traces:  "OTLP traces signal (ExportTraceServiceRequest)"
+							}
+						}
+					}
+					syslog: {
+						description:   "Syslog-specific decoding options."
+						relevant_when: "codec = \"syslog\""
+						required:      false
+						type: object: options: lossy: {
+							description: """
+																				Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+																				When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+																				[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+																				"""
+							required: false
+							type: bool: default: true
+						}
+					}
+					vrl: {
+						description:   "VRL-specific decoding options."
+						relevant_when: "codec = \"vrl\""
+						required:      true
+						type: object: options: {
+							source: {
+								description: """
+																				The [Vector Remap Language][vrl] (VRL) program to execute for each event.
+																				Note that the final contents of the `.` target will be used as the decoding result.
+																				Compilation error or use of 'abort' in a program will result in a decoding error.
+
+																				[vrl]: https://vector.dev/docs/reference/vrl
+																				"""
+								required: true
+								type: string: {}
+							}
+							timezone: {
+								description: """
+																				The name of the timezone to apply to timestamp conversions that do not contain an explicit
+																				time zone. The time zone name may be any name in the [TZ database][tz_database], or `local`
+																				to indicate system local time.
+
+																				If not set, `local` is used.
+
+																				[tz_database]: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+																				"""
+								required: false
+								type: string: examples: ["local", "America/New_York", "EST5EDT"]
+							}
+						}
+					}
+				}
+			}
+			framing: {
+				description: """
+					Framing configuration applied to the payload.
+
+					Only used when `decoding` is also set. Defaults to a per-codec choice
+					(typically `bytes`) that produces one event per payload.
+					"""
+				required: false
+				type: object: options: {
+					character_delimited: {
+						description:   "Options for the character delimited decoder."
+						relevant_when: "method = \"character_delimited\""
+						required:      true
+						type: object: options: {
+							delimiter: {
+								description: "The character that delimits byte sequences."
+								required:    true
+								type: ascii_char: {}
+							}
+							max_length: {
+								description: """
+																				The maximum length of the byte buffer.
+
+																				This length does *not* include the trailing delimiter.
+
+																				By default, there is no maximum length enforced. If events are malformed, this can lead to
+																				additional resource usage as events continue to be buffered in memory, and can potentially
+																				lead to memory exhaustion in extreme cases.
+
+																				If there is a risk of processing malformed data, such as logs with user-controlled input,
+																				consider setting the maximum length to a reasonably large value as a safety net. This
+																				ensures that processing is not actually unbounded.
+																				"""
+								required: false
+								type: uint: {}
+							}
+						}
+					}
+					chunked_gelf: {
+						description:   "Options for the chunked GELF decoder."
+						relevant_when: "method = \"chunked_gelf\""
+						required:      false
+						type: object: options: {
+							decompression: {
+								description: "Decompression configuration for GELF messages."
+								required:    false
+								type: string: {
+									default: "Auto"
+									enum: {
+										Auto: "Automatically detect the decompression method based on the magic bytes of the message."
+										Gzip: "Use Gzip decompression."
+										None: "Do not decompress the message."
+										Zlib: "Use Zlib decompression."
+									}
+								}
+							}
+							max_length: {
+								description: """
+																				The maximum length of a single GELF message, in bytes. Messages longer than this length will
+																				be dropped. If this option is not set, the decoder does not limit the length of messages and
+																				the per-message memory is unbounded.
+
+																				**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																				message, not to individual chunks.
+
+																				This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
+																				The message's payload is the concatenation of all the chunks' payloads.
+																				"""
+								required: false
+								type: uint: {}
+							}
+							pending_messages_limit: {
+								description: """
+																				The maximum number of pending incomplete messages. If this limit is reached, the decoder starts
+																				dropping chunks of new messages, ensuring the memory usage of the decoder's state is bounded.
+																				If this option is not set, the decoder does not limit the number of pending messages and the memory usage
+																				of its messages buffer can grow unbounded. This matches Graylog Server's behavior.
+																				"""
+								required: false
+								type: uint: {}
+							}
+							timeout_secs: {
+								description: """
+																				The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
+																				decoder drops all the received chunks of the timed out message.
+																				"""
+								required: false
+								type: float: default: 5.0
+							}
+						}
+					}
+					length_delimited: {
+						description:   "Options for the length delimited decoder."
+						relevant_when: "method = \"length_delimited\""
+						required:      true
+						type: object: options: {
+							length_field_is_big_endian: {
+								description: "Length field byte order (little or big endian)"
+								required:    false
+								type: bool: default: true
+							}
+							length_field_length: {
+								description: "Number of bytes representing the field length"
+								required:    false
+								type: uint: default: 4
+							}
+							length_field_offset: {
+								description: "Number of bytes in the header before the length field"
+								required:    false
+								type: uint: default: 0
+							}
+							max_frame_length: {
+								description: "Maximum frame length"
+								required:    false
+								type: uint: default: 8388608
+							}
+						}
+					}
+					max_frame_length: {
+						description:   "Maximum frame length"
+						relevant_when: "method = \"varint_length_delimited\""
+						required:      false
+						type: uint: default: 8388608
+					}
+					method: {
+						description: "The framing method."
+						required:    true
+						type: string: enum: {
+							bytes:               "Byte frames are passed through as-is according to the underlying I/O boundaries (for example, split between messages or stream segments)."
+							character_delimited: "Byte frames which are delimited by a chosen character."
+							chunked_gelf: """
+																			Byte frames which are chunked GELF messages.
+
+																			[chunked_gelf]: https://go2docs.graylog.org/current/getting_in_log_data/gelf.html
+																			"""
+							length_delimited:  "Byte frames which are prefixed by an unsigned big-endian 32-bit integer indicating the length."
+							newline_delimited: "Byte frames which are delimited by a newline character."
+							octet_counting: """
+																			Byte frames according to the [octet counting][octet_counting] format.
+
+																			[octet_counting]: https://tools.ietf.org/html/rfc6587#section-3.4.1
+																			"""
+							varint_length_delimited: """
+																			Byte frames which are prefixed by a varint indicating the length.
+																			This is compatible with protobuf's length-delimited encoding.
+																			"""
+						}
+					}
+					newline_delimited: {
+						description:   "Options for the newline delimited decoder."
+						relevant_when: "method = \"newline_delimited\""
+						required:      false
+						type: object: options: max_length: {
+							description: """
+																				The maximum length of the byte buffer.
+
+																				This length does *not* include the trailing delimiter.
+
+																				By default, there is no maximum length enforced. If events are malformed, this can lead to
+																				additional resource usage as events continue to be buffered in memory, and can potentially
+																				lead to memory exhaustion in extreme cases.
+
+																				If there is a risk of processing malformed data, such as logs with user-controlled input,
+																				consider setting the maximum length to a reasonably large value as a safety net. This
+																				ensures that processing is not actually unbounded.
+																				"""
+							required: false
+							type: uint: {}
+						}
+					}
+					octet_counting: {
+						description:   "Options for the octet counting decoder."
+						relevant_when: "method = \"octet_counting\""
+						required:      false
+						type: object: options: max_length: {
+							description: "The maximum length of the byte buffer."
+							required:    false
+							type: uint: {}
+						}
+					}
+				}
+			}
+		}
+	}
 	keepalive: {
 		description: "Configuration of HTTP server keepalive parameters."
 		required:    false
@@ -106,6 +623,519 @@ generated: components: sources: splunk_hec: configuration: {
 			}
 		}
 	}
+	raw: {
+		description: """
+			Codec configuration applied to events received on `/services/collector/raw`.
+
+			When `decoding` is set, the (decompressed) request body is fed through the
+			codec instead of being emitted as a single event. Decode failures are
+			swallowed and do not return an error to the Splunk client. When unset, the
+			endpoint preserves its existing behavior of one event per request body.
+			"""
+		required: false
+		type: object: options: {
+			decoding: {
+				description: """
+					Decoding configuration applied to the payload.
+
+					When unset, the endpoint preserves its existing per-endpoint default
+					behavior. When set, the endpoint-selected payload is processed through
+					`framing` and `decoding`, and a single payload can fan out to multiple
+					events.
+					"""
+				required: false
+				type: object: options: {
+					avro: {
+						description:   "Apache Avro-specific encoder options."
+						relevant_when: "codec = \"avro\""
+						required:      true
+						type: object: options: {
+							schema: {
+								description: """
+																				The Avro schema definition.
+																				**Note**: The following [`apache_avro::types::Value`] variants are *not* supported:
+																				* `Date`
+																				* `Decimal`
+																				* `Duration`
+																				* `Fixed`
+																				* `TimeMillis`
+																				"""
+								required: true
+								type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
+							}
+							strip_schema_id_prefix: {
+								description: """
+																				For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
+																				According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
+																				"""
+								required: true
+								type: bool: {}
+							}
+						}
+					}
+					codec: {
+						description: "The codec to use for decoding events."
+						required:    true
+						type: string: enum: {
+							avro: """
+																			Decodes the raw bytes as as an [Apache Avro][apache_avro] message.
+
+																			[apache_avro]: https://avro.apache.org/
+																			"""
+							bytes: "Uses the raw bytes as-is."
+							gelf: """
+																			Decodes the raw bytes as a [GELF][gelf] message.
+
+																			This codec is experimental for the following reason:
+
+																			The GELF specification is more strict than the actual Graylog receiver.
+																			Vector's decoder adheres more strictly to the GELF spec, with
+																			the exception that some characters such as `@`  are allowed in field names.
+
+																			Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
+																			by Graylog, and is much more relaxed than the GELF spec.
+
+																			Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
+																			the codec may continue to relax the enforcement of specification.
+
+																			[gelf]: https://docs.graylog.org/docs/gelf
+																			[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
+																			"""
+							influxdb: """
+																			Decodes the raw bytes as an [Influxdb Line Protocol][influxdb] message.
+
+																			[influxdb]: https://docs.influxdata.com/influxdb/cloud/reference/syntax/line-protocol
+																			"""
+							json: """
+																			Decodes the raw bytes as [JSON][json].
+
+																			[json]: https://www.json.org/
+																			"""
+							native: """
+																			Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
+
+																			This decoder can output all types of events (logs, metrics, traces).
+
+																			This codec is **[experimental][experimental]**.
+
+																			[vector_native_protobuf]: https://github.com/vectordotdev/vector/blob/master/lib/vector-core/proto/event.proto
+																			[experimental]: https://vector.dev/highlights/2022-03-31-native-event-codecs
+																			"""
+							native_json: """
+																			Decodes the raw bytes as [native JSON format][vector_native_json].
+
+																			This decoder can output all types of events (logs, metrics, traces).
+
+																			This codec is **[experimental][experimental]**.
+
+																			[vector_native_json]: https://github.com/vectordotdev/vector/blob/master/lib/codecs/tests/data/native_encoding/schema.cue
+																			[experimental]: https://vector.dev/highlights/2022-03-31-native-event-codecs
+																			"""
+							otlp: """
+																			Decodes the raw bytes as [OTLP (OpenTelemetry Protocol)][otlp] protobuf format.
+
+																			This decoder handles the three OTLP signal types: logs, metrics, and traces.
+																			It automatically detects which type of OTLP message is being decoded.
+
+																			[otlp]: https://opentelemetry.io/docs/specs/otlp/
+																			"""
+							protobuf: """
+																			Decodes the raw bytes as [protobuf][protobuf].
+
+																			[protobuf]: https://protobuf.dev/
+																			"""
+							syslog: """
+																			Decodes the raw bytes as a Syslog message.
+
+																			Decodes either as the [RFC 3164][rfc3164]-style format ("old" style) or the
+																			[RFC 5424][rfc5424]-style format ("new" style, includes structured data).
+
+																			[rfc3164]: https://www.ietf.org/rfc/rfc3164.txt
+																			[rfc5424]: https://www.ietf.org/rfc/rfc5424.txt
+																			"""
+							vrl: """
+																			Decodes the raw bytes as a string and passes them as input to a [VRL][vrl] program.
+
+																			[vrl]: https://vector.dev/docs/reference/vrl
+																			"""
+						}
+					}
+					gelf: {
+						description:   "GELF-specific decoding options."
+						relevant_when: "codec = \"gelf\""
+						required:      false
+						type: object: options: {
+							lossy: {
+								description: """
+																				Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+																				When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+																				[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+																				"""
+								required: false
+								type: bool: default: true
+							}
+							validation: {
+								description: "Configures the decoding validation mode."
+								required:    false
+								type: string: {
+									default: "strict"
+									enum: {
+										relaxed: """
+																							Uses more relaxed validation that skips strict GELF specification checks.
+
+																							This mode will not treat specification violations as errors, allowing the decoder
+																							to accept messages from sources that don't strictly follow the GELF spec.
+																							"""
+										strict: "Uses strict validation that closely follows the GELF spec."
+									}
+								}
+							}
+						}
+					}
+					influxdb: {
+						description:   "Influxdb-specific decoding options."
+						relevant_when: "codec = \"influxdb\""
+						required:      false
+						type: object: options: lossy: {
+							description: """
+																				Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+																				When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+																				[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+																				"""
+							required: false
+							type: bool: default: true
+						}
+					}
+					json: {
+						description:   "JSON-specific decoding options."
+						relevant_when: "codec = \"json\""
+						required:      false
+						type: object: options: lossy: {
+							description: """
+																				Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+																				When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+																				[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+																				"""
+							required: false
+							type: bool: default: true
+						}
+					}
+					native_json: {
+						description:   "Vector's native JSON-specific decoding options."
+						relevant_when: "codec = \"native_json\""
+						required:      false
+						type: object: options: lossy: {
+							description: """
+																				Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+																				When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+																				[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+																				"""
+							required: false
+							type: bool: default: true
+						}
+					}
+					protobuf: {
+						description:   "Protobuf-specific decoding options."
+						relevant_when: "codec = \"protobuf\""
+						required:      false
+						type: object: options: {
+							desc_file: {
+								description: """
+																				The path to the protobuf descriptor set file.
+
+																				This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
+
+																				You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																				"""
+								required: false
+								type: string: default: ""
+							}
+							message_type: {
+								description: "The name of the message type to use for serializing."
+								required:    false
+								type: string: {
+									default: ""
+									examples: ["package.Message"]
+								}
+							}
+							use_json_names: {
+								description: """
+																				Use JSON field names (camelCase) instead of protobuf field names (snake_case).
+
+																				When enabled, the deserializer will output fields using their JSON names as defined
+																				in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+
+																				This is useful when working with data that needs to be converted to JSON or
+																				when interfacing with systems that use JSON naming conventions.
+																				"""
+								required: false
+								type: bool: default: false
+							}
+						}
+					}
+					signal_types: {
+						description: """
+																Signal types to attempt parsing, in priority order.
+
+																The deserializer will try parsing in the order specified. This allows you to optimize
+																performance when you know the expected signal types. For example, if you only receive
+																traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
+
+																If not specified, defaults to trying all types in order: logs, metrics, traces.
+																Duplicate signal types are automatically removed while preserving order.
+																"""
+						relevant_when: "codec = \"otlp\""
+						required:      false
+						type: array: {
+							default: ["logs", "metrics", "traces"]
+							items: type: string: enum: {
+								logs:    "OTLP logs signal (ExportLogsServiceRequest)"
+								metrics: "OTLP metrics signal (ExportMetricsServiceRequest)"
+								traces:  "OTLP traces signal (ExportTraceServiceRequest)"
+							}
+						}
+					}
+					syslog: {
+						description:   "Syslog-specific decoding options."
+						relevant_when: "codec = \"syslog\""
+						required:      false
+						type: object: options: lossy: {
+							description: """
+																				Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+																				When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+																				[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+																				"""
+							required: false
+							type: bool: default: true
+						}
+					}
+					vrl: {
+						description:   "VRL-specific decoding options."
+						relevant_when: "codec = \"vrl\""
+						required:      true
+						type: object: options: {
+							source: {
+								description: """
+																				The [Vector Remap Language][vrl] (VRL) program to execute for each event.
+																				Note that the final contents of the `.` target will be used as the decoding result.
+																				Compilation error or use of 'abort' in a program will result in a decoding error.
+
+																				[vrl]: https://vector.dev/docs/reference/vrl
+																				"""
+								required: true
+								type: string: {}
+							}
+							timezone: {
+								description: """
+																				The name of the timezone to apply to timestamp conversions that do not contain an explicit
+																				time zone. The time zone name may be any name in the [TZ database][tz_database], or `local`
+																				to indicate system local time.
+
+																				If not set, `local` is used.
+
+																				[tz_database]: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+																				"""
+								required: false
+								type: string: examples: ["local", "America/New_York", "EST5EDT"]
+							}
+						}
+					}
+				}
+			}
+			framing: {
+				description: """
+					Framing configuration applied to the payload.
+
+					Only used when `decoding` is also set. Defaults to a per-codec choice
+					(typically `bytes`) that produces one event per payload.
+					"""
+				required: false
+				type: object: options: {
+					character_delimited: {
+						description:   "Options for the character delimited decoder."
+						relevant_when: "method = \"character_delimited\""
+						required:      true
+						type: object: options: {
+							delimiter: {
+								description: "The character that delimits byte sequences."
+								required:    true
+								type: ascii_char: {}
+							}
+							max_length: {
+								description: """
+																				The maximum length of the byte buffer.
+
+																				This length does *not* include the trailing delimiter.
+
+																				By default, there is no maximum length enforced. If events are malformed, this can lead to
+																				additional resource usage as events continue to be buffered in memory, and can potentially
+																				lead to memory exhaustion in extreme cases.
+
+																				If there is a risk of processing malformed data, such as logs with user-controlled input,
+																				consider setting the maximum length to a reasonably large value as a safety net. This
+																				ensures that processing is not actually unbounded.
+																				"""
+								required: false
+								type: uint: {}
+							}
+						}
+					}
+					chunked_gelf: {
+						description:   "Options for the chunked GELF decoder."
+						relevant_when: "method = \"chunked_gelf\""
+						required:      false
+						type: object: options: {
+							decompression: {
+								description: "Decompression configuration for GELF messages."
+								required:    false
+								type: string: {
+									default: "Auto"
+									enum: {
+										Auto: "Automatically detect the decompression method based on the magic bytes of the message."
+										Gzip: "Use Gzip decompression."
+										None: "Do not decompress the message."
+										Zlib: "Use Zlib decompression."
+									}
+								}
+							}
+							max_length: {
+								description: """
+																				The maximum length of a single GELF message, in bytes. Messages longer than this length will
+																				be dropped. If this option is not set, the decoder does not limit the length of messages and
+																				the per-message memory is unbounded.
+
+																				**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																				message, not to individual chunks.
+
+																				This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
+																				The message's payload is the concatenation of all the chunks' payloads.
+																				"""
+								required: false
+								type: uint: {}
+							}
+							pending_messages_limit: {
+								description: """
+																				The maximum number of pending incomplete messages. If this limit is reached, the decoder starts
+																				dropping chunks of new messages, ensuring the memory usage of the decoder's state is bounded.
+																				If this option is not set, the decoder does not limit the number of pending messages and the memory usage
+																				of its messages buffer can grow unbounded. This matches Graylog Server's behavior.
+																				"""
+								required: false
+								type: uint: {}
+							}
+							timeout_secs: {
+								description: """
+																				The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
+																				decoder drops all the received chunks of the timed out message.
+																				"""
+								required: false
+								type: float: default: 5.0
+							}
+						}
+					}
+					length_delimited: {
+						description:   "Options for the length delimited decoder."
+						relevant_when: "method = \"length_delimited\""
+						required:      true
+						type: object: options: {
+							length_field_is_big_endian: {
+								description: "Length field byte order (little or big endian)"
+								required:    false
+								type: bool: default: true
+							}
+							length_field_length: {
+								description: "Number of bytes representing the field length"
+								required:    false
+								type: uint: default: 4
+							}
+							length_field_offset: {
+								description: "Number of bytes in the header before the length field"
+								required:    false
+								type: uint: default: 0
+							}
+							max_frame_length: {
+								description: "Maximum frame length"
+								required:    false
+								type: uint: default: 8388608
+							}
+						}
+					}
+					max_frame_length: {
+						description:   "Maximum frame length"
+						relevant_when: "method = \"varint_length_delimited\""
+						required:      false
+						type: uint: default: 8388608
+					}
+					method: {
+						description: "The framing method."
+						required:    true
+						type: string: enum: {
+							bytes:               "Byte frames are passed through as-is according to the underlying I/O boundaries (for example, split between messages or stream segments)."
+							character_delimited: "Byte frames which are delimited by a chosen character."
+							chunked_gelf: """
+																			Byte frames which are chunked GELF messages.
+
+																			[chunked_gelf]: https://go2docs.graylog.org/current/getting_in_log_data/gelf.html
+																			"""
+							length_delimited:  "Byte frames which are prefixed by an unsigned big-endian 32-bit integer indicating the length."
+							newline_delimited: "Byte frames which are delimited by a newline character."
+							octet_counting: """
+																			Byte frames according to the [octet counting][octet_counting] format.
+
+																			[octet_counting]: https://tools.ietf.org/html/rfc6587#section-3.4.1
+																			"""
+							varint_length_delimited: """
+																			Byte frames which are prefixed by a varint indicating the length.
+																			This is compatible with protobuf's length-delimited encoding.
+																			"""
+						}
+					}
+					newline_delimited: {
+						description:   "Options for the newline delimited decoder."
+						relevant_when: "method = \"newline_delimited\""
+						required:      false
+						type: object: options: max_length: {
+							description: """
+																				The maximum length of the byte buffer.
+
+																				This length does *not* include the trailing delimiter.
+
+																				By default, there is no maximum length enforced. If events are malformed, this can lead to
+																				additional resource usage as events continue to be buffered in memory, and can potentially
+																				lead to memory exhaustion in extreme cases.
+
+																				If there is a risk of processing malformed data, such as logs with user-controlled input,
+																				consider setting the maximum length to a reasonably large value as a safety net. This
+																				ensures that processing is not actually unbounded.
+																				"""
+							required: false
+							type: uint: {}
+						}
+					}
+					octet_counting: {
+						description:   "Options for the octet counting decoder."
+						relevant_when: "method = \"octet_counting\""
+						required:      false
+						type: object: options: max_length: {
+							description: "The maximum length of the byte buffer."
+							required:    false
+							type: uint: {}
+						}
+					}
+				}
+			}
+		}
+	}
 	store_hec_token: {
 		description: """
 			Whether or not to forward the Splunk HEC authentication token with events.

From 17a720cc90ebbbab9051eb5a2479a51eddf2760d Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 7 May 2026 12:23:08 -0400
Subject: [PATCH 208/326] chore(ci): remove release-flags.sh (#24828)

* chore(dev): add codegen-units = 1 in Cargo.toml

* chore(ci): remove release-flags.sh

* Remove compilation-timings.yml

* Use thin lto in cross.yml to prevent OOM/timeout
---
 .github/workflows/cross.yml          |  1 +
 .github/workflows/publish.yml        |  2 --
 Cargo.toml                           |  5 ++---
 Cross.toml                           |  1 +
 scripts/environment/prepare.sh       |  4 ----
 scripts/environment/release-flags.sh | 14 --------------
 tests/e2e/Dockerfile                 |  1 -
 7 files changed, 4 insertions(+), 24 deletions(-)
 delete mode 100755 scripts/environment/release-flags.sh

diff --git a/.github/workflows/cross.yml b/.github/workflows/cross.yml
index ec0a7f33f7076..7b66b7ccbf0a3 100644
--- a/.github/workflows/cross.yml
+++ b/.github/workflows/cross.yml
@@ -18,6 +18,7 @@ jobs:
     timeout-minutes: 45
     env:
       CARGO_INCREMENTAL: 0
+      CARGO_PROFILE_RELEASE_LTO: thin # fat LTO OOMs/timeouts on standard 16GB runners; thin is sufficient to verify linking
     strategy:
       matrix:
         target:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2f313a30459f7..0ce890aa849a0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -21,8 +21,6 @@ env:
   DISABLE_MOLD: true
   DEBIAN_FRONTEND: noninteractive
   CONTAINER_TOOL: docker
-  CARGO_PROFILE_RELEASE_LTO: fat
-  CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 1
   CHANNEL: ${{ inputs.channel }}
 
 jobs:
diff --git a/Cargo.toml b/Cargo.toml
index 5810b5940ddcc..d46d60c8fac24 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,11 +39,10 @@ name = "vector_api"
 path = "tests/vector_api/lib.rs"
 required-features = ["vector-api-tests"]
 
-# CI-based builds use full release optimization. See scripts/environment/release-flags.sh.
-# This results in roughly a 5% reduction in performance when compiling locally vs when
-# compiled via the CI pipeline.
 [profile.release]
 debug = false # Do not include debug symbols in the executable.
+codegen-units = 1
+lto = "fat"
 
 [profile.bench]
 debug = true
diff --git a/Cross.toml b/Cross.toml
index 96e97d7ff64dc..958c7fd7780e6 100644
--- a/Cross.toml
+++ b/Cross.toml
@@ -2,6 +2,7 @@
 passthrough = [
     "BUILD_DIR",
     "CARGO_INCREMENTAL",
+    "CARGO_PROFILE_RELEASE_LTO",
     "CARGO_PROFILE_RELEASE_OPT_LEVEL",
     "CARGO_PROFILE_RELEASE_CODEGEN_UNITS",
     "RUST_BACKTRACE",
diff --git a/scripts/environment/prepare.sh b/scripts/environment/prepare.sh
index b5c63c02f9d69..c08fb4499d49b 100755
--- a/scripts/environment/prepare.sh
+++ b/scripts/environment/prepare.sh
@@ -55,7 +55,6 @@ ALL_MODULES=(
   markdownlint-cli2
   prettier
   datadog-ci
-  release-flags  # Not a tool - sources release-flags.sh to set CI env vars
   vdev
 )
 
@@ -230,9 +229,6 @@ fi
 
 install=(install)
 if contains_module rustup; then
-  # shellcheck source=scripts/environment/release-flags.sh
-  . "${SCRIPT_DIR}"/release-flags.sh
-
   ensure_active_toolchain_is_installed
 
   if [ "${require_binstall}" = "true" ]; then
diff --git a/scripts/environment/release-flags.sh b/scripts/environment/release-flags.sh
deleted file mode 100755
index 4115517c437e1..0000000000000
--- a/scripts/environment/release-flags.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-set -e -o verbose
-
-# We want to ensure we're building using "full" release capabilities when possible, which
-# means full LTO and a single codegen unit.  This maximizes performance of the resulting
-# code, but increases compilation time.  We only set this if we're in CI _and_ we haven't
-# been instructed to use the debug profile (via PROFILE environment variable).
-if [[ "${CI-}" == "true" && "${PROFILE-}" != "debug" ]]; then
-  {
-    echo "CARGO_PROFILE_RELEASE_LTO=fat";
-    echo "CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1";
-    echo "CARGO_PROFILE_RELEASE_DEBUG=false";
-  } >> "${GITHUB_ENV}"
-fi
diff --git a/tests/e2e/Dockerfile b/tests/e2e/Dockerfile
index 1e7cda7fc696b..c7c438d02002b 100644
--- a/tests/e2e/Dockerfile
+++ b/tests/e2e/Dockerfile
@@ -25,7 +25,6 @@ COPY tests/data/ca/certs /certs
 COPY scripts/environment/install-protoc.sh /
 COPY scripts/environment/prepare.sh /
 COPY scripts/environment/binstall.sh /
-COPY scripts/environment/release-flags.sh /
 
 WORKDIR /vector
 COPY rust-toolchain.toml .

From 256b8fa98627f37f26d6e11a84bfeda44981fc21 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 7 May 2026 13:52:19 -0400
Subject: [PATCH 209/326] fix(tests): skip Windows UDP-excluded ports in
 next_addr_for_ip (#25386)

* fix(tests): skip Windows UDP-excluded ports in next_addr_for_ip

* fmt

* Remove alias
---
 src/test_util/addr.rs | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/test_util/addr.rs b/src/test_util/addr.rs
index 4654858cd99fc..d7d5be7afbfbb 100644
--- a/src/test_util/addr.rs
+++ b/src/test_util/addr.rs
@@ -8,6 +8,8 @@
 //!
 //! This ensures no race window between port allocation and registration.
 
+#[cfg(windows)]
+use std::net::UdpSocket;
 use std::{
     collections::HashSet,
     net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr, TcpListener as StdTcpListener},
@@ -79,6 +81,14 @@ pub fn next_addr_for_ip(ip: IpAddr) -> (PortGuard, SocketAddr) {
             continue;
         }
 
+        // On Windows, certain ports are in OS-excluded ranges (e.g. set by Hyper-V/WSL).
+        // TCP bind(0) may return such a port, but UDP bind to the same port will fail with
+        // WSAEACCES (10013). Probe with a UDP socket and retry if it is excluded.
+        #[cfg(windows)]
+        if UdpSocket::bind(addr).is_err() {
+            continue;
+        }
+
         // Port is unique, mark it as reserved BEFORE dropping the listener
         // This ensures no race window between dropping listener and registering the port
         reserved.insert(port);

From 8d83e1790cf3337f8db56c0920e629866e7a1362 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 7 May 2026 18:03:02 +0000
Subject: [PATCH 210/326] chore(deps): bump hickory-net from 0.26.0 to 0.26.1
 (#25389)

Bumps [hickory-net](https://github.com/hickory-dns/hickory-dns) from 0.26.0 to 0.26.1.
- [Release notes](https://github.com/hickory-dns/hickory-dns/releases)
- [Changelog](https://github.com/hickory-dns/hickory-dns/blob/main/CHANGELOG.md)
- [Commits](https://github.com/hickory-dns/hickory-dns/compare/v0.26.0...v0.26.1)

---
updated-dependencies:
- dependency-name: hickory-net
  dependency-version: 0.26.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 641e0da9e4541..0fffdcba1ec15 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2784,7 +2784,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.61.0",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -3765,7 +3765,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.0",
- "windows-sys 0.61.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -5174,9 +5174,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "hickory-net"
-version = "0.26.0"
+version = "0.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c61c8db47fae51ba9f8f2a2748bd87542acfbe22f2ec9cf9c8ec72d1ee6e9a6"
+checksum = "e2295ed2f9c31e471e1428a8f88a3f0e1f4b27c15049592138d1eebe9c35b183"
 dependencies = [
  "async-trait",
  "cfg-if",
@@ -5671,7 +5671,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.0",
+ "socket2 0.5.10",
  "system-configuration 0.6.1",
  "tokio",
  "tower-service",
@@ -8727,7 +8727,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22505a5c94da8e3b7c2996394d1c933236c4d743e81a410bcca4e6989fc066a4"
 dependencies = [
  "bytes",
- "heck 0.5.0",
+ "heck 0.4.1",
  "itertools 0.12.1",
  "log",
  "multimap",
@@ -8747,7 +8747,7 @@ version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
- "heck 0.5.0",
+ "heck 0.4.1",
  "itertools 0.14.0",
  "log",
  "multimap",
@@ -9993,7 +9993,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -10872,7 +10872,7 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
- "heck 0.5.0",
+ "heck 0.4.1",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
@@ -10884,7 +10884,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54254b8531cafa275c5e096f62d48c81435d1015405a91198ddb11e967301d40"
 dependencies = [
- "heck 0.5.0",
+ "heck 0.4.1",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
@@ -11521,10 +11521,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.2",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]

From bbde98b342fff4d69ccc49d537feda9572c9df79 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 8 May 2026 10:20:34 -0400
Subject: [PATCH 211/326] fix(ci): fix LTO settings after release-flags.sh
 removal (#25393)

fix(ci): restore LTO settings for k8s and regression detector after release-flags.sh removal
---
 .github/workflows/k8s_e2e.yml    | 1 +
 .github/workflows/regression.yml | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index 6b65985cc6eb6..53f811f0a2a35 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -73,6 +73,7 @@ jobs:
     # cargo-deb requires a release build, but we don't need optimizations for tests
     env:
       CARGO_PROFILE_RELEASE_OPT_LEVEL: 0
+      CARGO_PROFILE_RELEASE_LTO: thin # fat LTO OOMs/timeouts on standard 16GB runners; thin is sufficient to verify linking
       CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 256
       CARGO_INCREMENTAL: 0
       DISABLE_MOLD: true
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index d30d74fae716a..0c234590fb702 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -188,7 +188,7 @@ jobs:
   build-baseline:
     name: Build baseline Vector container
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    timeout-minutes: 60
     needs:
       - should-run-gate
       - resolve-inputs
@@ -231,7 +231,7 @@ jobs:
   build-comparison:
     name: Build comparison Vector container
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    timeout-minutes: 60
     needs:
       - should-run-gate
       - resolve-inputs

From cdb27e859b95fda129cfbed5e2b078af0f3c42c9 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Fri, 8 May 2026 10:36:09 -0400
Subject: [PATCH 212/326] chore(dev): kill Ruby and port release scripts to
 native vdev (#25379)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* chore(dev): replace Ruby release flow with internal vdev functions

Ports the two remaining Ruby release scripts to native Rust and folds
the resulting `vdev release` surface down to the bits that are actually
called.

- `scripts/generate-release-cue.rb` (467 lines) is replaced by a
  `pub(super) fn run` in `vdev/src/commands/release/generate_cue.rs`.
  The function walks `git log v<last>...HEAD` (three-dot symmetric
  difference, so `--cherry-pick --right-only` filters out commits
  already released on a patch branch — the Ruby form), parses the
  conventional-commit messages, processes `changelog.d/*.md` fragments
  into the release CUE schema, and runs `cue fmt`. It is called only
  from `vdev release prepare` (no standalone CLI subcommand).

- `scripts/release-commit.rb`, `vdev release commit`, `vdev release push`,
  `vdev build release-cue`, and the corresponding Makefile targets
  (`make release`, `release-commit`, `release-push`) are removed: none
  of them were called by CI workflows, scripts, or issue templates, and
  the original `release-commit.rb` had been broken for some time
  (pointing at `docs/reference/releases`, a directory that no longer
  exists). Manual operator tagging happens via `git tag` directly per
  the release issue templates.

- The `scripts/util/*.rb` library, `Gemfile`, `Gemfile.lock`, and the
  `Gemfile` COPY in `scripts/environment/Dockerfile` are deleted.
  `ruby` itself stays in the bootstrap scripts and `vdev/README.md` —
  `scripts/check-events` is the last remaining Ruby script and gets
  ported in a follow-up commit.

- Docs, issue templates, the `changes.yml` workflow filter, and
  `website/README.md` are repointed at `cargo vdev release prepare`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(dev): port scripts/check-events to vdev via syn AST

Replaces the last Ruby script in the repo (515 lines) with a native
`vdev check events` that walks Rust source via `syn`'s AST instead of
regex-scraping. The validation rules from `docs/specs/instrumentation.md`
are preserved unchanged; behaviour against the current tree matches
the Ruby script (`0 error(s)` on master, identical reports on a
synthetic fixture exercising every rule branch).

Implementation notes:

- Structural scanning (struct fields, impl-block trait/event names)
  uses syn visitors. Macro argument parsing (`counter!(...)`,
  `trace!(...)`, etc.) uses small targeted regexes on the macro's
  already-tokenised input. Use-counting (`emit!(EventName)` /
  `register!(...)`) uses one regex pass over the raw source because
  syn does not descend into the bodies of opaque macros like
  `tokio::select!` where some emit sites live.

- `## skip check-validity-events ##` is added to
  `lib/vector-common/src/internal_event/component_events_dropped.rs`.
  That impl block is the foundation type the `registered_event!` macro
  abstracts over, so it has to implement `RegisterInternalEvent` by
  hand. The Ruby script's regex never matched its multi-line `impl`
  header and so silently let it through; the AST scanner sees it
  correctly and the existing skip-marker mechanism makes the intent
  explicit.

- `proc-macro2`, `quote`, and `syn` are declared as workspace deps with
  default-features off; vdev opts into the syn `full`, `visit`,
  `extra-traits`, `printing`, `parsing` features and proc-macro2's
  `span-locations` locally. These features are already pulled in
  transitively by Vector's existing dep graph (verified via
  `cargo tree -p vector`), so the additions do not change Vector's
  production binary.

- 32 unit tests are added: 14 covering the macro/log/metric arg
  parsers (literal-first, named-field, variable, trailing-literal,
  `%`-capture, message format checks, comma-arg nesting,
  `CamelCase → snake_case`) and 18 driving every branch of
  `validate_event` with synthetic `Event` structs.

- Differential test (run by hand against a worktree with a synthetic
  fixture file): `ruby scripts/check-events` and `cargo vdev check
  events` flagged the same eight events plus the same duplicate pair;
  outputs differed only in sort order and a Ruby string-escape
  artefact.

The bootstrap scripts (`scripts/environment/bootstrap-{macos,
ubuntu-24.04}.sh`), `vdev/README.md`, and `.ruby-version` lose their
Ruby references — there is no Ruby left in the repo to install.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(dev): make check-events robust to CWD and trailing-literal messages

Two bugs caught in code review of `vdev/src/commands/check/events.rs`:

1. The native check globbed `src/**/*.rs` and `lib/**/*.rs` relative to
   the caller's CWD. The Ruby script wrapper used to chdir to the repo
   root, so this silently regressed: running `vdev check events` from
   anywhere outside the repo root produced `0 error(s)` without
   scanning anything.

   Fix: chdir to `paths::find_repo_root()` at the top of `Cli::exec`,
   matching the previous wrapper's behaviour. Running from a subdir
   now scans correctly; running from outside the repo errors out with
   a useful message.

2. `parse_log_args` claimed the first bare positional expression as
   the log message before scanning the rest of the args for a string
   literal. For real Vector code that uses
   `warn!(%error, "Failed to flush.")`, the literal is the actual
   message but the function never reached it — so the message-format
   check (capital + trailing period) silently never fired on those
   sites.

   Fix: walk all args once, classify each as a literal candidate,
   `message =` named-field candidate, bare-positional candidate, or
   plain parameter, then pick the message in that priority order.
   Adds a regression test covering the bare-then-literal pattern.

Both bugs were flagged by Codex code review on PR #25379.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(dev): cover nested log calls and dedup against released metadata

Three review findings on the check-events / release-cue ports:

- `vdev check events` only ran its log-message format check via the
  syn AST visitor, which does not descend into the bodies of opaque
  outer macros like `tokio::select!` / `cfg_if!`. Log calls nested
  inside those macros were silently exempt. Replaces the AST format
  check with a raw-text pass that finds every `(trace|debug|info|
  warn|error)!(...)` invocation regardless of nesting. Adds two unit
  tests against the new pass — including one that asserts a violation
  inside a synthetic `tokio::select!` block is still reported.

- `generate_cue::run` no longer relies on `--cherry-pick --right-only`
  alone to dedupe commits against earlier releases — that flag only
  filters patch-id-equivalent commits, so a conflict-resolved cherry-
  pick (different SHA, same PR) could re-appear in the next release
  CUE. Adds a `collect_released_identifiers` pass that pulls the SHA
  and PR-number sets out of every existing
  `website/cue/reference/releases/*.cue`, then filters the fetched
  commit set against both. Two unit tests cover the extractor.

- `Commit::validate` now bails when the conventional-commit parser
  could not classify the subject (`type: None`). Previously such
  commits passed validation and landed in the published release CUE
  with a null type — a malformed PR title would silently ship.

Also factors `parse_log_args` so it shares one `&str` implementation
with the new raw-text pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(dev): apply rustfmt over previous fix

Pre-push hook reformatting on the format-check + dedup fixes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(dev): replace map().unwrap_or(false) in check-events test helper

`cargo clippy -p vdev --all-targets` flagged two map_unwrap_or lints
in the test-only `check()` helper. Identical pattern to fixes already
applied in production code; just missed when test cases were added
later.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(dev): clean up vdev check-events module

Drop the pedantic clippy allows the file was carrying and refactor to
satisfy them: rename Event fields whose `_event` suffix tripped
struct_field_names, group the three skip flags into a SkipFlags
substruct (struct_excessive_bools), and split validate_event and
Cli::exec into smaller helpers (too_many_lines).

Also remove a redundant `name_ends_with` wrapper that just called
str::ends_with, and merge the parse_log_args TokenStream wrapper into
its `&str` body. One callsite was already operating on stringified
tokens, so it was doing a wasted parse-and-restringify round trip.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(deps): use convert_case for snake-casing in vdev check-events

Replace the bespoke `camel_to_snake` regex helper in vdev's check-events
with `convert_case::Casing::to_case`. Promote convert_case to a
workspace dep so vdev and vector-config-common share the same version
declaration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: drop outdated comment on workspace proc-macro2/quote/syn deps

The comment claimed declaring these at the workspace level prevented
vdev's extra `syn` features from unifying into Vector's production
build. That's not what workspace declarations do — `cargo` unifies
features across the resolved dep graph regardless. The reason vdev's
features don't reach the `vector` package is simply that vdev isn't a
dep of `vector`. The comment was also stale: these crates are now
direct deps of vector-config-macros, vector-config-common, and
vector-common-macros, not just vdev.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(dev): accept uppercase release scopes in conventional-commit parser

The release-CUE generator rejected commit subjects with uppercase scope
characters (e.g. `fix(ARC): ...`), even though `.github/workflows/semantic.yml`
explicitly lists `ARC` as a valid scope. A PR title that passed semantic
validation could therefore block `release prepare` later. Widen the
scope character class to allow uppercase letters and add a regression
test.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(dev): track angle brackets in macro-arg splitter

split_comma_args only tracked `()[]{}` nesting, so a registered_event!
handle field with a generic type containing a comma would be split
mid-type. The existing src/internal_events/filter.rs field
`Registered<ComponentEventsDropped<'static, INTENTIONAL>> = register!(...)`
broke before the assignment, hiding the register! emission and causing
spurious missing-log/counter errors for FilterEventsDropped.

Track angle depth as a separate counter and only decrement `>` when
there is a matching `<`, so the `>` in `key => value` tag pairs (used
inside counter! args) stays unaffected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/ISSUE_TEMPLATE/minor-release.md       |    2 +-
 .github/ISSUE_TEMPLATE/patch-release.md       |    6 +-
 .github/workflows/changes.yml                 |    1 -
 .ruby-version                                 |    1 -
 Cargo.lock                                    |    4 +
 Cargo.toml                                    |    4 +
 Makefile                                      |   11 -
 docs/DOCUMENTING.md                           |    9 +-
 .../component_events_dropped.rs               |    3 +
 lib/vector-config-common/Cargo.toml           |    2 +-
 scripts/Gemfile                               |   10 -
 scripts/Gemfile.lock                          |   22 -
 scripts/check-events                          |  515 -----
 scripts/check_changelog_fragments.sh          |    2 +-
 scripts/environment/Dockerfile                |    2 -
 scripts/environment/bootstrap-macos.sh        |   10 +-
 scripts/environment/bootstrap-ubuntu-24.04.sh |    1 -
 scripts/generate-release-cue.rb               |  467 -----
 scripts/release-commit.rb                     |  121 --
 scripts/util/commit.rb                        |  166 --
 scripts/util/conventional_commit.rb           |   97 -
 scripts/util/git_log_commit.rb                |  122 --
 scripts/util/printer.rb                       |   74 -
 scripts/util/release.rb                       |   39 -
 scripts/util/version.rb                       |   45 -
 vdev/Cargo.toml                               |    6 +
 vdev/README.md                                |    1 -
 vdev/src/commands/build/mod.rs                |    5 -
 vdev/src/commands/check/events.rs             | 1744 +++++++++++++++++
 vdev/src/commands/check/mod.rs                |    6 +-
 vdev/src/commands/release/generate_cue.rs     |  825 ++++++++
 vdev/src/commands/release/mod.rs              |   13 +-
 vdev/src/commands/release/prepare.rs          |   27 +-
 vdev/src/commands/release/push.rs             |   31 -
 vdev/src/utils/git.rs                         |   20 +-
 website/README.md                             |    8 +-
 36 files changed, 2616 insertions(+), 1806 deletions(-)
 delete mode 100644 .ruby-version
 delete mode 100644 scripts/Gemfile
 delete mode 100644 scripts/Gemfile.lock
 delete mode 100755 scripts/check-events
 delete mode 100755 scripts/generate-release-cue.rb
 delete mode 100755 scripts/release-commit.rb
 delete mode 100644 scripts/util/commit.rb
 delete mode 100644 scripts/util/conventional_commit.rb
 delete mode 100644 scripts/util/git_log_commit.rb
 delete mode 100644 scripts/util/printer.rb
 delete mode 100644 scripts/util/release.rb
 delete mode 100644 scripts/util/version.rb
 create mode 100644 vdev/src/commands/check/events.rs
 create mode 100644 vdev/src/commands/release/generate_cue.rs
 delete mode 100644 vdev/src/commands/release/push.rs

diff --git a/.github/ISSUE_TEMPLATE/minor-release.md b/.github/ISSUE_TEMPLATE/minor-release.md
index f295a03555512..1c1172b1552ba 100644
--- a/.github/ISSUE_TEMPLATE/minor-release.md
+++ b/.github/ISSUE_TEMPLATE/minor-release.md
@@ -45,7 +45,7 @@ Automated steps include:
 - Pin VRL to latest released version rather than `main`
 - Check if there is a newer version of [Alpine](https://alpinelinux.org/releases/) or [Debian](https://www.debian.org/releases/) available to update the release images in
       `distribution/docker/`. Update if so.
-- Run `cargo vdev build release-cue` to generate a new cue file for the release
+- Generate a new cue file for the release in `website/cue/reference/releases/`
   - Copy VRL changelogs from the VRL version in the last Vector release as a new changelog entry
         ([example](https://github.com/vectordotdev/vector/blob/9c67bba358195f5018febca2f228dfcb2be794b5/website/cue/reference/releases/0.41.0.cue#L33-L64))
 - Update version number in `website/cue/reference/administration/interfaces/kubectl.cue`
diff --git a/.github/ISSUE_TEMPLATE/patch-release.md b/.github/ISSUE_TEMPLATE/patch-release.md
index 4a36f7255e36b..743d928ba70e7 100644
--- a/.github/ISSUE_TEMPLATE/patch-release.md
+++ b/.github/ISSUE_TEMPLATE/patch-release.md
@@ -24,8 +24,10 @@ export PREP_BRANCH=prepare-v-0-"${CURRENT_MINOR_VERSION}"-"${NEW_PATCH_VERSION}"
 - [ ] Cherry-pick in all commits to be released from the associated release milestone
   - If any merge conflicts occur, attempt to solve them and if needed enlist the aid of those familiar with the conflicting commits.
 - [ ] Bump the release number in the `Cargo.toml` to the current version number
-- [ ] Run `cargo vdev build release-cue` to generate a new cue file for the release
-  - [ ] Add description key to the generated cue file with a description of the release (see
+- [ ] Add a new cue file for the release at `website/cue/reference/releases/${NEW_VERSION}.cue`
+      by copying the previous patch release file and editing the version, date, commits, and
+      changelog entries to match this release.
+  - [ ] Add a description key to the cue file with a description of the release (see
         previous releases for examples).
 - [ ] Update version number in `distribution/install.sh`
 - [ ] Add new version to `website/cue/reference/versions.cue`
diff --git a/.github/workflows/changes.yml b/.github/workflows/changes.yml
index 710932c694bc2..246aff0001d64 100644
--- a/.github/workflows/changes.yml
+++ b/.github/workflows/changes.yml
@@ -228,7 +228,6 @@ jobs:
               - "vdev/**"
               - ".github/workflows/changes.yml"
             component_docs:
-              - 'scripts/generate-component-docs.rb'
               - "vdev/**"
               - 'website/cue/**/*.cue'
               - 'docs/generated/**'
diff --git a/.ruby-version b/.ruby-version
deleted file mode 100644
index 0aec50e6ede78..0000000000000
--- a/.ruby-version
+++ /dev/null
@@ -1 +0,0 @@
-3.1.4
diff --git a/Cargo.lock b/Cargo.lock
index 0fffdcba1ec15..09d10412bdfcc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -12903,6 +12903,7 @@ dependencies = [
  "clap",
  "clap-verbosity-flag",
  "clap_complete",
+ "convert_case 0.8.0",
  "directories",
  "git2",
  "glob",
@@ -12914,6 +12915,8 @@ dependencies = [
  "log",
  "owo-colors",
  "pastey",
+ "proc-macro2 1.0.106",
+ "quote 1.0.45",
  "regex",
  "reqwest 0.11.26",
  "semver",
@@ -12922,6 +12925,7 @@ dependencies = [
  "serde_yaml",
  "sha2",
  "strum 0.28.0",
+ "syn 2.0.117",
  "tempfile",
  "toml",
  "toml_edit 0.23.9",
diff --git a/Cargo.toml b/Cargo.toml
index d46d60c8fac24..fb79af1caa48f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -149,6 +149,7 @@ clap = { version = "4.5.60", default-features = false, features = ["derive", "er
 clap_complete = "4.5.66"
 colored = { version = "3.1.1", default-features = false }
 const-str = { version = "1.1.0", default-features = false }
+convert_case = { version = "0.8", default-features = false }
 criterion = "0.8"
 crossbeam-utils = { version = "0.8.21", default-features = false }
 darling = { version = "0.20.11", default-features = false, features = ["suggestions"] }
@@ -198,6 +199,9 @@ tokio = { version = "1.49.0", default-features = false }
 tokio-stream = { version = "0.1.18", default-features = false }
 tokio-test = "0.4.5"
 tokio-tungstenite = { version = "0.20.1", default-features = false }
+proc-macro2 = { version = "1", default-features = false }
+quote = { version = "1", default-features = false }
+syn = { version = "2", default-features = false }
 toml = { version = "0.9.8", default-features = false, features = ["serde", "display", "parse"] }
 tonic = { version = "0.11", default-features = false, features = ["transport", "codegen", "prost", "tls", "tls-roots", "gzip"] }
 tonic-build = { version = "0.11", default-features = false, features = ["transport", "prost"] }
diff --git a/Makefile b/Makefile
index d4465e861194f..2d4cc46a3323d 100644
--- a/Makefile
+++ b/Makefile
@@ -595,13 +595,6 @@ package-%:
 
 ##@ Releasing
 
-.PHONY: release
-release: release-prepare generate release-commit ## Release a new Vector version
-
-.PHONY: release-commit
-release-commit: ## Commits release changes
-	@$(VDEV) release commit
-
 .PHONY: release-docker
 release-docker: ## Release to Docker Hub
 	@$(VDEV) release docker
@@ -618,10 +611,6 @@ release-homebrew: ## Release to vectordotdev Homebrew tap
 release-prepare: ## Prepares the release with metadata and highlights
 	@$(VDEV) release prepare
 
-.PHONY: release-push
-release-push: ## Push new Vector version
-	@$(VDEV) release push
-
 .PHONY: release-s3
 release-s3: ## Release artifacts to S3
 	@$(VDEV) release s3
diff --git a/docs/DOCUMENTING.md b/docs/DOCUMENTING.md
index e6a032fee8dcf..3faa1f0011ba9 100644
--- a/docs/DOCUMENTING.md
+++ b/docs/DOCUMENTING.md
@@ -147,9 +147,12 @@ watchexec "make check-docs"
 
 ### Changelog
 
-Contributors do not need to maintain a changelog. This is automatically generated
-via the `make release` command, made possible by the use of
-[conventional commit](https://www.conventionalcommits.org/en/v1.0.0/) titles.
+Contributors document user-facing changes by adding a fragment under
+[`changelog.d/`](../changelog.d/README.md); the release CUE file's user-facing
+changelog section is assembled from those fragments by `cargo vdev release
+prepare` during release prep. The CUE file's `commits:` array is populated
+from the git log via [conventional commit](https://www.conventionalcommits.org/en/v1.0.0/)
+titles, so PR titles must follow that spec.
 
 ### Release highlights
 
diff --git a/lib/vector-common/src/internal_event/component_events_dropped.rs b/lib/vector-common/src/internal_event/component_events_dropped.rs
index 8421d1d0f49ae..d86891f4ba815 100644
--- a/lib/vector-common/src/internal_event/component_events_dropped.rs
+++ b/lib/vector-common/src/internal_event/component_events_dropped.rs
@@ -27,9 +27,12 @@ impl<'a, const INTENTIONAL: bool> From<&'a str> for ComponentEventsDropped<'a, I
     }
 }
 
+// ComponentEventsDropped is the foundation type the `registered_event!` macro
+// abstracts over, so we have to implement RegisterInternalEvent by hand here.
 impl<'a, const INTENTIONAL: bool> RegisterInternalEvent
     for ComponentEventsDropped<'a, INTENTIONAL>
 {
+    // ## skip check-validity-events ##
     type Handle = DroppedHandle<'a, INTENTIONAL>;
     fn register(self) -> Self::Handle {
         Self::Handle {
diff --git a/lib/vector-config-common/Cargo.toml b/lib/vector-config-common/Cargo.toml
index 350c1cb1678f4..946bc48e17e70 100644
--- a/lib/vector-config-common/Cargo.toml
+++ b/lib/vector-config-common/Cargo.toml
@@ -5,7 +5,7 @@ edition = "2024"
 license = "MPL-2.0"
 
 [dependencies]
-convert_case = { version = "0.8", default-features = false }
+convert_case.workspace = true
 darling.workspace = true
 proc-macro2 = { version = "1.0", default-features = false }
 serde.workspace = true
diff --git a/scripts/Gemfile b/scripts/Gemfile
deleted file mode 100644
index 91a2743ddd3fc..0000000000000
--- a/scripts/Gemfile
+++ /dev/null
@@ -1,10 +0,0 @@
-ruby '~> 3.1.0'
-
-# !!!
-# Please try not to add more dependencies here.
-# We are trying to remove Ruby entirely from this repo.
-# !!!
-
-source 'https://rubygems.org'
-gem 'paint', '~> 2.1' # for scripts/release-prepare.rb
-gem 'logging', '~> 2.3.1' # for scripts/generate-component-docs.rb
diff --git a/scripts/Gemfile.lock b/scripts/Gemfile.lock
deleted file mode 100644
index 47f15be10da47..0000000000000
--- a/scripts/Gemfile.lock
+++ /dev/null
@@ -1,22 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    little-plugger (1.1.4)
-    logging (2.3.1)
-      little-plugger (~> 1.1)
-      multi_json (~> 1.14)
-    multi_json (1.15.0)
-    paint (2.2.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  logging (~> 2.3.1)
-  paint (~> 2.1)
-
-RUBY VERSION
-   ruby 3.1.4p223
-
-BUNDLED WITH
-   2.4.14
diff --git a/scripts/check-events b/scripts/check-events
deleted file mode 100755
index 18a3c61b85418..0000000000000
--- a/scripts/check-events
+++ /dev/null
@@ -1,515 +0,0 @@
-#!/usr/bin/env ruby
-# coding: utf-8
-
-require 'find'
-
-# These members/tags are common to multiple events
-BYTE_SIZE_COUNT = ['byte_size', 'count']
-
-# SUFFIX => [MESSAGE, COUNTERS, ADDITIONAL_TAGS]
-EVENT_CLASSES = {
-  'BytesReceived' => [
-    'Bytes received.', ['received_bytes'], ['byte_size', 'protocol']
-  ],
-  'EventsReceived' => [
-    'Events received.', ['received_events', 'received_event_bytes'], ['count', 'byte_size']
-  ],
-  'EventsSent' => [
-    'Events sent.', ['sent_events', 'sent_event_bytes'], ['count', 'byte_size']
-  ],
-  'BytesSent' => [
-    'Bytes sent.', ['sent_bytes'], ['byte_size', 'protocol']
-  ],
-}
-
-METRIC_NAME_EVENTS_DROPPED = 'component_discarded_events_total'
-METRIC_NAME_ERROR = 'component_errors_total'
-
-def hash_array_add(hash, key, item)
-  arr = hash.fetch(key, Array::new)
-  arr.append(item)
-  hash[key] = arr
-end
-
-def is_constant?(name)
-  name.start_with? '"' and name.end_with? '"' or name.match? /^(.+::)[A-Z0-9_]$/
-end
-
-def find_line_number(haystack, needle)
-  idx = haystack.index(needle)
-  if !idx.nil?
-    prior = haystack[0,idx]
-    prior.lines.count
-  else
-    nil
-  end
-end
-
-# A class to hold error reports and common functionality
-class Event
-  attr_accessor :path, :skip_dropped_events, :uses, :skip_duplicate_check, :skip_validity_check, :impl_internal_event, :impl_register_event, :impl_event_handle
-  attr_reader :name, :reports, :logs
-  attr_writer :members
-
-  def initialize(name)
-    @path = nil
-    @skip_duplicate_check = false
-    @skip_validity_check = false
-    @skip_dropped_events = false
-    @emits_component_events_dropped = false
-    @name = name
-    @reports = []
-    @members = {}
-    @counters = {}
-    @metrics = {}
-    @logs = []
-    @uses = 0
-    @impl_internal_event = false
-    @impl_register_event = false
-    @impl_event_handle = false
-  end
-
-  def add_metric(type, name, tags)
-    @metrics["#{type}:#{name}"] = tags
-    if type == 'counter'
-      @counters[name] = tags
-    end
-  end
-
-  # Scan for counter names and tags
-  def scan_metrics(block)
-    # Match string literal names: counter!("metric_name", ...)
-    block.scan(/ (counter|gauge|histogram)!\((?:\n\s+)?"([^"]+)",?(.+?)\)[;\n]/ms) \
-    do |type, name, tags|
-      tags = Hash[tags.scan(/"([^"]+)" => (.+?)(?:,|$)/)]
-      add_metric(type, name, tags)
-    end
-    # Match typed enum names: counter!(CounterName::VariantName, ...)
-    block.scan(/ (counter|gauge|histogram)!\((?:\n\s+)?\w+Name::(\w+),?(.+?)\)[;\n]/ms) \
-    do |type, variant, tags|
-      # Convert CamelCase variant name to snake_case metric name
-      name = variant.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
-                    .gsub(/([a-z\d])([A-Z])/, '\1_\2')
-                    .downcase
-      tags = Hash[tags.scan(/"([^"]+)" => (.+?)(?:,|$)/)]
-      add_metric(type, name, tags)
-    end
-  end
-
-  # Scan the registered event macro block
-  def scan_registered_event(event_fields, handle_fields, data_type, emit_block)
-    @members = event_fields.scan(/^ *([a-z0-9_]+): *(.+?),$/m) \
-                 .map { |member, type| [member, type] }
-    handle_fields.scan(/^ *([a-z0-9_]+): *(.+?) *= *(.+?),$/m) do |name, type, assignment|
-      self.scan_component_dropped_events(assignment)
-      # This is a _slightly_ different regex than the above, couldn't figure a way to unify them
-      assignment.match(/ (counter|gauge|histogram)!\((?:\n\s+)?"([^"]+)"(,.+)?\)/ms) \
-      do
-        |type, name, tags|
-        tags = tags || ''
-        tags = Hash[tags.scan(/"([^"]+)" => (.+?)(?:,|$)/)]
-        add_metric(type, name, tags)
-        true
-      end
-    end
-    self.scan_logs(emit_block)
-  end
-
-  def add_log(type, message, parameters)
-    @logs.append([type, message, parameters])
-  end
-
-  # Scan for log outputs and their parameters
-  def scan_logs(block)
-    block.scan(/
-               (trace|debug|info|warn|error)! # The log type
-                \(\s*(?:message\s*=\s*)? # Skip any leading "message =" bit
-                (?:"([^({)][^("]+)"|([^,]+)) # The log message text
-                ([^;]*?) # Match the parameter list
-                \)(?:;|\n\s*}) # Normally would end with simply ");", but some are missing the semicolon
-               /mx) \
-    do |type, raw_message, var_message, parameters|
-      parameters = parameters.scan(/([a-z0-9_]+) *= .|[?%]([a-z0-9_.]+)/) \
-                     .map { |assignment, simple| assignment or simple }
-
-      message = raw_message.nil? ? var_message : raw_message
-
-      add_log(type, message, parameters)
-    end
-  end
-
-  # Scan for the emission of ComponentEventsDropped.
-  def scan_component_dropped_events(block)
-    if block.match?(/(emit|register)!\(\s*ComponentEventsDropped\b/)
-      @emits_component_events_dropped = true
-    end
-  end
-
-  # The event signature is used to check for duplicates and is
-  # composed from the member names and their types, the metric types,
-  # names, and their tags, and the log messages and parameters. If no
-  # metrics and no logs are defined for the event, the signature is
-  # `nil` to skip duplicate checking.
-  def signature
-    if @metrics.length == 0 and @logs.length == 0
-      nil
-    else
-      members = @members.map { |name, type| "#{name}:#{type}" }.sort.join(':')
-      metrics = @metrics.map do |name, value|
-        tags = value.keys.sort.join(',')
-        "#{name}(#{tags})"
-      end
-      metrics = metrics.sort.join(';')
-      logs = @logs.sort.join(';')
-      "#{members}[#{logs}][#{metrics}]"
-    end
-  end
-
-  def valid?
-    valid_with_handle? self
-  end
-
-  def valid_with_handle?(handle)
-    if @uses == 0
-      append('Event has no uses.')
-    end
-
-    EVENT_CLASSES.each do |suffix, (required_message, counters, additional_tags)|
-      if @name.end_with? suffix
-        handle.logs.each do |type, message, parameters|
-          if type != 'trace'
-            append('Log type MUST be \"trace!\".')
-          end
-          if message != required_message
-            append("Log message MUST be \"#{required_message}\" (is \"#{message}\").")
-          end
-          additional_tags.each do |tag_name|
-            unless parameters.include? tag_name
-              append("Log MUST contain tag \"#{tag_name}\"")
-            end
-          end
-        end
-        counters.each do |counter|
-          counter = "component_#{counter}_total"
-          counters_must_include_exclude_tags(counter, additional_tags - BYTE_SIZE_COUNT)
-        end
-      end
-    end
-
-    has_error_logs = handle.logs.one? { |type, _, _| type == 'error' }
-
-    is_events_dropped_event = (@name.end_with? 'EventsDropped' or @counters.include? METRIC_NAME_EVENTS_DROPPED)
-
-    # Validate <Name>Error events
-    if (has_error_logs and !is_events_dropped_event) or @name.end_with? 'Error'
-
-      # Name check
-      append('Error events MUST be named "___Error".') unless @name.end_with? 'Error'
-      # Outputs an error log
-      handle.log_level_exactly('error')
-      # Metric check
-      counters_must_include_exclude_tags(METRIC_NAME_ERROR, ['error_type', 'stage'])
-
-      # Make sure Error events contain the required parameters
-      handle.logs.each do |type, message, parameters|
-        if type == 'error'
-          ['error_type', 'stage'].each do |parameter|
-            unless parameters.include? parameter
-              append("Error log for Error event MUST include parameter \"#{parameter}\".")
-            end
-          end
-
-          ['error_code', 'error_type', 'stage'].each do |parameter|
-            if parameters.include? parameter and !@counters[METRIC_NAME_ERROR].include? parameter
-              append("Counter \"#{METRIC_NAME_ERROR}\" must include \"#{parameter}\" to match error log.")
-            end
-          end
-        end
-      end
-    end
-
-    # TODO remove @skip_dropped_events check logic after DroppedEvents audit is complete
-    # (https://github.com/vectordotdev/vector/issues/13995)
-
-    # Validate <Namespace>EventsDropped events
-    if is_events_dropped_event && !@skip_dropped_events
-
-      # Don't run the checks on event structs which themselves emit ComponentEventsDropped,
-      # as the ComponentEventsDropped event is already checked.
-      # Instead, verify that component_discarded_events_total is not being over-incremented.
-      if @emits_component_events_dropped
-        if @counters.include? METRIC_NAME_EVENTS_DROPPED
-          append("Event emitting ComponentEventsDropped should not also increment counter `#{METRIC_NAME_EVENTS_DROPPED}`")
-        end
-      else
-
-        # Name check
-        append('EventsDropped events MUST be named "___EventsDropped".') unless @name.end_with? 'EventsDropped'
-
-        # Outputs an error log or debug log. Which level is dependent on the value of the param `intentional`, however
-        # because implementation can involve passing in the value of the `intentional` bool at compile time, we would need to
-        # scan all the source code for places that emit this event to determine that.
-        handle.log_level_one_of(['error', 'debug'])
-
-        # Metric check
-        counters_must_include_exclude_tags(METRIC_NAME_EVENTS_DROPPED, ['intentional'], ['reason', 'count'])
-
-        # Make sure EventsDropped events contain the required parameters
-        handle.logs.each do |type, message, parameters|
-          if type == 'error'
-            ['count', 'intentional', 'reason'].each do |parameter|
-              unless parameters.include? parameter
-                append("Error log for EventsDropped event MUST include parameter \"#{parameter}\".")
-              end
-            end
-
-            ['intentional'].each do |parameter|
-              if parameters.include? parameter and !@counters[METRIC_NAME_EVENTS_DROPPED].include? parameter
-                append("Counter \"#{METRIC_NAME_EVENTS_DROPPED}\" must include \"#{parameter}\" to match error log.")
-              end
-            end
-          end
-        end
-      end
-    end
-
-    @counters.each do |name, tags|
-      # Only component_errors_total and component_discarded_events_total metrics are considered
-      if ['component_errors_total', 'component_discarded_events_total'].include? name
-        # Make sure defined tags to counters are constants
-        tags.each do |tag, value|
-          if tag == 'stage'
-            if !value.start_with? 'error_stage::'
-              append("Counter \"#{name}\" tag \"#{tag}\" value must be an \"error_stage\" constant.")
-            end
-          elsif tag == 'error_type'
-            if !value.start_with? 'error_type::'
-              append("Counter \"#{name}\" tag \"#{tag}\" value must be an \"error_type\" constant.")
-            end
-          end
-        end
-      end
-    end
-
-    @reports.empty?
-  end
-
-  def log_level_one_of(levels)
-    if @logs.find_index { |type, message, parameters| levels.include? type }.nil?
-      append("This event MUST log with one of these levels: #{levels}.")
-    end
-  end
-
-  def log_level_exactly(level)
-    log_level_one_of([level])
-  end
-
-  def append(report)
-    @reports.append(report)
-  end
-
-  private
-
-    def counters_must_include_exclude_tags(name, required_tags, exclude_tags = [])
-      unless @counters.include? name
-        append("This event MUST increment counter \"#{name}\".")
-      else
-        tags = @counters[name]
-        required_tags.each do |tag|
-          unless tags.include? tag
-            append("Counter \"#{name}\" MUST include tag \"#{tag}\".")
-          end
-        end
-
-        exclude_tags.each do |tag|
-          if tags.include? tag
-            append("Counter \"#{name}\" MUST NOT include tag \"#{tag}\".")
-          end
-        end
-      end
-    end
-
-end
-
-$all_events = Hash::new { |hash, key| hash[key] = Event::new(key) }
-
-error_count = 0
-
-# Scan sources and build internal structures
-Find.find('./src', './lib') do |path|
-  if path.start_with? './'
-    path = path[2..]
-  end
-
-  if path.end_with? '.rs'
-    text = File.read(path)
-
-    text.scan(/\b(?:emit!?|register!?)\((?:[a-z][a-z0-9_:]+)?([A-Z][A-Za-z0-9]+)/) \
-    do |event_name,|
-      $all_events[event_name].uses += 1
-    end
-
-    # Check log message texts for correct formatting.
-    if path.start_with? 'src/'
-      reports = []
-
-      # Try to find all general usage of the various `tracing` macros.
-      text.scan(/(
-        (trace|debug|info|warn|error)!\( # Log type.
-        ([^;]*?) # All parameters to the macro.
-        \)(?:;|\n\s*}) # Handles usages that lack a trailing semicolon.
-        )/mx) \
-      do |full, type, params|
-        # Extract each parameter to the macros, which involves handling structured fields and
-        # string literals. We parse them further below so that we can iterate through them to try
-        # and determine what the actual log message is, depending on if it's set by using the
-        # `message` field, or implicitly with a string literal.
-        #
-        # We also have some special handling in there for `tracing`-specific "target" and "parent"
-        # settings which influence how the event is handled when being processed by a subscriber,
-        # which we don't care about _here_ but need to account for in our pattern to parse things.
-        params = params.scan(/("(?:[^"\\]++|\\.)*+"|(?:target|parent):\s*[^,]+|(\w+\s*=\s*(?:"(?:[^"\\]++|\\.)*+"|[%?]?[^,]+))|[%?][^,]+)/) \
-          .map do |param|
-            if /^\".*\"$/.match?(param[0].strip)
-              { "type" => "litstr", "value" => param[0] }
-            elsif param[0].include? "="
-              parts = param[0].split('=', 2).map { |part| part.strip }
-              { "type" => "named_field", "field" => parts[0], "value" => parts[1] }
-            else
-              { "type" => "field", "field" => param[0] }
-            end
-          end
-
-        # See if we found a message field.
-        message_param = params.find { |param|
-          # Use the first string literal parameter.
-          param["type"] == "litstr" ||
-          # Or the first named field called `message` that has a value that is a string literal.
-          (param["type"] == "named_field" && param["field"] == "message" && /^\".*\"$/.match?(param["value"]))
-        }
-
-        # We further scrutinize the message field, if we believe we found one. This lets us avoid
-        # scenarios where variable interpolation is being used, since we can't reasonably detect if
-        # an interpolated variable at the beginning or end of the message is capitalized or has a
-        # trailing period, respectively.
-        has_message = !message_param.nil?
-        message = if has_message then message_param["value"].gsub(/^"|"$/, '') else nil end
-        is_capitalized = !has_message || (message[0] == "{" || !message.match?(/^[a-zA-Z]/) || message.match?(/^[[:upper:]]/))
-        has_trailing_period = !has_message || (message[-1, 1] == "}" || message.match?(/\.$/))
-
-        match_reports = []
-        match_reports.append('Message must start with a capital.') unless is_capitalized
-        match_reports.append('Message must end with a period.') unless has_trailing_period
-        unless match_reports.empty?
-          line_no = find_line_number(text, full)
-          match_reports.each { |report| reports.push("    #{report} (`#{type}` call on #{path}:#{line_no})") }
-        end
-      end
-
-      unless reports.empty?
-        reports.each { |report| puts report }
-        error_count += reports.length
-      end
-    end
-
-    # TODO remove @skip_dropped_events check logic after DroppedEvents audit is complete
-    # (https://github.com/vectordotdev/vector/issues/13995)
-    skip_dropped_events = text.match? /## skip check-dropped-events ##/i
-
-    if (path.start_with? 'src/internal_events/' or path.start_with? 'lib/vector-common/src/internal_event/')
-      # Scan internal event structs for member names
-      text.scan(/[\n ]struct (\S+?)(?:<.+?>)?(?: {\n(.+?)\n\s*}|;)\n/m) do |struct_name, members|
-        event = $all_events[struct_name]
-        event.path = path
-        event.skip_dropped_events = skip_dropped_events
-        if members
-          members = members.scan(/ ([A-Za-z0-9_]+): +(.+?),/).map { |member, type| [member, type] }
-          event.members = members.to_h
-        end
-      end
-
-      # Scan internal event implementation blocks for logs and metrics
-      text.scan(/^(\s*)impl(?:<.+?>)? (InternalEvent|RegisterInternalEvent|InternalEventHandle) for ([A-Za-z0-9_]+)(?:<.+?>)? {\n(.+?)\n\1}$/m) \
-      do |_space, trait, event_name, block|
-        event = $all_events[event_name]
-        event.path = path
-
-        event.skip_duplicate_check = block.match? /## skip check-duplicate-events ##/i
-        event.skip_validity_check = block.match? /## skip check-validity-events ##/i
-
-        if trait == 'InternalEvent'
-          # Look-aside internal events that defer their implementation to a registered event.
-          if ! block.include? 'register('
-            event.impl_internal_event = true
-            event.scan_metrics(block)
-            event.scan_logs(block)
-            event.scan_component_dropped_events(block)
-          end
-        elsif trait == 'RegisterInternalEvent'
-          # This is just a dummy name and will cause spurious errors, but it will at least surface
-          # the issue of using the macro.
-          event.impl_register_event = event_name
-          event.append("Do not implement RegisterInternalEvent manually. Use the registered_event! macro instead.")
-        elsif trait == 'InternalEventHandle'
-          event.impl_event_handle = true
-          event.scan_logs(block)
-        end
-      end
-    end
-
-    # Scan for the `registered_event` macro
-    text.scan(/^(crate::|vector_common::|)registered_event! *[({]\n *([A-Za-z0-9_]+) *({(.*?)})? *=> *{(.+?)}$.*^ *fn emit\(\&self, [a-z0-9_]+: ([A-Za-z0-9_]+)\) {$(.+?)}\n(\);|\})$/m) \
-    do |_, event_name, _, event_fields, handle_fields, data_type, emit_block, _|
-      event = $all_events[event_name]
-      event.path = path
-      event.scan_registered_event(event_fields || "", handle_fields, data_type, emit_block)
-    end
-  end
-end
-
-$duplicates = Hash::new { |hash, key| hash[key] = [] }
-
-$all_events.each do |name, event|
-  # Check for duplicated signatures
-  if !event.skip_duplicate_check and (event.impl_internal_event or event.impl_event_handle)
-    signature = event.signature
-    if signature
-      $duplicates[event.signature].append(name)
-    end
-  end
-
-  # Check events for validity
-  if !event.skip_validity_check
-    if event.impl_internal_event
-      unless event.valid?
-        puts "#{event.path}: Errors in event #{event.name}:"
-        event.reports.each { |report| puts "    #{report}" }
-        error_count += 1
-      end
-    elsif event.impl_register_event
-      handle = $all_events[event.impl_register_event]
-      if handle
-        unless event.valid_with_handle? handle
-          puts "#{event.path}: Errors in event #{event.name}:"
-          event.reports.each { |report| puts "    #{report}" }
-          error_count += 1
-        end
-      else
-        puts "Registered event #{event.name} references nonexistent handle #{event.impl_register_event}"
-        error_count += 1
-        next
-      end
-    end
-  end
-end
-
-$duplicates.each do |signature, dupes|
-  if dupes.length > 1
-    dupes = dupes.join(', ')
-    puts "Duplicate events detected: #{dupes}"
-    error_count += 1
-  end
-end
-
-puts "#{error_count} error(s)"
-exit 1 if error_count > 0
diff --git a/scripts/check_changelog_fragments.sh b/scripts/check_changelog_fragments.sh
index 916ebe88dd53b..555f802866dbc 100755
--- a/scripts/check_changelog_fragments.sh
+++ b/scripts/check_changelog_fragments.sh
@@ -8,7 +8,7 @@
 CHANGELOG_DIR="changelog.d"
 
 # NOTE: If these are altered, update both the 'changelog.d/README.md' and
-#       'scripts/generate-release-cue.rb' accordingly.
+#       'vdev/src/commands/release/generate_cue.rs' accordingly.
 FRAGMENT_TYPES="breaking|security|deprecation|feature|enhancement|fix"
 
 if [ ! -d "${CHANGELOG_DIR}" ]; then
diff --git a/scripts/environment/Dockerfile b/scripts/environment/Dockerfile
index 2798a296dd428..4502f2f71ddba 100644
--- a/scripts/environment/Dockerfile
+++ b/scripts/environment/Dockerfile
@@ -20,8 +20,6 @@ COPY scripts/environment/npm-tools/ scripts/environment/npm-tools/
 RUN ./scripts/environment/bootstrap-ubuntu-24.04.sh
 
 # Setup the toolchain
-COPY scripts/Gemfile scripts/Gemfile.lock \
-    /git/vectordotdev/vector/scripts/
 COPY rust-toolchain.toml \
     /git/vectordotdev/vector/
 RUN ./scripts/environment/prepare.sh && ./scripts/environment/setup-helm.sh
diff --git a/scripts/environment/bootstrap-macos.sh b/scripts/environment/bootstrap-macos.sh
index 5cf014b31546c..8efff32ac98c5 100755
--- a/scripts/environment/bootstrap-macos.sh
+++ b/scripts/environment/bootstrap-macos.sh
@@ -2,12 +2,4 @@
 set -e -o verbose
 
 brew update
-brew install ruby@3 coreutils cue-lang/tap/cue protobuf
-
-gem install bundler
-
-echo "export PATH=\"/usr/local/opt/ruby/bin:\$PATH\"" >> "$HOME/.bash_profile"
-
-if [ -n "${CI-}" ] ; then
-  echo "/usr/local/opt/ruby/bin" >> "$GITHUB_PATH"
-fi
+brew install coreutils cue-lang/tap/cue protobuf
diff --git a/scripts/environment/bootstrap-ubuntu-24.04.sh b/scripts/environment/bootstrap-ubuntu-24.04.sh
index 4298fb4dba94b..6cc2c010157d6 100755
--- a/scripts/environment/bootstrap-ubuntu-24.04.sh
+++ b/scripts/environment/bootstrap-ubuntu-24.04.sh
@@ -47,7 +47,6 @@ apt-get install --yes \
     pkg-config \
     rename \
     rpm \
-    ruby-bundler \
     shellcheck \
     sudo \
     unzip \
diff --git a/scripts/generate-release-cue.rb b/scripts/generate-release-cue.rb
deleted file mode 100755
index d11d9f8f02c8a..0000000000000
--- a/scripts/generate-release-cue.rb
+++ /dev/null
@@ -1,467 +0,0 @@
-#!/usr/bin/env ruby
-
-# release-meta.rb
-#
-# SUMMARY
-#
-#   A script that prepares the release .meta/releases/vX.X.X.toml file.
-#   Afterwards, the `make generate` command should be used to refresh
-#   the generated files against the new release metadata.
-
-#
-# Setup
-#
-
-require "json"
-require "time"
-require "optparse"
-require 'pathname'
-require_relative "util/commit"
-require_relative "util/git_log_commit"
-require_relative "util/printer"
-require_relative "util/release"
-require_relative "util/version"
-
-# Function to find the repository root by looking for .git directory
-def find_repo_root
-  # Get the absolute path of the current script
-  script_path = File.expand_path(__FILE__)
-  dir = Pathname.new(script_path).dirname
-
-  # Walk up the directory tree until we find .git or reach the filesystem root
-  loop do
-    return dir.to_s if File.exist?(File.join(dir, '.git'))
-    parent = dir.parent
-    raise "Could not find repository root (no .git directory found)" if parent == dir # Reached filesystem root
-    dir = parent
-  end
-end
-
-#
-# Constants
-#
-
-ROOT = find_repo_root
-RELEASE_REFERENCE_DIR = File.join(ROOT, "website", "cue", "reference", "releases")
-CHANGELOG_DIR = File.join(ROOT, "changelog.d")
-TYPES = ["chore", "docs", "feat", "fix", "enhancement", "perf", "revert"]
-TYPES_THAT_REQUIRE_SCOPES = ["feat", "enhancement", "fix"]
-
-# Parse command-line options
-options = {}
-OptionParser.new do |opts|
-  opts.banner = "Usage: #{File.basename(__FILE__)} [options]"
-
-  opts.on("--new-version VERSION", "Specify the new version (e.g., 1.2.3)") do |v|
-    options[:new_version] = v
-  end
-  opts.on("--[no-]interactive", "Enable/disable interactive prompts (default: true)") do |i|
-    options[:interactive] = i
-  end
-  opts.on_tail("-h", "--help", "Show this help message") do
-    puts opts
-    exit
-  end
-end.parse!
-
-#
-# Functions
-#
-# Sorted alphabetically.
-#
-
-# Creates and updates the new release log file located at
-#
-#   /.meta/releases/X.X.X.log
-#
-# This file is created from outstanding commits since the last release.
-# It's meant to be a starting point. The resulting file should be reviewed
-# and edited by a human before being turned into a cue file.
-def create_log_file!(current_commits, new_version, interactive)
-  release_log_path = "#{RELEASE_REFERENCE_DIR}/#{new_version}.log"
-
-  # Grab all existing commits
-  existing_commits = get_existing_commits!
-
-  # Filter out duplicate commits
-  new_commits = current_commits.select do |current_commit|
-    !existing_commits.any? { |existing_commit| existing_commit.eql?(current_commit) }
-  end
-
-  new_commit_lines = new_commits.collect { |c| c.to_git_log_commit.to_raw }.join("\n")
-
-  if new_commits.any?
-    if File.exists?(release_log_path)
-      if interactive
-        words = <<~EOF
-          I found #{new_commits.length} new commits since you last ran this
-          command. So that I don't erase any other work in that file, please
-          manually add the following commit lines:
-
-              #{new_commit_lines.split("\n").collect { |line| "    #{line}" }.join("\n")}
-
-          To:
-
-              #{release_log_path}
-
-          All done? Ready to proceed?
-        EOF
-
-        if Util::Printer.get(words, ["y", "n"]) == "n"
-          Util::Printer.error!("Ok, re-run this command when you're ready.")
-        end
-      end
-    else
-      File.open(release_log_path, 'w+') do |file|
-        file.write(new_commit_lines)
-      end
-
-      puts interactive
-      if interactive
-        words = <<~EOF
-          I've created a release log file here:
-
-              #{release_log_path}
-
-          Please review the commits and *adjust the commit messages as necessary*.
-
-          All done? Ready to proceed?
-        EOF
-
-        if Util::Printer.get(words, ["y", "n"]) == "n"
-          Util::Printer.error!("Ok, re-run this command when you're ready.")
-        end
-      end
-    end
-  end
-
-  release_log_path
-end
-
-def retire_changelog_entries!()
-
-  Dir.glob("#{CHANGELOG_DIR}/*.md") do |fname|
-    if File.basename(fname) == "README.md"
-      next
-    end
-    system('git', 'rm', fname)
-  end
-end
-
-def generate_changelog!(new_version)
-
-  entries = ""
-
-  Dir.glob("#{CHANGELOG_DIR}/*.md") do |fname|
-
-    if File.basename(fname) == "README.md"
-      next
-    end
-
-    if entries != ""
-      entries += ",\n"
-    end
-
-    fragment_contents = File.open(fname)
-
-    # add the GitHub username for any fragments
-    # that have an authors field at the end of the
-    # fragment. This is generally used for external
-    # contributor PRs.
-    lines = fragment_contents.to_a
-    last = lines.last
-    contributors = Array.new
-
-    if last.start_with?("authors: ")
-      contributors = last[9..].split(" ").map(&:strip)
-
-      # remove that line from the description
-      lines.pop()
-    end
-
-    description = lines.join("").strip()
-
-    # get the PR number of the changelog fragment.
-    # the fragment type is not used in the Vector release currently.
-    basename = File.basename(fname, ".md")
-    parts = basename.split(".")
-
-    if parts.length() != 2
-       Util::Printer.error!("Changelog fragment #{fname} is invalid (exactly two period delimiters required).")
-    end
-
-    fragment_type = parts[1]
-
-    # map the fragment type to Vector's semantic types
-    # https://github.com/vectordotdev/vector/blob/master/.github/semantic.yml#L13
-    # the type "chore" isn't rendered in the changelog on the website currently,
-    # but we are mapping "breaking" and "deprecations" to that type, and both of
-    # these are handled in the upgrade guide separately.
-
-    # NOTE: If the fragment types are altered, update both the 'changelog.d/README.md' and
-    #       'scripts/check_changelog_fragments.sh' accordingly.
-    type = ""
-    if fragment_type == "breaking"
-      type = "chore"
-    elsif fragment_type == "security" or fragment_type == "fix"
-      type = "fix"
-    elsif fragment_type == "deprecation"
-      type = "chore"
-    elsif fragment_type == "feature"
-      type = "feat"
-    elsif fragment_type == "enhancement"
-      type = "enhancement"
-    else
-       Util::Printer.error!("Changelog fragment #{fname} is invalid. Fragment type #{fragment_type} unrecognized.")
-    end
-
-    # Note: `pr_numbers`, `scopes` and `breaking` are being omitted from the entries.
-    #       These are currently not required for rendering in the website.
-    # Use CUE raw multi-line strings (#"""..."""#) so backslashes in the
-    # fragment (e.g. shell line continuations) are not interpreted as
-    # escape sequences.
-    entry = "{\n" +
-      "type: #{type.to_json}\n" +
-      "description: #\"\"\"\n" +
-      "#{description}\n" +
-      "\"\"\"#\n"
-
-    if contributors.length() > 0
-      entry += "contributors: #{contributors.to_json}\n"
-    end
-
-    entry += "}"
-
-    entries += entry
-  end
-
-  if entries != ""
-    retire_changelog_entries!()
-  end
-
-  entries
-end
-
-def create_release_file!(new_version)
-  release_log_path = "#{RELEASE_REFERENCE_DIR}/#{new_version}.log"
-  git_log = Vector::GitLogCommit.from_file!(release_log_path)
-  commits = Vector::Commit.from_git_log!(git_log)
-
-  release_reference_path = "#{RELEASE_REFERENCE_DIR}/#{new_version}.cue"
-
-  if commits.any?
-    commits.each(&:validate!)
-    cue_commits = commits.collect(&:to_cue_struct).join(",\n    ")
-
-    changelog_entries = generate_changelog!(new_version)
-
-    if File.exists?(release_reference_path)
-      words =
-        <<~EOF
-        It looks like you already have a release file:
-
-            #{release_reference_path}
-
-        So that I don't overwrite your work, please copy these commits into
-        the release file:
-
-        #{cue_commits}
-
-        All done? Ready to proceed?
-        EOF
-
-      if Util::Printer.get(words, ["y", "n"]) == "n"
-        Util::Printer.error!("Ok, re-run this command when you're ready.")
-      end
-    else
-      File.open(release_reference_path, 'w+') do |file|
-        file.write(
-          <<~EOF
-          package metadata
-
-          releases: #{new_version.to_json}: {
-            date:     #{Date.today.to_json}
-            codename: ""
-
-            whats_next: []
-
-            changelog: [
-          #{changelog_entries}
-            ]
-
-            commits: [
-          #{cue_commits}
-            ]
-          }
-          EOF
-        )
-      end
-
-      `cue fmt #{release_reference_path}`
-
-      words =
-        <<~EOF
-        All done! I've create a release file at:
-
-            #{release_reference_path}
-
-        I recommend previewing the website changes with this release.
-        EOF
-
-      Util::Printer.success(words)
-    end
-
-    `cue fmt #{release_reference_path}`
-
-    true
-  else
-    false
-  end
-end
-
-def get_commits_since(last_version)
-  Vector::Commit.fetch_since(last_version)
-end
-
-# Grabs all existing commits that are included in the `.meta/releases/*.toml`
-# files. We grab _all_ commits to ensure we do not include duplicate commits
-# in the new release.
-def get_existing_commits!
-  releases = Vector::Release.all!(RELEASE_REFERENCE_DIR)
-  release_commits = releases.collect(&:commits).flatten
-
-  release_log_paths = Dir.glob("#{RELEASE_REFERENCE_DIR}/*.log").to_a
-
-  log_commits =
-    release_log_paths.collect do |release_log_path|
-      git_log = Vector::GitLogCommit.from_file!(release_log_path)
-      Vector::Commit.from_git_log!(git_log)
-    end.flatten
-
-  release_commits + log_commits
-end
-
-def get_new_version(last_version, current_commits)
-  next_version =
-    if current_commits.any? { |c| c.breaking_change? }
-      next_version =
-        if last_version.major == 0
-          "0.#{last_version.minor + 1}.0"
-        else
-          "#{last_version.major + 1}.0.0"
-        end
-
-      words = "It looks like the new commits contain breaking changes. " +
-        "Would you like to use the recommended version #{next_version} for " +
-        "this release?"
-
-      if Util::Printer.get(words, ["y", "n"]) == "y"
-        next_version
-      else
-        nil
-      end
-    elsif current_commits.any? { |c| c.new_feature? }
-      next_version = "#{last_version.major}.#{last_version.minor + 1}.0"
-
-      words = "It looks like this release contains commits with new features. " +
-        "Would you like to use the recommended version #{next_version} for " +
-        "this release?"
-
-      if Util::Printer.get(words, ["y", "n"]) == "y"
-        next_version
-      else
-        nil
-      end
-    elsif current_commits.any? { |c| c.fix? }
-      next_version = "#{last_version.major}.#{last_version.minor}.#{last_version.patch + 1}"
-
-      words = "It looks like this release contains commits with bug fixes. " +
-        "Would you like to use the recommended version #{next_version} for " +
-        "this release?"
-
-      if Util::Printer.get(words, ["y", "n"]) == "y"
-        next_version
-      else
-        nil
-      end
-    end
-
-  version_string = next_version || Util::Printer.get("What is the next version you are releasing? (current version is #{last_version})")
-
-  version =
-    begin
-      Util::Version.new(version_string)
-    rescue ArgumentError => e
-      Util::Printer.invalid("It looks like the version you entered is invalid: #{e.message}")
-      get_new_version(last_version, current_commits)
-    end
-
-  if last_version.bump_type(version).nil?
-    Util::Printer.invalid("The version you entered must be a single patch, minor, or major bump")
-    get_new_version(last_version, current_commits)
-  else
-    version
-  end
-end
-
-def migrate_highlights(new_version)
-  Dir.glob("#{HIGHLIGHTS_ROOT}/*.md").to_a.each do |highlight_path|
-    content = File.read(highlight_path)
-    release_line = "\nrelease: \"nightly\"\n"
-
-    if content.include?(release_line)
-      new_content = content.replace(release_line, "\nrelease: \"#{new_version}\"\n")
-
-      File.open(highlight_path, 'w+') do |file|
-        file.write(new_content)
-      end
-    end
-  end
-end
-
-#
-# Execute
-#
-script_dir = File.expand_path(File.dirname(__FILE__))
-Dir.chdir script_dir
-
-Util::Printer.title("Creating release meta file...")
-
-all_tags = `git tag --list --sort=-v:refname`.lines.map(&:chomp)
-valid_tag = all_tags.find do |t|
-    !t.start_with?('vdev-v') &&
-    t.match(/^v\d+\.\d+\.\d+$/)
-end
-
-if valid_tag.nil?
-  Util::Printer.error!("No valid semantic version tag found (e.g. v1.2.3)")
-  exit 1
-end
-
-last_tag = valid_tag
-last_version = Util::Version.new(last_tag.gsub(/^v/, ''))
-current_commits = get_commits_since(last_version)
-
-new_version_string = options[:new_version]
-if new_version_string
-  begin
-    new_version = Util::Version.new(new_version_string)
-    if last_version.bump_type(new_version).nil?
-      Util::Printer.error!("The specified version '#{new_version_string}' must be a single patch, minor, or major bump from #{last_version}")
-      exit 1
-    end
-  rescue ArgumentError => e
-    Util::Printer.error!("Invalid version specified: #{e.message}")
-    exit 1
-  end
-else
-  new_version = get_new_version(last_version, current_commits)
-end
-
-log_file_path = create_log_file!(current_commits, new_version, options[":interactive"])
-create_release_file!(new_version)
-File.delete(log_file_path)
-
-#Util::Printer.title("Migrating all nightly associated highlights to #{new_version}...")
-
-#migrate_highlights(new_version)
diff --git a/scripts/release-commit.rb b/scripts/release-commit.rb
deleted file mode 100755
index 49e3495b57b83..0000000000000
--- a/scripts/release-commit.rb
+++ /dev/null
@@ -1,121 +0,0 @@
-#!/usr/bin/env ruby
-
-# release-commit.rb
-#
-# SUMMARY
-#
-#   Commits and tags the pending release
-
-#
-# Setup
-#
-
-require "json"
-require_relative "util/printer"
-require_relative "util/release"
-
-#
-# Constants
-#
-
-ROOT_DIR = "."
-RELEASE_REFERENCE_DIR = File.join(ROOT_DIR, "docs", "reference", "releases")
-
-#
-# Functions
-#
-
-def bump_cargo_version(version)
-  # Cargo.toml
-  content = File.read("#{ROOT_DIR}/Cargo.toml")
-  new_content = bump_version(content, version)
-  File.write("#{ROOT_DIR}/Cargo.toml", new_content)
-
-  # Cargo.lock
-  content = File.read("#{ROOT_DIR}/Cargo.lock")
-  new_content = bump_version(content, version)
-  File.write("#{ROOT_DIR}/Cargo.lock", new_content)
-end
-
-def bump_version(content, version)
-  content.sub(
-    /name = "vector"\nversion = "([a-z0-9.-]*)"\n/,
-    "name = \"vector\"\nversion = \"#{version}\"\n"
-  )
-end
-
-def release_exists?(release)
-  errors = `git rev-parse tags/v#{release.version} 2>&1 >/dev/null`
-  errors == ""
-end
-
-#
-# Execute
-#
-
-release = Vector::Release.all!(RELEASE_REFERENCE_DIR).last
-
-if release_exists?(release)
-  Util::Printer.error!(
-    <<~EOF
-    It looks like release v#{release.version} has already been released. A tag for this release already exists.
-
-    This command will only release the latest release. If you're trying to release from an older major or minor version, you must do so from that branch.
-    EOF
-  )
-else
-  Util::Printer.title("Committing and tagging release")
-
-  bump_cargo_version(release.version)
-
-  Util::Printer.success("Bumped the version in Cargo.toml & Cargo.lock to #{release.version}")
-
-  branch_name = "#{release.version.major}.#{release.version.minor}"
-
-  commands =
-    <<~EOF
-    git add #{ROOT_DIR} -A
-    git commit -sam 'chore: Prepare v#{release.version} release' || true
-    git tag -a v#{release.version} -m "v#{release.version}"
-    git branch v#{branch_name} 2>/dev/null || true
-    EOF
-
-  commands.chomp!
-
-  status = `git status --short`.chomp!
-
-  words =
-    <<~EOF
-    We'll be releasing v#{release.version} with the following commands:
-
-    #{commands}
-
-    Your current `git status` is:
-
-    #{status}
-
-    Proceed to execute the above commands?
-    EOF
-
-  if Util::Printer.get(words, ["y", "n"]) == "n"
-    Util::Printer.error!("Ok, I've aborted. Please re-run this command when you're ready.")
-  end
-
-  commands.chomp.split("\n").each do |command|
-    system(command)
-
-    if !$?.success?
-      Util::Printer.error!(
-        <<~EOF
-        Command failed!
-
-          #{command}
-
-        Produced the following error:
-
-          #{$?.inspect}
-        EOF
-      )
-    end
-  end
-end
diff --git a/scripts/util/commit.rb b/scripts/util/commit.rb
deleted file mode 100644
index 8b4f5baba1ca1..0000000000000
--- a/scripts/util/commit.rb
+++ /dev/null
@@ -1,166 +0,0 @@
-require_relative "conventional_commit"
-require_relative "git_log_commit"
-
-module Vector
-  class Commit
-    class << self
-      def fetch_since(last_version)
-        git_log = GitLogCommit.fetch_since!(last_version)
-        git_log.collect do |git_log_commit|
-          from_git_log_commit(git_log_commit)
-        end
-      end
-
-      def fetch_since!(last_version)
-        git_log = GitLogCommit.fetch_since!(last_version)
-        git_log.collect do |git_log_commit|
-          from_git_log_commit!(git_log_commit)
-        end
-      end
-
-      def from_git_log!(git_log)
-        git_log.collect do |git_log_commit|
-          from_git_log_commit!(git_log_commit)
-        end
-      end
-
-      private
-        def from_git_log_commit(git_log_commit)
-          conventional_commit = ConventionalCommit.parse(git_log_commit.message)
-          hash = git_log_commit.to_h.merge(conventional_commit.to_h)
-          new(hash)
-        end
-
-        def from_git_log_commit!(git_log_commit)
-          conventional_commit = ConventionalCommit.parse!(git_log_commit.message)
-          hash = git_log_commit.to_h.merge(conventional_commit.to_h)
-          new(hash)
-        end
-    end
-
-    attr_reader :author,
-      :breaking_change,
-      :date,
-      :deletions_count,
-      :description,
-      :files_count,
-      :insertions_count,
-      :pr_number,
-      :scopes,
-      :sha,
-      :type
-
-    def initialize(hash)
-      @author = hash.fetch("author")
-      @breaking_change = hash.fetch("breaking_change")
-      @date = hash.fetch("date")
-      @deletions_count = hash.fetch("deletions_count")
-      @description = hash.fetch("description")
-      @files_count = hash.fetch("files_count")
-      @insertions_count = hash.fetch("insertions_count")
-      @pr_number = hash.fetch("pr_number")
-      @scopes = hash.fetch("scopes")
-      @sha = hash.fetch("sha")
-      @type = hash.fetch("type")
-    end
-
-    def eql?(other)
-      sha == other.sha || pr_number == other.pr_number
-    end
-
-    def breaking_change?
-      breaking_change == true
-    end
-
-    def fix?
-      type == "fix"
-    end
-
-    def new_feature?
-      type == "feat"
-    end
-
-    def to_cue_struct
-      "{" +
-        "sha: #{sha.to_json}, " +
-        "date: #{date.to_json}, " +
-        "description: #{description.to_json}, " +
-        "pr_number: #{pr_number.to_json}, " +
-        "scopes: #{scopes.to_json}, " +
-        "type: #{type.to_json}, " +
-        "breaking_change: #{breaking_change.to_json}, " +
-        "author: #{author.to_json}, " +
-        "files_count: #{files_count.to_json}, " +
-        "insertions_count: #{insertions_count.to_json}, " +
-        "deletions_count: #{deletions_count.to_json}}"
-    end
-
-    def validate!
-      if !type.nil? && !TYPES.include?(type)
-        raise <<~EOF
-        The following commit has an invalid type!
-
-          #{to_s}
-
-        The type must be one of #{TYPES.inspect}.
-
-          #{type.inspect}
-
-        Please correct in the release /.meta file and retry.
-        EOF
-      end
-
-      if TYPES_THAT_REQUIRE_SCOPES.include?(type) && scopes.empty?
-        raise <<~EOF
-        The following commit does not have a scope
-
-          #{to_s}
-
-        A scope is required for commits of type #{TYPES_THAT_REQUIRE_SCOPES.inspect}.
-
-          #{description}
-
-        Please correct in the release /.meta file and retry.
-        EOF
-      end
-
-      true
-    end
-
-    def to_git_log_commit
-      message = ""
-
-      if type
-        message = "#{message}#{type.clone}"
-      end
-
-      if scopes.any?
-        message = "#{message}(#{scopes.join(", ")})"
-      end
-
-      if breaking_change?
-        message = "#{message}!"
-      end
-
-      message = "#{message}: #{description}"
-
-      if pr_number
-        message = "#{message} (##{pr_number})"
-      end
-
-      GitLogCommit.new({
-        "author" => author,
-        "date" => date,
-        "deletions_count" => deletions_count,
-        "files_count" => files_count,
-        "insertions_count" => insertions_count,
-        "message" => message,
-        "sha" => sha
-      })
-    end
-
-    def to_s
-      "#{sha} #{type}(#{scopes.join(", ")})#{breaking_change? ? "!" : ""}: #{description} (##{pr_number})"
-    end
-  end
-end
diff --git a/scripts/util/conventional_commit.rb b/scripts/util/conventional_commit.rb
deleted file mode 100644
index 5944bb407f663..0000000000000
--- a/scripts/util/conventional_commit.rb
+++ /dev/null
@@ -1,97 +0,0 @@
-module Vector
-  class ConventionalCommit
-    class << self
-      def parse(message)
-        hash = parse_commit_message(message)
-        new(hash)
-      end
-
-      def parse!(message)
-        hash = parse_commit_message!(message)
-        new(hash)
-      end
-
-      private
-        def parse_commit_message(message)
-          begin
-            parse_commit_message!(message)
-          rescue Exception => e
-            if message.include?("Use `namespace` field in metric sources")
-              raise e
-            end
-
-            {
-              "breaking_change" => nil,
-              "description" => message,
-              "pr_number" => nil,
-              "scopes" => [],
-              "type" => nil
-            }
-          end
-        end
-
-        def parse_commit_message!(message)
-          match = message.match(/^(?<type>[a-z]*)(\((?<scope>[a-z0-9_, ]*)\))?(?<breaking_change>!)?: (?<description>.*?)( \(#(?<pr_number>[0-9]*)\))?$/)
-
-          if match.nil?
-            raise <<~EOF
-            Commit message does not conform to the conventional commit format.
-
-            Unable to parse at all!
-
-              #{message}
-
-            Please correct in the release /.meta file and retry.
-            EOF
-          end
-
-          attributes =
-            {
-              "type" => match[:type],
-              "breaking_change" => !match[:breaking_change].nil?,
-              "description" => match[:description]
-            }
-
-          attributes["scopes"] =
-            if match[:scope]
-              match[:scope].split(",").collect(&:strip)
-            else
-              []
-            end
-
-          attributes["pr_number"] =
-            if match[:pr_number]
-              match[:pr_number].to_i
-            else
-              nil
-            end
-
-          attributes
-        end
-    end
-
-    attr_reader :breaking_change,
-      :description,
-      :pr_number,
-      :type,
-      :scopes
-
-    def initialize(hash)
-      @breaking_change = hash.fetch("breaking_change")
-      @description = hash.fetch("description")
-      @pr_number = hash.fetch("pr_number")
-      @type = hash.fetch("type")
-      @scopes = hash.fetch("scopes")
-    end
-
-    def to_h
-      {
-          "breaking_change" => breaking_change,
-          "description" => description,
-          "pr_number" => pr_number,
-          "type" => type,
-          "scopes" => scopes
-      }
-    end
-  end
-end
diff --git a/scripts/util/git_log_commit.rb b/scripts/util/git_log_commit.rb
deleted file mode 100644
index fe8425209a86d..0000000000000
--- a/scripts/util/git_log_commit.rb
+++ /dev/null
@@ -1,122 +0,0 @@
-module Vector
-  class GitLogCommit
-    class << self
-      def fetch_since!(last_version)
-        range = "v#{last_version}..."
-        commit_log = `git log #{range} --cherry-pick --right-only --no-merges --pretty=format:'%H\t%s\t%aN\t%ad'`.chomp
-        commit_lines = commit_log.split("\n").reverse
-
-        commit_lines.collect do |commit_line|
-          hash = parse_commit_line!(commit_line)
-          new(hash)
-        end
-      end
-
-      def from_file!(path)
-        contents = File.read(path)
-        contents.split("\n").collect do |line|
-          hash = parse_commit_line!(line)
-          new(hash)
-        end
-      end
-
-      private
-        # This is used for the `files_count`, `insertions_count`, and `deletions_count`
-        # attributes. It helps to communicate stats and the depth of changes in our
-        # release notes.
-        def get_commit_stats(sha)
-          `git show --shortstat --oneline #{sha}`.split("\n").last
-        end
-
-        def parse_commit_line!(commit_line)
-          # Parse the full commit line
-          line_parts = commit_line.split("\t")
-          sha = line_parts.fetch(0)
-          message = line_parts.fetch(1)
-          author = line_parts.fetch(2)
-          date = Time.parse(line_parts.fetch(3)).utc
-
-          attributes =
-            {
-              "sha" =>  sha,
-              "author" => author,
-              "date" => date,
-              "message" => message
-            }
-
-          # Parse the stats
-          stats = get_commit_stats(attributes.fetch("sha"))
-          if /^\W*\p{Digit}+ files? changed,/.match(stats)
-            stats_attributes = parse_commit_stats!(stats)
-            attributes.merge!(stats_attributes)
-          end
-
-          attributes
-        end
-
-        # Parses the data from `#get_commit_stats`.
-        def parse_commit_stats!(stats)
-          attributes = {}
-
-          stats.split(", ").each do |stats_part|
-            stats_part.strip!
-
-            key =
-              case stats_part
-              when /insertions?/
-                "insertions_count"
-              when /deletions?/
-                "deletions_count"
-              when /files? changed/
-                "files_count"
-              else
-                raise "Invalid commit stat: #{stats_part}"
-              end
-
-            count = stats_part.match(/^(?<count>[0-9]*) /)[:count].to_i
-            attributes[key] = count
-          end
-
-          attributes["insertions_count"] ||= 0
-          attributes["deletions_count"] ||= 0
-          attributes["files_count"] ||= 0
-          attributes
-        end
-    end
-
-    attr_reader :author,
-      :date,
-      :deletions_count,
-      :files_count,
-      :insertions_count,
-      :message,
-      :raw,
-      :sha
-
-    def initialize(hash)
-      @author = hash.fetch("author")
-      @date = hash.fetch("date")
-      @deletions_count = hash.fetch("deletions_count", 0)
-      @files_count = hash.fetch("files_count", 0)
-      @insertions_count = hash.fetch("insertions_count", 0)
-      @message = hash.fetch("message")
-      @sha = hash.fetch("sha")
-    end
-
-    def to_h
-      {
-        "author" => author,
-        "date" => date,
-        "deletions_count" => deletions_count,
-        "files_count" => files_count,
-        "insertions_count" => insertions_count,
-        "message" => message,
-        "sha" => sha
-      }
-    end
-
-    def to_raw
-      "#{sha}\t#{message}\t#{author}\t#{date.strftime("%a %b %d %H:%M:%S %Y %z")}"
-    end
-  end
-end
diff --git a/scripts/util/printer.rb b/scripts/util/printer.rb
deleted file mode 100644
index 4f65f2d904359..0000000000000
--- a/scripts/util/printer.rb
+++ /dev/null
@@ -1,74 +0,0 @@
-require "paint"
-
-module Util
-  module Printer
-    PROMPT = "---> "
-    INDENT = "     "
-    SEPARATOR = "-" * 80
-    TITLE_PROMPT = "#### "
-
-    extend self
-
-    def error!(message)
-      Printer.say(message, color: :red)
-      exit(1)
-    end
-
-    def Printer.get(words, choices = nil)
-      question = "#{words.strip}"
-
-      if !choices.nil?
-        question += " (" + choices.join("/") + ")"
-      end
-
-      Printer.say(question)
-
-      print INDENT
-
-      input = gets().chomp
-
-      if choices && !choices.include?(input)
-        Printer.say("You must enter one of #{choices.join(", ")}", color: :red)
-        Printer.get(words, choices)
-      else
-        input
-      end
-    end
-
-    def invalid(words)
-      Printer.say(words, color: :yellow)
-    end
-
-    def say(words, color: nil, new: true, prompt: PROMPT)
-      prefix = new ? prompt : INDENT
-
-      if color
-        words = Paint[prefix + words, color]
-      else
-        words = prefix + words
-      end
-
-      puts words.gsub("\n", "\n#{INDENT}")
-    end
-
-    def separate(color: nil)
-      string = SEPARATOR
-
-      if color
-        string = Paint[string, color]
-      end
-
-      puts ""
-      puts string
-    end
-
-    def success(words)
-      Printer.say(words, color: :green)
-    end
-
-    def title(words)
-      separate(color: :cyan)
-      Printer.say(words, color: :cyan, prompt: TITLE_PROMPT)
-    end
-  end
-end
diff --git a/scripts/util/release.rb b/scripts/util/release.rb
deleted file mode 100644
index 112ee39e19536..0000000000000
--- a/scripts/util/release.rb
+++ /dev/null
@@ -1,39 +0,0 @@
-require_relative "commit"
-require_relative "version"
-
-module Vector
-  class Release
-    class << self
-      def all!(dir)
-        release_meta_paths = Dir.glob("#{dir}/*.cue").to_a
-
-        release_meta_paths.
-          collect do |release_meta_path|
-            urls_cue_path = File.join(File.dirname(release_meta_path), "..", "urls.cue")
-            release_json = `cue export #{urls_cue_path} #{release_meta_path}`
-            release_hash = JSON.parse(release_json)
-            name = release_hash.fetch("releases").keys.first
-            hash = release_hash.fetch("releases").values.first
-            new(hash.merge({"name" => name}))
-          end.
-          sort_by(&:version)
-      end
-    end
-
-    attr_reader :codename,
-      :commits,
-      :date,
-      :name,
-      :version,
-      :whats_next
-
-    def initialize(hash)
-      @codename = hash.fetch("codename", "")
-      @commits = hash.fetch("commits").collect { |commit_hash| Commit.new(commit_hash) }
-      @date = hash.fetch("date")
-      @name = hash.fetch("name")
-      @version = Util::Version.new(@name)
-      @whats_next = hash.fetch("whats_next", [])
-    end
-  end
-end
diff --git a/scripts/util/version.rb b/scripts/util/version.rb
deleted file mode 100644
index afc69ab15483f..0000000000000
--- a/scripts/util/version.rb
+++ /dev/null
@@ -1,45 +0,0 @@
-module Util
-  class Version < Gem::Version
-    def bump_type(other_version)
-      # Return nil if the other version is not greater than the current version
-      if other_version <= self
-        return nil
-      end
-
-      bumped_version = bump
-      next_major = segments.first + 1
-
-      if other_version.prerelease?
-        "pre"
-      elsif other_version < bumped_version
-        "patch"
-      elsif other_version == bumped_version
-        "minor"
-      elsif other_version.segments.first == next_major
-        "major"
-      else
-        nil
-      end
-    end
-
-    def major
-      segments[0]
-    end
-
-    def major_x
-      "#{segments[0]}.X"
-    end
-
-    def minor
-      segments[1]
-    end
-
-    def minor_x
-      "#{segments[0]}.#{segments[1]}.X"
-    end
-
-    def patch
-      segments[2]
-    end
-  end
-end
diff --git a/vdev/Cargo.toml b/vdev/Cargo.toml
index ff0265fddfc3e..68c92a4f198c2 100644
--- a/vdev/Cargo.toml
+++ b/vdev/Cargo.toml
@@ -46,6 +46,12 @@ strum.workspace = true
 indoc.workspace = true
 git2 = { version = "0.20.4" }
 cfg-if.workspace = true
+convert_case.workspace = true
+# Used by check-events to walk Rust source via syn's AST. The extra features
+# are vdev-local; they do not propagate into the `vector` package's build.
+syn = { workspace = true, features = ["full", "visit", "extra-traits", "printing", "parsing"] }
+proc-macro2 = { workspace = true, features = ["span-locations"] }
+quote.workspace = true
 
 [package.metadata.binstall]
 pkg-url = "{ repo }/releases/download/vdev-v{ version }/{ name }-{ target }-v{ version }.tgz"
diff --git a/vdev/README.md b/vdev/README.md
index c036bc3c891fd..c20860b1f06e1 100644
--- a/vdev/README.md
+++ b/vdev/README.md
@@ -23,7 +23,6 @@ This assumes that you have the following tools installed:
 - [cargo](https://rustup.rs/)
 - [docker](https://www.docker.com/)
 - [npm](https://www.npmjs.com/)
-- [ruby](https://www.ruby-lang.org/en/)
 
 Some other tools may need to be installed depending on the command you are running. All other
 dependencies can be installed by running
diff --git a/vdev/src/commands/build/mod.rs b/vdev/src/commands/build/mod.rs
index 6edd74dcf13a5..8124ff11aa5fd 100644
--- a/vdev/src/commands/build/mod.rs
+++ b/vdev/src/commands/build/mod.rs
@@ -11,7 +11,6 @@ crate::cli_subcommands! {
     licenses,
     manifests,
     publish_metadata,
-    release_cue,
     vector,
     vrl_docs,
     vrl_wasm,
@@ -21,7 +20,3 @@ crate::script_wrapper! {
     manifests = "Build Kubernetes manifests from latest Helm chart"
         => "generate-manifests.sh"
 }
-crate::script_wrapper! {
-    release_cue = "Build the release documentation files"
-        => "generate-release-cue.rb"
-}
diff --git a/vdev/src/commands/check/events.rs b/vdev/src/commands/check/events.rs
new file mode 100644
index 0000000000000..3ac1b87a8c6a5
--- /dev/null
+++ b/vdev/src/commands/check/events.rs
@@ -0,0 +1,1744 @@
+//! Walks `src/**/*.rs` and `lib/**/*.rs`, extracts internal-event definitions
+//! and `tracing` log calls via `syn`'s AST, and validates them against the
+//! rules in `docs/specs/instrumentation.md`. Macro argument scraping (the
+//! contents of `counter!(...)`, `trace!(...)`, etc.) uses small targeted
+//! regexes on the macro's already-tokenised input — never on raw source.
+
+#![allow(clippy::print_stdout, clippy::print_stderr)]
+
+use std::{
+    collections::{BTreeMap, HashMap},
+    fs,
+    path::PathBuf,
+    process,
+    sync::LazyLock,
+};
+
+use anyhow::Result;
+use convert_case::{Case, Casing};
+use glob::glob;
+use proc_macro2::TokenStream;
+use quote::ToTokens;
+use regex::Regex;
+use syn::{
+    ItemImpl, ItemStruct, Type,
+    spanned::Spanned,
+    visit::{self, Visit},
+};
+
+const BYTE_SIZE_COUNT: &[&str] = &["byte_size", "count"];
+
+const METRIC_NAME_EVENTS_DROPPED: &str = "component_discarded_events_total";
+const METRIC_NAME_ERROR: &str = "component_errors_total";
+
+struct EventClass {
+    /// Required log message text for events with this suffix.
+    message: &'static str,
+    /// Counter suffixes (full name is `component_<suffix>_total`).
+    counters: &'static [&'static str],
+    /// Tags that must appear on logs and on counters (minus `BYTE_SIZE_COUNT`).
+    additional_tags: &'static [&'static str],
+}
+
+const EVENT_CLASSES: &[(&str, EventClass)] = &[
+    (
+        "BytesReceived",
+        EventClass {
+            message: "Bytes received.",
+            counters: &["received_bytes"],
+            additional_tags: &["byte_size", "protocol"],
+        },
+    ),
+    (
+        "EventsReceived",
+        EventClass {
+            message: "Events received.",
+            counters: &["received_events", "received_event_bytes"],
+            additional_tags: &["count", "byte_size"],
+        },
+    ),
+    (
+        "EventsSent",
+        EventClass {
+            message: "Events sent.",
+            counters: &["sent_events", "sent_event_bytes"],
+            additional_tags: &["count", "byte_size"],
+        },
+    ),
+    (
+        "BytesSent",
+        EventClass {
+            message: "Bytes sent.",
+            counters: &["sent_bytes"],
+            additional_tags: &["byte_size", "protocol"],
+        },
+    ),
+];
+
+#[derive(Debug, Default, Clone)]
+struct SkipFlags {
+    dropped_events: bool,
+    duplicate_check: bool,
+    validity_check: bool,
+}
+
+#[derive(Debug, Default, Clone)]
+struct Event {
+    path: Option<String>,
+    skip: SkipFlags,
+    emits_component_events_dropped: bool,
+    members: BTreeMap<String, String>,
+    counters: BTreeMap<String, BTreeMap<String, String>>,
+    metrics: BTreeMap<String, BTreeMap<String, String>>,
+    logs: Vec<LogCall>,
+    uses: u32,
+    internal_impl: bool,
+    register_impl: Option<String>,
+    impl_event_handle: bool,
+    reports: Vec<String>,
+}
+
+#[derive(Debug, Clone)]
+struct LogCall {
+    level: String,
+    message: String,
+    parameters: Vec<String>,
+}
+
+impl Event {
+    fn add_metric(&mut self, ty: &str, name: &str, tags: BTreeMap<String, String>) {
+        let key = format!("{ty}:{name}");
+        self.metrics.insert(key, tags.clone());
+        if ty == "counter" {
+            self.counters.insert(name.to_string(), tags);
+        }
+    }
+
+    fn add_log(&mut self, level: &str, message: &str, parameters: Vec<String>) {
+        self.logs.push(LogCall {
+            level: level.to_string(),
+            message: message.to_string(),
+            parameters,
+        });
+    }
+
+    fn append(&mut self, report: impl Into<String>) {
+        self.reports.push(report.into());
+    }
+
+    fn signature(&self) -> Option<String> {
+        if self.metrics.is_empty() && self.logs.is_empty() {
+            return None;
+        }
+        let members: Vec<String> = self
+            .members
+            .iter()
+            .map(|(name, ty)| format!("{name}:{ty}"))
+            .collect();
+        let mut metrics: Vec<String> = self
+            .metrics
+            .iter()
+            .map(|(name, tags)| {
+                let mut keys: Vec<&str> = tags.keys().map(String::as_str).collect();
+                keys.sort_unstable();
+                format!("{name}({})", keys.join(","))
+            })
+            .collect();
+        metrics.sort();
+        let mut logs: Vec<String> = self
+            .logs
+            .iter()
+            .map(|l| format!("[\"{}\", \"{}\", {:?}]", l.level, l.message, l.parameters))
+            .collect();
+        logs.sort();
+        Some(format!(
+            "{}[{}][{}]",
+            members.join(":"),
+            logs.join(";"),
+            metrics.join(";")
+        ))
+    }
+}
+
+// ---- Validation ------------------------------------------------------------
+
+fn log_level_one_of(reports: &mut Vec<String>, logs: &[LogCall], levels: &[&str]) {
+    if !logs.iter().any(|l| levels.contains(&l.level.as_str())) {
+        reports.push(format!(
+            "This event MUST log with one of these levels: [{}].",
+            levels
+                .iter()
+                .map(|l| format!("\"{l}\""))
+                .collect::<Vec<_>>()
+                .join(", ")
+        ));
+    }
+}
+
+fn counters_must_include_exclude_tags(
+    reports: &mut Vec<String>,
+    counters: &BTreeMap<String, BTreeMap<String, String>>,
+    name: &str,
+    required_tags: &[&str],
+    exclude_tags: &[&str],
+) {
+    let Some(tags) = counters.get(name) else {
+        reports.push(format!("This event MUST increment counter \"{name}\"."));
+        return;
+    };
+    for tag in required_tags {
+        if !tags.contains_key(*tag) {
+            reports.push(format!("Counter \"{name}\" MUST include tag \"{tag}\"."));
+        }
+    }
+    for tag in exclude_tags {
+        if tags.contains_key(*tag) {
+            reports.push(format!(
+                "Counter \"{name}\" MUST NOT include tag \"{tag}\"."
+            ));
+        }
+    }
+}
+
+fn check_event_class(reports: &mut Vec<String>, name: &str, event: &Event, handle: &Event) {
+    for (suffix, class) in EVENT_CLASSES {
+        if !name.ends_with(suffix) {
+            continue;
+        }
+        for log in &handle.logs {
+            if log.level != "trace" {
+                reports.push("Log type MUST be \"trace!\".".to_string());
+            }
+            if log.message != class.message {
+                reports.push(format!(
+                    "Log message MUST be \"{}\" (is \"{}\").",
+                    class.message, log.message
+                ));
+            }
+            for tag in class.additional_tags {
+                if !log.parameters.iter().any(|p| p == tag) {
+                    reports.push(format!("Log MUST contain tag \"{tag}\""));
+                }
+            }
+        }
+        for counter in class.counters {
+            let counter_name = format!("component_{counter}_total");
+            let required: Vec<&str> = class
+                .additional_tags
+                .iter()
+                .copied()
+                .filter(|t| !BYTE_SIZE_COUNT.contains(t))
+                .collect();
+            counters_must_include_exclude_tags(
+                reports,
+                &event.counters,
+                &counter_name,
+                &required,
+                &[],
+            );
+        }
+    }
+}
+
+fn check_error_event(reports: &mut Vec<String>, name: &str, event: &Event, handle: &Event) {
+    if !name.ends_with("Error") {
+        reports.push("Error events MUST be named \"___Error\".".to_string());
+    }
+    log_level_one_of(reports, &handle.logs, &["error"]);
+    counters_must_include_exclude_tags(
+        reports,
+        &event.counters,
+        METRIC_NAME_ERROR,
+        &["error_type", "stage"],
+        &[],
+    );
+    for log in &handle.logs {
+        if log.level != "error" {
+            continue;
+        }
+        for parameter in ["error_type", "stage"] {
+            if !log.parameters.iter().any(|p| p == parameter) {
+                reports.push(format!(
+                    "Error log for Error event MUST include parameter \"{parameter}\"."
+                ));
+            }
+        }
+        for parameter in ["error_code", "error_type", "stage"] {
+            if log.parameters.iter().any(|p| p == parameter)
+                && !event
+                    .counters
+                    .get(METRIC_NAME_ERROR)
+                    .is_some_and(|m| m.contains_key(parameter))
+            {
+                reports.push(format!(
+                    "Counter \"{METRIC_NAME_ERROR}\" must include \"{parameter}\" to match error log."
+                ));
+            }
+        }
+    }
+}
+
+fn check_events_dropped(reports: &mut Vec<String>, name: &str, event: &Event, handle: &Event) {
+    if event.emits_component_events_dropped {
+        if event.counters.contains_key(METRIC_NAME_EVENTS_DROPPED) {
+            reports.push(format!(
+                "Event emitting ComponentEventsDropped should not also increment counter `{METRIC_NAME_EVENTS_DROPPED}`"
+            ));
+        }
+        return;
+    }
+    if !name.ends_with("EventsDropped") {
+        reports.push("EventsDropped events MUST be named \"___EventsDropped\".".to_string());
+    }
+    log_level_one_of(reports, &handle.logs, &["error", "debug"]);
+    counters_must_include_exclude_tags(
+        reports,
+        &event.counters,
+        METRIC_NAME_EVENTS_DROPPED,
+        &["intentional"],
+        &["reason", "count"],
+    );
+    for log in &handle.logs {
+        if log.level != "error" {
+            continue;
+        }
+        for parameter in ["count", "intentional", "reason"] {
+            if !log.parameters.iter().any(|p| p == parameter) {
+                reports.push(format!(
+                    "Error log for EventsDropped event MUST include parameter \"{parameter}\"."
+                ));
+            }
+        }
+        if log.parameters.iter().any(|p| p == "intentional")
+            && !event
+                .counters
+                .get(METRIC_NAME_EVENTS_DROPPED)
+                .is_some_and(|m| m.contains_key("intentional"))
+        {
+            reports.push(format!(
+                "Counter \"{METRIC_NAME_EVENTS_DROPPED}\" must include \"intentional\" to match error log."
+            ));
+        }
+    }
+}
+
+fn check_error_counter_tag_constants(reports: &mut Vec<String>, event: &Event) {
+    for (cname, tags) in &event.counters {
+        if cname != METRIC_NAME_ERROR && cname != METRIC_NAME_EVENTS_DROPPED {
+            continue;
+        }
+        for (tag, value) in tags {
+            if tag == "stage" && !value.starts_with("error_stage::") {
+                reports.push(format!(
+                    "Counter \"{cname}\" tag \"{tag}\" value must be an \"error_stage\" constant."
+                ));
+            } else if tag == "error_type" && !value.starts_with("error_type::") {
+                reports.push(format!(
+                    "Counter \"{cname}\" tag \"{tag}\" value must be an \"error_type\" constant."
+                ));
+            }
+        }
+    }
+}
+
+fn validate_event(events: &HashMap<String, Event>, name: &str, handle_name: &str) -> Vec<String> {
+    let event = events.get(name).expect("event present");
+    let handle = events.get(handle_name).expect("handle present");
+    let mut reports: Vec<String> = Vec::new();
+
+    if event.uses == 0 {
+        reports.push("Event has no uses.".to_string());
+    }
+
+    check_event_class(&mut reports, name, event, handle);
+
+    let has_error_logs = handle.logs.iter().filter(|l| l.level == "error").count() == 1;
+    let is_events_dropped_event =
+        name.ends_with("EventsDropped") || event.counters.contains_key(METRIC_NAME_EVENTS_DROPPED);
+
+    if (has_error_logs && !is_events_dropped_event) || name.ends_with("Error") {
+        check_error_event(&mut reports, name, event, handle);
+    }
+
+    if is_events_dropped_event && !event.skip.dropped_events {
+        check_events_dropped(&mut reports, name, event, handle);
+    }
+
+    check_error_counter_tag_constants(&mut reports, event);
+
+    for r in &event.reports {
+        reports.push(r.clone());
+    }
+
+    reports
+}
+
+// ---- Macro arg parsers (operate on small token strings) --------------------
+
+/// `emit!(ComponentEventsDropped...)` detection regex, applied to the raw
+/// source slice of an impl block (which preserves comments and original
+/// formatting that `to_token_stream` strips).
+static RE_EMIT_DROPPED: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"(?:emit|register)!\([ \t\r\n]*ComponentEventsDropped(?:[^A-Za-z0-9_]|$)").unwrap()
+});
+
+/// `emit!(EventName)` / `register!(Path::EventName)` use-counting regex,
+/// applied to the raw file text so it sees calls nested inside other macros
+/// (e.g. `tokio::select!`) that `syn` does not descend into.
+static RE_USES: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(
+        r"(?:^|[^A-Za-z0-9_])(?:emit!?|register!?)\((?:[a-z][a-z0-9_:]+)?([A-Z][A-Za-z0-9]+)",
+    )
+    .unwrap()
+});
+
+/// Locator for `tracing` log-macro calls (`trace!(`, `debug!(`, `info!(`,
+/// `warn!(`, `error!(`) in raw source text. Used by the format-check pass
+/// because the AST visitor cannot see log calls nested inside opaque outer
+/// macros like `tokio::select!`.
+static RE_LOG_CALL_OPEN: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"(?:^|[^A-Za-z0-9_])(trace|debug|info|warn|error)!\(").unwrap());
+
+/// `"key" => value` tag-pair regex. Used inside `counter!(...)` arg lists.
+/// Note: syn's `TokenStream` rendering may produce `=>` as `= >`; the regex
+/// accepts either form via `=[ \t]*>`.
+static RE_TAG_PAIR: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#""([^"]+)"[ \t\r\n]*=[ \t\r\n]*>[ \t\r\n]*(.+?)(?:,|$)"#).unwrap()
+});
+
+/// Strip whitespace introduced by `TokenStream::to_string` around `::` so
+/// `error_stage :: PROCESSING` becomes `error_stage::PROCESSING` for the
+/// constant-prefix validation (`starts_with("error_stage::")`).
+fn normalize_value(s: &str) -> String {
+    let trimmed = s.trim();
+    let collapsed = Regex::new(r"[ \t\r\n]*::[ \t\r\n]*")
+        .unwrap()
+        .replace_all(trimmed, "::");
+    collapsed.into_owned()
+}
+
+/// Split a token stream that represents a comma-separated argument list into
+/// per-argument substrings, respecting bracket/paren/brace nesting and string
+/// literals. Operates on the (already-bounded) macro-arg token text.
+///
+/// Angle brackets are tracked as a separate depth so that generic-type commas
+/// like `Registered<ComponentEventsDropped<'static, INTENTIONAL>>` don't
+/// fragment a `registered_event!` field. `>` only decrements when there is a
+/// matching `<`, so the `>` in `key => value` tag pairs (used by `counter!`
+/// args) doesn't underflow.
+fn split_comma_args(s: &str) -> Vec<String> {
+    let mut out = Vec::new();
+    let mut depth: i32 = 0;
+    let mut angle_depth: i32 = 0;
+    let mut in_str = false;
+    let mut esc = false;
+    let mut start = 0;
+    let bytes = s.as_bytes();
+    for (i, &b) in bytes.iter().enumerate() {
+        if in_str {
+            if esc {
+                esc = false;
+            } else if b == b'\\' {
+                esc = true;
+            } else if b == b'"' {
+                in_str = false;
+            }
+            continue;
+        }
+        match b {
+            b'"' => in_str = true,
+            b'(' | b'[' | b'{' => depth += 1,
+            b')' | b']' | b'}' => depth -= 1,
+            b'<' => angle_depth += 1,
+            b'>' if angle_depth > 0 => angle_depth -= 1,
+            b',' if depth == 0 && angle_depth == 0 => {
+                out.push(s[start..i].trim().to_string());
+                start = i + 1;
+            }
+            _ => {}
+        }
+    }
+    let last = s[start..].trim().to_string();
+    if !last.is_empty() {
+        out.push(last);
+    }
+    out
+}
+
+#[derive(Debug)]
+struct ParsedMetric {
+    ty: String,
+    name: String,
+    tags: BTreeMap<String, String>,
+}
+
+/// Parse a `counter!(...)` / `gauge!(...)` / `histogram!(...)` invocation's
+/// already-tokenised args into a name (string literal or `CamelCase` variant
+/// of `<X>Name::Variant`) and its `"key" => value` tag pairs.
+fn parse_metric_args(ty: &str, tokens: &TokenStream) -> Option<ParsedMetric> {
+    let raw = tokens.to_string();
+    let args = split_comma_args(&raw);
+    if args.is_empty() {
+        return None;
+    }
+    let name = parse_metric_name(args[0].as_str())?;
+    let mut tags = BTreeMap::new();
+    let rest = args[1..].join(",");
+    for caps in RE_TAG_PAIR.captures_iter(&rest) {
+        tags.insert(caps[1].to_string(), normalize_value(&caps[2]));
+    }
+    if tags.is_empty() {
+        for caps in RE_TAG_PAIR.captures_iter(&raw) {
+            tags.insert(caps[1].to_string(), normalize_value(&caps[2]));
+        }
+    }
+    Some(ParsedMetric {
+        ty: ty.to_string(),
+        name,
+        tags,
+    })
+}
+
+/// Extract the metric name from the first arg of a `counter!`/`gauge!`/`histogram!`.
+/// Accepts `"literal"` or `<TypeName>::<Variant>`.
+fn parse_metric_name(arg: &str) -> Option<String> {
+    let arg = arg.trim();
+    if let Some(stripped) = arg.strip_prefix('"').and_then(|s| s.strip_suffix('"')) {
+        return Some(stripped.to_string());
+    }
+    // path::Variant — Ruby matched `\w+Name::(\w+)` and snake-cased the variant.
+    let re = Regex::new(r"^[A-Za-z0-9_]+Name[ \t]*::[ \t]*([A-Za-z0-9_]+)").unwrap();
+    re.captures(arg).map(|c| (&c[1]).to_case(Case::Snake))
+}
+
+#[derive(Debug)]
+struct ParsedLog {
+    /// The captured message text (string literal contents *or* variable name
+    /// if the message was passed as an expression). Always set when the log
+    /// has any message-shaped argument.
+    message: String,
+    /// Whether the message came from a string literal (`"..."`). Format
+    /// checks (capitalised, trailing period) only run on literal messages.
+    has_literal_message: bool,
+    parameters: Vec<String>,
+}
+
+/// Parse a `trace!(...)` / `debug!(...)` / `info!(...)` / `warn!(...)` /
+/// `error!(...)` invocation's already-stringified args into the message text
+/// and the list of parameter names it carries.
+///
+/// `tracing` allows the message in any position: leading positional literal,
+/// trailing positional literal, or `message = "..."` named field. We mirror
+/// the Ruby script: take the first string-literal value across all args (be
+/// it a positional `"..."` or a `message = "..."` named field) and treat it
+/// as the message. Only when no literal is present do we fall back to the
+/// first bare positional expression — otherwise patterns like
+/// `warn!(%error, "Failed to flush.")` would never have their message format
+/// checked because the bare `%error` would be claimed as the message first.
+fn parse_log_args(raw: &str) -> ParsedLog {
+    let args = split_comma_args(raw);
+
+    let mut literal_message: Option<String> = None;
+    let mut named_var_message: Option<String> = None;
+    let mut bare_positional_message: Option<String> = None;
+    let mut parameters: Vec<String> = Vec::new();
+
+    for arg in &args {
+        let trimmed = arg.trim();
+        if trimmed.starts_with("target :") || trimmed.starts_with("parent :") {
+            continue;
+        }
+
+        // `message = ...` (named field). The value may or may not be a literal.
+        if let Some(rest) = trimmed.strip_prefix("message")
+            && let Some(value) = rest.trim_start().strip_prefix('=').map(str::trim_start)
+        {
+            let value = value.trim();
+            if let Some(stripped) = value.strip_prefix('"').and_then(|s| s.strip_suffix('"')) {
+                if literal_message.is_none() {
+                    literal_message = Some(stripped.to_string());
+                }
+            } else if named_var_message.is_none() {
+                named_var_message = Some(value.to_string());
+            }
+            continue;
+        }
+
+        // Leading/trailing positional string literal (`"..."` standalone arg).
+        if let Some(stripped) = trimmed.strip_prefix('"').and_then(|s| s.strip_suffix('"')) {
+            if literal_message.is_none() {
+                literal_message = Some(stripped.to_string());
+            }
+            continue;
+        }
+
+        // Bare positional expression (no `=`). Track the first one as a
+        // candidate message in case no literal is found later, and *also*
+        // record it as a parameter — `tracing` lets the same expression
+        // serve both roles.
+        if !trimmed.contains('=') {
+            if bare_positional_message.is_none() {
+                bare_positional_message = Some(trimmed.to_string());
+            }
+            if let Some(name) = parameter_name(trimmed) {
+                parameters.push(name);
+            }
+            continue;
+        }
+
+        // Any other `key = value` named field: just a parameter.
+        if let Some(name) = parameter_name(trimmed) {
+            parameters.push(name);
+        }
+    }
+
+    let (message, has_literal_message) = if let Some(m) = literal_message {
+        (m, true)
+    } else if let Some(m) = named_var_message {
+        (m, false)
+    } else if let Some(m) = bare_positional_message {
+        (m, false)
+    } else {
+        (String::new(), false)
+    };
+
+    ParsedLog {
+        message,
+        has_literal_message,
+        parameters,
+    }
+}
+
+/// Extract the parameter name from a log-macro arg. `tracing` accepts:
+/// `name = expr`, `?name`, `%name`, and bare `name`. Token-stream
+/// serialisation puts whitespace around punctuation (`% protocol`) so we
+/// trim after stripping each prefix.
+fn parameter_name(arg: &str) -> Option<String> {
+    let s = arg.trim();
+    if s.is_empty() {
+        return None;
+    }
+    if let Some((lhs, _)) = s.split_once('=') {
+        let lhs = lhs
+            .trim()
+            .trim_start_matches('?')
+            .trim_start_matches('%')
+            .trim();
+        if is_identifier(lhs) {
+            return Some(lhs.to_string());
+        }
+    }
+    let stripped = s
+        .trim_start_matches('?')
+        .trim_start_matches('%')
+        .trim_start();
+    let head: String = stripped
+        .chars()
+        .take_while(|c| c.is_ascii_alphanumeric() || *c == '_' || *c == '.')
+        .collect();
+    if !head.is_empty() && head.chars().any(|c| c.is_ascii_alphabetic() || c == '_') {
+        return Some(head);
+    }
+    None
+}
+
+fn is_identifier(s: &str) -> bool {
+    !s.is_empty()
+        && s.chars()
+            .all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '.')
+        && s.chars()
+            .next()
+            .is_some_and(|c| c.is_ascii_alphabetic() || c == '_')
+}
+
+// ---- AST scanner -----------------------------------------------------------
+
+#[derive(Clone)]
+struct ImplCtx {
+    event_name: String,
+}
+
+struct Scanner<'a> {
+    events: &'a mut HashMap<String, Event>,
+    path_str: String,
+    in_internal_events_dir: bool,
+    skip_dropped_for_file: bool,
+    text: &'a str,
+    impl_stack: Vec<ImplCtx>,
+}
+
+impl<'ast> Visit<'ast> for Scanner<'_> {
+    fn visit_item_struct(&mut self, node: &'ast ItemStruct) {
+        if self.in_internal_events_dir {
+            let name = node.ident.to_string();
+            let event = self.events.entry(name).or_default();
+            event.path = Some(self.path_str.clone());
+            event.skip.dropped_events = self.skip_dropped_for_file;
+            for field in &node.fields {
+                if let Some(ident) = &field.ident {
+                    let ty = field.ty.to_token_stream().to_string();
+                    event.members.insert(ident.to_string(), ty);
+                }
+            }
+        }
+        visit::visit_item_struct(self, node);
+    }
+
+    fn visit_item_impl(&mut self, node: &'ast ItemImpl) {
+        let trait_name = node
+            .trait_
+            .as_ref()
+            .and_then(|(_, path, _)| path.segments.last())
+            .map(|s| s.ident.to_string());
+        let event_name = match &*node.self_ty {
+            Type::Path(tp) => tp.path.segments.last().map(|s| s.ident.to_string()),
+            _ => None,
+        };
+
+        if self.in_internal_events_dir
+            && let (Some(trait_name), Some(event_name)) = (trait_name.as_deref(), event_name)
+        {
+            let mut handled = false;
+            if matches!(
+                trait_name,
+                "InternalEvent" | "RegisterInternalEvent" | "InternalEventHandle"
+            ) {
+                // The token-stream form of the impl block has all comments
+                // stripped by syn, so the `## skip ##` markers (which live in
+                // line comments) are missing. Read them from the original
+                // source text within the span instead.
+                let raw_block = source_slice(self.text, node.span());
+                let registers_inside = node.to_token_stream().to_string().contains("register (");
+
+                let event = self.events.entry(event_name.clone()).or_default();
+                event.path = Some(self.path_str.clone());
+                event.skip.duplicate_check |=
+                    raw_block.contains("## skip check-duplicate-events ##");
+                event.skip.validity_check |= raw_block.contains("## skip check-validity-events ##");
+
+                match trait_name {
+                    "InternalEvent" => {
+                        if !registers_inside {
+                            event.internal_impl = true;
+                        }
+                    }
+                    "RegisterInternalEvent" => {
+                        event.register_impl = Some(event_name.clone());
+                        event.append(
+                            "Do not implement RegisterInternalEvent manually. Use the registered_event! macro instead.",
+                        );
+                    }
+                    "InternalEventHandle" => event.impl_event_handle = true,
+                    _ => {}
+                }
+                if RE_EMIT_DROPPED.is_match(&raw_block) {
+                    event.emits_component_events_dropped = true;
+                }
+                self.impl_stack.push(ImplCtx { event_name });
+                handled = true;
+            }
+            visit::visit_item_impl(self, node);
+            if handled {
+                self.impl_stack.pop();
+            }
+            return;
+        }
+        visit::visit_item_impl(self, node);
+    }
+
+    fn visit_macro(&mut self, node: &'ast syn::Macro) {
+        let name = node
+            .path
+            .segments
+            .last()
+            .map(|s| s.ident.to_string())
+            .unwrap_or_default();
+
+        // Use-counting, ComponentEventsDropped detection, and the
+        // log-message format check all run via a separate raw-source pass
+        // because `syn` does not descend into the bodies of arbitrary
+        // `tokio::select!` / `cfg_if!` / etc. macro invocations.
+
+        // Inside an InternalEvent-family impl: capture logs / metrics /
+        //    ComponentEventsDropped emissions for the active event.
+        if let Some(ctx) = self.impl_stack.last().cloned() {
+            match name.as_str() {
+                "trace" | "debug" | "info" | "warn" | "error" => {
+                    let parsed = parse_log_args(&node.tokens.to_string());
+                    let event = self.events.entry(ctx.event_name.clone()).or_default();
+                    event.add_log(&name, &parsed.message, parsed.parameters);
+                }
+                "counter" | "gauge" | "histogram" => {
+                    if let Some(metric) = parse_metric_args(&name, &node.tokens) {
+                        let event = self.events.entry(ctx.event_name.clone()).or_default();
+                        event.add_metric(&metric.ty, &metric.name, metric.tags);
+                    }
+                }
+                _ => {}
+            }
+        }
+        if name == "registered_event" {
+            self.handle_registered_event(node);
+        }
+
+        visit::visit_macro(self, node);
+    }
+}
+
+impl Scanner<'_> {
+    /// Parse a `registered_event!` invocation's tokens to extract the event
+    /// name, members, handle metrics, and emit-block log calls.
+    fn handle_registered_event(&mut self, mac: &syn::Macro) {
+        let raw = mac.tokens.to_string();
+        // Event name: first ident.
+        let Some(event_name) = first_ident(&raw) else {
+            return;
+        };
+        let event = self.events.entry(event_name.clone()).or_default();
+        event.path = Some(self.path_str.clone());
+
+        // Pull out the optional `{ event_fields }` immediately after the name,
+        // then `=> { handle_fields }`, and the `fn emit(...)  { body }`.
+        let after_name = match raw.find(&event_name) {
+            Some(idx) => &raw[idx + event_name.len()..],
+            None => return,
+        };
+        let after_name = after_name.trim_start();
+
+        // Extract `{ ... }` after name, if any (optional event fields).
+        let (event_fields_text, after_fields): (Option<String>, &str) =
+            if after_name.starts_with('{') {
+                let (block, rest) = split_brace_block(after_name);
+                (Some(block.to_string()), rest)
+            } else {
+                (None, after_name)
+            };
+
+        // Parse member fields from the event-fields block.
+        if let Some(block) = event_fields_text {
+            for arg in split_comma_args(&block) {
+                if let Some((name, ty)) = arg.split_once(':') {
+                    event
+                        .members
+                        .insert(name.trim().to_string(), ty.trim().to_string());
+                }
+            }
+        }
+
+        // Skip past `=> { handle_fields }`.
+        let after_arrow = after_fields.trim_start();
+        let after_arrow = after_arrow
+            .strip_prefix("=>")
+            .unwrap_or(after_arrow)
+            .trim_start();
+        let (handle_block, _after_handle) = if after_arrow.starts_with('{') {
+            let (block, rest) = split_brace_block(after_arrow);
+            (block.to_string(), rest)
+        } else {
+            return;
+        };
+
+        // Each handle field: `name : type = expr ,`. Pick out metric calls
+        // inside the `expr` portion to register on the event.
+        for arg in split_comma_args(&handle_block) {
+            let arg = arg.trim();
+            if arg.is_empty() {
+                continue;
+            }
+            // Attempt to parse the assignment.
+            let after_colon = match arg.find(':') {
+                Some(i) => &arg[i + 1..],
+                None => continue,
+            };
+            let Some((_ty, expr)) = after_colon.split_once('=') else {
+                continue;
+            };
+            let expr = expr.trim();
+
+            // Look for embedded `counter!` / `gauge!` / `histogram!` calls.
+            for ty in ["counter", "gauge", "histogram"] {
+                let needle = format!("{ty} ! (");
+                if let Some(idx) = expr.find(&needle) {
+                    // Find the matching `)` from the `(` after `!`.
+                    let after = &expr[idx + needle.len()..];
+                    if let Some(end) = match_paren_end(after) {
+                        let inside = &after[..end];
+                        let toks: TokenStream = inside.parse().unwrap_or_default();
+                        if let Some(metric) = parse_metric_args(ty, &toks) {
+                            event.add_metric(&metric.ty, &metric.name, metric.tags);
+                        }
+                    }
+                }
+            }
+
+            // Component-events-dropped emission.
+            if expr.contains("emit ! (ComponentEventsDropped")
+                || expr.contains("register ! (ComponentEventsDropped")
+            {
+                event.emits_component_events_dropped = true;
+            }
+        }
+
+        // The emit-fn body. Find `fn emit (...) { ... }` after the handle block.
+        // We re-scan the original tokens for any log macros within the impl
+        // body via the AST visitor — simpler than reparsing here. The handle
+        // block above already covers metric extraction. Logs registered to the
+        // outer event come from the visit_macro handling above when the visitor
+        // descends into nested macros (note: macros aren't normal items, so
+        // visit_macro won't recurse into a parent macro's tokens). To capture
+        // log calls inside `registered_event!`, we parse them out by scanning
+        // the macro's full token text for log macro signatures.
+        for ty in ["trace", "debug", "info", "warn", "error"] {
+            let needle = format!("{ty} ! (");
+            let mut start = 0;
+            while let Some(idx) = raw[start..].find(&needle) {
+                let after = &raw[start + idx + needle.len()..];
+                if let Some(end) = match_paren_end(after) {
+                    let inside = &after[..end];
+                    let parsed = parse_log_args(inside);
+                    let event = self.events.entry(event_name.clone()).or_default();
+                    event.add_log(ty, &parsed.message, parsed.parameters);
+                    start = start + idx + needle.len() + end;
+                } else {
+                    break;
+                }
+            }
+        }
+    }
+}
+
+/// Format-check every `tracing` log macro invocation in `text` (a Rust
+/// source file's contents). Returns a list of human-readable report lines.
+///
+/// Operates on the raw source rather than via the AST so that log calls
+/// nested inside opaque outer macros (`tokio::select!`, `cfg_if!`, …) are
+/// also covered — those bodies are not visited by `syn`.
+fn format_check_log_messages(text: &str, path_str: &str) -> Vec<String> {
+    let mut reports = Vec::new();
+    for caps in RE_LOG_CALL_OPEN.captures_iter(text) {
+        let level_match = caps.get(1).expect("group 1 is the level");
+        let level = level_match.as_str();
+        // The match ends with the literal `(`. Walk forward from there to
+        // find the matching `)` accounting for nested parens / braces /
+        // brackets and string literals; this is the inside of the macro.
+        let after_paren = caps.get(0).expect("full match").end();
+        if after_paren > text.len() {
+            continue;
+        }
+        let body_start = after_paren; // position right after `(`
+        let Some(close_offset) = match_paren_end(&text[body_start..]) else {
+            continue;
+        };
+        let inside = &text[body_start..body_start + close_offset];
+        let parsed = parse_log_args(inside);
+        if !parsed.has_literal_message {
+            continue;
+        }
+        let message = parsed.message;
+        if message.is_empty() {
+            continue;
+        }
+        let is_capitalized = message.starts_with('{')
+            || !message
+                .chars()
+                .next()
+                .is_some_and(|c| c.is_ascii_alphabetic())
+            || message
+                .chars()
+                .next()
+                .is_some_and(|c| c.is_ascii_uppercase());
+        let has_trailing_period = message.ends_with('}') || message.ends_with('.');
+        if is_capitalized && has_trailing_period {
+            continue;
+        }
+        let line_no = text[..level_match.start()].matches('\n').count() + 1;
+        if !is_capitalized {
+            reports.push(format!(
+                "    Message must start with a capital. (`{level}` call on {path_str}:{line_no})"
+            ));
+        }
+        if !has_trailing_period {
+            reports.push(format!(
+                "    Message must end with a period. (`{level}` call on {path_str}:{line_no})"
+            ));
+        }
+    }
+    reports
+}
+
+/// Extract the source slice covered by a `proc_macro2::Span`. Used to read
+/// line-comment skip markers (e.g. `## skip check-validity-events ##`) which
+/// `syn` discards from the AST.
+fn source_slice(text: &str, span: proc_macro2::Span) -> String {
+    let start = span.start();
+    let end = span.end();
+    let mut out = String::new();
+    for (i, line) in text.lines().enumerate() {
+        let line_no = i + 1;
+        if line_no >= start.line && line_no <= end.line {
+            out.push_str(line);
+            out.push('\n');
+        }
+        if line_no > end.line {
+            break;
+        }
+    }
+    out
+}
+
+/// Given a string starting with `(`, find the index of the matching `)`.
+fn match_paren_end(s: &str) -> Option<usize> {
+    // `s` here is the text right after the opening `(`. Walk it tracking depth.
+    let mut depth: i32 = 1;
+    let mut in_str = false;
+    let mut esc = false;
+    for (i, b) in s.bytes().enumerate() {
+        if in_str {
+            if esc {
+                esc = false;
+            } else if b == b'\\' {
+                esc = true;
+            } else if b == b'"' {
+                in_str = false;
+            }
+            continue;
+        }
+        match b {
+            b'"' => in_str = true,
+            b'(' => depth += 1,
+            b')' => {
+                depth -= 1;
+                if depth == 0 {
+                    return Some(i);
+                }
+            }
+            _ => {}
+        }
+    }
+    None
+}
+
+/// Split a `{ ... }` block off the front of `s`, returning `(inside, rest)`.
+fn split_brace_block(s: &str) -> (&str, &str) {
+    if !s.starts_with('{') {
+        return ("", s);
+    }
+    let mut depth = 0i32;
+    let mut in_str = false;
+    let mut esc = false;
+    for (i, b) in s.bytes().enumerate() {
+        if in_str {
+            if esc {
+                esc = false;
+            } else if b == b'\\' {
+                esc = true;
+            } else if b == b'"' {
+                in_str = false;
+            }
+            continue;
+        }
+        match b {
+            b'"' => in_str = true,
+            b'{' => depth += 1,
+            b'}' => {
+                depth -= 1;
+                if depth == 0 {
+                    return (&s[1..i], &s[i + 1..]);
+                }
+            }
+            _ => {}
+        }
+    }
+    ("", s)
+}
+
+/// Pull the first identifier-shaped substring out of a token text.
+fn first_ident(s: &str) -> Option<String> {
+    for tok in s.split(|c: char| !c.is_ascii_alphanumeric() && c != '_') {
+        if !tok.is_empty()
+            && tok
+                .chars()
+                .next()
+                .is_some_and(|c| c.is_ascii_alphabetic() || c == '_')
+        {
+            return Some(tok.to_string());
+        }
+    }
+    None
+}
+
+// ---- CLI -------------------------------------------------------------------
+
+/// Check that internal events satisfy the patterns set in
+/// <https://github.com/vectordotdev/vector/blob/master/docs/specs/instrumentation.md>.
+#[derive(clap::Args, Debug)]
+#[command()]
+pub(super) struct Cli {}
+
+fn collect_source_paths() -> Result<Vec<PathBuf>> {
+    let mut paths: Vec<PathBuf> = Vec::new();
+    for pattern in ["src/**/*.rs", "lib/**/*.rs"] {
+        for entry in glob(pattern)? {
+            paths.push(entry?);
+        }
+    }
+    paths.sort();
+    Ok(paths)
+}
+
+fn scan_file(path: &PathBuf, events: &mut HashMap<String, Event>) -> Result<usize> {
+    let path_str = path.to_string_lossy().replace('\\', "/");
+    let text = fs::read_to_string(path)?;
+    let lower = text.to_ascii_lowercase();
+
+    let in_internal_events = path_str.starts_with("src/internal_events/")
+        || path_str.starts_with("lib/vector-common/src/internal_event/");
+    let in_src = path_str.starts_with("src/");
+    let skip_dropped = lower.contains("## skip check-dropped-events ##");
+
+    for caps in RE_USES.captures_iter(&text) {
+        let name = caps[1].to_string();
+        events.entry(name).or_default().uses += 1;
+    }
+
+    let mut errors = 0usize;
+    if in_src {
+        let format_reports = format_check_log_messages(&text, &path_str);
+        if !format_reports.is_empty() {
+            for r in &format_reports {
+                println!("{r}");
+            }
+            errors += format_reports.len();
+        }
+    }
+
+    let file = match syn::parse_file(&text) {
+        Ok(f) => f,
+        Err(e) => {
+            eprintln!("warning: failed to parse {path_str}: {e}");
+            return Ok(errors);
+        }
+    };
+
+    let mut scanner = Scanner {
+        events,
+        path_str: path_str.clone(),
+        in_internal_events_dir: in_internal_events,
+        skip_dropped_for_file: skip_dropped,
+        text: &text,
+        impl_stack: Vec::new(),
+    };
+    visit::visit_file(&mut scanner, &file);
+    Ok(errors)
+}
+
+fn report_event_errors(events: &HashMap<String, Event>, name: &str, handle_name: &str) -> bool {
+    let reports = validate_event(events, name, handle_name);
+    if reports.is_empty() {
+        return false;
+    }
+    let path = events
+        .get(name)
+        .and_then(|e| e.path.as_deref())
+        .unwrap_or("?");
+    println!("{path}: Errors in event {name}:");
+    for r in &reports {
+        println!("    {r}");
+    }
+    true
+}
+
+fn validate_all(events: &HashMap<String, Event>) -> usize {
+    let mut names: Vec<String> = events.keys().cloned().collect();
+    names.sort();
+    let mut duplicates: HashMap<String, Vec<String>> = HashMap::new();
+    let mut error_count = 0usize;
+
+    for name in &names {
+        let event = events.get(name).expect("present");
+        if !event.skip.duplicate_check
+            && (event.internal_impl || event.impl_event_handle)
+            && let Some(sig) = event.signature()
+        {
+            duplicates.entry(sig).or_default().push(name.clone());
+        }
+        if event.skip.validity_check {
+            continue;
+        }
+        if event.internal_impl {
+            if report_event_errors(events, name, name) {
+                error_count += 1;
+            }
+        } else if let Some(handle_name) = event.register_impl.as_deref() {
+            if events.contains_key(handle_name) {
+                if report_event_errors(events, name, handle_name) {
+                    error_count += 1;
+                }
+            } else {
+                println!("Registered event {name} references nonexistent handle {handle_name}");
+                error_count += 1;
+            }
+        }
+    }
+
+    let mut dup_keys: Vec<&String> = duplicates.keys().collect();
+    dup_keys.sort();
+    for sig in dup_keys {
+        let dupes = &duplicates[sig];
+        if dupes.len() > 1 {
+            println!("Duplicate events detected: {}", dupes.join(", "));
+            error_count += 1;
+        }
+    }
+
+    error_count
+}
+
+impl Cli {
+    pub(super) fn exec(self) -> Result<()> {
+        // Resolve all `src/**` / `lib/**` globs against the repo root rather
+        // than the caller's CWD. Without this, running the binary from
+        // anywhere outside the repo root silently scans nothing and reports
+        // `0 error(s)` — which the previous Ruby script wrapper avoided
+        // because it was always invoked with the repo as the working dir.
+        let repo_root = crate::utils::paths::find_repo_root()?;
+        std::env::set_current_dir(&repo_root)?;
+
+        let mut events: HashMap<String, Event> = HashMap::new();
+        let mut error_count = 0usize;
+
+        for path in &collect_source_paths()? {
+            error_count += scan_file(path, &mut events)?;
+        }
+
+        error_count += validate_all(&events);
+
+        println!("{error_count} error(s)");
+        if error_count > 0 {
+            process::exit(1);
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn split_comma_args_respects_nesting() {
+        assert_eq!(
+            split_comma_args(r#""a", "b" => "c, d", e"#),
+            vec![
+                r#""a""#.to_string(),
+                r#""b" => "c, d""#.to_string(),
+                "e".to_string(),
+            ]
+        );
+    }
+
+    #[test]
+    fn split_comma_args_respects_angle_brackets() {
+        // A `registered_event!` handle field with a generic type containing a
+        // comma must not be split at the comma inside `<...>`.
+        let input = "events_dropped : Registered<ComponentEventsDropped<'static, INTENTIONAL>> = register!(X)";
+        assert_eq!(split_comma_args(input), vec![input.to_string()]);
+    }
+
+    #[test]
+    fn parse_metric_name_string_or_variant() {
+        assert_eq!(
+            parse_metric_name(r#""my_metric""#),
+            Some("my_metric".to_string())
+        );
+        assert_eq!(
+            parse_metric_name("CounterName::ComponentErrorsTotal"),
+            Some("component_errors_total".to_string())
+        );
+        assert_eq!(parse_metric_name("not_a_metric"), None);
+    }
+
+    #[test]
+    fn signature_none_when_empty() {
+        assert!(Event::default().signature().is_none());
+    }
+
+    fn parse(src: &str) -> ParsedLog {
+        let mac: syn::Macro = syn::parse_str(src).expect("parse macro");
+        parse_log_args(&mac.tokens.to_string())
+    }
+
+    #[test]
+    fn parse_log_args_literal_message_first() {
+        let p = parse(r#"trace!("Hello there.", count = 1)"#);
+        assert_eq!(p.message, "Hello there.");
+        assert!(p.has_literal_message);
+        assert_eq!(p.parameters, vec!["count".to_string()]);
+    }
+
+    #[test]
+    fn parse_log_args_literal_message_named() {
+        let p = parse(r#"error!(message = "Stuff broke.", error_type = err)"#);
+        assert_eq!(p.message, "Stuff broke.");
+        assert!(p.has_literal_message);
+        assert_eq!(p.parameters, vec!["error_type".to_string()]);
+    }
+
+    #[test]
+    fn parse_log_args_variable_message_named() {
+        let p = parse("error!(message = exec_reason, error_type = err, stage = stg)");
+        assert_eq!(p.message, "exec_reason");
+        assert!(!p.has_literal_message);
+        assert_eq!(
+            p.parameters,
+            vec!["error_type".to_string(), "stage".to_string()]
+        );
+    }
+
+    #[test]
+    fn parse_log_args_trailing_string_literal() {
+        // Some sites pass key=values first and the literal message last —
+        // tracing accepts this.
+        let p = parse(r#"error!(path = req.uri().path(), "Bad request.")"#);
+        assert_eq!(p.message, "Bad request.");
+        assert!(p.has_literal_message);
+        assert!(p.parameters.contains(&"path".to_string()));
+    }
+
+    #[test]
+    fn format_check_finds_nested_log_calls() {
+        // `syn` does not descend into the bodies of opaque outer macros like
+        // `tokio::select!`, which is why this check runs over the raw source
+        // rather than via the AST visitor. Fixture covers both a top-level
+        // violation and one nested inside `tokio::select!`.
+        let src = r#"
+            fn _f() {
+                error!("missing period");
+                tokio::select! {
+                    _ = something() => {
+                        info!("lowercase first.");
+                    }
+                }
+            }
+        "#;
+        let reports = format_check_log_messages(src, "fixture.rs");
+        let joined = reports.join("\n");
+        assert!(
+            joined.contains("Message must end with a period.") && joined.contains("`error` call"),
+            "expected period-violation report, got: {joined}"
+        );
+        assert!(
+            joined.contains("Message must start with a capital.") && joined.contains("`info` call"),
+            "expected capital-violation report on the nested info!, got: {joined}"
+        );
+    }
+
+    #[test]
+    fn format_check_skips_non_literal_messages() {
+        // `error!(?err, "Plain text.")` — literal is fine, no report.
+        let src = r#"fn _f() { error!(?err, "Plain text."); }"#;
+        let reports = format_check_log_messages(src, "fixture.rs");
+        assert!(reports.is_empty(), "expected no reports, got: {reports:?}");
+    }
+
+    #[test]
+    fn parse_log_args_bare_field_then_trailing_literal() {
+        // `warn!(%error, "Message.")` — the bare field comes first but the
+        // string literal is the real message. The parser must scan all args
+        // for a literal before falling back to the bare expression as the
+        // message, otherwise the format checks never fire here.
+        let p = parse(r#"warn!(%error, "Failed to flush.")"#);
+        assert_eq!(p.message, "Failed to flush.");
+        assert!(p.has_literal_message);
+        assert!(p.parameters.contains(&"error".to_string()));
+    }
+
+    #[test]
+    fn parse_log_args_percent_capture() {
+        let p = parse(r#"trace!(message = "Bytes received.", byte_size = bs, %protocol)"#);
+        assert!(p.has_literal_message);
+        assert_eq!(p.message, "Bytes received.");
+        assert!(p.parameters.contains(&"byte_size".to_string()));
+        assert!(p.parameters.contains(&"protocol".to_string()));
+    }
+
+    fn check(message: &str) -> (bool, bool) {
+        // Replicates the gating in `format_check_log_messages` for a literal message.
+        let is_capitalized = message.starts_with('{')
+            || !message
+                .chars()
+                .next()
+                .is_some_and(|c| c.is_ascii_alphabetic())
+            || message
+                .chars()
+                .next()
+                .is_some_and(|c| c.is_ascii_uppercase());
+        let has_trailing_period = message.ends_with('}') || message.ends_with('.');
+        (is_capitalized, has_trailing_period)
+    }
+
+    #[test]
+    fn message_format_capital_period_pass() {
+        assert_eq!(check("Hello there."), (true, true));
+    }
+
+    #[test]
+    fn message_format_lowercase_first_fails() {
+        let (cap, _) = check("hello there.");
+        assert!(!cap);
+    }
+
+    #[test]
+    fn message_format_no_period_fails() {
+        let (_, period) = check("Hello there");
+        assert!(!period);
+    }
+
+    #[test]
+    fn message_format_interpolation_passes() {
+        // `{...}` at start or end is fine — we can't see what it expands to.
+        assert_eq!(check("{count} dropped."), (true, true));
+        assert_eq!(check("Dropped {count}"), (true, true));
+    }
+
+    #[test]
+    fn message_format_non_alpha_first_passes() {
+        // E.g. starts with a number — no capitalisation requirement.
+        assert_eq!(check("42 things happened."), (true, true));
+    }
+
+    // ---- validate_event branch coverage --------------------------------
+    //
+    // Each test builds a synthetic `Event` (or a `(event, handle)` pair for
+    // registered events), inserts it into a HashMap, calls `validate_event`,
+    // and asserts on the returned report list. This covers the rule branches
+    // independently of the parsing/scanning layer.
+
+    fn mk_event() -> Event {
+        Event {
+            uses: 1, // default to "has uses" so that branch isn't always firing
+            internal_impl: true,
+            ..Default::default()
+        }
+    }
+
+    fn one_log(level: &str, message: &str, params: &[&str]) -> Vec<LogCall> {
+        vec![LogCall {
+            level: level.to_string(),
+            message: message.to_string(),
+            parameters: params.iter().map(|s| (*s).to_string()).collect(),
+        }]
+    }
+
+    fn counter(tags: &[(&str, &str)]) -> BTreeMap<String, String> {
+        tags.iter()
+            .map(|(k, v)| ((*k).to_string(), (*v).to_string()))
+            .collect()
+    }
+
+    fn run(name: &str, event: Event) -> Vec<String> {
+        let mut events = HashMap::new();
+        events.insert(name.to_string(), event);
+        validate_event(&events, name, name)
+    }
+
+    #[test]
+    fn validate_event_no_uses_reported() {
+        let mut e = mk_event();
+        e.uses = 0;
+        let r = run("Foo", e);
+        assert!(r.iter().any(|m| m == "Event has no uses."));
+    }
+
+    #[test]
+    fn validate_bytes_received_log_type_must_be_trace() {
+        let mut e = mk_event();
+        e.logs = one_log("info", "Bytes received.", &["byte_size", "protocol"]);
+        e.counters.insert(
+            "component_received_bytes_total".to_string(),
+            counter(&[("protocol", "tcp")]),
+        );
+        let r = run("FooBytesReceived", e);
+        assert!(r.iter().any(|m| m == "Log type MUST be \"trace!\"."));
+    }
+
+    #[test]
+    fn validate_bytes_received_log_message_exact() {
+        let mut e = mk_event();
+        e.logs = one_log(
+            "trace",
+            "Bytes were received here.",
+            &["byte_size", "protocol"],
+        );
+        e.counters.insert(
+            "component_received_bytes_total".to_string(),
+            counter(&[("protocol", "tcp")]),
+        );
+        let r = run("FooBytesReceived", e);
+        assert!(
+            r.iter()
+                .any(|m| m.contains("Log message MUST be \"Bytes received.\""))
+        );
+    }
+
+    #[test]
+    fn validate_bytes_received_log_required_tag() {
+        let mut e = mk_event();
+        e.logs = one_log("trace", "Bytes received.", &["byte_size"]); // missing protocol
+        e.counters.insert(
+            "component_received_bytes_total".to_string(),
+            counter(&[("protocol", "tcp")]),
+        );
+        let r = run("FooBytesReceived", e);
+        assert!(r.iter().any(|m| m == "Log MUST contain tag \"protocol\""));
+    }
+
+    #[test]
+    fn validate_bytes_received_counter_required_tag() {
+        let mut e = mk_event();
+        e.logs = one_log("trace", "Bytes received.", &["byte_size", "protocol"]);
+        e.counters
+            .insert("component_received_bytes_total".to_string(), counter(&[])); // missing protocol
+        let r = run("FooBytesReceived", e);
+        assert!(r.iter().any(|m| {
+            m == "Counter \"component_received_bytes_total\" MUST include tag \"protocol\"."
+        }));
+    }
+
+    #[test]
+    fn validate_events_received_class() {
+        let mut e = mk_event();
+        e.logs = one_log("trace", "Wrong message.", &["count", "byte_size"]);
+        let r = run("FooEventsReceived", e);
+        assert!(
+            r.iter()
+                .any(|m| m.contains("Log message MUST be \"Events received.\""))
+        );
+        assert!(
+            r.iter()
+                .any(|m| m
+                    == "This event MUST increment counter \"component_received_events_total\".")
+        );
+    }
+
+    #[test]
+    fn validate_error_event_must_be_named_error() {
+        let mut e = mk_event();
+        e.logs = one_log("error", "Something failed.", &["error_type", "stage"]);
+        e.counters.insert(
+            METRIC_NAME_ERROR.to_string(),
+            counter(&[
+                ("error_type", "error_type::CONNECTION_FAILED"),
+                ("stage", "error_stage::PROCESSING"),
+            ]),
+        );
+        let r = run("BadlyNamed", e);
+        assert!(
+            r.iter()
+                .any(|m| m == "Error events MUST be named \"___Error\".")
+        );
+    }
+
+    #[test]
+    fn validate_error_event_log_level_must_be_error() {
+        let mut e = mk_event();
+        // info-level log when name ends with Error
+        e.logs = one_log("info", "Something failed.", &["error_type", "stage"]);
+        e.counters.insert(
+            METRIC_NAME_ERROR.to_string(),
+            counter(&[
+                ("error_type", "error_type::CONNECTION_FAILED"),
+                ("stage", "error_stage::PROCESSING"),
+            ]),
+        );
+        let r = run("FooError", e);
+        assert!(
+            r.iter()
+                .any(|m| m.contains("MUST log with one of these levels: [\"error\"]"))
+        );
+    }
+
+    #[test]
+    fn validate_error_event_log_must_include_error_type_and_stage() {
+        let mut e = mk_event();
+        e.logs = one_log("error", "Something failed.", &[]); // no error_type, no stage
+        e.counters.insert(
+            METRIC_NAME_ERROR.to_string(),
+            counter(&[
+                ("error_type", "error_type::CONNECTION_FAILED"),
+                ("stage", "error_stage::PROCESSING"),
+            ]),
+        );
+        let r = run("FooError", e);
+        assert!(
+            r.iter()
+                .any(|m| m == "Error log for Error event MUST include parameter \"error_type\".")
+        );
+        assert!(
+            r.iter()
+                .any(|m| m == "Error log for Error event MUST include parameter \"stage\".")
+        );
+    }
+
+    #[test]
+    fn validate_error_counter_must_match_error_log_params() {
+        let mut e = mk_event();
+        // Log mentions error_code but counter doesn't
+        e.logs = one_log("error", "Failed.", &["error_type", "stage", "error_code"]);
+        e.counters.insert(
+            METRIC_NAME_ERROR.to_string(),
+            counter(&[
+                ("error_type", "error_type::CONNECTION_FAILED"),
+                ("stage", "error_stage::PROCESSING"),
+            ]),
+        );
+        let r = run("FooError", e);
+        assert!(r.iter().any(|m| {
+            m == "Counter \"component_errors_total\" must include \"error_code\" to match error log."
+        }));
+    }
+
+    #[test]
+    fn validate_error_stage_must_be_constant() {
+        let mut e = mk_event();
+        e.logs = one_log("error", "Failed.", &["error_type", "stage"]);
+        e.counters.insert(
+            METRIC_NAME_ERROR.to_string(),
+            counter(&[
+                ("error_type", "error_type::CONNECTION_FAILED"),
+                ("stage", "\"processing\""),
+            ]),
+        );
+        let r = run("FooError", e);
+        assert!(
+            r.iter()
+                .any(|m| m.contains("must be an \"error_stage\" constant"))
+        );
+    }
+
+    #[test]
+    fn validate_error_type_must_be_constant() {
+        let mut e = mk_event();
+        e.logs = one_log("error", "Failed.", &["error_type", "stage"]);
+        e.counters.insert(
+            METRIC_NAME_ERROR.to_string(),
+            counter(&[
+                ("error_type", "\"connection_failed\""),
+                ("stage", "error_stage::PROCESSING"),
+            ]),
+        );
+        let r = run("FooError", e);
+        assert!(
+            r.iter()
+                .any(|m| m.contains("must be an \"error_type\" constant"))
+        );
+    }
+
+    #[test]
+    fn validate_events_dropped_must_be_named_events_dropped() {
+        let mut e = mk_event();
+        e.logs = one_log(
+            "error",
+            "Events dropped.",
+            &["count", "intentional", "reason"],
+        );
+        e.counters.insert(
+            METRIC_NAME_EVENTS_DROPPED.to_string(),
+            counter(&[("intentional", "false")]),
+        );
+        let r = run("BadlyNamed", e);
+        assert!(
+            r.iter()
+                .any(|m| m == "EventsDropped events MUST be named \"___EventsDropped\".")
+        );
+    }
+
+    #[test]
+    fn validate_events_dropped_log_level_error_or_debug() {
+        let mut e = mk_event();
+        e.logs = one_log("info", "Dropped.", &["count", "intentional", "reason"]);
+        e.counters.insert(
+            METRIC_NAME_EVENTS_DROPPED.to_string(),
+            counter(&[("intentional", "false")]),
+        );
+        let r = run("FooEventsDropped", e);
+        assert!(
+            r.iter().any(|m| {
+                m.contains("MUST log with one of these levels: [\"error\", \"debug\"]")
+            })
+        );
+    }
+
+    #[test]
+    fn validate_events_dropped_counter_required_and_excluded_tags() {
+        let mut e = mk_event();
+        e.logs = one_log("error", "Dropped.", &["count", "intentional", "reason"]);
+        // Missing intentional, has reason and count (which it must NOT)
+        e.counters.insert(
+            METRIC_NAME_EVENTS_DROPPED.to_string(),
+            counter(&[("reason", "\"r\""), ("count", "1")]),
+        );
+        let r = run("FooEventsDropped", e);
+        assert!(r.iter().any(|m| {
+            m == "Counter \"component_discarded_events_total\" MUST include tag \"intentional\"."
+        }));
+        assert!(r.iter().any(|m| {
+            m == "Counter \"component_discarded_events_total\" MUST NOT include tag \"reason\"."
+        }));
+        assert!(r.iter().any(|m| {
+            m == "Counter \"component_discarded_events_total\" MUST NOT include tag \"count\"."
+        }));
+    }
+
+    #[test]
+    fn validate_events_dropped_log_required_params() {
+        let mut e = mk_event();
+        // Error log present but missing required params (count, intentional, reason)
+        e.logs = one_log("error", "Dropped.", &[]);
+        e.counters.insert(
+            METRIC_NAME_EVENTS_DROPPED.to_string(),
+            counter(&[("intentional", "false")]),
+        );
+        let r = run("FooEventsDropped", e);
+        for p in ["count", "intentional", "reason"] {
+            assert!(
+                r.iter().any(|m| m
+                    == &format!(
+                        "Error log for EventsDropped event MUST include parameter \"{p}\"."
+                    )),
+                "missing report for parameter {p} in: {r:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn validate_emits_dropped_must_not_also_increment_counter() {
+        let mut e = mk_event();
+        e.emits_component_events_dropped = true;
+        e.counters.insert(
+            METRIC_NAME_EVENTS_DROPPED.to_string(),
+            counter(&[("intentional", "false")]),
+        );
+        let r = run("FooEventsDropped", e);
+        assert!(r.iter().any(|m| {
+            m.contains("should not also increment counter")
+                && m.contains(METRIC_NAME_EVENTS_DROPPED)
+        }));
+    }
+
+    #[test]
+    fn validate_clean_event_no_reports() {
+        // A correctly-shaped Error event should produce no reports.
+        let mut e = mk_event();
+        e.logs = one_log("error", "Connection failed.", &["error_type", "stage"]);
+        e.counters.insert(
+            METRIC_NAME_ERROR.to_string(),
+            counter(&[
+                ("error_type", "error_type::CONNECTION_FAILED"),
+                ("stage", "error_stage::PROCESSING"),
+            ]),
+        );
+        let r = run("ConnectionFailedError", e);
+        assert!(r.is_empty(), "expected no reports, got: {r:?}");
+    }
+}
diff --git a/vdev/src/commands/check/mod.rs b/vdev/src/commands/check/mod.rs
index 44a2242cc35b3..91e97de05f029 100644
--- a/vdev/src/commands/check/mod.rs
+++ b/vdev/src/commands/check/mod.rs
@@ -1,5 +1,6 @@
 mod component_features;
 mod deny;
+mod events;
 mod examples;
 mod fmt;
 mod generated_docs;
@@ -29,8 +30,3 @@ crate::script_wrapper! {
     docs = "Check that all /docs files are valid"
         => "check-docs.sh"
 }
-
-crate::script_wrapper! {
-    events = "Check that events satisfy patterns set in <https://github.com/vectordotdev/vector/blob/master/docs/specs/instrumentation.md>"
-        => "check-events"
-}
diff --git a/vdev/src/commands/release/generate_cue.rs b/vdev/src/commands/release/generate_cue.rs
new file mode 100644
index 0000000000000..5ac95237029eb
--- /dev/null
+++ b/vdev/src/commands/release/generate_cue.rs
@@ -0,0 +1,825 @@
+use std::{
+    env,
+    fmt::Write as _,
+    fs,
+    path::{Path, PathBuf},
+    process::Command,
+};
+
+use anyhow::{Context, Result, anyhow, bail};
+use chrono::Utc;
+use regex::Regex;
+use semver::Version;
+use serde_json::json;
+
+use crate::utils::{git, paths};
+
+const RELEASES_DIR: &str = "website/cue/reference/releases";
+const CHANGELOG_DIR: &str = "changelog.d";
+
+/// Conventional-commit types that require a scope.
+const TYPES_REQUIRING_SCOPES: &[&str] = &["feat", "enhancement", "fix"];
+
+/// Allowed conventional-commit types.
+const ALLOWED_TYPES: &[&str] = &[
+    "chore",
+    "docs",
+    "feat",
+    "fix",
+    "enhancement",
+    "perf",
+    "revert",
+];
+
+/// Generate the release CUE file for the given new version. Returns the path that was written.
+pub(super) fn run(new_version: &Version) -> Result<PathBuf> {
+    let repo_root = paths::find_repo_root()?;
+    env::set_current_dir(&repo_root)?;
+
+    info!("Creating release meta file...");
+
+    let last_version = find_latest_release_tag()?;
+    let commits = fetch_commits_since(&last_version)?;
+
+    validate_single_bump(&last_version, new_version)?;
+    let new_version = new_version.clone();
+
+    let cue_path = repo_root
+        .join(RELEASES_DIR)
+        .join(format!("{new_version}.cue"));
+    if cue_path.exists() {
+        bail!(
+            "{} already exists. Delete it (or move it aside) and re-run.",
+            cue_path.display()
+        );
+    }
+
+    // Drop any commits that have already been recorded in a previous
+    // release CUE file. `--cherry-pick --right-only` only catches
+    // patch-id-equivalent commits, so non-identical backports of the same
+    // change (different SHA, same PR number) can otherwise re-appear in the
+    // next release CUE.
+    let already_released = collect_released_identifiers(&repo_root.join(RELEASES_DIR))?;
+    let commits: Vec<Commit> = commits
+        .into_iter()
+        .filter(|c| {
+            !already_released.shas.contains(&c.sha)
+                && c.pr_number
+                    .is_none_or(|pr| !already_released.pr_numbers.contains(&pr))
+        })
+        .collect();
+
+    if commits.is_empty() {
+        bail!("No commits found since v{last_version}; nothing to release.");
+    }
+
+    for c in &commits {
+        c.validate()?;
+    }
+
+    let changelog_dir = repo_root.join(CHANGELOG_DIR);
+    let changelog_entries = read_changelog_fragments(&changelog_dir)?;
+
+    let cue_text = render_release_cue(&new_version, &changelog_entries, &commits);
+    fs::write(&cue_path, cue_text)
+        .with_context(|| format!("Failed to write {}", cue_path.display()))?;
+
+    // Retire the changelog fragments via `git rm` (preserves README.md).
+    retire_changelog_fragments(&changelog_dir)?;
+
+    // Format with `cue fmt` (best-effort: warn but do not fail if cue is missing).
+    if let Err(e) = run_cue_fmt(&cue_path) {
+        warn!("cue fmt failed (skipping format): {e}");
+    }
+
+    success!("Wrote {}", cue_path.display());
+    Ok(cue_path)
+}
+
+// ---------- Tag / version discovery ----------
+
+/// Set of commit identifiers already recorded in `website/cue/reference/releases/*.cue`.
+struct ReleasedIdentifiers {
+    shas: std::collections::HashSet<String>,
+    pr_numbers: std::collections::HashSet<u64>,
+}
+
+/// Scan every existing release CUE file for the `sha:` and `pr_number:`
+/// fields inside its `commits:` array and return the union as two sets.
+///
+/// We extract via simple regexes rather than running `cue export`. The shape
+/// of these files is well-defined (auto-generated and `cue fmt`-normalised
+/// against `urls.cue`) so this is the cheapest correct option, and avoids a
+/// runtime dependency on the `cue` binary just for de-duplication.
+fn collect_released_identifiers(releases_dir: &Path) -> Result<ReleasedIdentifiers> {
+    let mut out = ReleasedIdentifiers {
+        shas: std::collections::HashSet::new(),
+        pr_numbers: std::collections::HashSet::new(),
+    };
+    if !releases_dir.is_dir() {
+        return Ok(out);
+    }
+    let sha_re = Regex::new(r#"sha:[ \t]*"([0-9a-fA-F]{7,64})""#).unwrap();
+    let pr_re = Regex::new(r"pr_number:[ \t]*([0-9]+)").unwrap();
+    for entry in fs::read_dir(releases_dir)? {
+        let entry = entry?;
+        let path = entry.path();
+        if path.extension().is_none_or(|e| e != "cue") {
+            continue;
+        }
+        let text = fs::read_to_string(&path)
+            .with_context(|| format!("Failed to read {}", path.display()))?;
+        for caps in sha_re.captures_iter(&text) {
+            out.shas.insert(caps[1].to_string());
+        }
+        for caps in pr_re.captures_iter(&text) {
+            if let Ok(n) = caps[1].parse::<u64>() {
+                out.pr_numbers.insert(n);
+            }
+        }
+    }
+    Ok(out)
+}
+
+/// Find the latest semver release tag of the form `vX.Y.Z`, ignoring `vdev-v...` tags.
+pub(super) fn find_latest_release_tag() -> Result<Version> {
+    let tag_re = Regex::new(r"^v[0-9]+\.[0-9]+\.[0-9]+$").unwrap();
+    let output = git::run_and_check_output(&["tag", "--list", "--sort=-v:refname"])?;
+    for tag in output.lines() {
+        if tag.starts_with("vdev-v") {
+            continue;
+        }
+        if tag_re.is_match(tag) {
+            let v = Version::parse(tag.trim_start_matches('v'))
+                .with_context(|| format!("Failed to parse version from tag {tag}"))?;
+            return Ok(v);
+        }
+    }
+    bail!("No valid semantic version tag found (e.g. v1.2.3)")
+}
+
+fn validate_single_bump(last: &Version, new: &Version) -> Result<()> {
+    if bump_type(last, new).is_none() {
+        bail!(
+            "The specified version '{new}' must be a single patch, minor, or major bump from {last}"
+        );
+    }
+    Ok(())
+}
+
+/// Returns Some("patch"|"minor"|"major") if `new` is exactly one bump above `last`, else None.
+fn bump_type(last: &Version, new: &Version) -> Option<&'static str> {
+    if new <= last {
+        return None;
+    }
+    let patch = Version::new(last.major, last.minor, last.patch + 1);
+    let minor = Version::new(last.major, last.minor + 1, 0);
+    let major = if last.major == 0 {
+        Version::new(0, last.minor + 1, 0)
+    } else {
+        Version::new(last.major + 1, 0, 0)
+    };
+    if *new == patch {
+        Some("patch")
+    } else if *new == minor {
+        Some("minor")
+    } else if *new == major {
+        Some("major")
+    } else {
+        None
+    }
+}
+
+// ---------- Commit fetching / parsing ----------
+
+#[derive(Debug, Clone)]
+struct Commit {
+    sha: String,
+    author: String,
+    date: String,
+    description: String,
+    r#type: Option<String>,
+    scopes: Vec<String>,
+    breaking_change: bool,
+    pr_number: Option<u64>,
+    files_count: u64,
+    insertions_count: u64,
+    deletions_count: u64,
+}
+
+impl Commit {
+    fn validate(&self) -> Result<()> {
+        // The release path *must* refuse to write a release CUE that contains
+        // commits whose subject didn't match the conventional-commit format —
+        // otherwise a malformed PR title slips silently into the published
+        // release notes. The Ruby release flow used a strict (`!`-suffixed)
+        // parser at this point for the same reason.
+        let Some(t) = self.r#type.as_deref() else {
+            bail!(
+                "Commit {} ({}) does not match the conventional-commit format \
+                 (`type(scope): description (#pr)`); fix the PR title or amend \
+                 the commit subject before tagging the release.",
+                self.sha,
+                self.description
+            );
+        };
+        if !ALLOWED_TYPES.contains(&t) {
+            bail!(
+                "Commit {} has invalid type '{}'. Allowed types: {:?}",
+                self.sha,
+                t,
+                ALLOWED_TYPES
+            );
+        }
+        if TYPES_REQUIRING_SCOPES.contains(&t) && self.scopes.is_empty() {
+            bail!(
+                "Commit {} of type '{}' requires a scope. Description: {}",
+                self.sha,
+                t,
+                self.description
+            );
+        }
+        Ok(())
+    }
+
+    fn render_cue(&self) -> String {
+        let scopes_json = serde_json::to_string(&self.scopes).expect("scopes serialise");
+        let pr_number = match self.pr_number {
+            Some(n) => n.to_string(),
+            None => "null".to_string(),
+        };
+        let type_json = match &self.r#type {
+            Some(t) => serde_json::to_string(t).unwrap(),
+            None => "null".to_string(),
+        };
+        format!(
+            "{{sha: {sha}, date: {date}, description: {description}, pr_number: {pr_number}, scopes: {scopes}, type: {type_field}, breaking_change: {breaking}, author: {author}, files_count: {files}, insertions_count: {ins}, deletions_count: {del}}}",
+            sha = json!(self.sha),
+            date = json!(self.date),
+            description = json!(self.description),
+            scopes = scopes_json,
+            type_field = type_json,
+            breaking = self.breaking_change,
+            author = json!(self.author),
+            files = self.files_count,
+            ins = self.insertions_count,
+            del = self.deletions_count,
+        )
+    }
+}
+
+fn fetch_commits_since(last_version: &Version) -> Result<Vec<Commit>> {
+    // Use the three-dot symmetric-difference range so `--cherry-pick`
+    // / `--right-only` filter out commits already released on the previous
+    // tag's branch (matches the Ruby `v#{last_version}...` form).
+    let range = format!("v{last_version}...");
+    let log_output = git::run_and_check_output(&[
+        "log",
+        &range,
+        "--cherry-pick",
+        "--right-only",
+        "--no-merges",
+        "--pretty=format:%H\t%s\t%aN\t%aI",
+    ])?;
+
+    let mut commits: Vec<Commit> = Vec::new();
+    for line in log_output.lines().rev() {
+        let parts: Vec<&str> = line.splitn(4, '\t').collect();
+        if parts.len() != 4 {
+            warn!("Skipping unparseable git log line: {line}");
+            continue;
+        }
+        let sha = parts[0].to_string();
+        let message = parts[1];
+        let author = parts[2].to_string();
+        let date = format_commit_date(parts[3]);
+        let conv = ConventionalParts::parse(message);
+        let (files, ins, del) = commit_stats(&sha)?;
+
+        commits.push(Commit {
+            sha,
+            author,
+            date,
+            description: conv.description,
+            r#type: conv.r#type,
+            scopes: conv.scopes,
+            breaking_change: conv.breaking_change,
+            pr_number: conv.pr_number,
+            files_count: files,
+            insertions_count: ins,
+            deletions_count: del,
+        });
+    }
+    Ok(commits)
+}
+
+/// Convert an ISO-8601 commit date (`%aI`) to the "YYYY-MM-DD HH:MM:SS UTC" form
+/// used in existing release CUE files.
+fn format_commit_date(iso: &str) -> String {
+    chrono::DateTime::parse_from_rfc3339(iso).map_or_else(
+        |_| iso.to_string(),
+        |dt| {
+            dt.with_timezone(&Utc)
+                .format("%Y-%m-%d %H:%M:%S UTC")
+                .to_string()
+        },
+    )
+}
+
+/// Returns `(files_changed, insertions, deletions)` from `git show --shortstat`.
+fn commit_stats(sha: &str) -> Result<(u64, u64, u64)> {
+    let out = git::run_and_check_output(&["show", "--shortstat", "--oneline", sha])?;
+    let stats_line = out.lines().last().unwrap_or("");
+    if !stats_line.contains("file") {
+        return Ok((0, 0, 0));
+    }
+    let mut files = 0u64;
+    let mut ins = 0u64;
+    let mut del = 0u64;
+    for part in stats_line.split(',') {
+        let part = part.trim();
+        let count: u64 = part
+            .split_whitespace()
+            .next()
+            .and_then(|n| n.parse().ok())
+            .unwrap_or(0);
+        if part.contains("insertion") {
+            ins = count;
+        } else if part.contains("deletion") {
+            del = count;
+        } else if part.contains("file") {
+            files = count;
+        }
+    }
+    Ok((files, ins, del))
+}
+
+#[derive(Debug)]
+struct ConventionalParts {
+    r#type: Option<String>,
+    scopes: Vec<String>,
+    breaking_change: bool,
+    description: String,
+    pr_number: Option<u64>,
+}
+
+impl ConventionalParts {
+    fn parse(message: &str) -> Self {
+        let re = Regex::new(
+            r"^(?P<type>[a-z]*)(\((?P<scope>[a-zA-Z0-9_, ]*)\))?(?P<breaking>!)?: (?P<desc>.*?)( \(#(?P<pr>[0-9]+)\))?$",
+        )
+        .unwrap();
+
+        if let Some(caps) = re.captures(message) {
+            let r#type = caps
+                .name("type")
+                .map(|m| m.as_str().to_string())
+                .filter(|s| !s.is_empty());
+            let scopes: Vec<String> = caps
+                .name("scope")
+                .map(|m| {
+                    m.as_str()
+                        .split(',')
+                        .map(|s| s.trim().to_string())
+                        .filter(|s| !s.is_empty())
+                        .collect()
+                })
+                .unwrap_or_default();
+            let breaking_change = caps.name("breaking").is_some();
+            let description = caps
+                .name("desc")
+                .map(|m| m.as_str().to_string())
+                .unwrap_or_default();
+            let pr_number = caps.name("pr").and_then(|m| m.as_str().parse::<u64>().ok());
+            ConventionalParts {
+                r#type,
+                scopes,
+                breaking_change,
+                description,
+                pr_number,
+            }
+        } else {
+            ConventionalParts {
+                r#type: None,
+                scopes: Vec::new(),
+                breaking_change: false,
+                description: message.to_string(),
+                pr_number: None,
+            }
+        }
+    }
+}
+
+// ---------- Changelog.d processing ----------
+
+#[derive(Debug)]
+struct ChangelogEntry {
+    /// Mapped CUE type ("chore" | "fix" | "feat" | "enhancement").
+    cue_type: String,
+    description: String,
+    contributors: Vec<String>,
+}
+
+fn read_changelog_fragments(dir: &Path) -> Result<Vec<ChangelogEntry>> {
+    if !dir.is_dir() {
+        return Ok(Vec::new());
+    }
+    let mut entries = Vec::new();
+    let mut paths: Vec<PathBuf> = fs::read_dir(dir)?
+        .filter_map(|e| e.ok().map(|e| e.path()))
+        .filter(|p| p.extension().is_some_and(|x| x == "md"))
+        .filter(|p| p.file_name().and_then(|n| n.to_str()) != Some("README.md"))
+        .collect();
+    paths.sort();
+    for path in paths {
+        let entry = parse_changelog_fragment(&path)?;
+        entries.push(entry);
+    }
+    Ok(entries)
+}
+
+fn parse_changelog_fragment(path: &Path) -> Result<ChangelogEntry> {
+    let stem = path
+        .file_stem()
+        .and_then(|n| n.to_str())
+        .ok_or_else(|| anyhow!("Bad fragment filename: {}", path.display()))?;
+    let parts: Vec<&str> = stem.split('.').collect();
+    if parts.len() != 2 {
+        bail!(
+            "Changelog fragment {} is invalid (filename must be <name>.<type>.md)",
+            path.display()
+        );
+    }
+    let fragment_type = parts[1];
+    let cue_type = match fragment_type {
+        "breaking" | "deprecation" => "chore",
+        "security" | "fix" => "fix",
+        "feature" => "feat",
+        "enhancement" => "enhancement",
+        other => bail!(
+            "Changelog fragment {} has unrecognized type '{}'",
+            path.display(),
+            other
+        ),
+    };
+
+    let raw =
+        fs::read_to_string(path).with_context(|| format!("Failed to read {}", path.display()))?;
+
+    let mut lines: Vec<&str> = raw.lines().collect();
+    let mut contributors: Vec<String> = Vec::new();
+    if let Some(last) = lines.last()
+        && let Some(rest) = last.strip_prefix("authors: ")
+    {
+        contributors = rest.split_whitespace().map(String::from).collect();
+        lines.pop();
+    }
+    let description = lines.join("\n").trim().to_string();
+
+    Ok(ChangelogEntry {
+        cue_type: cue_type.to_string(),
+        description,
+        contributors,
+    })
+}
+
+fn retire_changelog_fragments(dir: &Path) -> Result<()> {
+    if !dir.is_dir() {
+        return Ok(());
+    }
+    for entry in fs::read_dir(dir)? {
+        let entry = entry?;
+        let path = entry.path();
+        if path.extension().is_none_or(|x| x != "md") {
+            continue;
+        }
+        if path.file_name().and_then(|n| n.to_str()) == Some("README.md") {
+            continue;
+        }
+        let rel = path.strip_prefix(env::current_dir()?).unwrap_or(&path);
+        git::rm(&rel.to_string_lossy())?;
+    }
+    Ok(())
+}
+
+// ---------- CUE rendering ----------
+
+fn render_release_cue(
+    version: &Version,
+    changelog: &[ChangelogEntry],
+    commits: &[Commit],
+) -> String {
+    let date = Utc::now().format("%Y-%m-%d").to_string();
+    let changelog_block = render_changelog(changelog);
+    let commits_block = commits
+        .iter()
+        .map(Commit::render_cue)
+        .collect::<Vec<_>>()
+        .join(",\n    ");
+
+    format!(
+        "package metadata\n\
+         \n\
+         releases: \"{version}\": {{\n\
+         \tdate:     \"{date}\"\n\
+         \tcodename: \"\"\n\
+         \n\
+         \twhats_next: []\n\
+         \n\
+         \tchangelog: [\n\
+         {changelog_block}\n\
+         \t]\n\
+         \n\
+         \tcommits: [\n    {commits_block}\n\t]\n\
+         }}\n"
+    )
+}
+
+fn render_changelog(entries: &[ChangelogEntry]) -> String {
+    entries
+        .iter()
+        .map(|e| {
+            let mut s = String::new();
+            s.push_str("\t\t{\n");
+            writeln!(s, "\t\t\ttype: {}", json!(e.cue_type)).unwrap();
+            s.push_str("\t\t\tdescription: #\"\"\"\n");
+            for line in e.description.lines() {
+                writeln!(s, "\t\t\t\t{line}").unwrap();
+            }
+            s.push_str("\t\t\t\t\"\"\"#\n");
+            if !e.contributors.is_empty() {
+                let json_contribs = serde_json::to_string(&e.contributors).unwrap();
+                writeln!(s, "\t\t\tcontributors: {json_contribs}").unwrap();
+            }
+            s.push_str("\t\t}");
+            s
+        })
+        .collect::<Vec<_>>()
+        .join(",\n")
+}
+
+fn run_cue_fmt(path: &Path) -> Result<()> {
+    let status = Command::new("cue").arg("fmt").arg(path).status()?;
+    if !status.success() {
+        bail!("cue fmt exited with {status}");
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_conventional_basic() {
+        let p = ConventionalParts::parse("feat(kafka source): add new metric (#123)");
+        assert_eq!(p.r#type.as_deref(), Some("feat"));
+        assert_eq!(p.scopes, vec!["kafka source".to_string()]);
+        assert!(!p.breaking_change);
+        assert_eq!(p.description, "add new metric");
+        assert_eq!(p.pr_number, Some(123));
+    }
+
+    #[test]
+    fn parse_conventional_breaking() {
+        let p = ConventionalParts::parse("feat(api)!: drop legacy endpoint (#9)");
+        assert_eq!(p.r#type.as_deref(), Some("feat"));
+        assert!(p.breaking_change);
+        assert_eq!(p.description, "drop legacy endpoint");
+        assert_eq!(p.pr_number, Some(9));
+    }
+
+    #[test]
+    fn parse_conventional_multi_scope() {
+        let p = ConventionalParts::parse("fix(a, b): wip");
+        assert_eq!(p.scopes, vec!["a".to_string(), "b".to_string()]);
+        assert_eq!(p.pr_number, None);
+    }
+
+    #[test]
+    fn parse_conventional_uppercase_scope() {
+        // The semantic-PR workflow allows uppercase scopes like `ARC`, so the
+        // release-generation parser must accept them too.
+        let p = ConventionalParts::parse("fix(ARC): tweak retry policy (#456)");
+        assert_eq!(p.r#type.as_deref(), Some("fix"));
+        assert_eq!(p.scopes, vec!["ARC".to_string()]);
+        assert_eq!(p.description, "tweak retry policy");
+        assert_eq!(p.pr_number, Some(456));
+    }
+
+    #[test]
+    fn parse_conventional_unparseable_fallthrough() {
+        let p = ConventionalParts::parse("Merge branch 'foo'");
+        assert!(p.r#type.is_none());
+        assert_eq!(p.description, "Merge branch 'foo'");
+    }
+
+    #[test]
+    fn bump_type_patch_minor_major() {
+        let last = Version::new(1, 2, 3);
+        assert_eq!(bump_type(&last, &Version::new(1, 2, 4)), Some("patch"));
+        assert_eq!(bump_type(&last, &Version::new(1, 3, 0)), Some("minor"));
+        assert_eq!(bump_type(&last, &Version::new(2, 0, 0)), Some("major"));
+        assert_eq!(bump_type(&last, &Version::new(1, 2, 5)), None);
+        assert_eq!(bump_type(&last, &Version::new(1, 2, 3)), None);
+    }
+
+    #[test]
+    fn bump_type_zero_major() {
+        // For 0.x, "major" bump means 0.(x+1).0
+        let last = Version::new(0, 55, 0);
+        assert_eq!(bump_type(&last, &Version::new(0, 55, 1)), Some("patch"));
+        assert_eq!(bump_type(&last, &Version::new(0, 56, 0)), Some("minor"));
+    }
+
+    #[test]
+    fn read_changelog_fragments_maps_types_and_authors() {
+        let tmp = tempfile::tempdir().unwrap();
+        let dir = tmp.path();
+        fs::write(dir.join("README.md"), "ignored").unwrap();
+        fs::write(
+            dir.join("123_my_change.feature.md"),
+            "Adds a thing.\n\nIssue: https://example/123\n\nauthors: alice bob\n",
+        )
+        .unwrap();
+        fs::write(
+            dir.join("legacy_break.breaking.md"),
+            "Removed legacy thing.\n",
+        )
+        .unwrap();
+        fs::write(dir.join("sec.security.md"), "Patched a CVE.\n").unwrap();
+
+        let entries = read_changelog_fragments(dir).unwrap();
+        assert_eq!(entries.len(), 3);
+
+        // Sorted by filename
+        let by_type: Vec<_> = entries.iter().map(|e| e.cue_type.as_str()).collect();
+        assert_eq!(by_type, vec!["feat", "chore", "fix"]);
+
+        let feat = &entries[0];
+        assert_eq!(
+            feat.contributors,
+            vec!["alice".to_string(), "bob".to_string()]
+        );
+        assert!(feat.description.starts_with("Adds a thing."));
+        assert!(!feat.description.contains("authors:"));
+
+        // No-author entries get empty contributor list.
+        assert!(entries[1].contributors.is_empty());
+    }
+
+    #[test]
+    fn read_changelog_fragments_rejects_unknown_type() {
+        let tmp = tempfile::tempdir().unwrap();
+        fs::write(tmp.path().join("foo.bogus.md"), "x").unwrap();
+        assert!(read_changelog_fragments(tmp.path()).is_err());
+    }
+
+    #[test]
+    fn render_release_cue_matches_known_shape() {
+        let entries = vec![
+            ChangelogEntry {
+                cue_type: "feat".into(),
+                description: "Adds a thing.\nMulti-line.".into(),
+                contributors: vec!["alice".into()],
+            },
+            ChangelogEntry {
+                cue_type: "fix".into(),
+                description: "Fixed it.".into(),
+                contributors: vec![],
+            },
+        ];
+        let commits = vec![Commit {
+            sha: "abc123".into(),
+            author: "Pavlos".into(),
+            date: "2026-05-06 12:00:00 UTC".into(),
+            description: "do stuff".into(),
+            r#type: Some("feat".into()),
+            scopes: vec!["kafka source".into()],
+            breaking_change: false,
+            pr_number: Some(42),
+            files_count: 1,
+            insertions_count: 2,
+            deletions_count: 3,
+        }];
+
+        let out = render_release_cue(&Version::new(0, 99, 0), &entries, &commits);
+
+        assert!(out.starts_with("package metadata\n"));
+        assert!(out.contains("releases: \"0.99.0\":"));
+        assert!(out.contains("\twhats_next: []\n"));
+        assert!(out.contains("\t\t\ttype: \"feat\"\n"));
+        assert!(out.contains("\t\t\t\tAdds a thing.\n"));
+        assert!(out.contains("\t\t\t\tMulti-line.\n"));
+        assert!(out.contains("contributors: [\"alice\"]"));
+        // contributors line must NOT appear for the fix entry
+        assert!(out.contains("\t\t\ttype: \"fix\"\n"));
+        // Commit struct rendered inline.
+        assert!(out.contains("sha: \"abc123\""));
+        assert!(out.contains("scopes: [\"kafka source\"]"));
+        assert!(out.contains("pr_number: 42"));
+        assert!(out.contains("files_count: 1"));
+    }
+
+    #[test]
+    fn commit_validate_requires_scope_for_certain_types() {
+        let mut c = Commit {
+            sha: "x".into(),
+            author: "a".into(),
+            date: "d".into(),
+            description: "no scope".into(),
+            r#type: Some("feat".into()),
+            scopes: vec![],
+            breaking_change: false,
+            pr_number: None,
+            files_count: 0,
+            insertions_count: 0,
+            deletions_count: 0,
+        };
+        assert!(c.validate().is_err());
+        c.scopes = vec!["api".into()];
+        assert!(c.validate().is_ok());
+
+        // chore/docs don't need scopes
+        c.r#type = Some("chore".into());
+        c.scopes = vec![];
+        assert!(c.validate().is_ok());
+    }
+
+    #[test]
+    fn commit_validate_rejects_unknown_type() {
+        let c = Commit {
+            sha: "x".into(),
+            author: "a".into(),
+            date: "d".into(),
+            description: "x".into(),
+            r#type: Some("nope".into()),
+            scopes: vec!["a".into()],
+            breaking_change: false,
+            pr_number: None,
+            files_count: 0,
+            insertions_count: 0,
+            deletions_count: 0,
+        };
+        assert!(c.validate().is_err());
+    }
+
+    #[test]
+    fn commit_validate_rejects_unparseable_subject() {
+        // A non-conventional subject must abort the release path rather than
+        // silently land in the published CUE with type=null.
+        let c = Commit {
+            sha: "x".into(),
+            author: "a".into(),
+            date: "d".into(),
+            description: "Merge branch 'foo'".into(),
+            r#type: None,
+            scopes: Vec::new(),
+            breaking_change: false,
+            pr_number: None,
+            files_count: 0,
+            insertions_count: 0,
+            deletions_count: 0,
+        };
+        let err = c.validate().expect_err("must reject unparseable subject");
+        let msg = format!("{err}");
+        assert!(
+            msg.contains("conventional-commit format"),
+            "error should mention the rule: {msg}"
+        );
+    }
+
+    #[test]
+    fn collect_released_identifiers_extracts_shas_and_pr_numbers() {
+        let tmp = tempfile::tempdir().unwrap();
+        // A trimmed-down CUE file shaped like the real release cues.
+        fs::write(
+            tmp.path().join("0.55.0.cue"),
+            r#"package metadata
+
+releases: "0.55.0": {
+    commits: [
+        {sha: "deadbeefcafe", date: "2026-01-01 00:00:00 UTC", pr_number: 42, type: "fix"},
+        {sha: "abc1234567890abc", pr_number: 99},
+    ]
+}
+"#,
+        )
+        .unwrap();
+        // A non-cue file we should ignore.
+        fs::write(tmp.path().join("README.md"), "not a release").unwrap();
+
+        let ids = collect_released_identifiers(tmp.path()).unwrap();
+        assert!(ids.shas.contains("deadbeefcafe"));
+        assert!(ids.shas.contains("abc1234567890abc"));
+        assert!(ids.pr_numbers.contains(&42));
+        assert!(ids.pr_numbers.contains(&99));
+    }
+
+    #[test]
+    fn collect_released_identifiers_handles_missing_dir() {
+        let ids = collect_released_identifiers(Path::new("/nonexistent")).unwrap();
+        assert!(ids.shas.is_empty());
+        assert!(ids.pr_numbers.is_empty());
+    }
+}
diff --git a/vdev/src/commands/release/mod.rs b/vdev/src/commands/release/mod.rs
index e9c4f299caa0d..95b45ff4a041b 100644
--- a/vdev/src/commands/release/mod.rs
+++ b/vdev/src/commands/release/mod.rs
@@ -1,30 +1,19 @@
 mod channel;
+mod generate_cue;
 mod github;
 mod homebrew;
 mod prepare;
-mod push;
 
 crate::cli_subcommands! {
     "Manage the release process..."
-    generate_cue,
     channel,
-    commit,
     docker,
     github,
     homebrew,
     prepare,
-    push,
     s3,
 }
 
-crate::script_wrapper! {
-    generate_cue = "Generate the release documentation files"
-        => "generate-release-cue.rb"
-}
-crate::script_wrapper! {
-    commit = "Commits and tags the pending release"
-        => "release-commit.rb"
-}
 crate::script_wrapper! {
     docker = "Build the Vector docker images and optionally push it to the registry"
         => "build-docker.sh"
diff --git a/vdev/src/commands/release/prepare.rs b/vdev/src/commands/release/prepare.rs
index c1b623d7606d7..8cdb4a2341db6 100644
--- a/vdev/src/commands/release/prepare.rs
+++ b/vdev/src/commands/release/prepare.rs
@@ -1,6 +1,7 @@
 #![allow(clippy::print_stdout)]
 #![allow(clippy::print_stderr)]
 
+use crate::commands::release::generate_cue;
 use crate::utils::{command::run_command, git, paths};
 use anyhow::{Context, Result, anyhow};
 use reqwest::blocking::Client;
@@ -19,7 +20,6 @@ const ALPINE_PREFIX: &str = "FROM docker.io/alpine:";
 const ALPINE_DOCKERFILE: &str = "distribution/docker/alpine/Dockerfile";
 const DEBIAN_PREFIX: &str = "FROM docker.io/debian:";
 const DEBIAN_DOCKERFILE: &str = "distribution/docker/debian/Dockerfile";
-const RELEASE_CUE_SCRIPT: &str = "scripts/generate-release-cue.rb";
 const KUBECLT_CUE_FILE: &str = "website/cue/reference/administration/interfaces/kubectl.cue";
 const INSTALL_SCRIPT: &str = "distribution/install.sh";
 
@@ -70,7 +70,7 @@ impl Cli {
             alpine_version: self.alpine_version,
             debian_version: self.debian_version,
             repo_root,
-            latest_vector_version: get_latest_version_from_vector_tags()?,
+            latest_vector_version: generate_cue::find_latest_release_tag()?,
             release_branch: format!("v{}.{}", self.version.major, self.version.minor),
             // Websites containing `website` will also generate website previews.
             // Caveat is these branches can only contain alphanumeric chars and dashes.
@@ -210,16 +210,7 @@ impl Prepare {
     // Step 6
     fn generate_release_cue(&self) -> Result<()> {
         debug!("generate_release_cue");
-        let script = self.repo_root.join(RELEASE_CUE_SCRIPT);
-        let new_vector_version = &self.new_vector_version;
-        if script.is_file() {
-            run_command(&format!(
-                "{} --new-version {new_vector_version} --no-interactive",
-                script.to_string_lossy().as_ref()
-            ));
-        } else {
-            return Err(anyhow!("Script not found: {}", script.display()));
-        }
+        generate_cue::run(&self.new_vector_version)?;
 
         self.append_vrl_changelog_to_release_cue()?;
         git::add_files_in_current_dir()?;
@@ -429,18 +420,6 @@ fn update_vrl_to_version(cargo_toml_contents: &str, vrl_version: &str) -> Result
     Ok(doc.to_string())
 }
 
-fn get_latest_version_from_vector_tags() -> Result<Version> {
-    let tags = run_command("git tag --list --sort=-v:refname");
-    let latest_tag = tags
-        .lines()
-        .find(|tag| tag.starts_with('v') && !tag.starts_with("vdev-v"))
-        .ok_or_else(|| anyhow::anyhow!("Could not find latest Vector release tag"))?;
-
-    let version_str = latest_tag.trim_start_matches('v');
-    Version::parse(version_str)
-        .map_err(|e| anyhow::anyhow!("Failed to parse version from tag '{latest_tag}': {e}"))
-}
-
 fn format_vrl_changelog_block(changelog: &str) -> String {
     let double_tab = "\t\t";
     let body = changelog
diff --git a/vdev/src/commands/release/push.rs b/vdev/src/commands/release/push.rs
deleted file mode 100644
index 32dd588efb24d..0000000000000
--- a/vdev/src/commands/release/push.rs
+++ /dev/null
@@ -1,31 +0,0 @@
-use anyhow::Result;
-use clap::Args;
-
-use crate::{app, utils::git};
-use itertools::Itertools;
-
-/// Pushes new versions produced by `make release` to the repository
-#[derive(Args, Debug)]
-#[command()]
-pub struct Cli {}
-
-impl Cli {
-    pub fn exec(self) -> Result<()> {
-        let version = app::version()?;
-        let version_minor = version.split('.').take(2).join(".");
-
-        let current_branch = git::current_branch()?;
-        let branch_name = format!("v{version_minor}");
-        let tag_name = format!("v{version}");
-        println!("Preparing the branch and the tag...");
-        git::checkout_or_create_branch(&branch_name)?;
-        git::merge_branch(&current_branch)?;
-        git::tag_version(&tag_name)?;
-
-        println!("Pushing the branch and the tag...");
-        git::push_branch(&branch_name)?;
-        git::push_branch(&tag_name)?;
-
-        Ok(())
-    }
-}
diff --git a/vdev/src/utils/git.rs b/vdev/src/utils/git.rs
index dbd458937ca37..b1b4c6faaac21 100644
--- a/vdev/src/utils/git.rs
+++ b/vdev/src/utils/git.rs
@@ -34,21 +34,6 @@ pub fn checkout_or_create_branch(branch_name: &str) -> Result<()> {
     Ok(())
 }
 
-pub fn merge_branch(branch_name: &str) -> Result<()> {
-    let _output = run_and_check_output(&["merge", "--ff", branch_name])?;
-    Ok(())
-}
-
-pub fn tag_version(version: &str) -> Result<()> {
-    let _output = run_and_check_output(&["tag", "--annotate", version, "--message", version])?;
-    Ok(())
-}
-
-pub fn push_branch(branch_name: &str) -> Result<()> {
-    let _output = run_and_check_output(&["push", "origin", branch_name])?;
-    Ok(())
-}
-
 pub fn changed_files() -> Result<Vec<String>> {
     let mut files = HashSet::new();
 
@@ -138,6 +123,11 @@ pub fn commit(commit_message: &str) -> Result<String> {
         .check_output()
 }
 
+/// Removes a file from the index (and working tree) using `git rm`.
+pub fn rm(path: &str) -> Result<String> {
+    Command::new("git").args(["rm", path]).check_output()
+}
+
 /// Pushes changes from the current repo
 pub fn push() -> Result<String> {
     Command::new("git").args(["push"]).check_output()
diff --git a/website/README.md b/website/README.md
index 79a565b89fb7b..263f391b658b0 100644
--- a/website/README.md
+++ b/website/README.md
@@ -162,8 +162,12 @@ Navigate to http://localhost:1313. The site source is mounted as a volume so Hug
 
 ### Add a new version of Vector
 
-1. Add the new version to the `versions` list in [`cue/reference/versions.cue`](./cue/reference/versions.cue). Make sure to preserve reverse ordering.
-2. Generate a new CUE file for the release by running `make release-prepare` in the root directory of the Vector repo. This generates a CUE file at `cue/releases/{VERSION}.cue`.
+This is automated by `cargo vdev release prepare` (see the
+[release issue templates](../.github/ISSUE_TEMPLATE)). The steps it performs, listed
+here for reference:
+
+1. Add the new version to the `versions` list in [`cue/reference/versions.cue`](./cue/reference/versions.cue), preserving reverse ordering.
+2. Generate a new CUE file at `cue/reference/releases/{VERSION}.cue`.
 3. Add a new Markdown file to [`content/en/releases`](./content/en/releases), where the filename is `{version}.md` (e.g. `0.12.0.md`) and the file has metadata that looks like this:
 
     ```markdown

From 5cedf015de0c07d9f7e6f0023264279fcf986a40 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 8 May 2026 11:06:43 -0400
Subject: [PATCH 213/326] docs(codecs): fix wording in decoder and framing doc
 strings (#25382)

* docs(codecs): fix wording in decoder and framing doc strings

* Update generated docs

* Regenerate splunk_hec.cue
---
 lib/codecs/src/decoding/format/avro.rs        |   3 +-
 lib/codecs/src/decoding/format/gelf.rs        |   2 +-
 lib/codecs/src/decoding/format/otlp.rs        |   4 +-
 lib/codecs/src/decoding/format/protobuf.rs    |   4 +-
 lib/codecs/src/decoding/format/vrl.rs         |   4 +-
 .../decoding/framing/character_delimited.rs   |   4 +-
 .../src/decoding/framing/chunked_gelf.rs      |  12 +-
 .../src/decoding/framing/newline_delimited.rs |   4 +-
 lib/codecs/src/decoding/mod.rs                |  14 +--
 .../sinks/generated/websocket_server.cue      |  35 +++---
 .../components/sources/generated/amqp.cue     |  55 +++++----
 .../generated/aws_kinesis_firehose.cue        |  55 +++++----
 .../components/sources/generated/aws_s3.cue   |  55 +++++----
 .../components/sources/generated/aws_sqs.cue  |  55 +++++----
 .../sources/generated/datadog_agent.cue       |  55 +++++----
 .../sources/generated/demo_logs.cue           |  55 +++++----
 .../components/sources/generated/exec.cue     |  55 +++++----
 .../sources/generated/file_descriptor.cue     |  55 +++++----
 .../sources/generated/gcp_pubsub.cue          |  55 +++++----
 .../sources/generated/heroku_logs.cue         |  55 +++++----
 .../components/sources/generated/http.cue     |  55 +++++----
 .../sources/generated/http_client.cue         |  55 +++++----
 .../sources/generated/http_server.cue         |  55 +++++----
 .../components/sources/generated/kafka.cue    |  55 +++++----
 .../components/sources/generated/mqtt.cue     |  55 +++++----
 .../components/sources/generated/nats.cue     |  55 +++++----
 .../components/sources/generated/pulsar.cue   |  55 +++++----
 .../components/sources/generated/redis.cue    |  55 +++++----
 .../components/sources/generated/socket.cue   |  55 +++++----
 .../sources/generated/splunk_hec.cue          | 110 +++++++++---------
 .../components/sources/generated/stdin.cue    |  55 +++++----
 .../sources/generated/websocket.cue           |  55 +++++----
 32 files changed, 639 insertions(+), 712 deletions(-)

diff --git a/lib/codecs/src/decoding/format/avro.rs b/lib/codecs/src/decoding/format/avro.rs
index c21c09de21cfb..327c5d17acd78 100644
--- a/lib/codecs/src/decoding/format/avro.rs
+++ b/lib/codecs/src/decoding/format/avro.rs
@@ -103,8 +103,7 @@ pub struct AvroDeserializerOptions {
     ))]
     pub schema: String,
 
-    /// For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-    /// According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
+    /// For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
     pub strip_schema_id_prefix: bool,
 }
 
diff --git a/lib/codecs/src/decoding/format/gelf.rs b/lib/codecs/src/decoding/format/gelf.rs
index 377d437104cc4..021c6ef4df5ce 100644
--- a/lib/codecs/src/decoding/format/gelf.rs
+++ b/lib/codecs/src/decoding/format/gelf.rs
@@ -47,7 +47,7 @@ pub enum ValidationMode {
 
     /// Uses more relaxed validation that skips strict GELF specification checks.
     ///
-    /// This mode will not treat specification violations as errors, allowing the decoder
+    /// This mode does not treat specification violations as errors, allowing the decoder
     /// to accept messages from sources that don't strictly follow the GELF spec.
     Relaxed,
 }
diff --git a/lib/codecs/src/decoding/format/otlp.rs b/lib/codecs/src/decoding/format/otlp.rs
index 29b3477e4398f..3e81dec089dce 100644
--- a/lib/codecs/src/decoding/format/otlp.rs
+++ b/lib/codecs/src/decoding/format/otlp.rs
@@ -34,11 +34,11 @@ pub enum OtlpSignalType {
 pub struct OtlpDeserializerConfig {
     /// Signal types to attempt parsing, in priority order.
     ///
-    /// The deserializer will try parsing in the order specified. This allows you to optimize
+    /// The deserializer tries to parse signals in the specified order. This allows you to optimize
     /// performance when you know the expected signal types. For example, if you only receive
     /// traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
     ///
-    /// If not specified, defaults to trying all types in order: logs, metrics, traces.
+    /// If not specified, defaults to trying all types in this order: logs, metrics, traces.
     /// Duplicate signal types are automatically removed while preserving order.
     #[serde(default = "default_signal_types")]
     pub signal_types: IndexSet<OtlpSignalType>,
diff --git a/lib/codecs/src/decoding/format/protobuf.rs b/lib/codecs/src/decoding/format/protobuf.rs
index f5b923e4d1480..7ccc1acef66d7 100644
--- a/lib/codecs/src/decoding/format/protobuf.rs
+++ b/lib/codecs/src/decoding/format/protobuf.rs
@@ -75,7 +75,7 @@ pub struct ProtobufDeserializerOptions {
     ///
     /// This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
     ///
-    /// You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+    /// For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
     pub desc_file: PathBuf,
 
     /// The name of the message type to use for serializing.
@@ -85,7 +85,7 @@ pub struct ProtobufDeserializerOptions {
     /// Use JSON field names (camelCase) instead of protobuf field names (snake_case).
     ///
     /// When enabled, the deserializer will output fields using their JSON names as defined
-    /// in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+    /// in the `.proto` file (for example, `jobDescription` instead of `job_description`).
     ///
     /// This is useful when working with data that needs to be converted to JSON or
     /// when interfacing with systems that use JSON naming conventions.
diff --git a/lib/codecs/src/decoding/format/vrl.rs b/lib/codecs/src/decoding/format/vrl.rs
index 6920b912a087c..df990a767c7e8 100644
--- a/lib/codecs/src/decoding/format/vrl.rs
+++ b/lib/codecs/src/decoding/format/vrl.rs
@@ -30,8 +30,8 @@ pub struct VrlDeserializerConfig {
 #[derive(Debug, Clone, PartialEq, Eq, Default)]
 pub struct VrlDeserializerOptions {
     /// The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-    /// Note that the final contents of the `.` target will be used as the decoding result.
-    /// Compilation error or use of 'abort' in a program will result in a decoding error.
+    /// The final contents of the `.` target are used as the decoding result.
+    /// Compilation errors or use of `abort` in the program result in a decoding error.
     ///
     ///
     /// [vrl]: https://vector.dev/docs/reference/vrl
diff --git a/lib/codecs/src/decoding/framing/character_delimited.rs b/lib/codecs/src/decoding/framing/character_delimited.rs
index 09587893be205..819be2c77b655 100644
--- a/lib/codecs/src/decoding/framing/character_delimited.rs
+++ b/lib/codecs/src/decoding/framing/character_delimited.rs
@@ -47,13 +47,13 @@ pub struct CharacterDelimitedDecoderOptions {
     ///
     /// This length does *not* include the trailing delimiter.
     ///
-    /// By default, there is no maximum length enforced. If events are malformed, this can lead to
+    /// By default, no maximum length is enforced. If events are malformed, this can lead to
     /// additional resource usage as events continue to be buffered in memory, and can potentially
     /// lead to memory exhaustion in extreme cases.
     ///
     /// If there is a risk of processing malformed data, such as logs with user-controlled input,
     /// consider setting the maximum length to a reasonably large value as a safety net. This
-    /// ensures that processing is not actually unbounded.
+    /// prevents processing from being unbounded.
     #[serde(skip_serializing_if = "vector_core::serde::is_default")]
     pub max_length: Option<usize>,
 }
diff --git a/lib/codecs/src/decoding/framing/chunked_gelf.rs b/lib/codecs/src/decoding/framing/chunked_gelf.rs
index 3ba3c9bd33d33..aaf457b6c5b49 100644
--- a/lib/codecs/src/decoding/framing/chunked_gelf.rs
+++ b/lib/codecs/src/decoding/framing/chunked_gelf.rs
@@ -54,7 +54,7 @@ impl ChunkedGelfDecoderConfig {
 #[derivative(Default)]
 pub struct ChunkedGelfDecoderOptions {
     /// The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-    /// decoder drops all the received chunks of the timed out message.
+    /// decoder drops all received chunks for the timed-out message.
     #[serde(default = "default_timeout_secs")]
     #[derivative(Default(value = "default_timeout_secs()"))]
     pub timeout_secs: f64,
@@ -66,15 +66,15 @@ pub struct ChunkedGelfDecoderOptions {
     #[serde(default, skip_serializing_if = "vector_core::serde::is_default")]
     pub pending_messages_limit: Option<usize>,
 
-    /// The maximum length of a single GELF message, in bytes. Messages longer than this length will
-    /// be dropped. If this option is not set, the decoder does not limit the length of messages and
+    /// The maximum length of a single GELF message, in bytes. Messages longer than this length are
+    /// dropped. If this option is not set, the decoder does not limit the length of messages and
     /// the per-message memory is unbounded.
     ///
-    /// **Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+    /// **Note**: A message can be composed of multiple chunks, and this limit applies to the whole
     /// message, not to individual chunks.
     ///
-    /// This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-    /// The message's payload is the concatenation of all the chunks' payloads.
+    /// This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+    /// The message payload is the concatenation of all chunk payloads.
     #[serde(default, skip_serializing_if = "vector_core::serde::is_default")]
     pub max_length: Option<usize>,
 
diff --git a/lib/codecs/src/decoding/framing/newline_delimited.rs b/lib/codecs/src/decoding/framing/newline_delimited.rs
index 90177031c31c9..454aa08376c01 100644
--- a/lib/codecs/src/decoding/framing/newline_delimited.rs
+++ b/lib/codecs/src/decoding/framing/newline_delimited.rs
@@ -21,13 +21,13 @@ pub struct NewlineDelimitedDecoderOptions {
     ///
     /// This length does *not* include the trailing delimiter.
     ///
-    /// By default, there is no maximum length enforced. If events are malformed, this can lead to
+    /// By default, no maximum length is enforced. If events are malformed, this can lead to
     /// additional resource usage as events continue to be buffered in memory, and can potentially
     /// lead to memory exhaustion in extreme cases.
     ///
     /// If there is a risk of processing malformed data, such as logs with user-controlled input,
     /// consider setting the maximum length to a reasonably large value as a safety net. This
-    /// ensures that processing is not actually unbounded.
+    /// prevents processing from being unbounded.
     #[serde(skip_serializing_if = "vector_core::serde::is_default")]
     pub max_length: Option<usize>,
 }
diff --git a/lib/codecs/src/decoding/mod.rs b/lib/codecs/src/decoding/mod.rs
index bab1521e92f0a..0ed298554fea4 100644
--- a/lib/codecs/src/decoding/mod.rs
+++ b/lib/codecs/src/decoding/mod.rs
@@ -270,7 +270,7 @@ pub enum DeserializerConfig {
 
     /// Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
     ///
-    /// This decoder can output all types of events (logs, metrics, traces).
+    /// This decoder can output all types of events: logs, metrics, and traces.
     ///
     /// This codec is **[experimental][experimental]**.
     ///
@@ -280,7 +280,7 @@ pub enum DeserializerConfig {
 
     /// Decodes the raw bytes as [native JSON format][vector_native_json].
     ///
-    /// This decoder can output all types of events (logs, metrics, traces).
+    /// This decoder can output all types of events: logs, metrics, and traces.
     ///
     /// This codec is **[experimental][experimental]**.
     ///
@@ -294,13 +294,13 @@ pub enum DeserializerConfig {
     ///
     /// The GELF specification is more strict than the actual Graylog receiver.
     /// Vector's decoder adheres more strictly to the GELF spec, with
-    /// the exception that some characters such as `@`  are allowed in field names.
+    /// the exception that some characters such as `@` are allowed in field names.
     ///
-    /// Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-    /// by Graylog, and is much more relaxed than the GELF spec.
+    /// Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+    /// by Graylog and is much more relaxed than the GELF spec.
     ///
-    /// Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-    /// the codec may continue to relax the enforcement of specification.
+    /// Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+    /// the codec may continue to relax the enforcement of the specification.
     ///
     /// [gelf]: https://docs.graylog.org/docs/gelf
     /// [implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
diff --git a/website/cue/reference/components/sinks/generated/websocket_server.cue b/website/cue/reference/components/sinks/generated/websocket_server.cue
index 28e5823c8c7e5..08d747b10ccaa 100644
--- a/website/cue/reference/components/sinks/generated/websocket_server.cue
+++ b/website/cue/reference/components/sinks/generated/websocket_server.cue
@@ -604,11 +604,8 @@ generated: components: sinks: websocket_server: configuration: {
 										type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 									}
 									strip_schema_id_prefix: {
-										description: """
-																								For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																								According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																								"""
-										required: true
+										description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+										required:    true
 										type: bool: {}
 									}
 								}
@@ -632,13 +629,13 @@ generated: components: sinks: websocket_server: configuration: {
 
 																							The GELF specification is more strict than the actual Graylog receiver.
 																							Vector's decoder adheres more strictly to the GELF spec, with
-																							the exception that some characters such as `@`  are allowed in field names.
+																							the exception that some characters such as `@` are allowed in field names.
 
-																							Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-																							by Graylog, and is much more relaxed than the GELF spec.
+																							Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+																							by Graylog and is much more relaxed than the GELF spec.
 
-																							Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-																							the codec may continue to relax the enforcement of specification.
+																							Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+																							the codec may continue to relax the enforcement of the specification.
 
 																							[gelf]: https://docs.graylog.org/docs/gelf
 																							[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -656,7 +653,7 @@ generated: components: sinks: websocket_server: configuration: {
 										native: """
 																							Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-																							This decoder can output all types of events (logs, metrics, traces).
+																							This decoder can output all types of events: logs, metrics, and traces.
 
 																							This codec is **[experimental][experimental]**.
 
@@ -666,7 +663,7 @@ generated: components: sinks: websocket_server: configuration: {
 										native_json: """
 																							Decodes the raw bytes as [native JSON format][vector_native_json].
 
-																							This decoder can output all types of events (logs, metrics, traces).
+																							This decoder can output all types of events: logs, metrics, and traces.
 
 																							This codec is **[experimental][experimental]**.
 
@@ -728,7 +725,7 @@ generated: components: sinks: websocket_server: configuration: {
 												relaxed: """
 																											Uses more relaxed validation that skips strict GELF specification checks.
 
-																											This mode will not treat specification violations as errors, allowing the decoder
+																											This mode does not treat specification violations as errors, allowing the decoder
 																											to accept messages from sources that don't strictly follow the GELF spec.
 																											"""
 												strict: "Uses strict validation that closely follows the GELF spec."
@@ -796,7 +793,7 @@ generated: components: sinks: websocket_server: configuration: {
 
 																								This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																								You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																								For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																								"""
 										required: false
 										type: string: default: ""
@@ -814,7 +811,7 @@ generated: components: sinks: websocket_server: configuration: {
 																								Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																								When enabled, the deserializer will output fields using their JSON names as defined
-																								in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																								in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																								This is useful when working with data that needs to be converted to JSON or
 																								when interfacing with systems that use JSON naming conventions.
@@ -828,11 +825,11 @@ generated: components: sinks: websocket_server: configuration: {
 								description: """
 																				Signal types to attempt parsing, in priority order.
 
-																				The deserializer will try parsing in the order specified. This allows you to optimize
+																				The deserializer tries to parse signals in the specified order. This allows you to optimize
 																				performance when you know the expected signal types. For example, if you only receive
 																				traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-																				If not specified, defaults to trying all types in order: logs, metrics, traces.
+																				If not specified, defaults to trying all types in this order: logs, metrics, traces.
 																				Duplicate signal types are automatically removed while preserving order.
 																				"""
 								relevant_when: "codec = \"otlp\""
@@ -870,8 +867,8 @@ generated: components: sinks: websocket_server: configuration: {
 									source: {
 										description: """
 																								The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																								Note that the final contents of the `.` target will be used as the decoding result.
-																								Compilation error or use of 'abort' in a program will result in a decoding error.
+																								The final contents of the `.` target are used as the decoding result.
+																								Compilation errors or use of `abort` in the program result in a decoding error.
 
 																								[vrl]: https://vector.dev/docs/reference/vrl
 																								"""
diff --git a/website/cue/reference/components/sources/generated/amqp.cue b/website/cue/reference/components/sources/generated/amqp.cue
index ef71f410f0e29..2862dcf64a87c 100644
--- a/website/cue/reference/components/sources/generated/amqp.cue
+++ b/website/cue/reference/components/sources/generated/amqp.cue
@@ -72,11 +72,8 @@ generated: components: sources: amqp: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -100,13 +97,13 @@ generated: components: sources: amqp: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -124,7 +121,7 @@ generated: components: sources: amqp: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -134,7 +131,7 @@ generated: components: sources: amqp: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -196,7 +193,7 @@ generated: components: sources: amqp: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -264,7 +261,7 @@ generated: components: sources: amqp: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -282,7 +279,7 @@ generated: components: sources: amqp: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -296,11 +293,11 @@ generated: components: sources: amqp: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -338,8 +335,8 @@ generated: components: sources: amqp: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -394,13 +391,13 @@ generated: components: sources: amqp: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -427,15 +424,15 @@ generated: components: sources: amqp: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -453,7 +450,7 @@ generated: components: sources: amqp: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -530,13 +527,13 @@ generated: components: sources: amqp: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/aws_kinesis_firehose.cue b/website/cue/reference/components/sources/generated/aws_kinesis_firehose.cue
index 4464a2305412e..4f27aa233ace6 100644
--- a/website/cue/reference/components/sources/generated/aws_kinesis_firehose.cue
+++ b/website/cue/reference/components/sources/generated/aws_kinesis_firehose.cue
@@ -75,11 +75,8 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -103,13 +100,13 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -127,7 +124,7 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -137,7 +134,7 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -199,7 +196,7 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -267,7 +264,7 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -285,7 +282,7 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -299,11 +296,11 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -341,8 +338,8 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -392,13 +389,13 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -425,15 +422,15 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -451,7 +448,7 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -528,13 +525,13 @@ generated: components: sources: aws_kinesis_firehose: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/aws_s3.cue b/website/cue/reference/components/sources/generated/aws_s3.cue
index 95730d6c68ca6..2c9ea8802e4cc 100644
--- a/website/cue/reference/components/sources/generated/aws_s3.cue
+++ b/website/cue/reference/components/sources/generated/aws_s3.cue
@@ -190,11 +190,8 @@ generated: components: sources: aws_s3: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -218,13 +215,13 @@ generated: components: sources: aws_s3: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -242,7 +239,7 @@ generated: components: sources: aws_s3: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -252,7 +249,7 @@ generated: components: sources: aws_s3: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -314,7 +311,7 @@ generated: components: sources: aws_s3: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -382,7 +379,7 @@ generated: components: sources: aws_s3: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -400,7 +397,7 @@ generated: components: sources: aws_s3: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -414,11 +411,11 @@ generated: components: sources: aws_s3: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -456,8 +453,8 @@ generated: components: sources: aws_s3: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -521,13 +518,13 @@ generated: components: sources: aws_s3: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -554,15 +551,15 @@ generated: components: sources: aws_s3: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -580,7 +577,7 @@ generated: components: sources: aws_s3: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -657,13 +654,13 @@ generated: components: sources: aws_s3: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/aws_sqs.cue b/website/cue/reference/components/sources/generated/aws_sqs.cue
index b52cfcea28a31..0958460e2b1cb 100644
--- a/website/cue/reference/components/sources/generated/aws_sqs.cue
+++ b/website/cue/reference/components/sources/generated/aws_sqs.cue
@@ -185,11 +185,8 @@ generated: components: sources: aws_sqs: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -213,13 +210,13 @@ generated: components: sources: aws_sqs: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -237,7 +234,7 @@ generated: components: sources: aws_sqs: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -247,7 +244,7 @@ generated: components: sources: aws_sqs: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -309,7 +306,7 @@ generated: components: sources: aws_sqs: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -377,7 +374,7 @@ generated: components: sources: aws_sqs: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -395,7 +392,7 @@ generated: components: sources: aws_sqs: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -409,11 +406,11 @@ generated: components: sources: aws_sqs: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -451,8 +448,8 @@ generated: components: sources: aws_sqs: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -516,13 +513,13 @@ generated: components: sources: aws_sqs: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -549,15 +546,15 @@ generated: components: sources: aws_sqs: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -575,7 +572,7 @@ generated: components: sources: aws_sqs: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -652,13 +649,13 @@ generated: components: sources: aws_sqs: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/datadog_agent.cue b/website/cue/reference/components/sources/generated/datadog_agent.cue
index 70bd89821cb1f..fa6a519fe1e75 100644
--- a/website/cue/reference/components/sources/generated/datadog_agent.cue
+++ b/website/cue/reference/components/sources/generated/datadog_agent.cue
@@ -57,11 +57,8 @@ generated: components: sources: datadog_agent: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -85,13 +82,13 @@ generated: components: sources: datadog_agent: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -109,7 +106,7 @@ generated: components: sources: datadog_agent: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -119,7 +116,7 @@ generated: components: sources: datadog_agent: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -181,7 +178,7 @@ generated: components: sources: datadog_agent: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -249,7 +246,7 @@ generated: components: sources: datadog_agent: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -267,7 +264,7 @@ generated: components: sources: datadog_agent: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -281,11 +278,11 @@ generated: components: sources: datadog_agent: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -323,8 +320,8 @@ generated: components: sources: datadog_agent: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -389,13 +386,13 @@ generated: components: sources: datadog_agent: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -422,15 +419,15 @@ generated: components: sources: datadog_agent: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -448,7 +445,7 @@ generated: components: sources: datadog_agent: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -525,13 +522,13 @@ generated: components: sources: datadog_agent: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/demo_logs.cue b/website/cue/reference/components/sources/generated/demo_logs.cue
index e1227f9fc26ca..f67e10eab629c 100644
--- a/website/cue/reference/components/sources/generated/demo_logs.cue
+++ b/website/cue/reference/components/sources/generated/demo_logs.cue
@@ -36,11 +36,8 @@ generated: components: sources: demo_logs: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -64,13 +61,13 @@ generated: components: sources: demo_logs: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -88,7 +85,7 @@ generated: components: sources: demo_logs: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -98,7 +95,7 @@ generated: components: sources: demo_logs: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -160,7 +157,7 @@ generated: components: sources: demo_logs: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -228,7 +225,7 @@ generated: components: sources: demo_logs: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -246,7 +243,7 @@ generated: components: sources: demo_logs: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -260,11 +257,11 @@ generated: components: sources: demo_logs: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -302,8 +299,8 @@ generated: components: sources: demo_logs: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -385,13 +382,13 @@ generated: components: sources: demo_logs: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -418,15 +415,15 @@ generated: components: sources: demo_logs: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -444,7 +441,7 @@ generated: components: sources: demo_logs: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -521,13 +518,13 @@ generated: components: sources: demo_logs: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/exec.cue b/website/cue/reference/components/sources/generated/exec.cue
index a5380b6c01f1d..2db79f6896c0b 100644
--- a/website/cue/reference/components/sources/generated/exec.cue
+++ b/website/cue/reference/components/sources/generated/exec.cue
@@ -37,11 +37,8 @@ generated: components: sources: exec: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -65,13 +62,13 @@ generated: components: sources: exec: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -89,7 +86,7 @@ generated: components: sources: exec: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -99,7 +96,7 @@ generated: components: sources: exec: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -161,7 +158,7 @@ generated: components: sources: exec: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -229,7 +226,7 @@ generated: components: sources: exec: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -247,7 +244,7 @@ generated: components: sources: exec: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -261,11 +258,11 @@ generated: components: sources: exec: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -303,8 +300,8 @@ generated: components: sources: exec: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -373,13 +370,13 @@ generated: components: sources: exec: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -406,15 +403,15 @@ generated: components: sources: exec: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -432,7 +429,7 @@ generated: components: sources: exec: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -506,13 +503,13 @@ generated: components: sources: exec: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/file_descriptor.cue b/website/cue/reference/components/sources/generated/file_descriptor.cue
index 84ecfd0d85e94..6685f5ed5147a 100644
--- a/website/cue/reference/components/sources/generated/file_descriptor.cue
+++ b/website/cue/reference/components/sources/generated/file_descriptor.cue
@@ -27,11 +27,8 @@ generated: components: sources: file_descriptor: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -55,13 +52,13 @@ generated: components: sources: file_descriptor: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -79,7 +76,7 @@ generated: components: sources: file_descriptor: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -89,7 +86,7 @@ generated: components: sources: file_descriptor: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -151,7 +148,7 @@ generated: components: sources: file_descriptor: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -219,7 +216,7 @@ generated: components: sources: file_descriptor: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -237,7 +234,7 @@ generated: components: sources: file_descriptor: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -251,11 +248,11 @@ generated: components: sources: file_descriptor: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -293,8 +290,8 @@ generated: components: sources: file_descriptor: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -351,13 +348,13 @@ generated: components: sources: file_descriptor: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -384,15 +381,15 @@ generated: components: sources: file_descriptor: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -410,7 +407,7 @@ generated: components: sources: file_descriptor: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -484,13 +481,13 @@ generated: components: sources: file_descriptor: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/gcp_pubsub.cue b/website/cue/reference/components/sources/generated/gcp_pubsub.cue
index 74ceb80df85ff..b143ef998a256 100644
--- a/website/cue/reference/components/sources/generated/gcp_pubsub.cue
+++ b/website/cue/reference/components/sources/generated/gcp_pubsub.cue
@@ -103,11 +103,8 @@ generated: components: sources: gcp_pubsub: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -131,13 +128,13 @@ generated: components: sources: gcp_pubsub: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -155,7 +152,7 @@ generated: components: sources: gcp_pubsub: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -165,7 +162,7 @@ generated: components: sources: gcp_pubsub: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -227,7 +224,7 @@ generated: components: sources: gcp_pubsub: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -295,7 +292,7 @@ generated: components: sources: gcp_pubsub: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -313,7 +310,7 @@ generated: components: sources: gcp_pubsub: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -327,11 +324,11 @@ generated: components: sources: gcp_pubsub: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -369,8 +366,8 @@ generated: components: sources: gcp_pubsub: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -428,13 +425,13 @@ generated: components: sources: gcp_pubsub: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -461,15 +458,15 @@ generated: components: sources: gcp_pubsub: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -487,7 +484,7 @@ generated: components: sources: gcp_pubsub: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -564,13 +561,13 @@ generated: components: sources: gcp_pubsub: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/heroku_logs.cue b/website/cue/reference/components/sources/generated/heroku_logs.cue
index cb44587b15e4b..cba1d865c3033 100644
--- a/website/cue/reference/components/sources/generated/heroku_logs.cue
+++ b/website/cue/reference/components/sources/generated/heroku_logs.cue
@@ -100,11 +100,8 @@ generated: components: sources: heroku_logs: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -128,13 +125,13 @@ generated: components: sources: heroku_logs: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -152,7 +149,7 @@ generated: components: sources: heroku_logs: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -162,7 +159,7 @@ generated: components: sources: heroku_logs: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -224,7 +221,7 @@ generated: components: sources: heroku_logs: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -292,7 +289,7 @@ generated: components: sources: heroku_logs: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -310,7 +307,7 @@ generated: components: sources: heroku_logs: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -324,11 +321,11 @@ generated: components: sources: heroku_logs: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -366,8 +363,8 @@ generated: components: sources: heroku_logs: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -417,13 +414,13 @@ generated: components: sources: heroku_logs: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -450,15 +447,15 @@ generated: components: sources: heroku_logs: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -476,7 +473,7 @@ generated: components: sources: heroku_logs: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -553,13 +550,13 @@ generated: components: sources: heroku_logs: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/http.cue b/website/cue/reference/components/sources/generated/http.cue
index 259c800829438..ca96e3e7b1432 100644
--- a/website/cue/reference/components/sources/generated/http.cue
+++ b/website/cue/reference/components/sources/generated/http.cue
@@ -104,11 +104,8 @@ generated: components: sources: http: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -130,13 +127,13 @@ generated: components: sources: http: configuration: {
 
 						The GELF specification is more strict than the actual Graylog receiver.
 						Vector's decoder adheres more strictly to the GELF spec, with
-						the exception that some characters such as `@`  are allowed in field names.
+						the exception that some characters such as `@` are allowed in field names.
 
-						Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-						by Graylog, and is much more relaxed than the GELF spec.
+						Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+						by Graylog and is much more relaxed than the GELF spec.
 
-						Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-						the codec may continue to relax the enforcement of specification.
+						Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+						the codec may continue to relax the enforcement of the specification.
 
 						[gelf]: https://docs.graylog.org/docs/gelf
 						[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -154,7 +151,7 @@ generated: components: sources: http: configuration: {
 					native: """
 						Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-						This decoder can output all types of events (logs, metrics, traces).
+						This decoder can output all types of events: logs, metrics, and traces.
 
 						This codec is **[experimental][experimental]**.
 
@@ -164,7 +161,7 @@ generated: components: sources: http: configuration: {
 					native_json: """
 						Decodes the raw bytes as [native JSON format][vector_native_json].
 
-						This decoder can output all types of events (logs, metrics, traces).
+						This decoder can output all types of events: logs, metrics, and traces.
 
 						This codec is **[experimental][experimental]**.
 
@@ -225,7 +222,7 @@ generated: components: sources: http: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -293,7 +290,7 @@ generated: components: sources: http: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -311,7 +308,7 @@ generated: components: sources: http: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -325,11 +322,11 @@ generated: components: sources: http: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -367,8 +364,8 @@ generated: components: sources: http: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -433,13 +430,13 @@ generated: components: sources: http: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -466,15 +463,15 @@ generated: components: sources: http: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -492,7 +489,7 @@ generated: components: sources: http: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -566,13 +563,13 @@ generated: components: sources: http: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/http_client.cue b/website/cue/reference/components/sources/generated/http_client.cue
index 6631650e47fb5..c73fdbf14aeff 100644
--- a/website/cue/reference/components/sources/generated/http_client.cue
+++ b/website/cue/reference/components/sources/generated/http_client.cue
@@ -238,11 +238,8 @@ generated: components: sources: http_client: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -266,13 +263,13 @@ generated: components: sources: http_client: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -290,7 +287,7 @@ generated: components: sources: http_client: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -300,7 +297,7 @@ generated: components: sources: http_client: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -362,7 +359,7 @@ generated: components: sources: http_client: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -430,7 +427,7 @@ generated: components: sources: http_client: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -448,7 +445,7 @@ generated: components: sources: http_client: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -462,11 +459,11 @@ generated: components: sources: http_client: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -504,8 +501,8 @@ generated: components: sources: http_client: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -558,13 +555,13 @@ generated: components: sources: http_client: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -591,15 +588,15 @@ generated: components: sources: http_client: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -617,7 +614,7 @@ generated: components: sources: http_client: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -694,13 +691,13 @@ generated: components: sources: http_client: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/http_server.cue b/website/cue/reference/components/sources/generated/http_server.cue
index c84425dd8db2c..1610fc441b56d 100644
--- a/website/cue/reference/components/sources/generated/http_server.cue
+++ b/website/cue/reference/components/sources/generated/http_server.cue
@@ -104,11 +104,8 @@ generated: components: sources: http_server: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -130,13 +127,13 @@ generated: components: sources: http_server: configuration: {
 
 						The GELF specification is more strict than the actual Graylog receiver.
 						Vector's decoder adheres more strictly to the GELF spec, with
-						the exception that some characters such as `@`  are allowed in field names.
+						the exception that some characters such as `@` are allowed in field names.
 
-						Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-						by Graylog, and is much more relaxed than the GELF spec.
+						Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+						by Graylog and is much more relaxed than the GELF spec.
 
-						Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-						the codec may continue to relax the enforcement of specification.
+						Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+						the codec may continue to relax the enforcement of the specification.
 
 						[gelf]: https://docs.graylog.org/docs/gelf
 						[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -154,7 +151,7 @@ generated: components: sources: http_server: configuration: {
 					native: """
 						Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-						This decoder can output all types of events (logs, metrics, traces).
+						This decoder can output all types of events: logs, metrics, and traces.
 
 						This codec is **[experimental][experimental]**.
 
@@ -164,7 +161,7 @@ generated: components: sources: http_server: configuration: {
 					native_json: """
 						Decodes the raw bytes as [native JSON format][vector_native_json].
 
-						This decoder can output all types of events (logs, metrics, traces).
+						This decoder can output all types of events: logs, metrics, and traces.
 
 						This codec is **[experimental][experimental]**.
 
@@ -225,7 +222,7 @@ generated: components: sources: http_server: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -293,7 +290,7 @@ generated: components: sources: http_server: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -311,7 +308,7 @@ generated: components: sources: http_server: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -325,11 +322,11 @@ generated: components: sources: http_server: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -367,8 +364,8 @@ generated: components: sources: http_server: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -433,13 +430,13 @@ generated: components: sources: http_server: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -466,15 +463,15 @@ generated: components: sources: http_server: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -492,7 +489,7 @@ generated: components: sources: http_server: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -566,13 +563,13 @@ generated: components: sources: http_server: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/kafka.cue b/website/cue/reference/components/sources/generated/kafka.cue
index 7a0ebfdcf1006..923120ffbb59c 100644
--- a/website/cue/reference/components/sources/generated/kafka.cue
+++ b/website/cue/reference/components/sources/generated/kafka.cue
@@ -81,11 +81,8 @@ generated: components: sources: kafka: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -109,13 +106,13 @@ generated: components: sources: kafka: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -133,7 +130,7 @@ generated: components: sources: kafka: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -143,7 +140,7 @@ generated: components: sources: kafka: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -205,7 +202,7 @@ generated: components: sources: kafka: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -273,7 +270,7 @@ generated: components: sources: kafka: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -291,7 +288,7 @@ generated: components: sources: kafka: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -305,11 +302,11 @@ generated: components: sources: kafka: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -347,8 +344,8 @@ generated: components: sources: kafka: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -422,13 +419,13 @@ generated: components: sources: kafka: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -455,15 +452,15 @@ generated: components: sources: kafka: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -481,7 +478,7 @@ generated: components: sources: kafka: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -558,13 +555,13 @@ generated: components: sources: kafka: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/mqtt.cue b/website/cue/reference/components/sources/generated/mqtt.cue
index 0bcd847fd4717..83af76f0a723c 100644
--- a/website/cue/reference/components/sources/generated/mqtt.cue
+++ b/website/cue/reference/components/sources/generated/mqtt.cue
@@ -32,11 +32,8 @@ generated: components: sources: mqtt: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -60,13 +57,13 @@ generated: components: sources: mqtt: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -84,7 +81,7 @@ generated: components: sources: mqtt: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -94,7 +91,7 @@ generated: components: sources: mqtt: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -156,7 +153,7 @@ generated: components: sources: mqtt: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -224,7 +221,7 @@ generated: components: sources: mqtt: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -242,7 +239,7 @@ generated: components: sources: mqtt: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -256,11 +253,11 @@ generated: components: sources: mqtt: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -298,8 +295,8 @@ generated: components: sources: mqtt: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -349,13 +346,13 @@ generated: components: sources: mqtt: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -382,15 +379,15 @@ generated: components: sources: mqtt: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -408,7 +405,7 @@ generated: components: sources: mqtt: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -485,13 +482,13 @@ generated: components: sources: mqtt: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/nats.cue b/website/cue/reference/components/sources/generated/nats.cue
index c57371bafaa94..16a024742ac3a 100644
--- a/website/cue/reference/components/sources/generated/nats.cue
+++ b/website/cue/reference/components/sources/generated/nats.cue
@@ -124,11 +124,8 @@ generated: components: sources: nats: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -152,13 +149,13 @@ generated: components: sources: nats: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -176,7 +173,7 @@ generated: components: sources: nats: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -186,7 +183,7 @@ generated: components: sources: nats: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -248,7 +245,7 @@ generated: components: sources: nats: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -316,7 +313,7 @@ generated: components: sources: nats: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -334,7 +331,7 @@ generated: components: sources: nats: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -348,11 +345,11 @@ generated: components: sources: nats: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -390,8 +387,8 @@ generated: components: sources: nats: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -441,13 +438,13 @@ generated: components: sources: nats: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -474,15 +471,15 @@ generated: components: sources: nats: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -500,7 +497,7 @@ generated: components: sources: nats: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -577,13 +574,13 @@ generated: components: sources: nats: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/pulsar.cue b/website/cue/reference/components/sources/generated/pulsar.cue
index f51e1a449dbcb..015643d5651e3 100644
--- a/website/cue/reference/components/sources/generated/pulsar.cue
+++ b/website/cue/reference/components/sources/generated/pulsar.cue
@@ -130,11 +130,8 @@ generated: components: sources: pulsar: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -158,13 +155,13 @@ generated: components: sources: pulsar: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -182,7 +179,7 @@ generated: components: sources: pulsar: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -192,7 +189,7 @@ generated: components: sources: pulsar: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -254,7 +251,7 @@ generated: components: sources: pulsar: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -322,7 +319,7 @@ generated: components: sources: pulsar: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -340,7 +337,7 @@ generated: components: sources: pulsar: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -354,11 +351,11 @@ generated: components: sources: pulsar: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -396,8 +393,8 @@ generated: components: sources: pulsar: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -452,13 +449,13 @@ generated: components: sources: pulsar: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -485,15 +482,15 @@ generated: components: sources: pulsar: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -511,7 +508,7 @@ generated: components: sources: pulsar: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -588,13 +585,13 @@ generated: components: sources: pulsar: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/redis.cue b/website/cue/reference/components/sources/generated/redis.cue
index 4ddff3bf52d73..0f13fc2828156 100644
--- a/website/cue/reference/components/sources/generated/redis.cue
+++ b/website/cue/reference/components/sources/generated/redis.cue
@@ -42,11 +42,8 @@ generated: components: sources: redis: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -70,13 +67,13 @@ generated: components: sources: redis: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -94,7 +91,7 @@ generated: components: sources: redis: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -104,7 +101,7 @@ generated: components: sources: redis: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -166,7 +163,7 @@ generated: components: sources: redis: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -234,7 +231,7 @@ generated: components: sources: redis: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -252,7 +249,7 @@ generated: components: sources: redis: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -266,11 +263,11 @@ generated: components: sources: redis: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -308,8 +305,8 @@ generated: components: sources: redis: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -359,13 +356,13 @@ generated: components: sources: redis: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -392,15 +389,15 @@ generated: components: sources: redis: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -418,7 +415,7 @@ generated: components: sources: redis: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -495,13 +492,13 @@ generated: components: sources: redis: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/socket.cue b/website/cue/reference/components/sources/generated/socket.cue
index 63495e4a1fbaf..20bf3e0364c36 100644
--- a/website/cue/reference/components/sources/generated/socket.cue
+++ b/website/cue/reference/components/sources/generated/socket.cue
@@ -44,11 +44,8 @@ generated: components: sources: socket: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -72,13 +69,13 @@ generated: components: sources: socket: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -96,7 +93,7 @@ generated: components: sources: socket: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -106,7 +103,7 @@ generated: components: sources: socket: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -168,7 +165,7 @@ generated: components: sources: socket: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -236,7 +233,7 @@ generated: components: sources: socket: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -254,7 +251,7 @@ generated: components: sources: socket: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -268,11 +265,11 @@ generated: components: sources: socket: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -310,8 +307,8 @@ generated: components: sources: socket: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -361,13 +358,13 @@ generated: components: sources: socket: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -394,15 +391,15 @@ generated: components: sources: socket: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -420,7 +417,7 @@ generated: components: sources: socket: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -494,13 +491,13 @@ generated: components: sources: socket: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/splunk_hec.cue b/website/cue/reference/components/sources/generated/splunk_hec.cue
index d5fc8b762dc8a..6a3fd53775db0 100644
--- a/website/cue/reference/components/sources/generated/splunk_hec.cue
+++ b/website/cue/reference/components/sources/generated/splunk_hec.cue
@@ -117,11 +117,8 @@ generated: components: sources: splunk_hec: configuration: {
 								type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 							}
 							strip_schema_id_prefix: {
-								description: """
-																				For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																				According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																				"""
-								required: true
+								description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+								required:    true
 								type: bool: {}
 							}
 						}
@@ -143,13 +140,13 @@ generated: components: sources: splunk_hec: configuration: {
 
 																			The GELF specification is more strict than the actual Graylog receiver.
 																			Vector's decoder adheres more strictly to the GELF spec, with
-																			the exception that some characters such as `@`  are allowed in field names.
+																			the exception that some characters such as `@` are allowed in field names.
 
-																			Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-																			by Graylog, and is much more relaxed than the GELF spec.
+																			Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+																			by Graylog and is much more relaxed than the GELF spec.
 
-																			Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-																			the codec may continue to relax the enforcement of specification.
+																			Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+																			the codec may continue to relax the enforcement of the specification.
 
 																			[gelf]: https://docs.graylog.org/docs/gelf
 																			[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -167,7 +164,7 @@ generated: components: sources: splunk_hec: configuration: {
 							native: """
 																			Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-																			This decoder can output all types of events (logs, metrics, traces).
+																			This decoder can output all types of events: logs, metrics, and traces.
 
 																			This codec is **[experimental][experimental]**.
 
@@ -177,7 +174,7 @@ generated: components: sources: splunk_hec: configuration: {
 							native_json: """
 																			Decodes the raw bytes as [native JSON format][vector_native_json].
 
-																			This decoder can output all types of events (logs, metrics, traces).
+																			This decoder can output all types of events: logs, metrics, and traces.
 
 																			This codec is **[experimental][experimental]**.
 
@@ -238,7 +235,7 @@ generated: components: sources: splunk_hec: configuration: {
 										relaxed: """
 																							Uses more relaxed validation that skips strict GELF specification checks.
 
-																							This mode will not treat specification violations as errors, allowing the decoder
+																							This mode does not treat specification violations as errors, allowing the decoder
 																							to accept messages from sources that don't strictly follow the GELF spec.
 																							"""
 										strict: "Uses strict validation that closely follows the GELF spec."
@@ -306,7 +303,7 @@ generated: components: sources: splunk_hec: configuration: {
 
 																				This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																				You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																				For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																				"""
 								required: false
 								type: string: default: ""
@@ -324,7 +321,7 @@ generated: components: sources: splunk_hec: configuration: {
 																				Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																				When enabled, the deserializer will output fields using their JSON names as defined
-																				in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																				in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																				This is useful when working with data that needs to be converted to JSON or
 																				when interfacing with systems that use JSON naming conventions.
@@ -338,11 +335,11 @@ generated: components: sources: splunk_hec: configuration: {
 						description: """
 																Signal types to attempt parsing, in priority order.
 
-																The deserializer will try parsing in the order specified. This allows you to optimize
+																The deserializer tries to parse signals in the specified order. This allows you to optimize
 																performance when you know the expected signal types. For example, if you only receive
 																traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-																If not specified, defaults to trying all types in order: logs, metrics, traces.
+																If not specified, defaults to trying all types in this order: logs, metrics, traces.
 																Duplicate signal types are automatically removed while preserving order.
 																"""
 						relevant_when: "codec = \"otlp\""
@@ -380,8 +377,8 @@ generated: components: sources: splunk_hec: configuration: {
 							source: {
 								description: """
 																				The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																				Note that the final contents of the `.` target will be used as the decoding result.
-																				Compilation error or use of 'abort' in a program will result in a decoding error.
+																				The final contents of the `.` target are used as the decoding result.
+																				Compilation errors or use of `abort` in the program result in a decoding error.
 
 																				[vrl]: https://vector.dev/docs/reference/vrl
 																				"""
@@ -430,13 +427,13 @@ generated: components: sources: splunk_hec: configuration: {
 
 																				This length does *not* include the trailing delimiter.
 
-																				By default, there is no maximum length enforced. If events are malformed, this can lead to
+																				By default, no maximum length is enforced. If events are malformed, this can lead to
 																				additional resource usage as events continue to be buffered in memory, and can potentially
 																				lead to memory exhaustion in extreme cases.
 
 																				If there is a risk of processing malformed data, such as logs with user-controlled input,
 																				consider setting the maximum length to a reasonably large value as a safety net. This
-																				ensures that processing is not actually unbounded.
+																				prevents processing from being unbounded.
 																				"""
 								required: false
 								type: uint: {}
@@ -463,15 +460,15 @@ generated: components: sources: splunk_hec: configuration: {
 							}
 							max_length: {
 								description: """
-																				The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																				be dropped. If this option is not set, the decoder does not limit the length of messages and
+																				The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																				dropped. If this option is not set, the decoder does not limit the length of messages and
 																				the per-message memory is unbounded.
 
-																				**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																				**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																				message, not to individual chunks.
 
-																				This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																				The message's payload is the concatenation of all the chunks' payloads.
+																				This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																				The message payload is the concatenation of all chunk payloads.
 																				"""
 								required: false
 								type: uint: {}
@@ -489,7 +486,7 @@ generated: components: sources: splunk_hec: configuration: {
 							timeout_secs: {
 								description: """
 																				The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																				decoder drops all the received chunks of the timed out message.
+																				decoder drops all received chunks for the timed-out message.
 																				"""
 								required: false
 								type: float: default: 5.0
@@ -563,13 +560,13 @@ generated: components: sources: splunk_hec: configuration: {
 
 																				This length does *not* include the trailing delimiter.
 
-																				By default, there is no maximum length enforced. If events are malformed, this can lead to
+																				By default, no maximum length is enforced. If events are malformed, this can lead to
 																				additional resource usage as events continue to be buffered in memory, and can potentially
 																				lead to memory exhaustion in extreme cases.
 
 																				If there is a risk of processing malformed data, such as logs with user-controlled input,
 																				consider setting the maximum length to a reasonably large value as a safety net. This
-																				ensures that processing is not actually unbounded.
+																				prevents processing from being unbounded.
 																				"""
 							required: false
 							type: uint: {}
@@ -664,11 +661,8 @@ generated: components: sources: splunk_hec: configuration: {
 								type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 							}
 							strip_schema_id_prefix: {
-								description: """
-																				For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																				According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																				"""
-								required: true
+								description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+								required:    true
 								type: bool: {}
 							}
 						}
@@ -690,13 +684,13 @@ generated: components: sources: splunk_hec: configuration: {
 
 																			The GELF specification is more strict than the actual Graylog receiver.
 																			Vector's decoder adheres more strictly to the GELF spec, with
-																			the exception that some characters such as `@`  are allowed in field names.
+																			the exception that some characters such as `@` are allowed in field names.
 
-																			Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-																			by Graylog, and is much more relaxed than the GELF spec.
+																			Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+																			by Graylog and is much more relaxed than the GELF spec.
 
-																			Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-																			the codec may continue to relax the enforcement of specification.
+																			Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+																			the codec may continue to relax the enforcement of the specification.
 
 																			[gelf]: https://docs.graylog.org/docs/gelf
 																			[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -714,7 +708,7 @@ generated: components: sources: splunk_hec: configuration: {
 							native: """
 																			Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-																			This decoder can output all types of events (logs, metrics, traces).
+																			This decoder can output all types of events: logs, metrics, and traces.
 
 																			This codec is **[experimental][experimental]**.
 
@@ -724,7 +718,7 @@ generated: components: sources: splunk_hec: configuration: {
 							native_json: """
 																			Decodes the raw bytes as [native JSON format][vector_native_json].
 
-																			This decoder can output all types of events (logs, metrics, traces).
+																			This decoder can output all types of events: logs, metrics, and traces.
 
 																			This codec is **[experimental][experimental]**.
 
@@ -785,7 +779,7 @@ generated: components: sources: splunk_hec: configuration: {
 										relaxed: """
 																							Uses more relaxed validation that skips strict GELF specification checks.
 
-																							This mode will not treat specification violations as errors, allowing the decoder
+																							This mode does not treat specification violations as errors, allowing the decoder
 																							to accept messages from sources that don't strictly follow the GELF spec.
 																							"""
 										strict: "Uses strict validation that closely follows the GELF spec."
@@ -853,7 +847,7 @@ generated: components: sources: splunk_hec: configuration: {
 
 																				This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																				You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																				For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																				"""
 								required: false
 								type: string: default: ""
@@ -871,7 +865,7 @@ generated: components: sources: splunk_hec: configuration: {
 																				Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																				When enabled, the deserializer will output fields using their JSON names as defined
-																				in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																				in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																				This is useful when working with data that needs to be converted to JSON or
 																				when interfacing with systems that use JSON naming conventions.
@@ -885,11 +879,11 @@ generated: components: sources: splunk_hec: configuration: {
 						description: """
 																Signal types to attempt parsing, in priority order.
 
-																The deserializer will try parsing in the order specified. This allows you to optimize
+																The deserializer tries to parse signals in the specified order. This allows you to optimize
 																performance when you know the expected signal types. For example, if you only receive
 																traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-																If not specified, defaults to trying all types in order: logs, metrics, traces.
+																If not specified, defaults to trying all types in this order: logs, metrics, traces.
 																Duplicate signal types are automatically removed while preserving order.
 																"""
 						relevant_when: "codec = \"otlp\""
@@ -927,8 +921,8 @@ generated: components: sources: splunk_hec: configuration: {
 							source: {
 								description: """
 																				The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																				Note that the final contents of the `.` target will be used as the decoding result.
-																				Compilation error or use of 'abort' in a program will result in a decoding error.
+																				The final contents of the `.` target are used as the decoding result.
+																				Compilation errors or use of `abort` in the program result in a decoding error.
 
 																				[vrl]: https://vector.dev/docs/reference/vrl
 																				"""
@@ -977,13 +971,13 @@ generated: components: sources: splunk_hec: configuration: {
 
 																				This length does *not* include the trailing delimiter.
 
-																				By default, there is no maximum length enforced. If events are malformed, this can lead to
+																				By default, no maximum length is enforced. If events are malformed, this can lead to
 																				additional resource usage as events continue to be buffered in memory, and can potentially
 																				lead to memory exhaustion in extreme cases.
 
 																				If there is a risk of processing malformed data, such as logs with user-controlled input,
 																				consider setting the maximum length to a reasonably large value as a safety net. This
-																				ensures that processing is not actually unbounded.
+																				prevents processing from being unbounded.
 																				"""
 								required: false
 								type: uint: {}
@@ -1010,15 +1004,15 @@ generated: components: sources: splunk_hec: configuration: {
 							}
 							max_length: {
 								description: """
-																				The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																				be dropped. If this option is not set, the decoder does not limit the length of messages and
+																				The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																				dropped. If this option is not set, the decoder does not limit the length of messages and
 																				the per-message memory is unbounded.
 
-																				**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																				**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																				message, not to individual chunks.
 
-																				This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																				The message's payload is the concatenation of all the chunks' payloads.
+																				This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																				The message payload is the concatenation of all chunk payloads.
 																				"""
 								required: false
 								type: uint: {}
@@ -1036,7 +1030,7 @@ generated: components: sources: splunk_hec: configuration: {
 							timeout_secs: {
 								description: """
 																				The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																				decoder drops all the received chunks of the timed out message.
+																				decoder drops all received chunks for the timed-out message.
 																				"""
 								required: false
 								type: float: default: 5.0
@@ -1110,13 +1104,13 @@ generated: components: sources: splunk_hec: configuration: {
 
 																				This length does *not* include the trailing delimiter.
 
-																				By default, there is no maximum length enforced. If events are malformed, this can lead to
+																				By default, no maximum length is enforced. If events are malformed, this can lead to
 																				additional resource usage as events continue to be buffered in memory, and can potentially
 																				lead to memory exhaustion in extreme cases.
 
 																				If there is a risk of processing malformed data, such as logs with user-controlled input,
 																				consider setting the maximum length to a reasonably large value as a safety net. This
-																				ensures that processing is not actually unbounded.
+																				prevents processing from being unbounded.
 																				"""
 							required: false
 							type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/stdin.cue b/website/cue/reference/components/sources/generated/stdin.cue
index 72de586122b44..d9fdd20ba8b7b 100644
--- a/website/cue/reference/components/sources/generated/stdin.cue
+++ b/website/cue/reference/components/sources/generated/stdin.cue
@@ -27,11 +27,8 @@ generated: components: sources: stdin: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -55,13 +52,13 @@ generated: components: sources: stdin: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -79,7 +76,7 @@ generated: components: sources: stdin: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -89,7 +86,7 @@ generated: components: sources: stdin: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -151,7 +148,7 @@ generated: components: sources: stdin: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -219,7 +216,7 @@ generated: components: sources: stdin: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -237,7 +234,7 @@ generated: components: sources: stdin: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -251,11 +248,11 @@ generated: components: sources: stdin: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -293,8 +290,8 @@ generated: components: sources: stdin: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -344,13 +341,13 @@ generated: components: sources: stdin: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -377,15 +374,15 @@ generated: components: sources: stdin: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -403,7 +400,7 @@ generated: components: sources: stdin: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -477,13 +474,13 @@ generated: components: sources: stdin: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}
diff --git a/website/cue/reference/components/sources/generated/websocket.cue b/website/cue/reference/components/sources/generated/websocket.cue
index c770d5558e71a..ebeedbf2ce923 100644
--- a/website/cue/reference/components/sources/generated/websocket.cue
+++ b/website/cue/reference/components/sources/generated/websocket.cue
@@ -214,11 +214,8 @@ generated: components: sources: websocket: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -242,13 +239,13 @@ generated: components: sources: websocket: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -266,7 +263,7 @@ generated: components: sources: websocket: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -276,7 +273,7 @@ generated: components: sources: websocket: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -338,7 +335,7 @@ generated: components: sources: websocket: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -406,7 +403,7 @@ generated: components: sources: websocket: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -424,7 +421,7 @@ generated: components: sources: websocket: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -438,11 +435,11 @@ generated: components: sources: websocket: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -480,8 +477,8 @@ generated: components: sources: websocket: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -525,13 +522,13 @@ generated: components: sources: websocket: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -558,15 +555,15 @@ generated: components: sources: websocket: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -584,7 +581,7 @@ generated: components: sources: websocket: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -661,13 +658,13 @@ generated: components: sources: websocket: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}

From d9b06937242d4e5f484362fab6c0506b3676347f Mon Sep 17 00:00:00 2001
From: Jonathan Davies <jpds@protonmail.com>
Date: Fri, 8 May 2026 16:09:03 +0100
Subject: [PATCH 214/326] feat(vector sink): Add zstd compression support
 (#24917)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* chore(deps): enable tonic zstd feature

Enable the zstd compression feature in the tonic dependency to support
zstd compression for gRPC communication in the Vector sink and source.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* feat(vector sink): add zstd compression support

Add support for zstd compression to the Vector sink, alongside the
existing gzip compression. Changes include:

- Update compression field from bool to Compression enum with backward
  compatibility via bool_or_compression deserializer
- Support compression algorithms: "none", "gzip", "zstd"
- Add validation that returns clear errors for unsupported compression
  types (zlib, snappy)
- Apply appropriate tonic::codec::CompressionEncoding based on
  selected algorithm

The default behavior (no compression) is unchanged, ensuring full
backward compatibility with existing configurations.

Resolves #23030

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* feat(vector source): accept zstd compressed requests

Update the Vector source to accept zstd-compressed data in addition to
gzip. This enables the source to receive and decompress data from Vector
sinks using either compression algorithm, ensuring seamless
interoperability.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* docs: add changelog entry for vector sink zstd compression

Add changelog fragment documenting the new zstd compression support
in the Vector sink, including usage examples for all configuration
formats (legacy boolean, string, and advanced object syntax).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix(vector source): support zstd decompression in gRPC layer

The custom DecompressionAndMetrics tower layer only supported gzip,
rejecting zstd requests before tonic could handle them. Add zstd
support to the decompression layer and a test for the full path.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs: add deprecation entry for vector sink boolean compression syntax

The boolean compression syntax (`compression: true/false`) in the vector
sink is deprecated in favour of the string syntax (`compression: "gzip"`,
`compression: "none"`, etc.), to be removed in v0.57.0.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(sources): centralize gRPC compression negotiation in shared layer

The shared DecompressionAndMetricsLayer now owns gRPC compression
negotiation end-to-end: after decompressing the request body it strips
the `grpc-encoding` header so tonic treats the request as uncompressed,
and it injects `grpc-accept-encoding: gzip,zstd,identity` into every
response. Per-service `.accept_compressed(..)` calls are removed from
the `vector` and `opentelemetry` sources.

As a consequence, the `opentelemetry` source now transparently accepts
`zstd`-compressed OTLP requests in addition to `gzip`, matching the
capability advertised via `grpc-accept-encoding` and the capability
surface of the `vector` source.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* perf(vector source): avoid intermediate buffer in zstd gRPC decompression

Replace decode_all + extend_from_slice with copy_decode, which streams
directly into output_buf. Eliminates the temporary Vec<u8> that
decode_all allocates, reducing peak memory from compressed + 2×decompressed
to compressed + decompressed per message.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(vector sink): parameterize grpc compression tests

Refactor run_sink_test into run_sink_test_with_compression, asserting the
grpc-encoding header and decompressing the received frame when a scheme
is set. Adds gzip, zstd, and none variants of deliver_message.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* test(vector source): parameterize grpc compression tests

Refactor run_test into a helper parameterized on Option<&str> compression, mirroring the sink-side change and covering no-compression, gzip, and zstd variants.

* refactor(vector source): tie grpc-accept-encoding to encoding enum

Replace the hand-maintained GRPC_ACCEPT_ENCODING_VALUE literal and its
parallel match arms with an AdvertisedEncoding enum whose ALL constant
drives both the advertised header value (built once via LazyLock) and
the parse/to_scheme mapping. Adding a new advertised scheme now
requires adding an enum variant, which makes the to_scheme match
non-exhaustive until it's wired up — the type system enforces what was
previously a convention.

* fix(vector source): reject compressed gRPC frames with no negotiated encoding

When grpc-encoding is identity or absent, from_encoding_header returns None.
The decompression loop previously fell back to gzip via unwrap_or, so a frame
with the compressed bit set would be silently decoded as gzip instead of
rejected. Per the gRPC compression spec the compressed flag requires a
negotiated encoding, so return an error when it is set without one and
convert the now-unreachable fallback into an expect.

* docs(changelog): add authors line to 24917 otel zstd fragment

The fragment was missing the authors: line required by
scripts/check_changelog_fragments.sh.

* refactor(vector source): bind decompressor via match to drop expect

Replace the is_none/assign/as_mut().expect() pattern with a match on &mut decompressor that
uses Option::insert on the None arm. Both arms yield &mut Decompressor directly, so the post-hoc
expect("decompressor must be set") is no longer needed.

* Fix clippy

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock                                    |  38 +++-
 Cargo.toml                                    |   2 +-
 ...ector_sink_zstd_compression.enhancement.md |  33 ++++
 ...c_decompression_reject_unnegotiated.fix.md |   6 +
 .../24917_otel_source_zstd.enhancement.md     |   7 +
 docs/DEPRECATIONS.md                          |   1 +
 src/sinks/vector/compression.rs               | 143 ++++++++++++++
 src/sinks/vector/config.rs                    |  23 ++-
 src/sinks/vector/mod.rs                       |  74 ++++++-
 src/sinks/vector/service.rs                   |   9 +-
 src/sources/opentelemetry/config.rs           |   8 +-
 src/sources/util/grpc/decompression.rs        | 187 +++++++++++++++---
 src/sources/vector/mod.rs                     |  44 +++--
 .../components/sinks/generated/vector.cue     |  25 ++-
 14 files changed, 528 insertions(+), 72 deletions(-)
 create mode 100644 changelog.d/23030_vector_sink_zstd_compression.enhancement.md
 create mode 100644 changelog.d/24917_grpc_decompression_reject_unnegotiated.fix.md
 create mode 100644 changelog.d/24917_otel_source_zstd.enhancement.md
 create mode 100644 src/sinks/vector/compression.rs

diff --git a/Cargo.lock b/Cargo.lock
index 09d10412bdfcc..e7136b39c12ac 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -594,7 +594,7 @@ dependencies = [
  "arrow-select 58.1.0",
  "flatbuffers 25.9.23",
  "lz4_flex 0.13.0",
- "zstd",
+ "zstd 0.13.2",
 ]
 
 [[package]]
@@ -2849,8 +2849,8 @@ dependencies = [
  "compression-core",
  "flate2",
  "memchr",
- "zstd",
- "zstd-safe",
+ "zstd 0.13.2",
+ "zstd-safe 7.2.1",
 ]
 
 [[package]]
@@ -8109,7 +8109,7 @@ dependencies = [
  "snap",
  "thrift",
  "twox-hash",
- "zstd",
+ "zstd 0.13.2",
 ]
 
 [[package]]
@@ -8985,7 +8985,7 @@ dependencies = [
  "tokio-util",
  "url",
  "uuid",
- "zstd",
+ "zstd 0.13.2",
 ]
 
 [[package]]
@@ -12060,6 +12060,7 @@ dependencies = [
  "tower-layer",
  "tower-service",
  "tracing 0.1.44",
+ "zstd 0.12.4",
 ]
 
 [[package]]
@@ -12152,7 +12153,7 @@ dependencies = [
  "tower-layer",
  "tower-service",
  "tracing 0.1.44",
- "zstd",
+ "zstd 0.13.2",
 ]
 
 [[package]]
@@ -13142,7 +13143,7 @@ dependencies = [
  "windows 0.58.0",
  "windows-service",
  "wiremock",
- "zstd",
+ "zstd 0.13.2",
 ]
 
 [[package]]
@@ -13685,7 +13686,7 @@ dependencies = [
  "webbrowser",
  "woothee",
  "xxhash-rust",
- "zstd",
+ "zstd 0.13.2",
 ]
 
 [[package]]
@@ -14858,13 +14859,32 @@ version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
 
+[[package]]
+name = "zstd"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a27595e173641171fc74a1232b7b1c7a7cb6e18222c11e9dfb9888fa424c53c"
+dependencies = [
+ "zstd-safe 6.0.6",
+]
+
 [[package]]
 name = "zstd"
 version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fcf2b778a664581e31e389454a7072dab1647606d44f7feea22cd5abb9c9f3f9"
 dependencies = [
- "zstd-safe",
+ "zstd-safe 7.2.1",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "6.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee98ffd0b48ee95e6c5168188e44a54550b1564d9d530ee21d5f0eaed1069581"
+dependencies = [
+ "libc",
+ "zstd-sys",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index fb79af1caa48f..7f46e97d60ea0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -203,7 +203,7 @@ proc-macro2 = { version = "1", default-features = false }
 quote = { version = "1", default-features = false }
 syn = { version = "2", default-features = false }
 toml = { version = "0.9.8", default-features = false, features = ["serde", "display", "parse"] }
-tonic = { version = "0.11", default-features = false, features = ["transport", "codegen", "prost", "tls", "tls-roots", "gzip"] }
+tonic = { version = "0.11", default-features = false, features = ["transport", "codegen", "prost", "tls", "tls-roots", "gzip", "zstd"] }
 tonic-build = { version = "0.11", default-features = false, features = ["transport", "prost"] }
 tonic-health = { version = "0.11", default-features = false }
 tonic-reflection = { version = "0.11", default-features = false, features = ["server"] }
diff --git a/changelog.d/23030_vector_sink_zstd_compression.enhancement.md b/changelog.d/23030_vector_sink_zstd_compression.enhancement.md
new file mode 100644
index 0000000000000..5c1b8408d3248
--- /dev/null
+++ b/changelog.d/23030_vector_sink_zstd_compression.enhancement.md
@@ -0,0 +1,33 @@
+The `vector` sink now supports `zstd` compression in addition to `gzip`. This provides better
+compression ratios and performance for Vector-to-Vector communication.
+
+The compression configuration has been enhanced to support multiple algorithms while maintaining
+full backward compatibility:
+
+## Legacy boolean syntax (still supported)
+
+```yaml
+sinks:
+  my_vector:
+    type: vector
+    address: "localhost:6000"
+    compression: true   # Uses gzip (default)
+    # or
+    compression: false  # No compression
+```
+
+## New string syntax
+
+```yaml
+sinks:
+  my_vector:
+    type: vector
+    address: "localhost:6000"
+    compression: "zstd"  # Use zstd compression
+    # Supported values: "none", "gzip", "zstd"
+```
+
+The Vector source automatically accepts both gzip and zstd compressed data, enabling seamless
+communication between Vector instances using different compression algorithms.
+
+authors: jpds
diff --git a/changelog.d/24917_grpc_decompression_reject_unnegotiated.fix.md b/changelog.d/24917_grpc_decompression_reject_unnegotiated.fix.md
new file mode 100644
index 0000000000000..ef1e4a90cc53a
--- /dev/null
+++ b/changelog.d/24917_grpc_decompression_reject_unnegotiated.fix.md
@@ -0,0 +1,6 @@
+The shared gRPC decompression layer now rejects request frames that set the
+compressed flag without a negotiated `grpc-encoding` (e.g. `identity` or a
+missing header). Previously such malformed frames were silently decoded as
+gzip, which could mask client/server compression-negotiation bugs.
+
+authors: jpds
diff --git a/changelog.d/24917_otel_source_zstd.enhancement.md b/changelog.d/24917_otel_source_zstd.enhancement.md
new file mode 100644
index 0000000000000..1a35e5257e968
--- /dev/null
+++ b/changelog.d/24917_otel_source_zstd.enhancement.md
@@ -0,0 +1,7 @@
+The `opentelemetry` source's gRPC OTLP receiver now accepts `zstd`-compressed
+requests in addition to `gzip`, matching the compression schemes advertised via
+the `grpc-accept-encoding` response header. No configuration change is required;
+clients can send OTLP payloads with `grpc-encoding: zstd` and they will be
+transparently decompressed.
+
+authors: jpds
diff --git a/docs/DEPRECATIONS.md b/docs/DEPRECATIONS.md
index 9c36ff3eb7859..5d0e823165b1b 100644
--- a/docs/DEPRECATIONS.md
+++ b/docs/DEPRECATIONS.md
@@ -17,6 +17,7 @@ For example:
 - `v0.50.0` | `http-server-encoding` | The `encoding` field will be removed. Use `decoding` and `framing` instead.
 - `v0.53.0` | `buffer-bytes-events-metrics` | The `buffer_byte_size` and `buffer_events` gauges are deprecated in favor of the `buffer_size_bytes`/`buffer_size_events` metrics described in `docs/specs/buffer.md`.
 - `v0.58.0` | `azure-monitor-logs-sink` | The `azure_monitor_logs` sink is deprecated in favor of the new `azure_logs_ingestion` sink, which uses the Azure Monitor Logs Ingestion API. Users should migrate before Microsoft ends support for the old Data Collector API (scheduled for September 2026).
+- `v0.57.0` | `bool-or-vector-compression` | The boolean syntax for the `compression` field in the `vector` sink (`compression: true`/`compression: false`) is deprecated. Use the string syntax instead (`compression: "gzip"`, `compression: "zstd"`, or `compression: "none"`). The `bool_or_vector_compression` deserializer should be removed once the boolean syntax is no longer supported.
 - `v0.58.0` | `datadog-metrics-series-v1` | The `series_api_version: v1` option on the `datadog_metrics` sink is deprecated in favor of `v2` (the default). The v1 series endpoint (`/api/v1/series`) is a legacy endpoint; users should remove `series_api_version: v1` from their configuration or set it to `v2`.
 
 ## To be migrated
diff --git a/src/sinks/vector/compression.rs b/src/sinks/vector/compression.rs
new file mode 100644
index 0000000000000..9165d93934985
--- /dev/null
+++ b/src/sinks/vector/compression.rs
@@ -0,0 +1,143 @@
+use serde::{Deserialize, Deserializer, de};
+use vector_lib::configurable::configurable_component;
+
+/// Compression configuration for the Vector sink.
+///
+/// Only `gzip` and `zstd` are supported as compression algorithms for the
+/// Vector sink's gRPC transport. Compression levels are not configurable
+/// as the underlying tonic library does not support them.
+#[configurable_component]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+#[serde(rename_all = "snake_case")]
+#[configurable(metadata(
+    docs::enum_tag_description = "The compression algorithm to use for sending."
+))]
+pub enum VectorCompression {
+    /// No compression.
+    #[default]
+    None,
+
+    /// [Gzip][gzip] compression.
+    ///
+    /// [gzip]: https://www.gzip.org/
+    Gzip,
+
+    /// [Zstandard][zstd] compression.
+    ///
+    /// [zstd]: https://facebook.github.io/zstd/
+    Zstd,
+}
+
+impl VectorCompression {
+    /// Returns the corresponding `tonic::codec::CompressionEncoding`, if any.
+    pub const fn as_tonic_encoding(self) -> Option<tonic::codec::CompressionEncoding> {
+        match self {
+            VectorCompression::None => Option::None,
+            VectorCompression::Gzip => Some(tonic::codec::CompressionEncoding::Gzip),
+            VectorCompression::Zstd => Some(tonic::codec::CompressionEncoding::Zstd),
+        }
+    }
+}
+
+/// Enables deserializing compression from a bool (legacy) or string (new).
+///
+/// For backward compatibility:
+/// - `true` maps to `VectorCompression::Gzip`
+/// - `false` maps to `VectorCompression::None`
+///
+/// New syntax:
+/// - `"none"`, `"gzip"`, `"zstd"` as strings
+pub fn bool_or_vector_compression<'de, D>(deserializer: D) -> Result<VectorCompression, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    struct BoolOrVectorCompression;
+
+    impl<'de> de::Visitor<'de> for BoolOrVectorCompression {
+        type Value = VectorCompression;
+
+        fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {
+            formatter.write_str("boolean (deprecated) or string (\"none\", \"gzip\", or \"zstd\")")
+        }
+
+        fn visit_bool<E>(self, value: bool) -> Result<VectorCompression, E>
+        where
+            E: de::Error,
+        {
+            if value {
+                Ok(VectorCompression::Gzip)
+            } else {
+                Ok(VectorCompression::None)
+            }
+        }
+
+        fn visit_str<E>(self, value: &str) -> Result<VectorCompression, E>
+        where
+            E: de::Error,
+        {
+            VectorCompression::deserialize(de::value::StrDeserializer::new(value))
+        }
+    }
+
+    deserializer.deserialize_any(BoolOrVectorCompression)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[derive(Deserialize)]
+    struct TestConfig {
+        #[serde(deserialize_with = "bool_or_vector_compression")]
+        compression: VectorCompression,
+    }
+
+    #[test]
+    fn test_legacy_true() {
+        let json = r#"{"compression": true}"#;
+        let result: TestConfig = serde_json::from_str(json).unwrap();
+        assert_eq!(result.compression, VectorCompression::Gzip);
+    }
+
+    #[test]
+    fn test_legacy_false() {
+        let json = r#"{"compression": false}"#;
+        let result: TestConfig = serde_json::from_str(json).unwrap();
+        assert_eq!(result.compression, VectorCompression::None);
+    }
+
+    #[test]
+    fn test_string_gzip() {
+        let json = r#"{"compression": "gzip"}"#;
+        let result: TestConfig = serde_json::from_str(json).unwrap();
+        assert_eq!(result.compression, VectorCompression::Gzip);
+    }
+
+    #[test]
+    fn test_string_zstd() {
+        let json = r#"{"compression": "zstd"}"#;
+        let result: TestConfig = serde_json::from_str(json).unwrap();
+        assert_eq!(result.compression, VectorCompression::Zstd);
+    }
+
+    #[test]
+    fn test_string_none() {
+        let json = r#"{"compression": "none"}"#;
+        let result: TestConfig = serde_json::from_str(json).unwrap();
+        assert_eq!(result.compression, VectorCompression::None);
+    }
+
+    #[test]
+    fn test_unsupported_algorithm_rejected() {
+        let json = r#"{"compression": "snappy"}"#;
+        let result = serde_json::from_str::<TestConfig>(json);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_object_syntax_rejected() {
+        let json = r#"{"compression": {"algorithm": "zstd", "level": 3}}"#;
+        let result = serde_json::from_str::<TestConfig>(json);
+        assert!(result.is_err());
+    }
+}
diff --git a/src/sinks/vector/config.rs b/src/sinks/vector/config.rs
index 52601115cb67a..ae2847073a649 100644
--- a/src/sinks/vector/config.rs
+++ b/src/sinks/vector/config.rs
@@ -8,6 +8,7 @@ use vector_lib::configurable::configurable_component;
 
 use super::{
     VectorSinkError,
+    compression::VectorCompression,
     service::{VectorRequest, VectorResponse, VectorService},
     sink::VectorSink,
 };
@@ -49,14 +50,19 @@ pub struct VectorConfig {
     #[configurable(metadata(docs::examples = "https://somehost:6000"))]
     address: String,
 
-    /// Whether or not to compress requests.
+    /// Compression algorithm for requests.
     ///
-    /// If set to `true`, requests are compressed with [`gzip`][gzip_docs].
+    /// Supports `"none"`, `"gzip"`, or `"zstd"`.
     ///
-    /// [gzip_docs]: https://www.gzip.org/
-    #[configurable(metadata(docs::advanced))]
-    #[serde(default)]
-    compression: bool,
+    /// For backward compatibility, boolean values are still accepted:
+    /// - `true` defaults to gzip compression
+    /// - `false` disables compression (deprecated syntax)
+    #[configurable(derived)]
+    #[serde(
+        default,
+        deserialize_with = "super::compression::bool_or_vector_compression"
+    )]
+    compression: VectorCompression,
 
     #[configurable(derived)]
     #[serde(default)]
@@ -97,7 +103,7 @@ fn default_config(address: &str) -> VectorConfig {
     VectorConfig {
         version: None,
         address: address.to_owned(),
-        compression: false,
+        compression: VectorCompression::None,
         batch: BatchConfig::default(),
         request: TowerRequestConfig::default(),
         tls: None,
@@ -120,7 +126,8 @@ impl SinkConfig for VectorConfig {
             .clone()
             .map(|uri| uri.uri)
             .unwrap_or_else(|| uri.clone());
-        let healthcheck_client = VectorService::new(client.clone(), healthcheck_uri, false);
+        let healthcheck_client =
+            VectorService::new(client.clone(), healthcheck_uri, VectorCompression::None);
         let healthcheck = healthcheck(healthcheck_client, cx.healthcheck);
         let service = VectorService::new(client, uri, self.compression);
         let request_settings = self.request.into_settings();
diff --git a/src/sinks/vector/mod.rs b/src/sinks/vector/mod.rs
index 4cf882b1d2ee6..c3abd90d6b629 100644
--- a/src/sinks/vector/mod.rs
+++ b/src/sinks/vector/mod.rs
@@ -1,6 +1,7 @@
 use snafu::Snafu;
 use vector_lib::configurable::configurable_component;
 
+mod compression;
 mod config;
 mod service;
 mod sink;
@@ -79,11 +80,23 @@ mod tests {
     }
 
     async fn run_sink_test(test_type: TestType) {
+        run_sink_test_with_compression(test_type, None).await;
+    }
+
+    async fn run_sink_test_with_compression(test_type: TestType, compression: Option<&str>) {
         let num_lines = 10;
 
         let (_guard, in_addr) = next_addr();
 
-        let config = format!(r#"address = "http://{in_addr}/""#);
+        let config = match compression {
+            Some(c) => format!(
+                r#"
+                    address = "http://{in_addr}/"
+                    compression = "{c}"
+                "#
+            ),
+            None => format!(r#"address = "http://{in_addr}/""#),
+        };
         let config: VectorConfig = toml::from_str(&config).unwrap();
 
         let cx = SinkContext::default();
@@ -115,13 +128,29 @@ mod tests {
 
         assert_eq!(receiver.try_recv(), Ok(BatchStatus::Delivered));
 
-        let output_lines = get_received(rx, |parts| {
+        let expected_encoding = compression;
+        let output_lines = get_received(rx, move |parts| {
             assert_eq!(Method::POST, parts.method);
             assert_eq!("/vector.Vector/PushEvents", parts.uri.path());
             assert_eq!(
                 "application/grpc",
                 parts.headers.get("content-type").unwrap().to_str().unwrap()
             );
+            match expected_encoding {
+                Some(enc) => assert_eq!(
+                    enc,
+                    parts
+                        .headers
+                        .get("grpc-encoding")
+                        .unwrap_or_else(|| panic!("missing grpc-encoding header (expected {enc})"))
+                        .to_str()
+                        .unwrap()
+                ),
+                None => assert!(
+                    parts.headers.get("grpc-encoding").is_none(),
+                    "unexpected grpc-encoding header present"
+                ),
+            }
         })
         .await;
 
@@ -134,6 +163,21 @@ mod tests {
         run_sink_test(TestType::Normal).await;
     }
 
+    #[tokio::test]
+    async fn deliver_message_gzip() {
+        run_sink_test_with_compression(TestType::Normal, Some("gzip")).await;
+    }
+
+    #[tokio::test]
+    async fn deliver_message_zstd() {
+        run_sink_test_with_compression(TestType::Normal, Some("zstd")).await;
+    }
+
+    #[tokio::test]
+    async fn deliver_message_none() {
+        run_sink_test_with_compression(TestType::Normal, None).await;
+    }
+
     #[tokio::test]
     async fn data_volume_tags() {
         init_telemetry(
@@ -197,9 +241,35 @@ mod tests {
         assert_parts: impl Fn(Parts),
     ) -> Vec<String> {
         rx.map(|(parts, body)| {
+            let encoding = parts
+                .headers
+                .get("grpc-encoding")
+                .map(|v| v.to_str().unwrap().to_owned());
             assert_parts(parts);
 
+            let compressed = body[0] == 1;
             let proto_body = body.slice(GRPC_HEADER_SIZE..);
+            let proto_body = if compressed {
+                use std::io::Read;
+                let mut out = Vec::new();
+                match encoding.as_deref() {
+                    Some("gzip") => {
+                        flate2::read::GzDecoder::new(&proto_body[..])
+                            .read_to_end(&mut out)
+                            .unwrap();
+                    }
+                    Some("zstd") => {
+                        zstd::stream::read::Decoder::new(&proto_body[..])
+                            .unwrap()
+                            .read_to_end(&mut out)
+                            .unwrap();
+                    }
+                    other => panic!("unexpected grpc-encoding for compressed frame: {other:?}"),
+                }
+                Bytes::from(out)
+            } else {
+                proto_body
+            };
 
             let req = proto::PushEventsRequest::decode(proto_body).unwrap();
 
diff --git a/src/sinks/vector/service.rs b/src/sinks/vector/service.rs
index 471b3a98ed6b1..9c3d09fb0e541 100644
--- a/src/sinks/vector/service.rs
+++ b/src/sinks/vector/service.rs
@@ -13,7 +13,7 @@ use vector_lib::{
     stream::DriverResponse,
 };
 
-use super::VectorSinkError;
+use super::{VectorSinkError, compression::VectorCompression};
 use crate::{
     Error,
     event::{EventFinalizers, EventStatus, Finalizable},
@@ -70,7 +70,7 @@ impl VectorService {
     pub fn new(
         hyper_client: hyper::Client<ProxyConnector<HttpsConnector<HttpConnector>>, BoxBody>,
         uri: Uri,
-        compression: bool,
+        compression: VectorCompression,
     ) -> Self {
         let (protocol, endpoint) = uri::protocol_endpoint(uri.clone());
         let mut proto_client = proto_vector::Client::new(HyperSvc {
@@ -78,9 +78,10 @@ impl VectorService {
             client: hyper_client,
         });
 
-        if compression {
-            proto_client = proto_client.send_compressed(tonic::codec::CompressionEncoding::Gzip);
+        if let Some(encoding) = compression.as_tonic_encoding() {
+            proto_client = proto_client.send_compressed(encoding);
         }
+
         Self {
             client: proto_client,
             protocol,
diff --git a/src/sources/opentelemetry/config.rs b/src/sources/opentelemetry/config.rs
index 827bbd213360d..5ae97fa491479 100644
--- a/src/sources/opentelemetry/config.rs
+++ b/src/sources/opentelemetry/config.rs
@@ -19,7 +19,7 @@ use crate::{
 };
 use futures::FutureExt;
 use futures_util::{TryFutureExt, future::join};
-use tonic::{codec::CompressionEncoding, transport::server::RoutesBuilder};
+use tonic::transport::server::RoutesBuilder;
 use vector_config::indexmap::IndexSet;
 use vector_lib::{
     codecs::decoding::{OtlpDeserializer, OtlpSignalType},
@@ -285,6 +285,9 @@ impl SourceConfig for OpentelemetryConfig {
         let metrics_deserializer = self.get_signal_deserializer(OtlpSignalType::Metrics)?;
         let traces_deserializer = self.get_signal_deserializer(OtlpSignalType::Traces)?;
 
+        // Compression negotiation (gzip, zstd) is handled centrally by
+        // `DecompressionAndMetricsLayer` in `sources::util::grpc`, so these
+        // services deliberately do not call `.accept_compressed(..)`.
         let log_service = LogsServiceServer::new(Service {
             pipeline: cx.out.clone(),
             acknowledgements,
@@ -292,7 +295,6 @@ impl SourceConfig for OpentelemetryConfig {
             events_received: events_received.clone(),
             deserializer: logs_deserializer.clone(),
         })
-        .accept_compressed(CompressionEncoding::Gzip)
         .max_decoding_message_size(usize::MAX);
 
         let metrics_service = MetricsServiceServer::new(Service {
@@ -302,7 +304,6 @@ impl SourceConfig for OpentelemetryConfig {
             events_received: events_received.clone(),
             deserializer: metrics_deserializer.clone(),
         })
-        .accept_compressed(CompressionEncoding::Gzip)
         .max_decoding_message_size(usize::MAX);
 
         let trace_service = TraceServiceServer::new(Service {
@@ -312,7 +313,6 @@ impl SourceConfig for OpentelemetryConfig {
             events_received: events_received.clone(),
             deserializer: traces_deserializer.clone(),
         })
-        .accept_compressed(CompressionEncoding::Gzip)
         .max_decoding_message_size(usize::MAX);
 
         let mut builder = RoutesBuilder::default();
diff --git a/src/sources/util/grpc/decompression.rs b/src/sources/util/grpc/decompression.rs
index 535c938f3cbbe..26427f27afe6a 100644
--- a/src/sources/util/grpc/decompression.rs
+++ b/src/sources/util/grpc/decompression.rs
@@ -1,16 +1,17 @@
 use std::{
     cmp,
     future::Future,
-    io::Write,
+    io::{self, Write},
     mem,
     pin::Pin,
+    sync::LazyLock,
     task::{Context, Poll},
 };
 
 use bytes::{Buf, BufMut, BytesMut};
 use flate2::write::GzDecoder;
 use futures_util::FutureExt;
-use http::{Request, Response};
+use http::{HeaderValue, Request, Response};
 use hyper::{
     Body,
     body::{HttpBody, Sender},
@@ -31,8 +32,58 @@ const GRPC_MESSAGE_HEADER_LEN: usize = mem::size_of::<u8>() + mem::size_of::<u32
 const GRPC_ENCODING_HEADER: &str = "grpc-encoding";
 const GRPC_ACCEPT_ENCODING_HEADER: &str = "grpc-accept-encoding";
 
+// The encodings this layer advertises to clients via `grpc-accept-encoding`.
+// Each variant maps to a `CompressionScheme` (or `None` for `identity`) through
+// `to_scheme`, so adding a variant here forces the decompression match to be
+// updated and the advertised list cannot drift from the schemes actually handled.
+#[derive(Clone, Copy)]
+enum AdvertisedEncoding {
+    Gzip,
+    Zstd,
+    Identity,
+}
+
+impl AdvertisedEncoding {
+    const ALL: &'static [Self] = &[Self::Gzip, Self::Zstd, Self::Identity];
+
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Gzip => "gzip",
+            Self::Zstd => "zstd",
+            Self::Identity => "identity",
+        }
+    }
+
+    fn parse(s: &str) -> Option<Self> {
+        Self::ALL.iter().copied().find(|e| e.as_str() == s)
+    }
+
+    // `identity` is the gRPC no-op encoding: the request body is already
+    // uncompressed, so there's nothing to decompress.
+    const fn to_scheme(self) -> Option<CompressionScheme> {
+        match self {
+            Self::Gzip => Some(CompressionScheme::Gzip),
+            Self::Zstd => Some(CompressionScheme::Zstd),
+            Self::Identity => None,
+        }
+    }
+}
+
+// Advertised to clients via `grpc-accept-encoding`. Derived from
+// `AdvertisedEncoding::ALL` so this layer is the single owner of gRPC compression
+// negotiation for all Vector gRPC sources and the header value cannot drift from
+// the set of schemes actually handled.
+static GRPC_ACCEPT_ENCODING_VALUE: LazyLock<String> = LazyLock::new(|| {
+    AdvertisedEncoding::ALL
+        .iter()
+        .map(|e| e.as_str())
+        .collect::<Vec<_>>()
+        .join(",")
+});
+
 enum CompressionScheme {
     Gzip,
+    Zstd,
 }
 
 impl CompressionScheme {
@@ -49,17 +100,18 @@ impl CompressionScheme {
             .transpose()
             .and_then(|value| match value {
                 None => Ok(None),
-                Some(scheme) => match scheme.as_str() {
-                    "gzip" => Ok(Some(CompressionScheme::Gzip)),
-                    other => Err(Status::unimplemented(format!(
-                        "compression scheme `{other}` is not supported"
+                Some(scheme) => match AdvertisedEncoding::parse(&scheme) {
+                    Some(encoding) => Ok(encoding.to_scheme()),
+                    None => Err(Status::unimplemented(format!(
+                        "compression scheme `{scheme}` is not supported"
                     ))),
                 },
             })
             .map_err(|mut status| {
                 status.metadata_mut().insert(
                     GRPC_ACCEPT_ENCODING_HEADER,
-                    AsciiMetadataValue::from_static("gzip,identity"),
+                    AsciiMetadataValue::try_from(GRPC_ACCEPT_ENCODING_VALUE.as_str())
+                        .expect("advertised encoding value must be valid ASCII"),
                 );
                 status
             })
@@ -78,21 +130,64 @@ enum State {
     },
 }
 
-fn new_decompressor() -> GzDecoder<Vec<u8>> {
-    // Create the backing buffer for the decompressor and set the compression flag to false (0) and pre-allocate
-    // the space for the length prefix, which we'll fill out once we've finalized the decompressor.
-    let buf = vec![0; GRPC_MESSAGE_HEADER_LEN];
+enum Decompressor {
+    Gzip(Box<GzDecoder<Vec<u8>>>),
+    Zstd {
+        compressed: Vec<u8>,
+        output_buf: Vec<u8>,
+    },
+}
 
-    GzDecoder::new(buf)
+impl Decompressor {
+    fn new(scheme: &CompressionScheme) -> Result<Self, io::Error> {
+        // Create the backing buffer for the decompressor and set the compression flag to false (0)
+        // and pre-allocate the space for the length prefix, which we'll fill out once we've
+        // finalized the decompressor.
+        let buf = vec![0; GRPC_MESSAGE_HEADER_LEN];
+        match scheme {
+            CompressionScheme::Gzip => Ok(Decompressor::Gzip(Box::new(GzDecoder::new(buf)))),
+            CompressionScheme::Zstd => Ok(Decompressor::Zstd {
+                compressed: Vec::new(),
+                output_buf: buf,
+            }),
+        }
+    }
+
+    fn write_all(&mut self, data: &[u8]) -> io::Result<()> {
+        match self {
+            Decompressor::Gzip(d) => d.write_all(data),
+            Decompressor::Zstd { compressed, .. } => {
+                compressed.extend_from_slice(data);
+                Ok(())
+            }
+        }
+    }
+
+    fn finish(self) -> io::Result<Vec<u8>> {
+        match self {
+            Decompressor::Gzip(d) => (*d).finish(),
+            // Decode directly into output_buf to avoid a temporary intermediate Vec that
+            // decode_all would produce; peak memory is compressed + decompressed rather than
+            // compressed + 2 × decompressed.
+            Decompressor::Zstd {
+                compressed,
+                mut output_buf,
+            } => {
+                zstd::stream::copy_decode(io::Cursor::new(&compressed), &mut output_buf)?;
+                Ok(output_buf)
+            }
+        }
+    }
 }
 
 async fn drive_body_decompression(
     mut source: Body,
     mut destination: Sender,
+    scheme: Option<CompressionScheme>,
 ) -> Result<usize, Status> {
     let mut state = State::default();
     let mut buf = BytesMut::new();
-    let mut decompressor = None;
+    let mut decompressor: Option<Decompressor> = None;
     let mut bytes_received = 0;
 
     // Drain all message chunks from the body first.
@@ -131,6 +226,16 @@ async fn drive_body_decompression(
                     // decompressor incrementally because there's no good reason to make both the internal buffer and
                     // the decompressor buffer expand if we don't have to.
                     if is_compressed {
+                        // Per the gRPC compression spec, the compressed flag requires a
+                        // negotiated encoding. Reject frames that set it under identity
+                        // (or with no `grpc-encoding` header) rather than silently
+                        // falling back to gzip and masking client/server mismatches.
+                        if scheme.is_none() {
+                            return Err(Status::internal(
+                                "received compressed frame but no compression scheme was negotiated",
+                            ));
+                        }
+
                         // We skip the header in the buffer because it doesn't matter to the decompressor and we
                         // recreate it anyways.
                         buf.advance(GRPC_MESSAGE_HEADER_LEN);
@@ -170,8 +275,18 @@ async fn drive_body_decompression(
                             // the decompressor. This is _technically_ synchronous but there's really no way to do it
                             // asynchronously since we already have the data, and that's the only asynchronous part.
                             let to_take = cmp::min(available, *remaining);
-                            let decompressor = decompressor.get_or_insert_with(new_decompressor);
-                            if decompressor.write_all(&buf[..to_take]).is_err() {
+                            let d = match &mut decompressor {
+                                Some(d) => d,
+                                slot @ None => {
+                                    let scheme = scheme.as_ref().expect(
+                                        "compressed frames without a negotiated scheme are rejected earlier",
+                                    );
+                                    slot.insert(Decompressor::new(scheme).map_err(|_| {
+                                        Status::internal("failed to initialize decompressor")
+                                    })?)
+                                }
+                            };
+                            if d.write_all(&buf[..to_take]).is_err() {
                                 return Err(Status::internal("failed to write to decompressor"));
                             }
 
@@ -243,12 +358,13 @@ async fn drive_request<F, E>(
     destination: Sender,
     inner: F,
     bytes_received: Registered<BytesReceived>,
+    scheme: Option<CompressionScheme>,
 ) -> Result<Response<BoxBody>, E>
 where
     F: Future<Output = Result<Response<BoxBody>, E>>,
     E: std::fmt::Display,
 {
-    let body_decompression = drive_body_decompression(source, destination);
+    let body_decompression = drive_body_decompression(source, destination, scheme);
 
     pin!(inner);
     pin!(body_decompression);
@@ -256,7 +372,7 @@ where
     let mut body_eof = false;
     let mut body_bytes_received = 0;
 
-    let result = loop {
+    let mut result = loop {
         select! {
             biased;
 
@@ -291,6 +407,18 @@ where
         }
     };
 
+    // Advertise the set of compression schemes this layer can accept to the client.
+    // Since this layer is the single owner of compression negotiation, individual
+    // services no longer call `.accept_compressed(..)` and therefore tonic would not
+    // set this header itself.
+    if let Ok(res) = result.as_mut() {
+        res.headers_mut().insert(
+            GRPC_ACCEPT_ENCODING_HEADER,
+            HeaderValue::from_str(&GRPC_ACCEPT_ENCODING_VALUE)
+                .expect("advertised encoding value must be valid ASCII"),
+        );
+    }
+
     result
 }
 
@@ -325,16 +453,29 @@ where
             // The request either isn't using compression, or it has indicated compression may be used and we know we
             // can support decompression based on the indicated compression scheme... so wrap the body to decompress, if
             // need be, and then track the bytes that flowed through.
-            //
-            // TODO: Actually use the scheme given back to us to support other compression schemes.
-            Ok(_) => {
+            Ok(scheme) => {
                 let (destination, decompressed_body) = Body::channel();
-                let (req_parts, req_body) = req.into_parts();
+                let (mut req_parts, req_body) = req.into_parts();
+                // Since this layer owns compression negotiation and is about to hand the
+                // inner service a fully decompressed body (with the per-message compressed
+                // flag cleared), strip the `grpc-encoding` header so tonic's codegen treats
+                // the request as uncompressed and does not try to validate the encoding
+                // against any per-service `accept_compressed(..)` configuration.
+                if scheme.is_some() {
+                    req_parts.headers.remove(GRPC_ENCODING_HEADER);
+                }
                 let mapped_req = Request::from_parts(req_parts, decompressed_body);
 
                 let inner = self.inner.call(mapped_req);
 
-                drive_request(req_body, destination, inner, self.bytes_received.clone()).boxed()
+                drive_request(
+                    req_body,
+                    destination,
+                    inner,
+                    self.bytes_received.clone(),
+                    scheme,
+                )
+                .boxed()
             }
         }
     }
@@ -359,7 +500,7 @@ where
 /// request was valid, and was processed -- we can now report the number of bytes (after decompression) that were
 /// received _and_ processed correctly.
 ///
-/// The only supported compression scheme is gzip, which is also the only supported compression scheme in `tonic` itself.
+/// The supported compression schemes are gzip and zstd.
 #[derive(Clone, Default)]
 pub struct DecompressionAndMetricsLayer;
 
diff --git a/src/sources/vector/mod.rs b/src/sources/vector/mod.rs
index 5c29c975e4612..a1e0137258489 100644
--- a/src/sources/vector/mod.rs
+++ b/src/sources/vector/mod.rs
@@ -177,13 +177,16 @@ impl SourceConfig for VectorConfig {
         let acknowledgements = cx.do_acknowledgements(self.acknowledgements);
         let log_namespace = cx.log_namespace(self.log_namespace);
 
-        // Create the custom Vector service (existing)
+        // Create the custom Vector service (existing).
+        //
+        // Compression negotiation (gzip, zstd) is handled centrally by
+        // `DecompressionAndMetricsLayer` in `sources::util::grpc`, so we
+        // deliberately do not call `.accept_compressed(..)` here.
         let vector_service = proto::Server::new(Service {
             pipeline: cx.out,
             acknowledgements,
             log_namespace,
         })
-        .accept_compressed(tonic::codec::CompressionEncoding::Gzip)
         // Tonic added a default of 4MB in 0.9. This replaces the old behavior.
         .max_decoding_message_size(usize::MAX);
 
@@ -303,9 +306,11 @@ mod tests {
         test_util,
     };
 
-    async fn run_test(vector_source_config_str: &str, addr: SocketAddr) {
-        let config = format!(r#"address = "{addr}""#);
-        let source: VectorConfig = toml::from_str(&config).unwrap();
+    async fn run_test(compression: Option<&str>) {
+        let (_guard, addr) = test_util::addr::next_addr();
+
+        let source_config = format!(r#"address = "{addr}""#);
+        let source: VectorConfig = toml::from_str(&source_config).unwrap();
 
         let (tx, rx) = SourceSender::new_test();
         let server = source
@@ -318,7 +323,16 @@ mod tests {
         // Ideally, this would be a fully custom agent to send the data,
         // but the sink side already does such a test and this is good
         // to ensure interoperability.
-        let sink: SinkConfig = toml::from_str(vector_source_config_str).unwrap();
+        let sink_config = match compression {
+            Some(c) => format!(
+                r#"
+                    address = "{addr}"
+                    compression = "{c}"
+                "#
+            ),
+            None => format!(r#"address = "{addr}""#),
+        };
+        let sink: SinkConfig = toml::from_str(&sink_config).unwrap();
         let cx = SinkContext::default();
         let (sink, _) = sink.build(cx).await.unwrap();
 
@@ -338,21 +352,17 @@ mod tests {
 
     #[tokio::test]
     async fn receive_message() {
-        let (_guard, addr) = test_util::addr::next_addr();
-
-        let config = format!(r#"address = "{addr}""#);
-        run_test(&config, addr).await;
+        run_test(None).await;
     }
 
     #[tokio::test]
-    async fn receive_compressed_message() {
-        let (_guard, addr) = test_util::addr::next_addr();
+    async fn receive_gzip_compressed_message() {
+        run_test(Some("gzip")).await;
+    }
 
-        let config = format!(
-            r#"address = "{addr}"
-            compression=true"#
-        );
-        run_test(&config, addr).await;
+    #[tokio::test]
+    async fn receive_zstd_compressed_message() {
+        run_test(Some("zstd")).await;
     }
 
     #[tokio::test]
diff --git a/website/cue/reference/components/sinks/generated/vector.cue b/website/cue/reference/components/sinks/generated/vector.cue
index 0e2b629994703..c1bc55fcfe0fe 100644
--- a/website/cue/reference/components/sinks/generated/vector.cue
+++ b/website/cue/reference/components/sinks/generated/vector.cue
@@ -72,14 +72,31 @@ generated: components: sinks: vector: configuration: {
 	}
 	compression: {
 		description: """
-			Whether or not to compress requests.
+			Compression algorithm for requests.
 
-			If set to `true`, requests are compressed with [`gzip`][gzip_docs].
+			Supports `"none"`, `"gzip"`, or `"zstd"`.
 
-			[gzip_docs]: https://www.gzip.org/
+			For backward compatibility, boolean values are still accepted:
+			- `true` defaults to gzip compression
+			- `false` disables compression (deprecated syntax)
 			"""
 		required: false
-		type: bool: default: false
+		type: string: {
+			default: "none"
+			enum: {
+				gzip: """
+					[Gzip][gzip] compression.
+
+					[gzip]: https://www.gzip.org/
+					"""
+				none: "No compression."
+				zstd: """
+					[Zstandard][zstd] compression.
+
+					[zstd]: https://facebook.github.io/zstd/
+					"""
+			}
+		}
 	}
 	request: {
 		description: """

From e59ac5715d4c8cc63b2e9076d19c4ef0429a2b4e Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Fri, 8 May 2026 11:12:02 -0400
Subject: [PATCH 215/326] chore(external docs): Clarify acknowledgement
 guarantees with disk buffers (#25388)

docs: clarify acknowledgement guarantees with disk buffers
---
 website/content/en/docs/architecture/guarantees.md | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/website/content/en/docs/architecture/guarantees.md b/website/content/en/docs/architecture/guarantees.md
index 14a1c0c9a72d8..fd2b55e3a3df5 100644
--- a/website/content/en/docs/architecture/guarantees.md
+++ b/website/content/en/docs/architecture/guarantees.md
@@ -14,7 +14,7 @@ see which components support specific guarantees.
 
 ## Acknowledgement guarantees
 
-Vector supports end-to-end acknowledgement for the majority of its
+Vector supports [end-to-end acknowledgements][e2e_acks] for the majority of its
 sources and sinks. This is a system which tracks the delivery status of
 an event through the lifetime of that event as it travels from the
 originating source to any number of destination sinks. Support for this
@@ -121,7 +121,11 @@ will provide ample time to transition and, when possible, strive to retain backw
 
 One of the unique advantages of the metrics and logging use cases is that data is usually used for diagnostic purposes only. Therefore, losing the occasional event has little impact on your business. This affords you the opportunity to provision your pipeline towards performance, simplicity, and cost reduction. On the other hand, if you're using your data to perform business critical functions, then data loss is not acceptable and therefore requires "at-least-once" delivery.
 
-To clarify, even though a source or sink is marked as "best effort" it doesn't mean Vector takes delivery lightly. In fact, once data is within the boundary of Vector it won't be lost if you've configured on-disk buffers. Data loss for "best-effort" sources and sinks is almost always due to the limitations of the underlying protocol.
+To clarify, even though a source or sink is marked as "best effort" it doesn't mean Vector takes
+delivery lightly. For stronger delivery guarantees, use components that support
+[end-to-end acknowledgements][e2e_acks] and configure disk buffers where events need to survive
+restarts. Disk buffers improve durability for events that have been written to them, but they do not
+by themselves guarantee end-to-end delivery.
 
 ### Does Vector support exactly-once delivery?
 
@@ -134,4 +138,5 @@ filters.
 
 [bugs]: https://github.com/vectordotdev/vector/issues?q=is%3Aopen+is%3Aissue+label%3A%22type%3A+bug%22
 [components]: /components
+[e2e_acks]: /docs/architecture/end-to-end-acknowledgements
 [event]: /docs/architecture/data-model

From 39138e0e7b73a3b1d4f9dd7f0617343c3afd42ca Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 8 May 2026 11:27:00 -0400
Subject: [PATCH 216/326] feat(ci): add /ci-run-regression trigger + accept
 refs in inputs (#25245)

* chore(ci): accept refs in regression workflow and add /ci-run-regression trigger

* Shorten /ci-run-regression description

* chore(ci): drop unneeded actions: write and grant id-token on regression caller

* chore(ci): use startsWith and simplify regression baseline parsing
---
 .github/workflows/ci-review-trigger.yml | 46 ++++++++++++++
 .github/workflows/regression.yml        | 82 ++++++++++++-------------
 2 files changed, 85 insertions(+), 43 deletions(-)

diff --git a/.github/workflows/ci-review-trigger.yml b/.github/workflows/ci-review-trigger.yml
index ade6cf9c8c8c8..3b2a8b5304d3d 100644
--- a/.github/workflows/ci-review-trigger.yml
+++ b/.github/workflows/ci-review-trigger.yml
@@ -23,6 +23,17 @@
 # /ci-run-unit-windows        : runs Unit - Windows
 # /ci-run-environment         : runs Environment Suite
 # /ci-run-k8s                 : runs K8s E2E Suite
+#
+# Not included in /ci-run-all:
+#
+# /ci-run-regression          : runs Regression Detection Suite. The comparison ref is
+#                               the review's commit. An optional baseline ref can be
+#                               passed as an argument, otherwise the baseline defaults
+#                               to the SHA from 7 days ago. Examples:
+#                                 /ci-run-regression
+#                                 /ci-run-regression origin/master
+#                                 /ci-run-regression v0.55.0
+#                               Not included in `/ci-run-all` because it is expensive.
 
 name: CI Review Trigger
 
@@ -70,6 +81,7 @@ jobs:
       || startsWith(github.event.review.body, '/ci-run-unit-windows')
       || startsWith(github.event.review.body, '/ci-run-environment')
       || startsWith(github.event.review.body, '/ci-run-k8s')
+      || startsWith(github.event.review.body, '/ci-run-regression')
     steps:
       - name: Generate authentication token
         id: generate_token
@@ -197,6 +209,40 @@ jobs:
       ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
+  # Parse an optional baseline ref from a `/ci-run-regression <ref>` comment line.
+  # The captured ref is passed to the regression workflow; an empty value lets it
+  # fall back to its default (the SHA from 7 days ago).
+  regression-parse:
+    needs: validate
+    if: startsWith(github.event.review.body, '/ci-run-regression')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      baseline-sha: ${{ steps.parse.outputs.baseline }}
+    steps:
+      - name: Parse baseline ref from review body
+        id: parse
+        env:
+          REVIEW_BODY: ${{ github.event.review.body }}
+        run: |
+          # The body starts with `/ci-run-regression`; take the second whitespace-
+          # delimited token on the first line as the optional baseline ref.
+          read -r _ BASELINE _ <<< "${REVIEW_BODY}"
+          echo "Parsed baseline ref: '${BASELINE}'"
+          echo "baseline=${BASELINE}" >> "$GITHUB_OUTPUT"
+
+  regression:
+    needs: [validate, regression-parse]
+    if: startsWith(github.event.review.body, '/ci-run-regression')
+    permissions:
+      contents: read # Required to checkout code
+      id-token: write # Required for AWS OIDC token exchange in regression.yml
+    uses: ./.github/workflows/regression.yml
+    with:
+      baseline-sha: ${{ needs.regression-parse.outputs.baseline-sha }}
+      comparison-sha: ${{ github.event.review.commit_id }}
+    secrets: inherit
+
   coverage:
     needs: validate
     if: contains(github.event.review.body, '/ci-run-coverage')
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 0c234590fb702..6ffe79b24e2f2 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -1,15 +1,20 @@
 # Regression Detection Suite
 #
 # This workflow runs under the following conditions:
-#   - Once per day, based on a schedule
-#   - On demand, triggered from https://github.com/vectordotdev/vector/actions/workflows/regression_v2.yml
+#   - Once per week, based on a schedule
+#   - On demand, triggered from https://github.com/vectordotdev/vector/actions/workflows/regression.yml
+#   - On demand, via the `/ci-run-regression` (or `/ci-run-all`) PR review comment,
+#     which invokes this workflow via `workflow_call` from `ci-review-trigger.yml`.
 #
 # The workflow accepts two optional inputs:
-#   - The baseline SHA:
+#   - The baseline ref:
 #     - If not specified, the SHA from 7 days ago on origin/master is used.
-#   - The comparison SHA:
+#   - The comparison ref:
 #     - If not specified, the current HEAD of origin/master is used.
 #
+# Both inputs accept any git ref that `git rev-parse` can resolve: a full commit
+# SHA, a short SHA, a branch name (e.g. `origin/master`), or a tag.
+#
 # This workflow runs regression detection experiments, performing relative
 # evaluations of the baseline SHA and comparison SHA. The exact SHAs are determined
 # by how the workflow is triggered.
@@ -26,11 +31,21 @@ on:
   workflow_dispatch:
     inputs:
       baseline-sha:
-        description: "The SHA to use as the baseline (optional). If not provided, it defaults to the SHA from 7 days ago."
+        description: "Baseline git ref (full/short SHA, branch such as `origin/master`, or tag). Defaults to the SHA from 7 days ago."
+        required: false
+      comparison-sha:
+        description: "Comparison git ref (full/short SHA, branch such as `origin/master`, or tag). Defaults to the current HEAD of origin/master."
+        required: false
+  workflow_call:
+    inputs:
+      baseline-sha:
+        description: "Baseline git ref (full/short SHA, branch such as `origin/master`, or tag). Defaults to the SHA from 7 days ago."
         required: false
+        type: string
       comparison-sha:
-        description: "The SHA to use for comparison (optional). If not provided, it defaults to the current HEAD of the origin/master branch."
+        description: "Comparison git ref (full/short SHA, branch such as `origin/master`, or tag). Defaults to the current HEAD of origin/master."
         required: false
+        type: string
   schedule:
     - cron: "0 7 * * 1" # Runs at 7 AM UTC on Mondays
 
@@ -60,39 +75,32 @@ jobs:
 
       - name: Set and Validate SHAs
         id: set_and_validate_shas
+        env:
+          BASELINE_INPUT: ${{ inputs.baseline-sha }}
+          COMPARISON_INPUT: ${{ inputs.comparison-sha }}
         run: |
-          # Set baseline SHA
-          if [ -z "${{ github.event.inputs.baseline-sha }}" ]; then
+          # Resolve baseline ref to a full commit SHA
+          if [ -z "${BASELINE_INPUT}" ]; then
             BASELINE_SHA=$(git rev-list -n 1 --before="7 days ago" origin/master)
             echo "Using baseline SHA from 7 days ago: ${BASELINE_SHA}"
           else
-            BASELINE_SHA="${{ github.event.inputs.baseline-sha }}"
-            echo "Using provided baseline SHA: ${BASELINE_SHA}"
+            if ! BASELINE_SHA=$(git rev-parse --verify "${BASELINE_INPUT}^{commit}" 2>/dev/null); then
+              echo "Invalid baseline ref: '${BASELINE_INPUT}'. Expected a full/short SHA, branch (e.g. origin/master), or tag."
+              exit 1
+            fi
+            echo "Resolved baseline input '${BASELINE_INPUT}' to SHA: ${BASELINE_SHA}"
           fi
 
-          # Validate baseline SHA
-          if [ -n "${BASELINE_SHA}" ] && git cat-file -e "${BASELINE_SHA}^{commit}"; then
-            echo "Baseline SHA is valid."
-          else
-            echo "Invalid baseline SHA: ${BASELINE_SHA}."
-            exit 1
-          fi
-
-          # Set comparison SHA
-          if [ -z "${{ github.event.inputs.comparison-sha }}" ]; then
+          # Resolve comparison ref to a full commit SHA
+          if [ -z "${COMPARISON_INPUT}" ]; then
             COMPARISON_SHA=$(git rev-parse origin/master)
-            echo "Using current HEAD for comparison SHA: ${COMPARISON_SHA}"
+            echo "Using current HEAD of origin/master as comparison SHA: ${COMPARISON_SHA}"
           else
-            COMPARISON_SHA="${{ github.event.inputs.comparison-sha }}"
-            echo "Using provided comparison SHA: ${COMPARISON_SHA}"
-          fi
-
-          # Validate comparison SHA
-          if [ -n "${COMPARISON_SHA}" ] && git cat-file -e "${COMPARISON_SHA}^{commit}"; then
-            echo "Comparison SHA is valid."
-          else
-            echo "Invalid comparison SHA: ${COMPARISON_SHA}."
-            exit 1
+            if ! COMPARISON_SHA=$(git rev-parse --verify "${COMPARISON_INPUT}^{commit}" 2>/dev/null); then
+              echo "Invalid comparison ref: '${COMPARISON_INPUT}'. Expected a full/short SHA, branch (e.g. origin/master), or tag."
+              exit 1
+            fi
+            echo "Resolved comparison input '${COMPARISON_INPUT}' to SHA: ${COMPARISON_SHA}"
           fi
 
           # Set tags and export them
@@ -192,10 +200,6 @@ jobs:
     needs:
       - should-run-gate
       - resolve-inputs
-    # Job-level permissions for artifact upload
-    permissions:
-      contents: read # Required to checkout code
-      actions: write # Required to upload artifacts
     steps:
       - uses: colpal/actions-clean@36e6ca1abd35efe61cb60f912bd7837f67887c8a # v1.1.1
 
@@ -235,10 +239,6 @@ jobs:
     needs:
       - should-run-gate
       - resolve-inputs
-    # Job-level permissions for artifact upload
-    permissions:
-      contents: read # Required to checkout code
-      actions: write # Required to upload artifacts
     steps:
       - uses: colpal/actions-clean@36e6ca1abd35efe61cb60f912bd7837f67887c8a # v1.1.1
 
@@ -392,10 +392,8 @@ jobs:
       - resolve-inputs
       - upload-baseline-image-to-ecr
       - upload-comparison-image-to-ecr
-    # Job-level permissions for artifact upload
     permissions:
       contents: read # Required to checkout code
-      actions: write # Required to upload artifacts
       id-token: write # Required for GitHub OIDC token exchange
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -513,10 +511,8 @@ jobs:
       - should-run-gate
       - submit-job
       - resolve-inputs
-    # Job-level permissions for artifact upload
     permissions:
       contents: read # Required to checkout code
-      actions: write # Required to upload artifacts
       id-token: write # Required for GitHub OIDC token exchange
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

From 4ff1874b38008c15afeb61902298b36593a727bb Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Fri, 8 May 2026 12:43:29 -0400
Subject: [PATCH 217/326] fix(vdev): emit channel-suffixed version from
 publish-metadata (#25395)

cargo vdev build publish-metadata was emitting vector_version without
the channel suffix because it called cargo::get_version() (which only
reads VERSION env / Cargo.toml). The packaging Makefile and cargo vdev
version go through app::version(), which appends .custom.<sha> for
custom-channel builds.

The mismatch broke deb/rpm packaging in custom-channel CI runs:
make package-...-all produced archives named
vector-<ver>.custom.<sha>-<target>.tar.gz, but package-deb.sh looked for
vector-<ver>-<target>.tar.gz using the suffix-stripped VECTOR_VERSION env
from publish-metadata. Release-channel runs were unaffected because the
suffix is empty there.

Switch publish_metadata.rs to app::version() so all consumers see the
same canonical version string.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 vdev/src/commands/build/publish_metadata.rs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/vdev/src/commands/build/publish_metadata.rs b/vdev/src/commands/build/publish_metadata.rs
index 4f6de426228dc..6740513abd1d6 100644
--- a/vdev/src/commands/build/publish_metadata.rs
+++ b/vdev/src/commands/build/publish_metadata.rs
@@ -1,7 +1,7 @@
 use anyhow::Result;
 use chrono::prelude::*;
 
-use crate::utils::{cargo, git};
+use crate::{app, utils::git};
 use std::{
     env,
     fs::OpenOptions,
@@ -20,8 +20,9 @@ pub struct Cli {}
 
 impl Cli {
     pub fn exec(self) -> Result<()> {
-        // Generate the Vector version and build description.
-        let version = cargo::get_version()?;
+        // Use `app::version()` so the emitted `vector_version` matches archive filenames
+        // (which include `.custom.<sha>` on custom-channel runs).
+        let version = app::version()?;
 
         let git_sha = git::get_git_sha()?;
         let current_date = Local::now().naive_local().to_string();

From 41bc804eab5590ccb44084512eb05b4a5612e2b7 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 8 May 2026 12:49:29 -0400
Subject: [PATCH 218/326] chore(ci): replace bootstrap scripts with setup
 action in publish workflows (#25311)

* chore(ci): replace bootstrap scripts with setup action in publish workflows

* fix(ci): override VECTOR_VERSION from computed VERSION in Makefile.packaging

* ci: add /ci-run-packaging trigger and skip_publish input to publish workflow

* ci: grant required permissions to packaging job

* ci: install cmark-gfm for deb packaging

* fix(ci): use app::version in publish_metadata to include channel suffix in VECTOR_VERSION

* ci: fix trigger comments to move coverage and cross to non-all section
---
 .github/workflows/ci-review-trigger.yml | 24 ++++++++++++----
 .github/workflows/publish.yml           | 38 +++++++++++++++++++++----
 .github/workflows/vdev_publish.yml      | 14 +++------
 Makefile.packaging                      |  1 +
 4 files changed, 56 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/ci-review-trigger.yml b/.github/workflows/ci-review-trigger.yml
index 3b2a8b5304d3d..d7534297d5afb 100644
--- a/.github/workflows/ci-review-trigger.yml
+++ b/.github/workflows/ci-review-trigger.yml
@@ -9,7 +9,6 @@
 #
 # The available triggers are:
 #
-# /ci-run-coverage            : runs full coverage suite (unit + int + e2e) — NOT included in /ci-run-all (covered by others)
 # /ci-run-all                 : runs all of the below
 # /ci-run-cli                 : runs CLI - Linux
 # /ci-run-test-vector-api     : runs make test-vector-api
@@ -18,14 +17,15 @@
 # /ci-run-test-docs           : runs make test-docs
 # /ci-run-deny                : runs Deny - Linux
 # /ci-run-component-features  : runs Component Features - Linux
-# /ci-run-cross               : runs Cross
 # /ci-run-unit-mac            : runs Unit - Mac
 # /ci-run-unit-windows        : runs Unit - Windows
 # /ci-run-environment         : runs Environment Suite
 # /ci-run-k8s                 : runs K8s E2E Suite
+# /ci-run-packaging           : builds and verifies packages (without publishing to Docker/S3/GitHub)
 #
-# Not included in /ci-run-all:
-#
+# The following triggers are available but do NOT run as part of /ci-run-all:
+# /ci-run-cross               : runs Cross (covered by /ci-run-packaging)
+# /ci-run-coverage            : runs full coverage suite (unit + int + e2e)
 # /ci-run-regression          : runs Regression Detection Suite. The comparison ref is
 #                               the review's commit. An optional baseline ref can be
 #                               passed as an argument, otherwise the baseline defaults
@@ -81,6 +81,7 @@ jobs:
       || startsWith(github.event.review.body, '/ci-run-unit-windows')
       || startsWith(github.event.review.body, '/ci-run-environment')
       || startsWith(github.event.review.body, '/ci-run-k8s')
+      || startsWith(github.event.review.body, '/ci-run-packaging')
       || startsWith(github.event.review.body, '/ci-run-regression')
     steps:
       - name: Generate authentication token
@@ -171,7 +172,7 @@ jobs:
 
   cross:
     needs: validate
-    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-cross')
+    if: contains(github.event.review.body, '/ci-run-cross')
     uses: ./.github/workflows/cross.yml
     with:
       ref: ${{ github.event.review.commit_id }}
@@ -254,3 +255,16 @@ jobs:
     with:
       ref: ${{ github.event.review.commit_id }}
     secrets: inherit
+
+  packaging:
+    needs: validate
+    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-packaging')
+    permissions:
+      contents: write
+      packages: write
+    uses: ./.github/workflows/publish.yml
+    with:
+      git_ref: ${{ github.event.review.commit_id }}
+      channel: custom
+      skip_publish: true
+    secrets: inherit
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0ce890aa849a0..a74a30dfee59d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,6 +4,20 @@ permissions:
   contents: read
 
 on:
+  workflow_dispatch:
+    inputs:
+      git_ref:
+        description: "Git ref to build (branch, tag, or SHA)"
+        type: string
+        required: false
+      channel:
+        description: "Release channel (release/nightly/custom)"
+        type: string
+        default: custom
+      skip_publish:
+        description: "Build and verify only. Skip publishing to Docker, S3, and GitHub"
+        type: boolean
+        default: false
   workflow_call:
     inputs:
       git_ref:
@@ -14,6 +28,10 @@ on:
       channel:
         type: string
         required: true
+      skip_publish:
+        description: "Build and verify only. Skip publishing to Docker, S3, and GitHub"
+        type: boolean
+        default: false
 
 env:
   VERBOSE: true
@@ -70,12 +88,18 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.git_ref }}
-      - name: Bootstrap runner environment (Ubuntu-specific)
-        run: sudo -E bash scripts/environment/bootstrap-ubuntu-24.04.sh
-      - name: Bootstrap runner environment (generic)
-        run: bash scripts/environment/prepare.sh --modules=rustup,cross,cargo-deb
+      - uses: ./.github/actions/setup
+        with:
+          rust: true
+          cross: true
+          cargo-deb: true
+          protoc: true
+          libsasl2: true
       - name: Install cross-compilation tools
-        run: sudo apt-get install -y binutils-arm-linux-gnueabihf binutils-aarch64-linux-gnu
+        run: sudo apt-get install -y binutils-arm-linux-gnueabihf binutils-aarch64-linux-gnu cmark-gfm
+      - name: Install rpm
+        if: endsWith(matrix.target, '-linux-gnu') || matrix.target == 'armv7-unknown-linux-gnueabihf'
+        run: sudo apt-get install -y rpm
       - name: Build Vector
         run: make package-${{ matrix.target }}-all
       - name: Stage package artifacts for publish
@@ -310,6 +334,7 @@ jobs:
 
   publish-docker:
     name: Publish to Docker
+    if: ${{ !inputs.skip_publish }}
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     # Elevated permission required to push Docker images to GitHub Container Registry
@@ -370,6 +395,7 @@ jobs:
 
   publish-s3:
     name: Publish to S3
+    if: ${{ !inputs.skip_publish }}
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     needs:
@@ -407,7 +433,7 @@ jobs:
   publish-github:
     name: Publish release to GitHub
     # We only publish to GitHub for versioned releases, not nightlies.
-    if: inputs.channel == 'release'
+    if: ${{ !inputs.skip_publish && inputs.channel == 'release' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     # Elevated permission required to create GitHub releases and upload release assets
diff --git a/.github/workflows/vdev_publish.yml b/.github/workflows/vdev_publish.yml
index 80200d395f6ca..b40174d0f21fc 100644
--- a/.github/workflows/vdev_publish.yml
+++ b/.github/workflows/vdev_publish.yml
@@ -25,16 +25,10 @@ jobs:
       - name: Checkout Vector
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Bootstrap runner environment (Ubuntu)
-        if: startsWith(matrix.os, 'ubuntu')
-        run: |
-          sudo -E bash scripts/environment/bootstrap-ubuntu-24.04.sh
-
-      - name: Bootstrap runner environment (macOS)
-        if: startsWith(matrix.os, 'macos')
-        run: bash scripts/environment/bootstrap-macos.sh
-
-      - run: bash scripts/environment/prepare.sh --modules=rustup
+      - uses: ./.github/actions/setup
+        with:
+          rust: true
+          vdev: false
 
       - name: Build
         working-directory: vdev
diff --git a/Makefile.packaging b/Makefile.packaging
index 032e334094d19..39dbd28dcc942 100644
--- a/Makefile.packaging
+++ b/Makefile.packaging
@@ -14,6 +14,7 @@ VDEV := cargo vdev
 
 # Set version — only evaluated when this Makefile is loaded
 export VERSION ?= $(shell command -v cargo >/dev/null && $(VDEV) version || echo unknown)
+export VECTOR_VERSION := ${VERSION}
 
 # Delegate cross-compilation prerequisites to the main Makefile
 target/%/release/vector.tar.gz:

From 0d9111807bc7abb24ff53ef8590b8ca3ba4d8834 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Fri, 8 May 2026 13:41:34 -0400
Subject: [PATCH 219/326] chore(deps): bump vrl to latest main (#25398)

* chore(deps): bump vrl to latest main

Picks up new commits on the vrl `main` branch. The bump introduces
a new `allow_lossy_string_coercion` field on `vrl::protobuf::encode::Options`;
set to `true` in all call sites to preserve current Vector behavior
(matches vrl's default).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(deps): add allow_lossy_string_coercion to OTLP e2e helper

Same vrl::protobuf::encode::Options change as the codec serializers,
applied to the e2e-tests-opentelemetry helper so that target also
compiles with the bumped vrl revision.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 Cargo.lock                                    | 30 +++++++++----------
 lib/codecs/src/encoding/format/otlp.rs        |  1 +
 lib/codecs/src/encoding/format/proto_batch.rs |  1 +
 lib/codecs/src/encoding/format/protobuf.rs    |  1 +
 tests/e2e/opentelemetry/mod.rs                |  1 +
 5 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e7136b39c12ac..99ace18db604e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2067,7 +2067,7 @@ dependencies = [
  "bitflags 2.10.0",
  "cexpr",
  "clang-sys",
- "itertools 0.13.0",
+ "itertools 0.10.5",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "regex",
@@ -2784,7 +2784,7 @@ version = "3.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -3765,7 +3765,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.0",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -5671,7 +5671,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.0",
  "system-configuration 0.6.1",
  "tokio",
  "tower-service",
@@ -8727,7 +8727,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22505a5c94da8e3b7c2996394d1c933236c4d743e81a410bcca4e6989fc066a4"
 dependencies = [
  "bytes",
- "heck 0.4.1",
+ "heck 0.5.0",
  "itertools 0.12.1",
  "log",
  "multimap",
@@ -8747,8 +8747,8 @@ version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
- "heck 0.4.1",
- "itertools 0.14.0",
+ "heck 0.5.0",
+ "itertools 0.10.5",
  "log",
  "multimap",
  "once_cell",
@@ -8781,7 +8781,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
@@ -8794,7 +8794,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
- "itertools 0.14.0",
+ "itertools 0.10.5",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
@@ -9993,7 +9993,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -10872,7 +10872,7 @@ version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
 dependencies = [
- "heck 0.4.1",
+ "heck 0.5.0",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
@@ -10884,7 +10884,7 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54254b8531cafa275c5e096f62d48c81435d1015405a91198ddb11e967301d40"
 dependencies = [
- "heck 0.4.1",
+ "heck 0.5.0",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
@@ -11521,10 +11521,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -13576,7 +13576,7 @@ checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 [[package]]
 name = "vrl"
 version = "0.32.0"
-source = "git+https://github.com/vectordotdev/vrl.git?branch=main#8a5b4711f37d0b3bd4d0d2ea8bbb500942bd8e98"
+source = "git+https://github.com/vectordotdev/vrl.git?branch=main#704351cc3fdec4415bbf89653b9ca2cd0dc20212"
 dependencies = [
  "aes",
  "aes-siv",
diff --git a/lib/codecs/src/encoding/format/otlp.rs b/lib/codecs/src/encoding/format/otlp.rs
index fd0ffffe47b04..c3e8d325a8abc 100644
--- a/lib/codecs/src/encoding/format/otlp.rs
+++ b/lib/codecs/src/encoding/format/otlp.rs
@@ -64,6 +64,7 @@ impl OtlpSerializer {
     pub fn new() -> vector_common::Result<Self> {
         let options = Options {
             use_json_names: true,
+            allow_lossy_string_coercion: true,
         };
 
         let logs_descriptor = ProtobufSerializer::new_from_bytes(
diff --git a/lib/codecs/src/encoding/format/proto_batch.rs b/lib/codecs/src/encoding/format/proto_batch.rs
index 12fea52d02a25..3bdce405f6b70 100644
--- a/lib/codecs/src/encoding/format/proto_batch.rs
+++ b/lib/codecs/src/encoding/format/proto_batch.rs
@@ -94,6 +94,7 @@ impl ProtoBatchSerializer {
             descriptor: Arc::new(descriptor),
             options: Options {
                 use_json_names: false,
+                allow_lossy_string_coercion: true,
             },
         })
     }
diff --git a/lib/codecs/src/encoding/format/protobuf.rs b/lib/codecs/src/encoding/format/protobuf.rs
index f1c6730615707..b6ea35a5e848c 100644
--- a/lib/codecs/src/encoding/format/protobuf.rs
+++ b/lib/codecs/src/encoding/format/protobuf.rs
@@ -32,6 +32,7 @@ impl ProtobufSerializerConfig {
             message_descriptor,
             options: Options {
                 use_json_names: self.protobuf.use_json_names,
+                allow_lossy_string_coercion: true,
             },
         })
     }
diff --git a/tests/e2e/opentelemetry/mod.rs b/tests/e2e/opentelemetry/mod.rs
index 2d1f483d38128..42210e2b51bef 100644
--- a/tests/e2e/opentelemetry/mod.rs
+++ b/tests/e2e/opentelemetry/mod.rs
@@ -69,6 +69,7 @@ where
         vrl_value,
         &vrl::protobuf::encode::Options {
             use_json_names: true,
+            allow_lossy_string_coercion: true,
         },
     )
     .map_err(|e| format!("Failed to encode VRL value to protobuf: {e}"))?;

From 63b29fb2d8d80b5be57a897e14c8d29ed23d5663 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 8 May 2026 14:38:00 -0400
Subject: [PATCH 220/326] fix(ci): skip dd-sts federation on fork PRs via
 ACTIONS_ID_TOKEN_REQUEST_URL guard (#25399)

* fix(ci): skip dd-sts federation on fork PRs via ACTIONS_ID_TOKEN_REQUEST_URL guard

* fix(ci): gate dd-sts federation on OIDC availability via shell output

* fix(ci): keep dd-sts non-blocking on federation failure
---
 .github/actions/dd-token/action.yml | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/actions/dd-token/action.yml b/.github/actions/dd-token/action.yml
index f2b6b32eb0a16..a1fe17b21a803 100644
--- a/.github/actions/dd-token/action.yml
+++ b/.github/actions/dd-token/action.yml
@@ -10,10 +10,22 @@ inputs:
 runs:
   using: "composite"
   steps:
-    # Fork PRs don't get `id-token: write`, so federation cannot succeed.
-    # Allow the step to fail and let downstream steps run without DD credentials.
+    # Fork PRs don't get `id-token: write`, so ACTIONS_ID_TOKEN_REQUEST_URL is
+    # unset. Read it via shell (env context only covers YAML-declared vars) and
+    # skip federation when absent to avoid a hard failure.
+    - name: Check OIDC token availability
+      id: oidc
+      shell: bash
+      run: |
+        if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL}" ]; then
+          echo "available=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "available=false" >> "$GITHUB_OUTPUT"
+        fi
+
     - name: Federate Datadog token
       id: dd-sts
+      if: ${{ steps.oidc.outputs.available == 'true' }}
       continue-on-error: true
       uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75
       with:

From 81f013820839be8ab0cc28069ab943c44f0f28cb Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 8 May 2026 15:03:05 -0400
Subject: [PATCH 221/326] chore(ci): use debug profile for k8s e2e build
 (#25397)

Use debug profile for k8s job
---
 .github/workflows/k8s_e2e.yml |  4 ----
 Makefile.packaging            | 11 ++++++++---
 scripts/package-deb.sh        |  7 ++++---
 3 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index 53f811f0a2a35..329f31e642457 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -70,11 +70,7 @@ jobs:
     needs: changes
     # Run this job even if `changes` job is skipped
     if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' }}
-    # cargo-deb requires a release build, but we don't need optimizations for tests
     env:
-      CARGO_PROFILE_RELEASE_OPT_LEVEL: 0
-      CARGO_PROFILE_RELEASE_LTO: thin # fat LTO OOMs/timeouts on standard 16GB runners; thin is sufficient to verify linking
-      CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 256
       CARGO_INCREMENTAL: 0
       DISABLE_MOLD: true
     steps:
diff --git a/Makefile.packaging b/Makefile.packaging
index 39dbd28dcc942..58e0e970aa6bf 100644
--- a/Makefile.packaging
+++ b/Makefile.packaging
@@ -11,21 +11,26 @@
 # packaging and release targets here automatically.
 
 VDEV := cargo vdev
+PROFILE ?= release
 
 # Set version — only evaluated when this Makefile is loaded
 export VERSION ?= $(shell command -v cargo >/dev/null && $(VDEV) version || echo unknown)
 export VECTOR_VERSION := ${VERSION}
 
 # Delegate cross-compilation prerequisites to the main Makefile
-target/%/release/vector.tar.gz:
+target/%/vector.tar.gz:
 	unset TRIPLE && $(MAKE) $@
 
+# .SECONDEXPANSION allows prerequisites to reference $* (the pattern stem) and
+# $(PROFILE) (a variable) by escaping them as $$* and $$(PROFILE). Without it,
+# both would expand to empty at parse time before any target is matched.
+.SECONDEXPANSION:
+
 ##@ Packaging
 
 # archives
 target/artifacts/vector-${VERSION}-%.tar.gz: export TRIPLE :=$(@:target/artifacts/vector-${VERSION}-%.tar.gz=%)
-target/artifacts/vector-${VERSION}-%.tar.gz: override PROFILE =release
-target/artifacts/vector-${VERSION}-%.tar.gz: target/%/release/vector.tar.gz
+target/artifacts/vector-${VERSION}-%.tar.gz: target/$$*/$$(PROFILE)/vector.tar.gz
 	@echo "Built to ${<}, relocating to ${@}"
 	@mkdir -p target/artifacts/
 	@cp -v \
diff --git a/scripts/package-deb.sh b/scripts/package-deb.sh
index ede151f290b3b..6bbc86720e46e 100755
--- a/scripts/package-deb.sh
+++ b/scripts/package-deb.sh
@@ -13,6 +13,7 @@ set -x
 #   $TARGET         a target triple. ex: arm64-apple-darwin (no default)
 
 TARGET="${TARGET:?"You must specify a target triple, ex: arm64-apple-darwin"}"
+PROFILE="${PROFILE:-release}"
 
 #
 # Local vars
@@ -39,8 +40,8 @@ echo "TARGET: $TARGET"
 td="$(mktemp -d)"
 pushd "$td"
 tar -xvf "$ABSOLUTE_ARCHIVE_PATH"
-mkdir -p "$PROJECT_ROOT/target/$TARGET/release"
-mv "vector-$TARGET/bin/vector" "$PROJECT_ROOT/target/$TARGET/release"
+mkdir -p "$PROJECT_ROOT/target/$TARGET/$PROFILE"
+mv "vector-$TARGET/bin/vector" "$PROJECT_ROOT/target/$TARGET/$PROFILE"
 popd
 rm -rf "$td"
 
@@ -71,7 +72,7 @@ cat LICENSE NOTICE >"$PROJECT_ROOT/target/debian-license.txt"
 #   --no-build
 #     because this step should follow a build
 
-cargo deb --target "$TARGET" --deb-version "${PACKAGE_VERSION}-1" --variant "$TARGET" --no-build --no-strip
+cargo deb --target "$TARGET" --deb-version "${PACKAGE_VERSION}-1" --variant "$TARGET" --no-build --no-strip --profile "$PROFILE"
 
 # Rename the resulting .deb file to remove TARGET from name.
 for file in target/"${TARGET}"/debian/*.deb; do

From f3346607ba25645a682b4b5bbc56d95a7f4bb4dd Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 8 May 2026 15:11:30 -0400
Subject: [PATCH 222/326] chore(dev): make -D warnings the default via
 .cargo/config.toml (#25400)

* chore: make -D warnings the default via .cargo/config.toml

* chore(dev): move +crt-static into cargo config, drop RUSTFLAGS override in publish.yml
---
 .cargo/config.toml               |  3 ++-
 .github/actions/setup/action.yml | 11 -----------
 .github/workflows/publish.yml    |  1 -
 vdev/src/commands/check/rust.rs  |  7 -------
 4 files changed, 2 insertions(+), 20 deletions(-)

diff --git a/.cargo/config.toml b/.cargo/config.toml
index 2d2f4cbf67086..b74d481a4f475 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -8,6 +8,7 @@ JEMALLOC_SYS_WITH_LG_PAGE = "16"
 
 [target.'cfg(all())']
 rustflags = [
+  "-D", "warnings",
   "-Dclippy::print_stdout",
   "-Dclippy::print_stderr",
   "-Dclippy::dbg_macro",
@@ -35,4 +36,4 @@ rustflags = ["-C", "link-args=-rdynamic"]
 
 [target.x86_64-pc-windows-msvc]
 # https://github.com/dtolnay/inventory/issues/58
-rustflags = ["-C", "codegen-units=1"]
+rustflags = ["-C", "codegen-units=1", "-Ctarget-feature=+crt-static"]
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 3c7e645e6831b..4bce327b06aa1 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -149,17 +149,6 @@ runs:
       run: echo "::add-matcher::.github/matchers/rust.json"
       shell: bash
 
-    - name: Override warnings
-      if: ${{ env.NEEDS_RUST == 'true' }}
-      run: |
-        CARGO_OVERRIDE_DIR="${HOME}/.cargo"
-        CARGO_OVERRIDE_CONF="${CARGO_OVERRIDE_DIR}/config.toml"
-        cat <<EOF >>"$CARGO_OVERRIDE_CONF"
-        [target.'cfg(linux)']
-        rustflags = [ "-D", "warnings" ]
-        EOF
-      shell: bash
-
     - name: Cache Cargo registry, index, and git DB
       if: ${{ inputs.cargo-cache == 'true' || env.NEEDS_RUST == 'true' || env.VDEV_NEEDS_COMPILE == 'true' }}
       uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index a74a30dfee59d..8d6b8c2560ca0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -165,7 +165,6 @@ jobs:
       VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
       VECTOR_BUILD_DESC: ${{ needs.generate-publish-metadata.outputs.vector_build_desc }}
       CHANNEL: ${{ needs.generate-publish-metadata.outputs.vector_release_channel }}
-      RUSTFLAGS: "-D warnings -Ctarget-feature=+crt-static"
       RELEASE_BUILDER: "true"
     steps:
       - name: Checkout Vector
diff --git a/vdev/src/commands/check/rust.rs b/vdev/src/commands/check/rust.rs
index e7597550962df..3656ff96d62c4 100644
--- a/vdev/src/commands/check/rust.rs
+++ b/vdev/src/commands/check/rust.rs
@@ -36,12 +36,6 @@ impl Cli {
             Vec::default()
         };
 
-        let clippy_args = if self.clippy {
-            vec!["--", "-D", "warnings"]
-        } else {
-            Vec::default()
-        };
-
         let feature_args = if self.features.is_empty() {
             vec!["--all-features".to_string()]
         } else {
@@ -55,7 +49,6 @@ impl Cli {
         [tool.as_ref(), "--workspace", "--all-targets"]
             .chain_args(feature_args)
             .chain_args(pre_args)
-            .chain_args(clippy_args)
     }
 
     pub fn exec(self) -> Result<()> {

From f2f19212bb5cee15615c8d86658447a4ac096729 Mon Sep 17 00:00:00 2001
From: Martin Ruderer <martin.ruderer@gmail.com>
Date: Fri, 8 May 2026 21:18:40 +0200
Subject: [PATCH 223/326] fix(mqtt source): pass client certificates to rumqttc
 for mTLS (#24929)

* fix(mqtt source): pass client certificates to rumqttc for mutual TLS

* Update changelog.d/mqtt_source_mutual_TLS.fix.md

Co-authored-by: Thomas <thomasqueirozb@gmail.com>

* Revert (broken) error handling

---------

Co-authored-by: Thomas <thomasqueirozb@gmail.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 changelog.d/mqtt_source_mutual_TLS.fix.md | 3 +++
 src/sources/mqtt/config.rs                | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/mqtt_source_mutual_TLS.fix.md

diff --git a/changelog.d/mqtt_source_mutual_TLS.fix.md b/changelog.d/mqtt_source_mutual_TLS.fix.md
new file mode 100644
index 0000000000000..9d1c52d65c370
--- /dev/null
+++ b/changelog.d/mqtt_source_mutual_TLS.fix.md
@@ -0,0 +1,3 @@
+Fixed a bug in the `mqtt` source where user-provided TLS client certificates (`crt_file` / `key_file`) were being silently ignored, breaking mTLS connections to strict brokers like AWS IoT Core.
+
+authors: mr-
diff --git a/src/sources/mqtt/config.rs b/src/sources/mqtt/config.rs
index 635751a3a1b0a..92b8cd78f6a5b 100644
--- a/src/sources/mqtt/config.rs
+++ b/src/sources/mqtt/config.rs
@@ -148,7 +148,7 @@ impl MqttSourceConfig {
 
         if let Some(tls) = tls.tls() {
             let ca = tls.authorities_pem().flatten().collect();
-            let client_auth = None;
+            let client_auth = tls.identity_pem();
             let alpn = Some(vec!["mqtt".into()]);
             options.set_transport(Transport::Tls(TlsConfiguration::Simple {
                 ca,

From eda5b866e83cf5e0e926cae8ecf89c00a3109dc8 Mon Sep 17 00:00:00 2001
From: Vitalii Parfonov <vparfono@redhat.com>
Date: Sat, 9 May 2026 01:39:20 +0300
Subject: [PATCH 224/326] fix(tests): fix flaky
 `initial_size_correct_with_multievents` test (#25239)

* test: fix flaky lock race in buffer size test

Manually construct a write-only `BufferWriter` and `Ledger` during the test setup instead of using `create_default_buffer_v2`.
This prevents spawning a detached background finalizer task, ensuring the `Arc<Ledger>` and file lock are released synchronously
and deterministically when dropped.

* fix formatting
---
 .../src/variants/disk_v2/tests/basic.rs       | 39 +++++++++++++++----
 1 file changed, 32 insertions(+), 7 deletions(-)

diff --git a/lib/vector-buffers/src/variants/disk_v2/tests/basic.rs b/lib/vector-buffers/src/variants/disk_v2/tests/basic.rs
index 30cb47d3c265b..c523390b45796 100644
--- a/lib/vector-buffers/src/variants/disk_v2/tests/basic.rs
+++ b/lib/vector-buffers/src/variants/disk_v2/tests/basic.rs
@@ -1,4 +1,4 @@
-use std::{io::Cursor, time::Duration};
+use std::{io::Cursor, sync::Arc, time::Duration};
 
 use futures::{StreamExt, stream};
 use tokio::{select, time::sleep};
@@ -6,11 +6,14 @@ use tokio_test::{assert_pending, task::spawn};
 use tracing::Instrument;
 use vector_common::finalization::Finalizable;
 
-use super::{create_default_buffer_v2, read_next, read_next_some};
+use super::{
+    create_default_buffer_v2, create_default_buffer_v2_with_usage, read_next, read_next_some,
+};
 use crate::{
     EventCount, assert_buffer_is_empty, assert_buffer_records,
+    buffer_usage_data::BufferUsageHandle,
     test::{MultiEventRecord, SizedRecord, acknowledge, install_tracing_helpers, with_temp_dir},
-    variants::disk_v2::{tests::create_default_buffer_v2_with_usage, writer::RecordWriter},
+    variants::disk_v2::{BufferWriter, DiskBufferConfigBuilder, Ledger, writer::RecordWriter},
 };
 
 #[tokio::test]
@@ -155,8 +158,26 @@ async fn initial_size_correct_with_multievents() {
         let data_dir = dir.to_path_buf();
 
         async move {
-            // Create a regular buffer, no customizations required.
-            let (mut writer, _, _) = create_default_buffer_v2(data_dir.clone()).await;
+            // Build a write-only buffer without a finalizer task. Using
+            // `from_config_inner` would spawn a background finalizer that holds
+            // an Arc<Ledger> (and the lock file), causing a racy
+            // LedgerLockAlreadyHeld when we reopen the buffer below.
+            let config = DiskBufferConfigBuilder::from_path(&data_dir)
+                .build()
+                .expect("creating buffer config should not fail");
+            let usage_handle = BufferUsageHandle::noop();
+            let ledger = Ledger::load_or_create(config, usage_handle)
+                .await
+                .expect("ledger should not fail to load/create");
+            let ledger = Arc::new(ledger);
+
+            let mut writer = BufferWriter::new(Arc::clone(&ledger));
+            writer
+                .validate_last_write()
+                .await
+                .expect("validate_last_write should not fail");
+
+            ledger.synchronize_buffer_usage();
 
             let input_items = (512..768)
                 .cycle()
@@ -209,10 +230,14 @@ async fn initial_size_correct_with_multievents() {
             writer.flush().await.expect("writer flush should not fail");
             writer.close();
 
-            // Now drop our buffer and reopen it.
+            // Drop the first buffer. No background finalizer task exists, so the
+            // ledger lock is released immediately when the last Arc is dropped.
             drop(writer);
+            drop(ledger);
+
+            // Reopen the buffer with a full reader to verify the persisted data.
             let (writer, mut reader, ledger, usage) =
-                create_default_buffer_v2_with_usage::<_, MultiEventRecord>(data_dir).await;
+                create_default_buffer_v2_with_usage::<_, MultiEventRecord>(&data_dir).await;
             drop(writer);
 
             // Make sure our usage data agrees with our expected event count and byte size:

From c3676b9fa8aef8088bd341775416e4ecd91095b2 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 8 May 2026 19:11:57 -0400
Subject: [PATCH 225/326] chore(ci): centralize CARGO_INCREMENTAL=0 in setup
 action (#25401)

* chore(ci): centralize CARGO_INCREMENTAL=0 in setup action

* Update .github/actions/setup/action.yml

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 .github/actions/setup/action.yml        | 2 ++
 .github/workflows/coverage.yml          | 1 -
 .github/workflows/k8s_e2e.yml           | 2 --
 .github/workflows/test-make-command.yml | 1 -
 .github/workflows/unit-tests.yml        | 1 -
 .github/workflows/unit_mac.yml          | 2 --
 6 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 4bce327b06aa1..7257d92a8266b 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -142,6 +142,8 @@ runs:
           echo "RUST_BACKTRACE=full" >> "$GITHUB_ENV"
           # Set nice CI colors
           echo "CARGO_TERM_COLOR=always" >> "$GITHUB_ENV"
+          # Incremental compilation has no benefit because in our CI we always start from a clean state.
+          echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"
         fi
 
     - name: Enable rust matcher
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 5af2787d2b90f..a07ec850373a4 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -28,7 +28,6 @@ permissions:
   contents: read
 
 env:
-  CARGO_INCREMENTAL: "0" # Disable incremental compilation for coverage
   CI: true
 
 jobs:
diff --git a/.github/workflows/k8s_e2e.yml b/.github/workflows/k8s_e2e.yml
index 329f31e642457..71060116cfd78 100644
--- a/.github/workflows/k8s_e2e.yml
+++ b/.github/workflows/k8s_e2e.yml
@@ -71,7 +71,6 @@ jobs:
     # Run this job even if `changes` job is skipped
     if: ${{ !failure() && !cancelled() && github.event_name != 'pull_request' && needs.changes.outputs.website_only != 'true' && needs.changes.outputs.k8s != 'false' }}
     env:
-      CARGO_INCREMENTAL: 0
       DISABLE_MOLD: true
     steps:
       - name: Checkout branch
@@ -207,7 +206,6 @@ jobs:
         env:
           USE_MINIKUBE_CACHE: "true"
           SKIP_PACKAGE_DEB: "true"
-          CARGO_INCREMENTAL: 0
           HELM_CHART_REPO: ${{ github.workspace }}/helm-charts/charts/vector
         with:
           timeout_minutes: 45
diff --git a/.github/workflows/test-make-command.yml b/.github/workflows/test-make-command.yml
index 2a93f9016fcd1..b0a5e9aa6b4aa 100644
--- a/.github/workflows/test-make-command.yml
+++ b/.github/workflows/test-make-command.yml
@@ -37,7 +37,6 @@ jobs:
       id-token: write
     timeout-minutes: 90
     env:
-      CARGO_INCREMENTAL: 0
       DD_ENV: "ci"
     steps:
       - name: Checkout branch
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 3f95e9262a21f..b6bf76de5f10c 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -55,7 +55,6 @@ permissions:
   contents: read
 
 env:
-  CARGO_INCREMENTAL: "0"
   CI: true
   DD_ENV: "ci"
 
diff --git a/.github/workflows/unit_mac.yml b/.github/workflows/unit_mac.yml
index a44a84d368953..aec7b4521e26a 100644
--- a/.github/workflows/unit_mac.yml
+++ b/.github/workflows/unit_mac.yml
@@ -15,8 +15,6 @@ jobs:
   unit-mac:
     runs-on: macos-14-xlarge
     timeout-minutes: 90
-    env:
-      CARGO_INCREMENTAL: 0
     steps:
       - name: Checkout branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

From 4ddc412437c69cfa6d3b5184ff3abab7e3d75008 Mon Sep 17 00:00:00 2001
From: ArunPiduguDD <arun.pidugu@datadoghq.com>
Date: Mon, 11 May 2026 10:52:29 -0400
Subject: [PATCH 226/326] enhancement(tag_cardinality_limit transform): Add
 setting for per-metric vs global tag cardinality tracking (#25372)

* feat(tag_cardinality_limit transform): add `tracking_scope` setting for per-metric vs global tag tracking

When metrics do not have an explicit `per_metric_limits` entry, their tag values
were always pooled into a single shared bucket. The new `tracking_scope` setting
lets users opt into per-metric tracking buckets instead, providing isolation at
the cost of higher memory.

Default is `global` (current behavior); `per_metric` gives every distinct
(namespace, name) its own bucket regardless of `per_metric_limits` membership.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* tweak docs

* address review feedback: rename AcceptResult variants and update doc comments

- Rename AcceptResult::Accepted -> Tracked, Rejected -> Dropped for clarity
- Simplify TrackingScope::Global and PerMetric rustdoc per reviewer suggestion
- Update debug message for max_tracked_keys overflow path
- Regenerate component docs

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
---
 ...nality_limit_tracking_scope.enhancement.md |   6 +
 .../src/internal_event/metric_name.rs         |   4 +
 src/internal_events/tag_cardinality_limit.rs  |  27 ++-
 .../tag_cardinality_limit/config.rs           |  37 ++++
 src/transforms/tag_cardinality_limit/mod.rs   | 179 +++++++++++++-----
 src/transforms/tag_cardinality_limit/tests.rs | 143 ++++++++++++++
 .../generated/tag_cardinality_limit.cue       |  34 ++++
 7 files changed, 385 insertions(+), 45 deletions(-)
 create mode 100644 changelog.d/tag_cardinality_limit_tracking_scope.enhancement.md

diff --git a/changelog.d/tag_cardinality_limit_tracking_scope.enhancement.md b/changelog.d/tag_cardinality_limit_tracking_scope.enhancement.md
new file mode 100644
index 0000000000000..693a5c6005f5a
--- /dev/null
+++ b/changelog.d/tag_cardinality_limit_tracking_scope.enhancement.md
@@ -0,0 +1,6 @@
+The `tag_cardinality_limit` transform gained two new settings:
+
+- **`tracking_scope`**: isolate tag tracking per metric (`per_metric`) instead of sharing a single bucket across all metrics (`global`, the default).
+- **`max_tracked_keys`**: cap the total number of tag keys tracked to bound memory usage.
+
+authors: ArunPiduguDD
diff --git a/lib/vector-common/src/internal_event/metric_name.rs b/lib/vector-common/src/internal_event/metric_name.rs
index 21314695a13bf..a1438465518e2 100644
--- a/lib/vector-common/src/internal_event/metric_name.rs
+++ b/lib/vector-common/src/internal_event/metric_name.rs
@@ -76,6 +76,7 @@ pub enum CounterName {
     StaleEventsFlushedTotal,
     StartedTotal,
     StoppedTotal,
+    TagCardinalityUntrackedEventsTotal,
     TagValueLimitExceededTotal,
     ValueLimitReachedTotal,
     WebsocketBytesSentTotal,
@@ -190,6 +191,7 @@ pub enum GaugeName {
     ActiveClients,
     MemoryEnrichmentTableObjectsCount,
     MemoryEnrichmentTableByteSize,
+    TagCardinalityTrackedKeys,
 }
 
 impl GaugeName {
@@ -220,6 +222,7 @@ impl GaugeName {
             Self::ActiveClients => "active_clients",
             Self::MemoryEnrichmentTableObjectsCount => "memory_enrichment_table_objects_count",
             Self::MemoryEnrichmentTableByteSize => "memory_enrichment_table_byte_size",
+            Self::TagCardinalityTrackedKeys => "tag_cardinality_tracked_keys",
         }
     }
 }
@@ -304,6 +307,7 @@ impl CounterName {
             Self::StaleEventsFlushedTotal => "stale_events_flushed_total",
             Self::StartedTotal => "started_total",
             Self::StoppedTotal => "stopped_total",
+            Self::TagCardinalityUntrackedEventsTotal => "tag_cardinality_untracked_events_total",
             Self::TagValueLimitExceededTotal => "tag_value_limit_exceeded_total",
             Self::ValueLimitReachedTotal => "value_limit_reached_total",
             Self::WebsocketBytesSentTotal => "websocket_bytes_sent_total",
diff --git a/src/internal_events/tag_cardinality_limit.rs b/src/internal_events/tag_cardinality_limit.rs
index 9906f5c320f6b..8b9cd25c6d64c 100644
--- a/src/internal_events/tag_cardinality_limit.rs
+++ b/src/internal_events/tag_cardinality_limit.rs
@@ -1,6 +1,6 @@
 use vector_lib::{
-    NamedInternalEvent, counter,
-    internal_event::{ComponentEventsDropped, CounterName, INTENTIONAL, InternalEvent},
+    NamedInternalEvent, counter, gauge,
+    internal_event::{ComponentEventsDropped, CounterName, GaugeName, INTENTIONAL, InternalEvent},
 };
 
 #[derive(NamedInternalEvent)]
@@ -80,3 +80,26 @@ impl InternalEvent for TagCardinalityValueLimitReached<'_> {
         counter!(CounterName::ValueLimitReachedTotal).increment(1);
     }
 }
+
+#[derive(NamedInternalEvent)]
+pub struct TagCardinalityLimitUntracked;
+
+impl InternalEvent for TagCardinalityLimitUntracked {
+    fn emit(self) {
+        debug!(
+            message = "Max tracked keys limit reached; forwarding one or more metric tags without cardinality checks."
+        );
+        counter!(CounterName::TagCardinalityUntrackedEventsTotal).increment(1);
+    }
+}
+
+#[derive(NamedInternalEvent)]
+pub struct TagCardinalityTrackedKeys {
+    pub count: usize,
+}
+
+impl InternalEvent for TagCardinalityTrackedKeys {
+    fn emit(self) {
+        gauge!(GaugeName::TagCardinalityTrackedKeys).set(self.count as f64);
+    }
+}
diff --git a/src/transforms/tag_cardinality_limit/config.rs b/src/transforms/tag_cardinality_limit/config.rs
index 73788e71b73a0..9bfb9f86ab8a4 100644
--- a/src/transforms/tag_cardinality_limit/config.rs
+++ b/src/transforms/tag_cardinality_limit/config.rs
@@ -35,6 +35,25 @@ pub struct Config {
     #[serde(flatten)]
     pub global: Inner,
 
+    /// Controls how tag tracking state is partitioned across metrics.
+    #[configurable(derived)]
+    #[serde(default)]
+    pub tracking_scope: TrackingScope,
+
+    /// Maximum number of distinct (metric, tag-key) pairs to track across the entire
+    /// transform. When this cap is reached, additional tag keys on new metrics or new
+    /// tag keys on existing metrics are not tracked, and tag values for those pairs
+    /// pass through unchecked. Users can detect this via the
+    /// `tag_cardinality_untracked_events_total` counter and the
+    /// `tag_cardinality_tracked_keys` gauge.
+    ///
+    /// When unset (default), there is no cap and the transform tracks all pairs it
+    /// encounters. In `global` tracking scope mode, this limit still applies (the
+    /// metric key is set to `None` unless there is a per-metric override).
+    #[configurable(derived)]
+    #[serde(default)]
+    pub max_tracked_keys: Option<usize>,
+
     /// Tag cardinality limits configuration per metric name.
     #[configurable(
         derived,
@@ -44,6 +63,22 @@ pub struct Config {
     pub per_metric_limits: HashMap<String, PerMetricConfig>,
 }
 
+/// Controls how tag tracking state is partitioned across metrics.
+#[configurable_component]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+#[serde(rename_all = "snake_case")]
+pub enum TrackingScope {
+    /// All metrics share a single tracking bucket. Tag values pool across metrics
+    /// and the global `value_limit` caps the combined set.
+    #[default]
+    Global,
+
+    /// Every distinct metric gets its own tracking bucket, providing tag
+    /// cardinality limiting for each metric in isolation at the cost of higher
+    /// memory usage.
+    PerMetric,
+}
+
 /// Configuration for the `tag_cardinality_limit` transform for a specific group of metrics.
 #[configurable_component]
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -150,6 +185,8 @@ impl GenerateConfig for Config {
                 limit_exceeded_action: default_limit_exceeded_action(),
                 internal_metrics: InternalMetricsConfig::default(),
             },
+            tracking_scope: TrackingScope::default(),
+            max_tracked_keys: None,
             per_metric_limits: HashMap::default(),
         })
         .unwrap()
diff --git a/src/transforms/tag_cardinality_limit/mod.rs b/src/transforms/tag_cardinality_limit/mod.rs
index 6b936c59ce02c..83e4a02aff1d4 100644
--- a/src/transforms/tag_cardinality_limit/mod.rs
+++ b/src/transforms/tag_cardinality_limit/mod.rs
@@ -6,7 +6,7 @@ use vector_lib::{event::Event, transform::TaskTransform};
 
 use crate::internal_events::{
     TagCardinalityLimitRejectingEvent, TagCardinalityLimitRejectingTag,
-    TagCardinalityValueLimitReached,
+    TagCardinalityLimitUntracked, TagCardinalityTrackedKeys, TagCardinalityValueLimitReached,
 };
 
 pub mod config;
@@ -15,17 +15,33 @@ mod tag_value_set;
 #[cfg(test)]
 mod tests;
 
-pub use config::{BloomFilterConfig, Config, Inner, LimitExceededAction, Mode, PerMetricConfig};
+pub use config::{
+    BloomFilterConfig, Config, Inner, LimitExceededAction, Mode, PerMetricConfig, TrackingScope,
+};
 use tag_value_set::AcceptedTagValueSet;
 
 use crate::event::metric::TagValueSet;
 
 type MetricId = (Option<String>, String);
 
+/// Outcome of applying tag cardinality tracking to a tag value.
+#[derive(Debug, Eq, PartialEq)]
+enum AcceptResult {
+    /// The tag value was tracked and is within the configured `value_limit`.
+    Tracked,
+    /// The tag value was tracked and exceeded the configured `value_limit`.
+    Dropped,
+    /// The tag value was not tracked because tracking capacity is exhausted.
+    Untracked,
+}
+
 #[derive(Debug)]
 pub struct TagCardinalityLimit {
     config: Config,
     accepted_tags: HashMap<Option<MetricId>, HashMap<String, AcceptedTagValueSet>>,
+    /// Total count of currently-tracked (metric_bucket, tag_key) pairs.
+    /// Used to enforce `config.max_tracked_keys`.
+    tracked_keys_count: usize,
 }
 
 impl TagCardinalityLimit {
@@ -33,9 +49,28 @@ impl TagCardinalityLimit {
         Self {
             config,
             accepted_tags: HashMap::new(),
+            tracked_keys_count: 0,
+        }
+    }
+
+    /// Returns true if a new tag-key bucket can be allocated without exceeding
+    /// `config.max_tracked_keys`. Always returns true when `max_tracked_keys` is unset.
+    const fn can_allocate_new_key(&self) -> bool {
+        match self.config.max_tracked_keys {
+            Some(max) => self.tracked_keys_count < max,
+            None => true,
         }
     }
 
+    /// Bumps the tracked-keys counter and emits the gauge sample. Call after a
+    /// successful new-key allocation in `accepted_tags`.
+    fn record_new_key_allocation(&mut self) {
+        self.tracked_keys_count += 1;
+        emit!(TagCardinalityTrackedKeys {
+            count: self.tracked_keys_count,
+        });
+    }
+
     fn get_config_for_metric(&self, metric_key: Option<&MetricId>) -> &Inner {
         match metric_key {
             Some(id) => self
@@ -51,29 +86,46 @@ impl TagCardinalityLimit {
         }
     }
 
-    /// Takes in key and a value corresponding to a tag on an incoming Metric
-    /// Event.  If that value is already part of set of accepted values for that
-    /// key, then simply returns true.  If that value is not yet part of the
-    /// accepted values for that key, checks whether we have hit the value_limit
-    /// for that key yet and if not adds the value to the set of accepted values
-    /// for the key and returns true, otherwise returns false.  A false return
-    /// value indicates to the caller that the value is not accepted for this
-    /// key, and the configured limit_exceeded_action should be taken.
+    /// Attempts to accept a tag value for a (metric, tag-key) pair.
+    ///
+    /// Returns:
+    /// - `Tracked` if the value is already tracked, or fits under the configured
+    ///   `value_limit` and is now recorded.
+    /// - `Dropped` if the value would exceed `value_limit`; the caller should drop
+    ///   the tag.
+    /// - `Untracked` if a new (metric, tag-key) pair would have to be allocated but
+    ///   `max_tracked_keys` has been reached; the caller should pass the tag through
+    ///   unchecked and emit the warning metric.
     fn try_accept_tag(
         &mut self,
         metric_key: Option<&MetricId>,
         key: &str,
         value: &TagValueSet,
-    ) -> bool {
+    ) -> AcceptResult {
         let config = *self.get_config_for_metric(metric_key);
-        let metric_accepted_tags = self.accepted_tags.entry(metric_key.cloned()).or_default();
+        let metric_key_owned = metric_key.cloned();
+
+        // Determine whether this (metric, tag-key) pair already has a bucket.
+        let pair_exists = self
+            .accepted_tags
+            .get(&metric_key_owned)
+            .is_some_and(|m| m.contains_key(key));
+
+        if !pair_exists {
+            if !self.can_allocate_new_key() {
+                return AcceptResult::Untracked;
+            }
+            self.record_new_key_allocation();
+        }
+
+        let metric_accepted_tags = self.accepted_tags.entry(metric_key_owned).or_default();
         let tag_value_set = metric_accepted_tags
             .entry_ref(key)
             .or_insert_with(|| AcceptedTagValueSet::new(config.value_limit, &config.mode));
 
         if tag_value_set.contains(value) {
             // Tag value has already been accepted, nothing more to do.
-            return true;
+            return AcceptResult::Tracked;
         }
 
         // Tag value not yet part of the accepted set.
@@ -85,10 +137,10 @@ impl TagCardinalityLimit {
                 emit!(TagCardinalityValueLimitReached { key });
             }
 
-            true
+            AcceptResult::Tracked
         } else {
-            // New tag value is rejected.
-            false
+            // New tag value exceeds the configured limit.
+            AcceptResult::Dropped
         }
     }
 
@@ -112,29 +164,64 @@ impl TagCardinalityLimit {
     }
 
     /// Record a key and value corresponding to a tag on an incoming Metric.
-    fn record_tag_value(&mut self, metric_key: Option<&MetricId>, key: &str, value: &TagValueSet) {
+    ///
+    /// Returns `true` if the (metric, tag-key) pair could not be allocated due to
+    /// `max_tracked_keys` (and therefore the value is not recorded), `false` otherwise.
+    fn record_tag_value(
+        &mut self,
+        metric_key: Option<&MetricId>,
+        key: &str,
+        value: &TagValueSet,
+    ) -> bool {
         let config = *self.get_config_for_metric(metric_key);
-        let metric_accepted_tags = self.accepted_tags.entry(metric_key.cloned()).or_default();
+        let metric_key_owned = metric_key.cloned();
+
+        let pair_exists = self
+            .accepted_tags
+            .get(&metric_key_owned)
+            .is_some_and(|m| m.contains_key(key));
+
+        if !pair_exists {
+            if !self.can_allocate_new_key() {
+                return true;
+            }
+            self.record_new_key_allocation();
+        }
+
+        let metric_accepted_tags = self.accepted_tags.entry(metric_key_owned).or_default();
         metric_accepted_tags
             .entry_ref(key)
             .or_insert_with(|| AcceptedTagValueSet::new(config.value_limit, &config.mode))
             .insert(value.clone());
+        false
     }
 
     pub fn transform_one(&mut self, mut event: Event) -> Option<Event> {
         let metric = event.as_mut_metric();
         let metric_name = metric.name().to_string();
         let metric_namespace = metric.namespace().map(|n| n.to_string());
-        let has_per_metric_config = self.config.per_metric_limits.iter().any(|(name, config)| {
-            *name == metric_name
-                && (config.namespace.is_none() || config.namespace == metric_namespace)
-        });
-        let metric_key = if has_per_metric_config {
-            Some((metric_namespace, metric_name.clone()))
-        } else {
-            None
+        let metric_key = match self.config.tracking_scope {
+            TrackingScope::PerMetric => Some((metric_namespace, metric_name.clone())),
+            TrackingScope::Global => {
+                let has_per_metric_config =
+                    self.config.per_metric_limits.iter().any(|(name, config)| {
+                        *name == metric_name
+                            && (config.namespace.is_none() || config.namespace == metric_namespace)
+                    });
+                if has_per_metric_config {
+                    Some((metric_namespace, metric_name.clone()))
+                } else {
+                    None
+                }
+            }
         };
         if let Some(tags_map) = metric.tags_mut() {
+            let include_extended_tags = self
+                .get_config_for_metric(metric_key.as_ref())
+                .internal_metrics
+                .include_extended_tags;
+            let mut any_untracked = false;
+
             match self
                 .get_config_for_metric(metric_key.as_ref())
                 .limit_exceeded_action
@@ -145,40 +232,46 @@ impl TagCardinalityLimit {
 
                     for (key, value) in tags_map.iter_sets() {
                         if self.tag_limit_exceeded(metric_key.as_ref(), key, value) {
-                            let config = self.get_config_for_metric(metric_key.as_ref());
                             emit!(TagCardinalityLimitRejectingEvent {
                                 metric_name: &metric_name,
                                 tag_key: key,
                                 tag_value: &value.to_string(),
-                                include_extended_tags: config
-                                    .internal_metrics
-                                    .include_extended_tags,
+                                include_extended_tags,
                             });
                             return None;
                         }
                     }
                     for (key, value) in tags_map.iter_sets() {
-                        self.record_tag_value(metric_key.as_ref(), key, value);
+                        if self.record_tag_value(metric_key.as_ref(), key, value) {
+                            any_untracked = true;
+                        }
                     }
                 }
                 LimitExceededAction::DropTag => {
-                    let config = self.get_config_for_metric(metric_key.as_ref());
-                    let include_extended_tags = config.internal_metrics.include_extended_tags;
                     tags_map.retain(|key, value| {
-                        if self.try_accept_tag(metric_key.as_ref(), key, value) {
-                            true
-                        } else {
-                            emit!(TagCardinalityLimitRejectingTag {
-                                metric_name: &metric_name,
-                                tag_key: key,
-                                tag_value: &value.to_string(),
-                                include_extended_tags,
-                            });
-                            false
+                        match self.try_accept_tag(metric_key.as_ref(), key, value) {
+                            AcceptResult::Tracked => true,
+                            AcceptResult::Dropped => {
+                                emit!(TagCardinalityLimitRejectingTag {
+                                    metric_name: &metric_name,
+                                    tag_key: key,
+                                    tag_value: &value.to_string(),
+                                    include_extended_tags,
+                                });
+                                false
+                            }
+                            AcceptResult::Untracked => {
+                                any_untracked = true;
+                                true // pass through unchecked
+                            }
                         }
                     });
                 }
             }
+
+            if any_untracked {
+                emit!(TagCardinalityLimitUntracked);
+            }
         }
         Some(event)
     }
diff --git a/src/transforms/tag_cardinality_limit/tests.rs b/src/transforms/tag_cardinality_limit/tests.rs
index 19eabaa6e5963..6435be9ed0ca6 100644
--- a/src/transforms/tag_cardinality_limit/tests.rs
+++ b/src/transforms/tag_cardinality_limit/tests.rs
@@ -57,6 +57,8 @@ fn make_transform_hashset(
             mode: Mode::Exact,
             internal_metrics: InternalMetricsConfig::default(),
         },
+        tracking_scope: TrackingScope::default(),
+        max_tracked_keys: None,
         per_metric_limits: HashMap::new(),
     }
 }
@@ -71,6 +73,8 @@ fn make_transform_bloom(value_limit: usize, limit_exceeded_action: LimitExceeded
             }),
             internal_metrics: InternalMetricsConfig::default(),
         },
+        tracking_scope: TrackingScope::default(),
+        max_tracked_keys: None,
         per_metric_limits: HashMap::new(),
     }
 }
@@ -87,6 +91,8 @@ fn make_transform_hashset_with_per_metric_limits(
             mode: Mode::Exact,
             internal_metrics: InternalMetricsConfig::default(),
         },
+        tracking_scope: TrackingScope::default(),
+        max_tracked_keys: None,
         per_metric_limits,
     }
 }
@@ -105,6 +111,8 @@ fn make_transform_bloom_with_per_metric_limits(
             }),
             internal_metrics: InternalMetricsConfig::default(),
         },
+        tracking_scope: TrackingScope::default(),
+        max_tracked_keys: None,
         per_metric_limits,
     }
 }
@@ -595,3 +603,138 @@ async fn separate_value_limit_per_metric_name(config: Config) {
     })
     .await;
 }
+
+/// With `tracking_scope: per_metric`, two metrics without explicit `per_metric_limits` entries
+/// each get their own tracking bucket, so one hitting the limit does not affect the other.
+#[test]
+fn tracking_scope_per_metric_isolates_metrics() {
+    let mut config = make_transform_hashset(2, LimitExceededAction::DropEvent);
+    config.tracking_scope = TrackingScope::PerMetric;
+    let mut transform = TagCardinalityLimit::new(config);
+
+    // Fill metric_a's bucket to its limit (2 distinct values).
+    let a1 = make_metric_with_name(metric_tags!("tag" => "v1"), "metric_a");
+    let a2 = make_metric_with_name(metric_tags!("tag" => "v2"), "metric_a");
+    // metric_b should be tracked in its own bucket — not affected by metric_a.
+    let b1 = make_metric_with_name(metric_tags!("tag" => "v3"), "metric_b");
+    let b2 = make_metric_with_name(metric_tags!("tag" => "v4"), "metric_b");
+    // A 3rd unique value on metric_a should be rejected (its bucket is full).
+    let a3 = make_metric_with_name(metric_tags!("tag" => "v5"), "metric_a");
+
+    assert_eq!(transform.transform_one(a1.clone()), Some(a1));
+    assert_eq!(transform.transform_one(a2.clone()), Some(a2));
+    assert_eq!(transform.transform_one(b1.clone()), Some(b1));
+    assert_eq!(transform.transform_one(b2.clone()), Some(b2));
+    assert_eq!(transform.transform_one(a3), None);
+}
+
+/// With the default `tracking_scope: global`, metrics without explicit `per_metric_limits`
+/// entries share a single tracking bucket — so values from different metrics pool together.
+#[test]
+fn tracking_scope_global_pools_metrics() {
+    // Default `tracking_scope` is `Global`.
+    let config = make_transform_hashset(2, LimitExceededAction::DropEvent);
+    let mut transform = TagCardinalityLimit::new(config);
+
+    let a1 = make_metric_with_name(metric_tags!("tag" => "v1"), "metric_a");
+    // Different metric, but values pool into the shared bucket → 2/2 used.
+    let b1 = make_metric_with_name(metric_tags!("tag" => "v2"), "metric_b");
+    // 3rd unique value across the shared bucket → rejected.
+    let a2 = make_metric_with_name(metric_tags!("tag" => "v3"), "metric_a");
+
+    assert_eq!(transform.transform_one(a1.clone()), Some(a1));
+    assert_eq!(transform.transform_one(b1.clone()), Some(b1));
+    assert_eq!(transform.transform_one(a2), None);
+}
+
+/// With `max_tracked_keys: 2`, only 2 distinct (metric, tag-key) pairs get tracking
+/// buckets. Tag values for additional pairs pass through unchecked rather than being
+/// rejected. The tag values for tracked pairs are still subject to `value_limit`.
+#[test]
+fn max_tracked_keys_caps_pair_allocation() {
+    let mut config = make_transform_hashset(1, LimitExceededAction::DropTag);
+    config.max_tracked_keys = Some(2);
+    let mut transform = TagCardinalityLimit::new(config);
+
+    // First 2 distinct (metric, tag-key) pairs allocate buckets.
+    // (None, "tag1") — bucket 1
+    let e1 = transform
+        .transform_one(make_metric(metric_tags!("tag1" => "v1")))
+        .unwrap();
+    assert_eq!("v1", e1.as_metric().tags().unwrap().get("tag1").unwrap());
+
+    // (None, "tag2") — bucket 2
+    let e2 = transform
+        .transform_one(make_metric(metric_tags!("tag2" => "v1")))
+        .unwrap();
+    assert_eq!("v1", e2.as_metric().tags().unwrap().get("tag2").unwrap());
+
+    // tag1 value_limit hit at 1 → second value rejected (drop_tag).
+    let e3 = transform
+        .transform_one(make_metric(metric_tags!("tag1" => "v2")))
+        .unwrap();
+    assert!(!e3.as_metric().tags().unwrap().contains_key("tag1"));
+
+    // (None, "tag3") would need a 3rd bucket — cap is 2, so it passes through
+    // unchecked. The tag is retained even though we can't enforce a value_limit on it.
+    let e4 = transform
+        .transform_one(make_metric(metric_tags!("tag3" => "v1")))
+        .unwrap();
+    assert_eq!("v1", e4.as_metric().tags().unwrap().get("tag3").unwrap());
+    let e5 = transform
+        .transform_one(make_metric(metric_tags!("tag3" => "v2")))
+        .unwrap();
+    assert_eq!("v2", e5.as_metric().tags().unwrap().get("tag3").unwrap());
+}
+
+/// With `max_tracked_keys` unset (default), cardinality limiting works normally and
+/// new pairs are always tracked.
+#[test]
+fn max_tracked_keys_unlimited_by_default() {
+    let config = make_transform_hashset(1, LimitExceededAction::DropTag);
+    assert!(config.max_tracked_keys.is_none());
+    let mut transform = TagCardinalityLimit::new(config);
+
+    // Many distinct tag keys all get tracked; each enforces value_limit=1.
+    for i in 0..10 {
+        let key = format!("tag{i}");
+        let _ = transform
+            .transform_one(make_metric(metric_tags!(key.clone() => "v1")))
+            .unwrap();
+        // Second value for the same tag key should be rejected.
+        let e = transform
+            .transform_one(make_metric(metric_tags!(key.clone() => "v2")))
+            .unwrap();
+        assert!(!e.as_metric().tags().unwrap().contains_key(key.as_str()));
+    }
+}
+
+/// With `tracking_scope: per_metric`, the cap is enforced across *all* per-metric
+/// buckets — not per bucket. Once the cap is hit, further metrics pass through
+/// unchecked.
+#[test]
+fn max_tracked_keys_caps_across_per_metric_buckets() {
+    let mut config = make_transform_hashset(1, LimitExceededAction::DropTag);
+    config.tracking_scope = TrackingScope::PerMetric;
+    config.max_tracked_keys = Some(2);
+    let mut transform = TagCardinalityLimit::new(config);
+
+    // metric_a, tag "k" → pair 1 of 2
+    let _ = transform
+        .transform_one(make_metric_with_name(metric_tags!("k" => "v1"), "metric_a"))
+        .unwrap();
+    // metric_b, tag "k" → pair 2 of 2 (different bucket because per_metric scope)
+    let _ = transform
+        .transform_one(make_metric_with_name(metric_tags!("k" => "v1"), "metric_b"))
+        .unwrap();
+    // metric_c, tag "k" → would be pair 3, cap is 2 → untracked passthrough.
+    let e = transform
+        .transform_one(make_metric_with_name(metric_tags!("k" => "v1"), "metric_c"))
+        .unwrap();
+    assert_eq!("v1", e.as_metric().tags().unwrap().get("k").unwrap());
+    // Multiple distinct values on metric_c also pass through (no enforcement).
+    let e = transform
+        .transform_one(make_metric_with_name(metric_tags!("k" => "v2"), "metric_c"))
+        .unwrap();
+    assert_eq!("v2", e.as_metric().tags().unwrap().get("k").unwrap());
+}
diff --git a/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue b/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue
index b29a8264b3b71..88a96837b220a 100644
--- a/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue
+++ b/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue
@@ -40,6 +40,22 @@ generated: components: transforms: tag_cardinality_limit: configuration: {
 			}
 		}
 	}
+	max_tracked_keys: {
+		description: """
+			Maximum number of distinct (metric, tag-key) pairs to track across the entire
+			transform. When this cap is reached, additional tag keys on new metrics or new
+			tag keys on existing metrics are not tracked, and tag values for those pairs
+			pass through unchecked. Users can detect this via the
+			`tag_cardinality_untracked_events_total` counter and the
+			`tag_cardinality_tracked_keys` gauge.
+
+			When unset (default), there is no cap and the transform tracks all pairs it
+			encounters. In `global` tracking scope mode, this limit still applies (the
+			metric key is set to `None` unless there is a per-metric override).
+			"""
+		required: false
+		type: uint: {}
+	}
 	mode: {
 		description: "Controls the approach taken for tracking tag cardinality."
 		required:    true
@@ -139,6 +155,24 @@ generated: components: transforms: tag_cardinality_limit: configuration: {
 			}
 		}
 	}
+	tracking_scope: {
+		description: "Controls how tag tracking state is partitioned across metrics."
+		required:    false
+		type: string: {
+			default: "global"
+			enum: {
+				global: """
+					All metrics share a single tracking bucket. Tag values pool across metrics
+					and the global `value_limit` caps the combined set.
+					"""
+				per_metric: """
+					Every distinct metric gets its own tracking bucket, providing tag
+					cardinality limiting for each metric in isolation at the cost of higher
+					memory usage.
+					"""
+			}
+		}
+	}
 	value_limit: {
 		description: "How many distinct values to accept for any given key."
 		required:    false

From 11f1dff407534822b90d4690e446d718867d6baf Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 11 May 2026 14:55:00 -0400
Subject: [PATCH 227/326] fix(ci): include lib/ workspace crates in coverage
 reports (#25402)

* fix(coverage): include lib/ workspace crates in coverage reports

* revert(coverage): remove invalid --workspace flag from llvm-cov report
---
 vdev/src/testing/runner.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/vdev/src/testing/runner.rs b/vdev/src/testing/runner.rs
index 1e338b64797ab..3a89aa382c9fd 100644
--- a/vdev/src/testing/runner.rs
+++ b/vdev/src/testing/runner.rs
@@ -33,6 +33,7 @@ const COVERAGE_COMMAND: &[&str] = &[
     "cargo",
     "llvm-cov",
     "nextest",
+    "--workspace",
     "--no-fail-fast",
     "--no-default-features",
 ];

From 7efd6d7b53185a2997b81b2ef8fff4162d6c6506 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 11 May 2026 16:19:41 -0400
Subject: [PATCH 228/326] chore(dev): remove cargo vdev test --container runner
 (#25410)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The DockerTestRunner path of `cargo vdev test` is an opt-in dev-loop
helper that runs unit tests inside the timberio/vector-dev image.
It duplicates the native `cargo vdev test` path and is a remaining
consumer of the published dev environment image. Integration tests
are unaffected — they build their own runner image from
tests/e2e/Dockerfile.

Removes the --container flag, DockerTestRunner impl, UPSTREAM_IMAGE
constant, and the get_agent_test_runner factory.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 vdev/src/commands/test.rs  | 13 +++++--------
 vdev/src/testing/runner.rs | 36 +-----------------------------------
 2 files changed, 6 insertions(+), 43 deletions(-)

diff --git a/vdev/src/commands/test.rs b/vdev/src/commands/test.rs
index deb89c19b4fa6..72719e14d74dc 100644
--- a/vdev/src/commands/test.rs
+++ b/vdev/src/commands/test.rs
@@ -2,7 +2,10 @@ use anyhow::Result;
 use clap::Args;
 use std::collections::BTreeMap;
 
-use crate::{testing::runner::get_agent_test_runner, utils::platform};
+use crate::{
+    testing::runner::{LocalTestRunner, TestRunner as _},
+    utils::platform,
+};
 
 /// Execute tests
 #[derive(Args, Debug)]
@@ -11,10 +14,6 @@ pub struct Cli {
     /// Extra test command arguments
     args: Option<Vec<String>>,
 
-    /// Whether to run tests in a container
-    #[arg(short = 'C', long)]
-    container: bool,
-
     /// Environment variables in the form KEY[=VALUE]
     #[arg(short, long)]
     env: Option<Vec<String>>,
@@ -34,8 +33,6 @@ fn parse_env(env: Vec<String>) -> BTreeMap<String, Option<String>> {
 
 impl Cli {
     pub fn exec(self) -> Result<()> {
-        let runner = get_agent_test_runner(self.container)?;
-
         let mut args = vec!["--workspace".to_string()];
 
         if let Some(mut extra_args) = self.args {
@@ -47,7 +44,7 @@ impl Cli {
             args.extend(["--features".to_string(), features.to_string()]);
         }
 
-        runner.test(
+        LocalTestRunner.test(
             &parse_env(self.env.unwrap_or_default()),
             &BTreeMap::default(),
             None,
diff --git a/vdev/src/testing/runner.rs b/vdev/src/testing/runner.rs
index 3a89aa382c9fd..cd057e0ac1cec 100644
--- a/vdev/src/testing/runner.rs
+++ b/vdev/src/testing/runner.rs
@@ -1,5 +1,5 @@
 use anyhow::Result;
-use std::{collections::HashSet, env, process::Command};
+use std::{collections::HashSet, process::Command};
 
 use super::config::{IntegrationRunnerConfig, RustToolchainConfig};
 use crate::{
@@ -41,8 +41,6 @@ const COVERAGE_COMMAND: &[&str] = &[
 const COVERAGE_OUTPUT_DIR: &str = "/coverage";
 /// Coverage output path on the host (relative to project root).
 pub(crate) const LOCAL_COVERAGE_OUTPUT_DIR: &str = "target/coverage";
-// The upstream container we publish artifacts to on a successful master build.
-const UPSTREAM_IMAGE: &str = "docker.io/timberio/vector-dev:latest";
 
 pub enum RunnerState {
     Running,
@@ -55,14 +53,6 @@ pub enum RunnerState {
     Unknown,
 }
 
-pub fn get_agent_test_runner(container: bool) -> Result<Box<dyn TestRunner>> {
-    if container {
-        Ok(Box::new(DockerTestRunner))
-    } else {
-        Ok(Box::new(LocalTestRunner))
-    }
-}
-
 pub trait TestRunner {
     #[allow(clippy::too_many_arguments)]
     fn test(
@@ -411,30 +401,6 @@ impl ContainerTestRunner for IntegrationTestRunner {
     }
 }
 
-pub struct DockerTestRunner;
-
-impl ContainerTestRunner for DockerTestRunner {
-    fn network_name(&self) -> Option<&str> {
-        None
-    }
-
-    fn container_name(&self) -> String {
-        format!("vector-test-runner-{}", RustToolchainConfig::rust_version())
-    }
-
-    fn image_name(&self) -> String {
-        env::var("ENVIRONMENT_UPSTREAM").unwrap_or_else(|_| UPSTREAM_IMAGE.to_string())
-    }
-
-    fn needs_docker_socket(&self) -> bool {
-        false
-    }
-
-    fn volumes(&self) -> Vec<String> {
-        Vec::default()
-    }
-}
-
 pub struct LocalTestRunner;
 
 impl TestRunner for LocalTestRunner {

From e38ef0cab69d8dbd02deaadbd63870aafd77081b Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 12 May 2026 09:53:04 -0400
Subject: [PATCH 229/326] fix(external docs): warn about log namespace with
 disk buffers (#25413)

* docs: warn about log namespace with disk buffers

* docs: render nested config warnings
---
 src/config/schema.rs                          |  3 ++
 .../cue/reference/generated/configuration.cue |  1 +
 website/layouts/partials/data.html            | 36 ++++++++++++++++++-
 3 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/src/config/schema.rs b/src/config/schema.rs
index 388765b29e1b9..6c7b6e52dae4d 100644
--- a/src/config/schema.rs
+++ b/src/config/schema.rs
@@ -38,6 +38,9 @@ pub struct Options {
     ///
     /// See the [Log Namespacing guide](/guides/level-up/log_namespace/) for detailed information
     /// about when to use Vector namespace mode and how to migrate from legacy mode.
+    #[configurable(metadata(
+        docs::warnings = "Enabling log namespacing currently does not work when disk buffers are used. Avoid combining `schema.log_namespace = true` with disk buffers until [#18574](https://github.com/vectordotdev/vector/issues/18574) is resolved."
+    ))]
     pub log_namespace: Option<bool>,
 }
 
diff --git a/website/cue/reference/generated/configuration.cue b/website/cue/reference/generated/configuration.cue
index fdb5d0cb15bd0..198275e76e9b9 100644
--- a/website/cue/reference/generated/configuration.cue
+++ b/website/cue/reference/generated/configuration.cue
@@ -442,6 +442,7 @@ generated: configuration: {
 						See the [Log Namespacing guide](/guides/level-up/log_namespace/) for detailed information
 						about when to use Vector namespace mode and how to migrate from legacy mode.
 						"""
+					warnings: ["Enabling log namespacing currently does not work when disk buffers are used. Avoid combining `schema.log_namespace = true` with disk buffers until [#18574](https://github.com/vectordotdev/vector/issues/18574) is resolved."]
 					required: false
 				}
 				validation: {
diff --git a/website/layouts/partials/data.html b/website/layouts/partials/data.html
index 9252b6af3f414..6640c9b0938d1 100644
--- a/website/layouts/partials/data.html
+++ b/website/layouts/partials/data.html
@@ -2034,6 +2034,40 @@ <h3 id="{{ $code }}">
           {{ $v.description | markdownify }}
         </div>
 
+        {{ with $v.warnings }}
+          <div class="mt-3 border-2 rounded-md border-yellow-400 flex flex-col space-y-1.5 py-2 px-3">
+            <span>
+              {{ partial "heading.html" (dict "text" "Warning" "level" 4 "toc_hide" true) }}
+            </span>
+
+            {{ range . }}
+              <div class="flex space-x-5 items-center">
+                <div class="flex-shrink-0">
+                  {{/* Heroicon: outline/exclamation-circle */}}
+                  <svg
+                    xmlns="http://www.w3.org/2000/svg"
+                    class="text-yellow-500 h-5 w-5"
+                    fill="none"
+                    viewBox="0 0 24 24"
+                    stroke="currentColor"
+                  >
+                    <path
+                      stroke-linecap="round"
+                      stroke-linejoin="round"
+                      stroke-width="2"
+                      d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
+                    />
+                  </svg>
+                </div>
+
+                <div class="prose dark:prose-dark max-w-none leading-snug">
+                  {{ . | markdownify }}
+                </div>
+              </div>
+            {{ end }}
+          </div>
+        {{ end }}
+
         {{ if eq $v.type.string.syntax "template" }}
           <div class="mt-4 text-sm">
             <strong>Note</strong>: This parameter supports Vector's
@@ -2216,4 +2250,4 @@ <h3 id="{{ $code }}">
       </div>
     </div>
   </div>
-{{ end }}
\ No newline at end of file
+{{ end }}

From fc6a2b567f08a9c229e8a4b7584d6f30e1da1c9f Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 12 May 2026 09:58:10 -0400
Subject: [PATCH 230/326] chore(ci): make regression/Dockerfile self-contained
 (#25411)

Switches the regression builder stage from timberio/vector-dev:latest
to rust:1-slim-trixie + scripts/environment/prepare.sh, mirroring
tests/e2e/Dockerfile. The SMP regression detector no longer depends
on the published dev environment image.

The whole scripts/environment/ tree is copied (rather than individual
files) so prepare.sh can source its sibling scripts on older baseline
checkouts.

The target stage is unchanged. apt deps mirror what tests/e2e/Dockerfile
installs for a Vector build; a TODO is left to unify the two lists.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 regression/Dockerfile | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/regression/Dockerfile b/regression/Dockerfile
index 98b03547af9f7..0220f266f6703 100644
--- a/regression/Dockerfile
+++ b/regression/Dockerfile
@@ -1,8 +1,36 @@
 #
 # VECTOR BUILDER
 #
-FROM docker.io/timberio/vector-dev:latest AS builder
+ARG RUST_VERSION=1
+FROM docker.io/rust:${RUST_VERSION}-slim-trixie AS builder
+
+# TODO: unify this apt list with tests/e2e/Dockerfile.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    clang \
+    cmake \
+    curl \
+    git \
+    libclang-dev \
+    libsasl2-dev \
+    libssl-dev \
+    libxxhash-dev \
+    perl \
+    pkg-config \
+    unzip \
+    zlib1g-dev \
+  && rm -rf /var/lib/apt/lists/*
+
+# Copy the whole scripts/environment/ tree so prepare.sh can source its sibling
+# scripts on older checkouts in regression baseline builds.
+COPY scripts/environment/ /scripts/environment/
+
 WORKDIR /vector
+COPY rust-toolchain.toml .
+
+RUN bash /scripts/environment/prepare.sh --modules=rustup
+RUN bash /scripts/environment/install-protoc.sh
+
 COPY . .
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git \

From d06def7be6c4ac1e29e46c73f94ea3d9f99b9997 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 12 May 2026 16:06:08 -0400
Subject: [PATCH 231/326] chore(website deps): bump
 @babel/plugin-transform-modules-systemjs from 7.28.5 to 7.29.4 in /website
 (#25403)

chore(website deps): bump @babel/plugin-transform-modules-systemjs

Bumps [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) from 7.28.5 to 7.29.4.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.4/packages/babel-plugin-transform-modules-systemjs)

---
updated-dependencies:
- dependency-name: "@babel/plugin-transform-modules-systemjs"
  dependency-version: 7.29.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 website/yarn.lock | 91 +++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 85 insertions(+), 6 deletions(-)

diff --git a/website/yarn.lock b/website/yarn.lock
index f2f1ff986161b..88310b8a0e312 100644
--- a/website/yarn.lock
+++ b/website/yarn.lock
@@ -70,6 +70,15 @@
     js-tokens "^4.0.0"
     picocolors "^1.1.1"
 
+"@babel/code-frame@^7.28.6", "@babel/code-frame@^7.29.0":
+  version "7.29.0"
+  resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.29.0.tgz#7cd7a59f15b3cc0dcd803038f7792712a7d0b15c"
+  integrity sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==
+  dependencies:
+    "@babel/helper-validator-identifier" "^7.28.5"
+    js-tokens "^4.0.0"
+    picocolors "^1.1.1"
+
 "@babel/compat-data@^7.17.7", "@babel/compat-data@^7.27.2", "@babel/compat-data@^7.27.7", "@babel/compat-data@^7.28.5":
   version "7.28.5"
   resolved "https://registry.yarnpkg.com/@babel/compat-data/-/compat-data-7.28.5.tgz#a8a4962e1567121ac0b3b487f52107443b455c7f"
@@ -107,6 +116,17 @@
     "@jridgewell/trace-mapping" "^0.3.28"
     jsesc "^3.0.2"
 
+"@babel/generator@^7.29.0":
+  version "7.29.1"
+  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.29.1.tgz#d09876290111abbb00ef962a7b83a5307fba0d50"
+  integrity sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==
+  dependencies:
+    "@babel/parser" "^7.29.0"
+    "@babel/types" "^7.29.0"
+    "@jridgewell/gen-mapping" "^0.3.12"
+    "@jridgewell/trace-mapping" "^0.3.28"
+    jsesc "^3.0.2"
+
 "@babel/helper-annotate-as-pure@^7.16.7", "@babel/helper-annotate-as-pure@^7.25.9":
   version "7.25.9"
   resolved "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.25.9.tgz"
@@ -251,6 +271,14 @@
     "@babel/traverse" "^7.27.1"
     "@babel/types" "^7.27.1"
 
+"@babel/helper-module-imports@^7.28.6":
+  version "7.28.6"
+  resolved "https://registry.yarnpkg.com/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz#60632cbd6ffb70b22823187201116762a03e2d5c"
+  integrity sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==
+  dependencies:
+    "@babel/traverse" "^7.28.6"
+    "@babel/types" "^7.28.6"
+
 "@babel/helper-module-transforms@^7.27.1", "@babel/helper-module-transforms@^7.28.3":
   version "7.28.3"
   resolved "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.28.3.tgz#a2b37d3da3b2344fe085dab234426f2b9a2fa5f6"
@@ -260,6 +288,15 @@
     "@babel/helper-validator-identifier" "^7.27.1"
     "@babel/traverse" "^7.28.3"
 
+"@babel/helper-module-transforms@^7.28.6":
+  version "7.28.6"
+  resolved "https://registry.yarnpkg.com/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz#9312d9d9e56edc35aeb6e95c25d4106b50b9eb1e"
+  integrity sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==
+  dependencies:
+    "@babel/helper-module-imports" "^7.28.6"
+    "@babel/helper-validator-identifier" "^7.28.5"
+    "@babel/traverse" "^7.28.6"
+
 "@babel/helper-optimise-call-expression@^7.16.7", "@babel/helper-optimise-call-expression@^7.25.9":
   version "7.25.9"
   resolved "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.25.9.tgz"
@@ -279,6 +316,11 @@
   resolved "https://registry.yarnpkg.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.27.1.tgz#ddb2f876534ff8013e6c2b299bf4d39b3c51d44c"
   integrity sha512-1gn1Up5YXka3YYAHGKpbideQ5Yjf1tDa9qYcgysz+cNCXukyLl6DjPXhD3VRwSb8c0J9tA4b2+rHEZtc6R0tlw==
 
+"@babel/helper-plugin-utils@^7.28.6":
+  version "7.28.6"
+  resolved "https://registry.yarnpkg.com/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz#6f13ea251b68c8532e985fd532f28741a8af9ac8"
+  integrity sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==
+
 "@babel/helper-remap-async-to-generator@^7.27.1":
   version "7.27.1"
   resolved "https://registry.yarnpkg.com/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.27.1.tgz#4601d5c7ce2eb2aea58328d43725523fcd362ce6"
@@ -360,6 +402,13 @@
   dependencies:
     "@babel/types" "^7.28.5"
 
+"@babel/parser@^7.28.6", "@babel/parser@^7.29.0":
+  version "7.29.3"
+  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.29.3.tgz#116f70a77958307fceac27747573032f8a62f88e"
+  integrity sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==
+  dependencies:
+    "@babel/types" "^7.29.0"
+
 "@babel/plugin-bugfix-firefox-class-in-computed-class-key@^7.28.5":
   version "7.28.5"
   resolved "https://registry.yarnpkg.com/@babel/plugin-bugfix-firefox-class-in-computed-class-key/-/plugin-bugfix-firefox-class-in-computed-class-key-7.28.5.tgz#fbde57974707bbfa0376d34d425ff4fa6c732421"
@@ -662,14 +711,14 @@
     "@babel/helper-plugin-utils" "^7.27.1"
 
 "@babel/plugin-transform-modules-systemjs@^7.28.5":
-  version "7.28.5"
-  resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.28.5.tgz#7439e592a92d7670dfcb95d0cbc04bd3e64801d2"
-  integrity sha512-vn5Jma98LCOeBy/KpeQhXcV2WZgaRUtjwQmjoBuLNlOmkg0fB5pdvYVeWRYI69wWKwK2cD1QbMiUQnoujWvrew==
+  version "7.29.4"
+  resolved "https://registry.yarnpkg.com/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.29.4.tgz#f621105da99919c15cf4bde6fcc7346ef95e7b20"
+  integrity sha512-N7QmZ0xRZfjHOfZeQLJjwgX2zS9pdGHSVl/cjSGlo4dXMqvurfxXDMKY4RqEKzPozV78VMcd0lxyG13mlbKc4w==
   dependencies:
-    "@babel/helper-module-transforms" "^7.28.3"
-    "@babel/helper-plugin-utils" "^7.27.1"
+    "@babel/helper-module-transforms" "^7.28.6"
+    "@babel/helper-plugin-utils" "^7.28.6"
     "@babel/helper-validator-identifier" "^7.28.5"
-    "@babel/traverse" "^7.28.5"
+    "@babel/traverse" "^7.29.0"
 
 "@babel/plugin-transform-modules-umd@^7.27.1":
   version "7.27.1"
@@ -1040,6 +1089,15 @@
     "@babel/parser" "^7.27.2"
     "@babel/types" "^7.27.1"
 
+"@babel/template@^7.28.6":
+  version "7.28.6"
+  resolved "https://registry.yarnpkg.com/@babel/template/-/template-7.28.6.tgz#0e7e56ecedb78aeef66ce7972b082fce76a23e57"
+  integrity sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==
+  dependencies:
+    "@babel/code-frame" "^7.28.6"
+    "@babel/parser" "^7.28.6"
+    "@babel/types" "^7.28.6"
+
 "@babel/traverse@^7.25.9", "@babel/traverse@^7.26.5", "@babel/traverse@^7.27.1", "@babel/traverse@^7.28.0", "@babel/traverse@^7.28.3", "@babel/traverse@^7.28.4", "@babel/traverse@^7.28.5":
   version "7.28.5"
   resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.28.5.tgz#450cab9135d21a7a2ca9d2d35aa05c20e68c360b"
@@ -1053,6 +1111,19 @@
     "@babel/types" "^7.28.5"
     debug "^4.3.1"
 
+"@babel/traverse@^7.28.6", "@babel/traverse@^7.29.0":
+  version "7.29.0"
+  resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.29.0.tgz#f323d05001440253eead3c9c858adbe00b90310a"
+  integrity sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==
+  dependencies:
+    "@babel/code-frame" "^7.29.0"
+    "@babel/generator" "^7.29.0"
+    "@babel/helper-globals" "^7.28.0"
+    "@babel/parser" "^7.29.0"
+    "@babel/template" "^7.28.6"
+    "@babel/types" "^7.29.0"
+    debug "^4.3.1"
+
 "@babel/types@^7.24.7", "@babel/types@^7.25.9", "@babel/types@^7.27.1", "@babel/types@^7.27.3", "@babel/types@^7.28.2", "@babel/types@^7.28.4", "@babel/types@^7.28.5", "@babel/types@^7.4.4":
   version "7.28.5"
   resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.28.5.tgz#10fc405f60897c35f07e85493c932c7b5ca0592b"
@@ -1061,6 +1132,14 @@
     "@babel/helper-string-parser" "^7.27.1"
     "@babel/helper-validator-identifier" "^7.28.5"
 
+"@babel/types@^7.28.6", "@babel/types@^7.29.0":
+  version "7.29.0"
+  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.29.0.tgz#9f5b1e838c446e72cf3cd4b918152b8c605e37c7"
+  integrity sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==
+  dependencies:
+    "@babel/helper-string-parser" "^7.27.1"
+    "@babel/helper-validator-identifier" "^7.28.5"
+
 "@colors/colors@1.6.0", "@colors/colors@^1.6.0":
   version "1.6.0"
   resolved "https://registry.npmjs.org/@colors/colors/-/colors-1.6.0.tgz"

From 10de0ea6c6871d14d06b741d457d3cfab3676d67 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 12 May 2026 16:32:17 -0400
Subject: [PATCH 232/326] chore(vdev): publish to crates.io on tag push
 (#25420)

---
 .github/workflows/vdev_publish.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.github/workflows/vdev_publish.yml b/.github/workflows/vdev_publish.yml
index b40174d0f21fc..a3757e387519d 100644
--- a/.github/workflows/vdev_publish.yml
+++ b/.github/workflows/vdev_publish.yml
@@ -59,3 +59,24 @@ jobs:
           files: ${{ env.ASSET }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish:
+    runs-on: ubuntu-24.04
+    needs: build
+    env:
+      DISABLE_MOLD: true
+    steps:
+      - name: Checkout Vector
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: ./.github/actions/setup
+        with:
+          rust: true
+          vdev: false
+          mold: false
+
+      - name: Publish to crates.io
+        working-directory: vdev
+        run: cargo publish
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

From dce3678640998bdbaedd67a4f5c4ddea588dd3af Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 12 May 2026 16:43:00 -0400
Subject: [PATCH 233/326] chore(vdev): bump version to 0.3.3 (#25419)

Ships the native Rust `build component-docs` generator (was a Ruby
script wrapper in 0.3.2). Required so binstalled vdev in CI runs the
correct generator after `scripts/generate-component-docs.rb` was
removed in #24781.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 Cargo.lock      | 2 +-
 vdev/Cargo.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 99ace18db604e..e0fd75819866b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -12896,7 +12896,7 @@ checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
 [[package]]
 name = "vdev"
-version = "0.3.2"
+version = "0.3.3"
 dependencies = [
  "anyhow",
  "cfg-if",
diff --git a/vdev/Cargo.toml b/vdev/Cargo.toml
index 68c92a4f198c2..15cf92dbd860c 100644
--- a/vdev/Cargo.toml
+++ b/vdev/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "vdev"
-version = "0.3.2"
+version = "0.3.3"
 edition = "2024"
 authors = ["Vector Contributors <vector@datadoghq.com>"]
 license = "MPL-2.0"

From fe3871fd15e8cc07a132aba2413f4c8efa69f983 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 12 May 2026 21:42:02 -0400
Subject: [PATCH 234/326] chore(deps): bump markdownlint-cli2 to 0.22.1 and
 remove smol-toml override (#25416)

---
 .../environment/npm-tools/package-lock.json    | 18 +++++++++---------
 scripts/environment/npm-tools/package.json     |  7 +------
 2 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/scripts/environment/npm-tools/package-lock.json b/scripts/environment/npm-tools/package-lock.json
index ac93d1c99990a..6b596203f7eae 100644
--- a/scripts/environment/npm-tools/package-lock.json
+++ b/scripts/environment/npm-tools/package-lock.json
@@ -6,7 +6,7 @@
     "": {
       "dependencies": {
         "@datadog/datadog-ci": "5.13.0",
-        "markdownlint-cli2": "0.22.0",
+        "markdownlint-cli2": "0.22.1",
         "prettier": "3.8.1"
       }
     },
@@ -279,9 +279,9 @@
       }
     },
     "node_modules/globby": {
-      "version": "16.1.1",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-16.1.1.tgz",
-      "integrity": "sha512-dW7vl+yiAJSp6aCekaVnVJxurRv7DCOLyXqEG3RYMYUg7AuJ2jCqPkZTA8ooqC2vtnkaMcV5WfFBMuEnTu1OQg==",
+      "version": "16.2.0",
+      "resolved": "https://registry.npmjs.org/globby/-/globby-16.2.0.tgz",
+      "integrity": "sha512-QrJia2qDf5BB/V6HYlDTs0I0lBahyjLzpGQg3KT7FnCdTonAyPy2RtY802m2k4ALx6Dp752f82WsOczEVr3l6Q==",
       "license": "MIT",
       "dependencies": {
         "@sindresorhus/merge-streams": "^4.0.0",
@@ -486,12 +486,12 @@
       }
     },
     "node_modules/markdownlint-cli2": {
-      "version": "0.22.0",
-      "resolved": "https://registry.npmjs.org/markdownlint-cli2/-/markdownlint-cli2-0.22.0.tgz",
-      "integrity": "sha512-mOC9BY/XGtdX3M9n3AgERd79F0+S7w18yBBTNIQ453sI87etZfp1z4eajqSMV70CYjbxKe5ktKvT2HCpvcWx9w==",
+      "version": "0.22.1",
+      "resolved": "https://registry.npmjs.org/markdownlint-cli2/-/markdownlint-cli2-0.22.1.tgz",
+      "integrity": "sha512-X14ZbytybDCXAViDmtN4DKLt9ZTrRn+oOrxTYlg3a65jS6QcYYbAkGPh/En2L/GDNbFYJ6lKaQSUNrrbN1bPrw==",
       "license": "MIT",
       "dependencies": {
-        "globby": "16.1.1",
+        "globby": "16.2.0",
         "js-yaml": "4.1.1",
         "jsonc-parser": "3.3.1",
         "jsonpointer": "5.0.1",
@@ -499,7 +499,7 @@
         "markdownlint": "0.40.0",
         "markdownlint-cli2-formatter-default": "0.0.6",
         "micromatch": "4.0.8",
-        "smol-toml": "1.6.0"
+        "smol-toml": "1.6.1"
       },
       "bin": {
         "markdownlint-cli2": "markdownlint-cli2-bin.mjs"
diff --git a/scripts/environment/npm-tools/package.json b/scripts/environment/npm-tools/package.json
index fdffa6f8a2ac0..1f74c554bc665 100644
--- a/scripts/environment/npm-tools/package.json
+++ b/scripts/environment/npm-tools/package.json
@@ -1,14 +1,9 @@
 {
   "private": true,
   "description": "Pinned npm tools for CI. Run 'npm ci' to install with exact versions from package-lock.json.",
-  "overrides": {
-    "markdownlint-cli2": {
-      "smol-toml": "1.6.1"
-    }
-  },
   "dependencies": {
     "@datadog/datadog-ci": "5.13.0",
-    "markdownlint-cli2": "0.22.0",
+    "markdownlint-cli2": "0.22.1",
     "prettier": "3.8.1"
   }
 }

From c60bc0a68c30eecdf8698eddec3ee7e3c7393fbb Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 13 May 2026 12:46:40 -0400
Subject: [PATCH 235/326] chore(ci): install vdev via binstall (#25418)

* chore(ci): replace vdev compile-and-cache with cargo binstall

CI now installs vdev via `cargo binstall` (pinned at VDEV_VERSION in
prepare.sh, same path local devs already use) instead of building from
source and caching the binary in GitHub Actions cache.

Removes:
- .github/actions/install-vdev (the compile-or-restore composite action)
- The check-vdev-cache lookup, VDEV_NEEDS_COMPILE branching, and the
  cross-file cache-key sync hazard in actions/setup
- The implicit "vdev source change forces cargo registry cache + mold +
  protoc install" side effects in actions/setup

vdev still gets cached opportunistically alongside the other cargo
binaries (keyed on scripts/environment/*.sh, which contains
VDEV_VERSION), and VDEV=$(which vdev) is still exported so the Makefile
prefers the installed binary over the slow `cargo run` alias.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(vdev): lead README with binstall, demote crates.io install

Restructure the Installation section to recommend `cargo binstall vdev`
first (the path CI and `prepare.sh` use), keep `cargo install --path
vdev` as the recipe for active vdev development, and drop the redundant
`cargo install vdev` step since binstall already pulls from the same
release artifacts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* bump vdev version

* allow new word

* chore(ci): fail fast on missing binstall prebuilts

Pass --disable-strategies compile so cargo-binstall errors out instead of
silently falling back to source compilation when no prebuilt asset is
available. Keeps vdev (and other binstalled tools) off the CI critical
path that previously timed out a release.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(vdev): clarify pinned vs. latest install paths

Promote prepare.sh --modules=vdev as the canonical pinned install
matching CI, document bare cargo binstall as "latest, not pinned",
and restore an explicit cargo install fallback. Move the working-tree
install snippet under Developing vdev where it belongs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): scope binstall fail-fast to vdev only

The prior global --disable-strategies compile flag applied to every cargo
tool sharing the global install array, which broke dd-rust-license-tool:
it is intentionally not in REQUIRES_BINSTALL, but when bundled with vdev
(e.g. test.yml's check-licenses job) it picked up the binstall installer
and could fail with no compile fallback.

Move the override into maybe_install_cargo_tool with per-tool handling:
keep dd-rust-license-tool on cargo install, and apply
--disable-strategies compile only to vdev.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): include vdev in NEEDS_RUST detection

cargo binstall is a cargo subcommand and needs the rust toolchain on
PATH to install vdev. Previously this dependency was handled silently
inside prepare.sh (REQUIRES_BINSTALL auto-prepends rustup to MODULES),
which works but couples action.yml to prepare.sh internals.

Make the dependency explicit so vdev: true on its own drives the
toolchain setup steps in action.yml.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(vdev): note CI installs from a released binary

Lead the Installation section with the explicit guarantee that CI fetches
a published vdev binary via cargo-binstall and never compiles from source.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/actions/install-vdev/action.yml | 46 ------------------------
 .github/actions/setup/action.yml        | 48 +++++++++----------------
 .github/actions/spelling/allow.txt      |  1 +
 scripts/environment/prepare.sh          | 11 ++++--
 vdev/README.md                          | 26 ++++++++------
 5 files changed, 42 insertions(+), 90 deletions(-)
 delete mode 100644 .github/actions/install-vdev/action.yml

diff --git a/.github/actions/install-vdev/action.yml b/.github/actions/install-vdev/action.yml
deleted file mode 100644
index e98d9731f2a5d..0000000000000
--- a/.github/actions/install-vdev/action.yml
+++ /dev/null
@@ -1,46 +0,0 @@
-name: "Install vdev"
-description: "Install vdev CLI tool with caching based on source code changes"
-
-branding:
-  icon: tool
-  color: purple
-
-inputs:
-  skip-cache:
-    description: "Skip cache lookup and force compilation"
-    required: false
-    default: "false"
-
-runs:
-  using: "composite"
-  steps:
-    - name: Cache vdev binary
-      id: cache-vdev
-      if: ${{ inputs.skip-cache != 'true' }}
-      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
-      with:
-        path: ~/.cargo/bin/vdev
-        # WARNING: this key need to be in sync with the key in .github/actions/setup/action.yml
-        key: ${{ runner.os }}-vdev-${{ hashFiles('vdev/**', 'lib/vector-vrl/**', 'Cargo.toml', 'Cargo.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-vdev-
-
-    - name: Build and install vdev
-      if: steps.cache-vdev.outputs.cache-hit != 'true'
-      shell: bash
-      run: |
-        echo "Building vdev from source (cache miss)"
-        cargo install --path vdev --locked --force
-
-    - name: Save vdev to cache
-      if: ${{ inputs.skip-cache == 'true' }}
-      uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
-      with:
-        path: ~/.cargo/bin/vdev
-        # WARNING: this key need to be in sync with the key in .github/actions/setup/action.yml
-        key: ${{ runner.os }}-vdev-${{ hashFiles('vdev/**', 'lib/vector-vrl/**', 'Cargo.toml', 'Cargo.lock') }}
-
-    - name: Set VDEV environment variable
-      shell: bash
-      run: |
-        echo "VDEV=$(which vdev)" >> "$GITHUB_ENV"
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 7257d92a8266b..1811f59b22260 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -73,7 +73,7 @@ inputs:
   vdev:
     required: false
     default: true
-    description: "Install vdev CLI tool (cached by vdev/ directory changes)."
+    description: "Install vdev CLI tool via cargo binstall (uses VDEV_VERSION pinned in prepare.sh)."
 
   # prepare.sh - npm
   markdownlint-cli2:
@@ -92,25 +92,15 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Check vdev cache status
-      id: check-vdev-cache
-      if: ${{ inputs.vdev == 'true' }}
-      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
-      with:
-        path: ~/.cargo/bin/vdev
-        # WARNING: this key need to be in sync with the key in .github/actions/install-vdev/action.yml
-        key: ${{ runner.os }}-vdev-${{ hashFiles('vdev/**', 'lib/vector-vrl/**', 'Cargo.toml', 'Cargo.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-vdev-
-        lookup-only: true
-
     - id: needs
       name: Compute if rust is needed
       shell: bash
       run: |
         rust="false"
 
-        # If any rust-related inputs are true (excluding vdev), enable rust
+        # If any rust-related inputs are true, enable rust.
+        # vdev itself does not compile, but cargo binstall is a cargo subcommand
+        # and needs the rust toolchain on PATH to install it.
         for val in "${{ inputs.mold }}" \
                    "${{ inputs.rust }}" \
                    "${{ inputs.cargo-deb }}" \
@@ -121,22 +111,15 @@ runs:
                    "${{ inputs.cargo-hack }}" \
                    "${{ inputs.cargo-llvm-cov }}" \
                    "${{ inputs.dd-rust-license-tool }}" \
-                   "${{ inputs.wasm-pack }}"; do
+                   "${{ inputs.wasm-pack }}" \
+                   "${{ inputs.vdev }}"; do
           if [[ "$val" == "true" ]]; then
             rust="true"
             break
           fi
         done
 
-        # If vdev needs compilation (cache miss), enable rust
-        vdev_needs_compile="false"
-        if [[ "${{ inputs.vdev }}" == "true" && "${{ steps.check-vdev-cache.outputs.cache-hit }}" != "true" ]]; then
-          rust="true"
-          vdev_needs_compile="true"
-        fi
-
         echo "NEEDS_RUST=$rust" >> "$GITHUB_ENV"
-        echo "VDEV_NEEDS_COMPILE=$vdev_needs_compile" >> "$GITHUB_ENV"
 
         if [[ "$rust" == "true" ]]; then
           echo "RUST_BACKTRACE=full" >> "$GITHUB_ENV"
@@ -152,7 +135,7 @@ runs:
       shell: bash
 
     - name: Cache Cargo registry, index, and git DB
-      if: ${{ inputs.cargo-cache == 'true' || env.NEEDS_RUST == 'true' || env.VDEV_NEEDS_COMPILE == 'true' }}
+      if: ${{ inputs.cargo-cache == 'true' || env.NEEDS_RUST == 'true' }}
       uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: |
@@ -164,7 +147,7 @@ runs:
           ${{ runner.os }}-cargo-
 
     - name: Install mold
-      if: ${{ runner.os == 'Linux' && env.DISABLE_MOLD != 'true' && (inputs.mold == 'true' || env.VDEV_NEEDS_COMPILE == 'true') }}
+      if: ${{ runner.os == 'Linux' && env.DISABLE_MOLD != 'true' && inputs.mold == 'true' }}
       shell: bash
       run: |
         echo "Installing mold"
@@ -211,7 +194,7 @@ runs:
         EOF
 
     - name: Install protoc
-      if: ${{ inputs.protoc == 'true' || env.VDEV_NEEDS_COMPILE == 'true' }}
+      if: ${{ inputs.protoc == 'true' }}
       shell: bash
       run: |
         echo "Installing protoc"
@@ -241,12 +224,6 @@ runs:
       shell: bash
       run: sudo apt-get update && sudo apt-get install -y libsasl2-dev
 
-    - name: Install vdev
-      if: ${{ inputs.vdev == 'true' }}
-      uses: ./.github/actions/install-vdev
-      with:
-        skip-cache: ${{ env.VDEV_NEEDS_COMPILE == 'true' }}
-
     - name: Cache cargo binaries
       id: cache-cargo-binaries
       uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
@@ -261,6 +238,7 @@ runs:
           ~/.cargo/bin/cargo-llvm-cov
           ~/.cargo/bin/dd-rust-license-tool
           ~/.cargo/bin/wasm-pack
+          ~/.cargo/bin/vdev
         key: ${{ runner.os }}-cargo-binaries-${{ hashFiles('scripts/environment/*.sh') }}
         restore-keys: |
           ${{ runner.os }}-cargo-binaries-
@@ -286,6 +264,7 @@ runs:
         [[ "${{ inputs.cargo-llvm-cov }}" == "true" ]] && mods+=("cargo-llvm-cov")
         [[ "${{ inputs.dd-rust-license-tool }}" == "true" ]] && mods+=("dd-rust-license-tool")
         [[ "${{ inputs.wasm-pack }}" == "true" ]] && mods+=("wasm-pack")
+        [[ "${{ inputs.vdev }}" == "true" ]] && mods+=("vdev")
         [[ "${{ inputs.markdownlint-cli2 }}" == "true" ]] && mods+=("markdownlint-cli2")
         [[ "${{ inputs.prettier }}" == "true" ]] && mods+=("prettier")
         [[ "${{ inputs.datadog-ci }}" == "true" ]] && mods+=("datadog-ci")
@@ -294,3 +273,8 @@ runs:
         if [[ "$csm" != "" ]]; then
           ./scripts/environment/prepare.sh --modules="${csm}"
         fi
+
+    - name: Set VDEV environment variable
+      if: ${{ inputs.vdev == 'true' }}
+      shell: bash
+      run: echo "VDEV=$(which vdev)" >> "$GITHUB_ENV"
diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index db6d30301dcd7..b38f18f38d1eb 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -574,3 +574,4 @@ CLAUDE
 grpcurl
 linting
 lexers
+binstalled
diff --git a/scripts/environment/prepare.sh b/scripts/environment/prepare.sh
index c08fb4499d49b..6371db0a32c1d 100755
--- a/scripts/environment/prepare.sh
+++ b/scripts/environment/prepare.sh
@@ -39,7 +39,7 @@ CARGO_LLVM_COV_VERSION="0.8.4"
 WASM_PACK_VERSION="0.13.1"
 # npm tool versions are defined in scripts/environment/npm-tools/package.json
 # and pinned (including transitive deps) in npm-tools/package-lock.json.
-VDEV_VERSION="0.3.2"
+VDEV_VERSION="0.3.3"
 
 ALL_MODULES=(
   rustup
@@ -139,8 +139,15 @@ maybe_install_cargo_tool() {
     version_cmd="cargo ${tool#cargo-}"
   fi
 
+  # vdev fails fast on missing prebuilts so a cache/asset miss can't
+  # reintroduce the source-compile path that previously stalled a release.
+  local installer=("${install[@]}")
+  if [[ "$tool" == "vdev" && "${installer[0]}" == "binstall" ]]; then
+    installer+=(--disable-strategies compile)
+  fi
+
   if ! $version_cmd --version 2>/dev/null | grep -q "^${version_pattern}"; then
-    cargo "${install[@]}" "$tool" --version "$version" --force --locked
+    cargo "${installer[@]}" "$tool" --version "$version" --force --locked
   fi
 
   # cargo-llvm-cov requires the llvm-tools-preview rustup component
diff --git a/vdev/README.md b/vdev/README.md
index c20860b1f06e1..17b6b1cdf0d75 100644
--- a/vdev/README.md
+++ b/vdev/README.md
@@ -33,28 +33,28 @@ dependencies can be installed by running
 
 ## Installation
 
-Note that installation is not required, since `cargo vdev` commands will invoke vdev from within the
-repository.
-
-Run the following command from the root of the Vector repository:
+CI installs vdev from a published binary release via [cargo-binstall](https://github.com/cargo-bins/cargo-binstall) and never builds it from source. To match that locally:
 
 ```sh
-cargo install -f --path vdev
+./scripts/environment/prepare.sh --modules=vdev
 ```
 
-You can also install vdev from [crates.io](https://crates.io/crates/vdev)
+This pins the vdev version defined in `prepare.sh` and fetches the matching pre-compiled binary.
+
+For a quick install of the latest published vdev (not pinned):
 
 ```sh
-cargo install vdev
+cargo binstall vdev
 ```
 
-Or using [binstall](https://github.com/cargo-bins/cargo-binstall), which will download a
-pre-compiled binary (fastest)
+If binstall is unavailable, fall back to compiling from crates.io:
 
 ```sh
-cargo binstall vdev
+cargo install vdev
 ```
 
+Installation is otherwise optional: from within the Vector repository, `cargo vdev` works via a cargo alias that compiles vdev from source on each invocation. That path is fine for occasional use but is slower than a binstalled binary.
+
 
 ## Running Tests
 
@@ -71,6 +71,12 @@ You should use `./scripts/run-integration-test.sh`, which is the wrapper used by
 
 ## Developing vdev
 
+If you are actively developing vdev itself, install from your working tree so the binary on `PATH` reflects your local changes:
+
+```sh
+cargo install -f --path vdev
+```
+
 The CLI uses [Clap](https://github.com/clap-rs/clap) with the `derive` construction mechanism and is stored in the [commands](src/commands) directory.
 
 Every command group/namespace has its own directory with a `cli` module, including the root `vdev` command group. All commands have an `exec` method that provides the actual implementation, which in the case of command groups will be calling sub-commands.

From c3720d863abc606cef5c117486b6ced03f8cf134 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 13 May 2026 13:18:52 -0400
Subject: [PATCH 236/326] fix(releasing): remove default OS package config
 (#25425)

* fix(releasing): stop installing default OS package config

Vector's Debian, RPM, Alpine, and distroless-static packages installed
config/vector.yaml at /etc/vector/vector.yaml. That config runs a
demo_logs source and prints synthesized syslog to stdout, which ends up
in journald or /var/log/ when Vector is run as a service and is a
recurring source of "is my log forwarder compromised?" confusion.

Ship config/vector.yaml as a reference example under
/usr/share/vector/examples/ instead. The /etc/vector/examples/ tree of
additional sample configs is unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(docker platform): explain that images ship no default config

Replace the line claiming the default config file 'doesn't do anything'
with a note that no default is shipped and point users at the reference
example under /usr/share/vector/examples/vector.yaml.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(rpm platform): preserve existing vector.yaml on upgrade

When upgrading from an RPM that owned /etc/vector/vector.yaml to one
that no longer does, rpm would erase the file (or save it as .rpmsave
if user-modified). Either way the active path used by the systemd unit
ends up empty after the upgrade.

Mark the path as %ghost %config(noreplace) so rpm continues to claim it
without installing anything, and any existing on-disk file is left
alone during upgrade.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(releasing): update verify-install for empty-config behavior

Fresh installs no longer drop /etc/vector/vector.yaml. Update the
publish-pipeline verification script to:

- Assert that /etc/vector/vector.yaml is absent after fresh install.
- Assert that the reference example exists at
  /usr/share/vector/examples/vector.yaml.
- Continue to verify that a user-provided /etc/vector/vector.yaml is
  preserved across a re-install.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 Cargo.toml                                          |  4 ++--
 .../15513_remove_default_os_package_config.fix.md   |  7 +++++++
 distribution/docker/README.md                       | 13 ++++++-------
 distribution/docker/alpine/Dockerfile               |  2 +-
 distribution/docker/distroless-static/Dockerfile    |  2 +-
 distribution/rpm/vector.spec                        |  9 +++++++--
 scripts/verify-install.sh                           |  6 ++++--
 7 files changed, 28 insertions(+), 15 deletions(-)
 create mode 100644 changelog.d/15513_remove_default_os_package_config.fix.md

diff --git a/Cargo.toml b/Cargo.toml
index 7f46e97d60ea0..e94fa97574624 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -54,10 +54,10 @@ unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tokio_unstable)'] }
 name = "vector"
 section = "admin"
 maintainer-scripts = "distribution/debian/scripts/"
-conf-files = ["/etc/vector/vector.yaml", "/etc/default/vector"]
+conf-files = ["/etc/default/vector"]
 assets = [
   ["target/release/vector", "/usr/bin/", "755"],
-  ["config/vector.yaml", "/etc/vector/vector.yaml", "644"],
+  ["config/vector.yaml", "/usr/share/vector/examples/vector.yaml", "644"],
   ["config/examples/*", "/etc/vector/examples/", "644"],
   ["distribution/systemd/vector.service", "/lib/systemd/system/vector.service", "644"],
   ["distribution/systemd/vector.default", "/etc/default/vector", "600"],
diff --git a/changelog.d/15513_remove_default_os_package_config.fix.md b/changelog.d/15513_remove_default_os_package_config.fix.md
new file mode 100644
index 0000000000000..e509742ff2564
--- /dev/null
+++ b/changelog.d/15513_remove_default_os_package_config.fix.md
@@ -0,0 +1,7 @@
+The default `/etc/vector/vector.yaml` config file is no longer installed by the Debian, RPM, Alpine, and distroless-static Docker packages. The previous default ran a `demo_logs` source and printed synthesized syslog lines to stdout, which then surfaced in journald or `/var/log/` on hosts running Vector as a service and was a common source of confusion.
+
+New installs will now have no active config on disk. Provide your own configuration at `/etc/vector/vector.yaml` (or pass `--config <path>`) before starting Vector. A reference example is shipped at `/usr/share/vector/examples/vector.yaml`, and more sample configs remain at `/etc/vector/examples/`.
+
+Existing installs are unaffected on upgrade: package managers preserve the on-disk `/etc/vector/vector.yaml` if you already had one.
+
+authors: pront
diff --git a/distribution/docker/README.md b/distribution/docker/README.md
index e8c28e1c449a6..b504cee5a2162 100644
--- a/distribution/docker/README.md
+++ b/distribution/docker/README.md
@@ -33,9 +33,9 @@ observability data with Vector.
 
 ## Configuring
 
-You can pass a custom
-[Vector configuration file][docs.setup.configuration] to the container via the
-`-c` flag, mounting the file from the host:
+Vector images do not ship a default configuration. You must provide one via the
+`-c` flag, typically by mounting a [Vector configuration file][docs.setup.configuration]
+from the host:
 
 ```bash
 docker run \
@@ -44,9 +44,8 @@ docker run \
   -c /etc/vector/vector.yaml
 ```
 
-You'll want to do this since the
-[default `/etc/vector/vector.yaml` configuration file][urls.default_configuration]
-doesn't do anything.
+A reference [example configuration][urls.example_configuration] is bundled at
+`/usr/share/vector/examples/vector.yaml` inside the image.
 
 ## Deploying
 
@@ -137,7 +136,7 @@ Vector's Docker source files are located
 [docs.transforms]: https://vector.dev/docs/reference/configurationtransforms/
 [pages.index#correctness]: https://vector.dev/#correctness
 [pages.index#performance]: https://vector.dev/#performance
-[urls.default_configuration]: https://github.com/vectordotdev/vector/blob/master/config/vector.yaml
+[urls.example_configuration]: https://github.com/vectordotdev/vector/blob/master/config/vector.yaml
 [urls.docker_alpine]: https://hub.docker.com/_/alpine
 [urls.docker_debian]: https://hub.docker.com/_/debian
 [urls.rust]: https://www.rust-lang.org/
diff --git a/distribution/docker/alpine/Dockerfile b/distribution/docker/alpine/Dockerfile
index 426254abffd39..f0cdf4210bc8f 100644
--- a/distribution/docker/alpine/Dockerfile
+++ b/distribution/docker/alpine/Dockerfile
@@ -24,7 +24,7 @@ LABEL org.opencontainers.image.documentation="https://vector.dev/docs"
 RUN apk --no-cache add ca-certificates tzdata
 
 COPY --from=builder /vector/bin/* /usr/local/bin/
-COPY --from=builder /vector/config/vector.yaml /etc/vector/vector.yaml
+COPY --from=builder /vector/config/vector.yaml /usr/share/vector/examples/vector.yaml
 COPY --from=builder /var/lib/vector /var/lib/vector
 
 # Smoke test
diff --git a/distribution/docker/distroless-static/Dockerfile b/distribution/docker/distroless-static/Dockerfile
index 312190cda5302..e91eb6b3038f7 100644
--- a/distribution/docker/distroless-static/Dockerfile
+++ b/distribution/docker/distroless-static/Dockerfile
@@ -17,7 +17,7 @@ LABEL org.opencontainers.image.source="https://github.com/vectordotdev/vector"
 LABEL org.opencontainers.image.documentation="https://vector.dev/docs"
 
 COPY --from=builder /vector/bin/* /usr/local/bin/
-COPY --from=builder /vector/config/vector.yaml /etc/vector/vector.yaml
+COPY --from=builder /vector/config/vector.yaml /usr/share/vector/examples/vector.yaml
 COPY --from=builder /var/lib/vector /var/lib/vector
 
 # Smoke test
diff --git a/distribution/rpm/vector.spec b/distribution/rpm/vector.spec
index 0aaee7e7edbe8..a09809e221493 100644
--- a/distribution/rpm/vector.spec
+++ b/distribution/rpm/vector.spec
@@ -56,7 +56,8 @@ mkdir -p %{buildroot}%{_datadir}/%{_name}
 mkdir -p %{buildroot}%{_unitdir}
 
 cp -a %{_builddir}/bin/vector %{buildroot}%{_bindir}
-cp -a %{_builddir}/config/vector.yaml %{buildroot}%{_sysconfdir}/%{_name}/vector.yaml
+mkdir -p %{buildroot}%{_datadir}/%{_name}/examples
+cp -a %{_builddir}/config/vector.yaml %{buildroot}%{_datadir}/%{_name}/examples/vector.yaml
 cp -a %{_builddir}/config/examples/. %{buildroot}%{_sysconfdir}/%{_name}/examples
 cp -a %{_builddir}/systemd/vector.service %{buildroot}%{_unitdir}/vector.service
 cp -a %{_builddir}/systemd/vector.default %{buildroot}%{_sysconfdir}/default/vector
@@ -79,12 +80,16 @@ rm -rf %{buildroot}
 %defattr(-,root,root,-)
 %{_bindir}/*
 %{_unitdir}/vector.service
-%config(noreplace) %{_sysconfdir}/%{_name}/vector.yaml
 %config(noreplace) %{_sysconfdir}/default/vector
+# Older versions installed a demo config at this path; mark it as %ghost so
+# rpm preserves any existing on-disk file during upgrade instead of removing
+# it as orphaned.
+%ghost %config(noreplace) %{_sysconfdir}/%{_name}/vector.yaml
 %config %{_sysconfdir}/%{_name}/examples/*
 %dir %{_sharedstatedir}/%{_name}
 %doc README.md
 %doc %{_datadir}/%{_name}/NOTICE
+%doc %{_datadir}/%{_name}/examples/vector.yaml
 %doc %{_datadir}/%{_name}/licenses/*
 %doc %{_datadir}/%{_name}/LICENSE-3rdparty.csv
 %license LICENSE
diff --git a/scripts/verify-install.sh b/scripts/verify-install.sh
index a73dccc7a52b4..ab9e6039f3f14 100755
--- a/scripts/verify-install.sh
+++ b/scripts/verify-install.sh
@@ -26,8 +26,10 @@ getent passwd vector || (echo "vector user missing" && exit 1)
 getent group vector || (echo "vector group  missing" && exit 1)
 vector --version || (echo "vector --version failed" && exit 1)
 test -f /etc/default/vector || (echo "/etc/default/vector doesn't exist" && exit 1)
-test -f /etc/vector/vector.yaml || (echo "/etc/vector/vector.yaml doesn't exist" && exit 1)
+test ! -e /etc/vector/vector.yaml || (echo "/etc/vector/vector.yaml should not be installed by default" && exit 1)
+test -f /usr/share/vector/examples/vector.yaml || (echo "/usr/share/vector/examples/vector.yaml doesn't exist" && exit 1)
 
+mkdir -p /etc/vector
 echo "FOO=bar" > /etc/default/vector
 echo "foo: bar" > /etc/vector/vector.yaml
 
@@ -37,6 +39,6 @@ getent passwd vector || (echo "vector user missing" && exit 1)
 getent group vector || (echo "vector group  missing" && exit 1)
 vector --version || (echo "vector --version failed" && exit 1)
 grep -q "FOO=bar" "/etc/default/vector" || (echo "/etc/default/vector has incorrect contents" && exit 1)
-grep -q "foo: bar" "/etc/vector/vector.yaml" || (echo "/etc/vector/vector.yaml has incorrect contents" && exit 1)
+grep -q "foo: bar" "/etc/vector/vector.yaml" || (echo "user-provided /etc/vector/vector.yaml was not preserved on reinstall" && exit 1)
 
 dd-pkg lint "$package"

From 904f69f81c68826a982d351cc08335cea9afab5b Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 13 May 2026 16:35:46 -0400
Subject: [PATCH 237/326] enhancement(opentelemetry sink): warn on invalid json
 batching (#25423)

* enhancement(opentelemetry sink): warn on invalid json batching

Detect when the sink is built with `encoding.codec: json` and
`batch.max_events` greater than 1, which produces newline-delimited JSON
request bodies that OTLP receivers reject with HTTP 400. Log a warning
at startup pointing users at either `encoding.codec: otlp` (recommended)
or `batch.max_events: 1`. Also add a warning callout on the sink docs
page so the pitfall surfaces above the configuration reference.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: drop changelog fragment

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/sinks/opentelemetry/mod.rs                | 20 ++++++++++++++++++-
 .../components/sinks/opentelemetry.cue        | 11 +++++++++-
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/src/sinks/opentelemetry/mod.rs b/src/sinks/opentelemetry/mod.rs
index dcc13624372d5..3759c962ff78b 100644
--- a/src/sinks/opentelemetry/mod.rs
+++ b/src/sinks/opentelemetry/mod.rs
@@ -78,7 +78,10 @@ impl GenerateConfig for OpenTelemetryConfig {
 impl SinkConfig for OpenTelemetryConfig {
     async fn build(&self, cx: SinkContext) -> crate::Result<(VectorSink, Healthcheck)> {
         match &self.protocol {
-            Protocol::Http(config) => config.build(cx).await,
+            Protocol::Http(config) => {
+                warn_on_invalid_otlp_batching(config);
+                config.build(cx).await
+            }
         }
     }
 
@@ -95,6 +98,21 @@ impl SinkConfig for OpenTelemetryConfig {
     }
 }
 
+fn warn_on_invalid_otlp_batching(config: &HttpSinkConfig) {
+    let (_, serializer) = config.encoding.config();
+    let is_json = matches!(serializer, SerializerConfig::Json(_));
+    let batches_more_than_one = !matches!(config.batch.max_events, Some(1));
+    if is_json && batches_more_than_one {
+        tracing::warn!(
+            message = "`opentelemetry` sink is configured with `encoding.codec = json` and \
+                       `batch.max_events` greater than 1. This produces invalid OTLP request \
+                       bodies that receivers reject with HTTP 400. Use `encoding.codec = otlp` \
+                       (recommended) or set `batch.max_events = 1`. See \
+                       https://github.com/vectordotdev/vector/issues/22054.",
+        );
+    }
+}
+
 #[cfg(test)]
 mod test {
     #[test]
diff --git a/website/cue/reference/components/sinks/opentelemetry.cue b/website/cue/reference/components/sinks/opentelemetry.cue
index ffdc1d40b67c2..b5fa8855bcea2 100644
--- a/website/cue/reference/components/sinks/opentelemetry.cue
+++ b/website/cue/reference/components/sinks/opentelemetry.cue
@@ -32,7 +32,16 @@ components: sinks: opentelemetry: {
 
 	support: {
 		requirements: ["This sink accepts events conforming to the [OTEL proto format](\(urls.opentelemetry_proto)). You can use [Remap](\(urls.vector_remap_transform)) to prepare events for ingestion."]
-		warnings: []
+		warnings: [
+			"""
+				Batching only works with `encoding.codec: otlp`, which encodes events as protobuf
+				and supports native batching (recommended). The legacy `encoding.codec: json` path
+				produces newline-delimited JSON, which is not a valid OTLP request body, so on
+				that path you must either set `batch.max_events: 1` or merge events into a single
+				envelope upstream with the [`reduce`](\(urls.vector_reduce_transform)) transform.
+				See [#22054](https://github.com/vectordotdev/vector/issues/22054).
+				""",
+		]
 		notices: []
 	}
 

From 338fc3805f131ca9281baadccb05e4ff8ac26111 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 13 May 2026 17:06:03 -0400
Subject: [PATCH 238/326] fix(releasing): restore Vector RPM/DEB install on EL8
 family (#25387)

* fix(releasing): restore EL8 install for GNU artifacts (glibc 2.28 floor)

v0.55.0 broke installation on EL8 family distros. The cross-compilation
base image was bumped from a sysroot with glibc 2.23 to one with glibc
2.31, which made the binary reference GLIBC_2.29 and GLIBC_2.30 symbols.
EL8 ships glibc 2.28, so the dynamic loader rejects the binary at startup.

Build the x86_64-unknown-linux-gnu and aarch64-unknown-linux-gnu release
binaries natively inside an almalinux:8 container on GitHub-hosted
runners. The build environment IS the install floor (glibc 2.28), so the
binary cannot reference a glibc symbol newer than what install will see.

- Split build-linux-packages into build-linux-gnu-native (x86_64 and
  aarch64 GNU on hosted runners) and build-linux-cross (musl + 32-bit
  ARM via cross-rs).
- Add NATIVE=true mode to the Makefile target/%/vector rule.
- Add almalinux:8 to the rpm-verify container matrix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ci): restore x86_64-gnu cross digest for cross.yml smoke build

The previous commit removed CROSS_DIGEST_x86_64-unknown-linux-gnu because
the release build switched to native almalinux:8. But cross.yml's matrix
still includes x86_64-unknown-linux-gnu as a cross-compile smoke check
(invoked from master_merge_queue.yml when dependencies change), which
calls make cross-build-x86_64-unknown-linux-gnu and now errors out with
"No image digest pinned".

Restore the digest entry so the CI smoke check keeps working. The native
almalinux:8 path remains the production release build.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(releasing): pin almalinux:8 by digest in publish.yml

Replace the mutable almalinux:8 tag in build-linux-gnu-native and the
rpm-verify matrix with a digest pin. The native GNU release builds and
the EL8 install-floor verification now run against a frozen base layer,
so a Red Hat-side image rebuild can't silently shift the glibc floor
or other system libraries underneath us.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ci): drop invalid rustup input from macOS publish setup

The setup composite action exposes `rust:` (which internally runs the
rustup prepare.sh module); there is no `rustup:` input, so the arm64
macOS publish job was failing with "Unexpected input(s) 'rustup'".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ci): set HOME=/root in almalinux:8 native build container

The runner sets HOME=/github/home for container jobs, but the container
runs as root whose home is /root. rustup (and sudo) emit warnings to
stderr about the mismatch, which the Rust problem-matcher then surfaces
as red GitHub annotations even though the build itself succeeds.

Pinning HOME=/root on the container makes rustup, sudo, and cargo paths
consistent and silences the noise.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/actions/setup/action.yml         |  4 +
 .github/workflows/publish.yml            | 96 +++++++++++++++++++++---
 Makefile                                 | 28 +++++--
 changelog.d/25253_el8_glibc_floor.fix.md |  3 +
 scripts/package-rpm.sh                   |  3 +
 5 files changed, 116 insertions(+), 18 deletions(-)
 create mode 100644 changelog.d/25253_el8_glibc_floor.fix.md

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 1811f59b22260..ec229f1b666ce 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -274,6 +274,10 @@ runs:
           ./scripts/environment/prepare.sh --modules="${csm}"
         fi
 
+        if [[ "$NEEDS_RUST" == "true" ]]; then
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+        fi
+
     - name: Set VDEV environment variable
       if: ${{ inputs.vdev == 'true' }}
       shell: bash
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8d6b8c2560ca0..2899cea0c6e04 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -63,7 +63,78 @@ jobs:
         id: generate-publish-metadata
         run: make ci-generate-publish-metadata
 
-  build-linux-packages:
+  build-linux-gnu-native:
+    name: Build Vector for ${{ matrix.target }} (native)
+    runs-on: ${{ matrix.runner }}
+    container:
+      image: almalinux:8@sha256:ca871b110064fe81bff0250ed5cc56fbb0a9840715f09811c33bbf9d72cef56c
+      # Align HOME with the container's root user so rustup/sudo don't warn
+      # about $HOME (/github/home) differing from the euid-obtained home (/root).
+      env:
+        HOME: /root
+    timeout-minutes: 90
+    needs: generate-publish-metadata
+    env:
+      VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
+      VECTOR_BUILD_DESC: ${{ needs.generate-publish-metadata.outputs.vector_build_desc }}
+      CHANNEL: ${{ needs.generate-publish-metadata.outputs.vector_release_channel }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            runner: ubuntu-24.04-8core
+          - target: aarch64-unknown-linux-gnu
+            runner: ubuntu-24.04-8core-arm
+    steps:
+      - name: Install system dependencies
+        run: |
+          dnf install -y --setopt=install_weak_deps=False \
+            gcc gcc-c++ make cmake perl perl-IPC-Cmd \
+            openssl-devel cyrus-sasl-devel \
+            pkgconfig clang \
+            rpm-build sudo \
+            git tar gzip xz which findutils \
+            curl unzip
+      # TODO: generate the .deb description once in generate-publish-metadata and consume as an artifact, so all builders share the same output and this source build can go away.
+      - name: Build cmark-gfm from source
+        env:
+          CMARK_GFM_TAG: "0.29.0.gfm.13"
+          CMARK_GFM_SHA: "587a12bb54d95ac37241377e6ddc93ea0e45439b"
+        run: |
+          git clone --depth 1 --branch "$CMARK_GFM_TAG" https://github.com/github/cmark-gfm.git /tmp/cmark-gfm
+          actual_sha="$(git -C /tmp/cmark-gfm rev-parse HEAD)"
+          if [ "$actual_sha" != "$CMARK_GFM_SHA" ]; then
+            echo "::error::cmark-gfm tag $CMARK_GFM_TAG resolved to $actual_sha, expected $CMARK_GFM_SHA"
+            exit 1
+          fi
+          cmake -S /tmp/cmark-gfm -B /tmp/cmark-gfm/build \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DCMAKE_INSTALL_PREFIX=/usr \
+            -DCMAKE_INSTALL_LIBDIR=lib64
+          cmake --build /tmp/cmark-gfm/build -j "$(nproc)"
+          cmake --install /tmp/cmark-gfm/build
+          ldconfig
+          rm -rf /tmp/cmark-gfm
+          cmark-gfm --version
+      - name: Checkout Vector
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.git_ref }}
+      - uses: ./.github/actions/setup
+        with:
+          rust: true
+          cargo-deb: true
+          protoc: true
+      - name: Build Vector
+        run: make NATIVE=true package-${{ matrix.target }}-all
+      - name: Stage package artifacts for publish
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: vector-${{ env.VECTOR_VERSION }}-${{ matrix.target }}
+          path: target/artifacts/vector*
+
+  build-linux-cross:
     name: Build Vector for ${{ matrix.target }}
     runs-on: release-builder-linux
     timeout-minutes: 60
@@ -76,9 +147,7 @@ jobs:
       matrix:
         include:
           - target: x86_64-unknown-linux-musl # .tar.gz
-          - target: x86_64-unknown-linux-gnu # .tar.gz, .deb, .rpm
           - target: aarch64-unknown-linux-musl # .tar.gz
-          - target: aarch64-unknown-linux-gnu # .tar.gz, .deb, .rpm
           - target: armv7-unknown-linux-gnueabihf # .tar.gz, .deb, .rpm
           - target: armv7-unknown-linux-musleabihf # .tar.gz
           - target: arm-unknown-linux-gnueabi # .tar.gz, .deb
@@ -141,7 +210,6 @@ jobs:
       - uses: ./.github/actions/setup
         with:
           rust: true
-          rustup: true
           protoc: true
       - name: Build Vector
         env:
@@ -208,7 +276,8 @@ jobs:
     timeout-minutes: 5
     needs:
       - generate-publish-metadata
-      - build-linux-packages
+      - build-linux-gnu-native
+      - build-linux-cross
     env:
       VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
       DD_PKG_VERSION: "latest"
@@ -256,13 +325,16 @@ jobs:
     timeout-minutes: 10
     needs:
       - generate-publish-metadata
-      - build-linux-packages
+      - build-linux-gnu-native
+      - build-linux-cross
     env:
       VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
       DD_PKG_VERSION: "latest"
     strategy:
       matrix:
         container:
+          # Lowest supported glibc tier (EL8 family, glibc 2.28). Catches glibc-floor regressions.
+          - "almalinux:8@sha256:ca871b110064fe81bff0250ed5cc56fbb0a9840715f09811c33bbf9d72cef56c"
           - "quay.io/centos/centos:stream9"
           - "amazonlinux:2023"
           - "fedora:39"
@@ -341,7 +413,8 @@ jobs:
       packages: write
     needs:
       - generate-publish-metadata
-      - build-linux-packages
+      - build-linux-gnu-native
+      - build-linux-cross
       - deb-verify
     env:
       VECTOR_VERSION: ${{ needs.generate-publish-metadata.outputs.vector_version }}
@@ -399,7 +472,8 @@ jobs:
     timeout-minutes: 10
     needs:
       - generate-publish-metadata
-      - build-linux-packages
+      - build-linux-gnu-native
+      - build-linux-cross
       - build-apple-darwin-packages
       - build-x86_64-pc-windows-msvc-packages
       - deb-verify
@@ -440,7 +514,8 @@ jobs:
       contents: write
     needs:
       - generate-publish-metadata
-      - build-linux-packages
+      - build-linux-gnu-native
+      - build-linux-cross
       - build-apple-darwin-packages
       - build-x86_64-pc-windows-msvc-packages
       - deb-verify
@@ -474,7 +549,8 @@ jobs:
     timeout-minutes: 5
     needs:
       - generate-publish-metadata
-      - build-linux-packages
+      - build-linux-gnu-native
+      - build-linux-cross
       - build-apple-darwin-packages
       - build-x86_64-pc-windows-msvc-packages
     env:
diff --git a/Makefile b/Makefile
index 2d4cc46a3323d..905798634b2cd 100644
--- a/Makefile
+++ b/Makefile
@@ -274,7 +274,6 @@ CARGO_HANDLES_FRESHNESS:
 	${EMPTY}
 
 # Pinned digests for ghcr.io/cross-rs/<target>:edge.
-# Source: cross-rs/cross @ f86fd03bb70b4c6802847c18087e21391498b0b4, built 2026-04-10 (Ubuntu 20.04 focal).
 # Refresh with: crane digest ghcr.io/cross-rs/<target>:edge
 CROSS_DIGEST_x86_64-unknown-linux-gnu       := sha256:13f7a68e55cb05a19e840bce65834fc785dc069e0c2218d12b8fdb8f8a1519d5
 CROSS_DIGEST_aarch64-unknown-linux-gnu      := sha256:3bf094d22fc4f73c9bdce45ddd7a8bbae349efdbd51b4d4b5ee1bedd8454466b
@@ -290,13 +289,17 @@ CROSS_DIGEST_arm-unknown-linux-musleabi     := sha256:0ca8f4afcc29fb5964aa63e482
 .PHONY: cross-image-%
 cross-image-%: export TRIPLE =$($(strip @):cross-image-%=%)
 cross-image-%:
-	$(if $(CROSS_DIGEST_$*),,$(error No CROSS_DIGEST pinned for $*. Add it to the digest table in Makefile.))
-	$(CONTAINER_TOOL) build \
-		--build-arg TARGET=${TRIPLE} \
-		--build-arg CROSS_DIGEST=$(CROSS_DIGEST_$*) \
-		--file scripts/cross/Dockerfile \
-		--tag vector-cross-env:${TRIPLE} \
-		.
+	@if [ -n "$(CROSS_DIGEST_$*)" ]; then \
+		$(CONTAINER_TOOL) build \
+			--build-arg TARGET=$* \
+			--build-arg CROSS_DIGEST=$(CROSS_DIGEST_$*) \
+			--file scripts/cross/Dockerfile \
+			--tag vector-cross-env:$* \
+			. ; \
+	else \
+		echo "No image digest pinned for $*. Add it to the digest table in Makefile." >&2 ; \
+		exit 1 ; \
+	fi
 
 # This is basically a shorthand for folks.
 # `cross-anything-triple` will call `cross anything --target triple` with the right features.
@@ -318,6 +321,14 @@ target/%/vector: export PAIR =$(subst /, ,$(@:target/%/vector=%))
 target/%/vector: export TRIPLE ?=$(word 1,${PAIR})
 target/%/vector: export PROFILE ?=$(word 2,${PAIR})
 target/%/vector: export CFLAGS += -g0 -O3
+ifeq ($(NATIVE),true)
+target/%/vector: CARGO_HANDLES_FRESHNESS
+	cargo build \
+		$(if $(findstring release,$(PROFILE)),--release,) \
+		--target ${TRIPLE} \
+		--no-default-features \
+		--features target-${TRIPLE}
+else
 target/%/vector: cargo-install-cross CARGO_HANDLES_FRESHNESS
 	$(MAKE) -k cross-image-${TRIPLE}
 	cross build \
@@ -325,6 +336,7 @@ target/%/vector: cargo-install-cross CARGO_HANDLES_FRESHNESS
 		--target ${TRIPLE} \
 		--no-default-features \
 		--features target-${TRIPLE}
+endif
 
 target/%/vector.tar.gz: export PAIR =$(subst /, ,$(@:target/%/vector.tar.gz=%))
 target/%/vector.tar.gz: export TRIPLE ?=$(word 1,${PAIR})
diff --git a/changelog.d/25253_el8_glibc_floor.fix.md b/changelog.d/25253_el8_glibc_floor.fix.md
new file mode 100644
index 0000000000000..8c638782e339a
--- /dev/null
+++ b/changelog.d/25253_el8_glibc_floor.fix.md
@@ -0,0 +1,3 @@
+Restored support for installing Vector on RHEL 8, Rocky Linux 8, AlmaLinux 8, and CentOS Stream 8, which had been broken since v0.55.0 due to an inadvertent glibc requirement bump.
+
+authors: pront
diff --git a/scripts/package-rpm.sh b/scripts/package-rpm.sh
index bedb4486731cd..c2d5453daab6e 100755
--- a/scripts/package-rpm.sh
+++ b/scripts/package-rpm.sh
@@ -69,6 +69,9 @@ case "$TARGET" in
   armv7-*-gnueabihf) STRIP_TOOL="arm-linux-gnueabihf-strip" ;;
   *) STRIP_TOOL="strip" ;;
 esac
+# Fall back to the host's strip when building natively on the target arch
+# (e.g., aarch64 native build doesn't have aarch64-linux-gnu-strip).
+command -v "$STRIP_TOOL" >/dev/null 2>&1 || STRIP_TOOL="strip"
 
 # Perform the build.
 rpmbuild \

From 989f2ae0af0aa3da2691cfc78f675601178edadf Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 13 May 2026 17:38:33 -0400
Subject: [PATCH 239/326] fix(ci): pass GITHUB_TOKEN to prepare.sh for
 authenticated binstall requests (#25428)

---
 .github/actions/setup/action.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index ec229f1b666ce..3719771e4e521 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -252,6 +252,8 @@ runs:
 
     - name: Run prepare.sh
       shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
       run: |
         mods=()
         [[ "${{ inputs.rust == 'true' || env.NEEDS_RUST == 'true' }}" == "true" ]] && mods+=("rustup")

From e1772733754c4d069928169675791b2a484375a2 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 14 May 2026 10:28:23 -0400
Subject: [PATCH 240/326] chore(dev): retire the unused Docker dev environment
 (#25429)

* chore(makefile): kill ENVIRONMENT=true Docker dev shell wiring

Strips the `make environment` / `ENVIRONMENT=true` Docker/Podman dev
shell wiring: ENVIRONMENT_* variables, MAYBE_ENVIRONMENT_EXEC /
MAYBE_ENVIRONMENT_COPY_ARTIFACTS macros, ENVIRONMENT_EXEC /
ENVIRONMENT_PREPARE blocks, the `environment`, `environment-prepare`,
`environment-clean`, `environment-push` targets, and the
${MAYBE_ENVIRONMENT_EXEC} prefix on every build/test/bench/check recipe.

Also drops the dead `build-graphql-schema` target: no `graphql-schema`
binary exists in the workspace.

The VDEV macro uses `?=` so a caller-supplied VDEV (e.g. the pinned
prebuilt binary path exported by .github/actions/setup) wins over the
local `cargo vdev` default, avoiding a vdev source recompile per recipe.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): drop Environment Suite workflow

Removes .github/workflows/environment.yml (the weekly cron and
workflow_dispatch that built and pushed timberio/vector-dev:latest to
Docker Hub) and the /ci-run-environment review-trigger wiring in
ci-review-trigger.yml.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(internal docs): drop Docker dev environment section

Removes the "Using a Docker or Podman environment" walkthrough and the
remaining `ENVIRONMENT=true` / `make environment-generate` / `build-dev`
mentions from docs/DEVELOPING.md, matching the Makefile cleanup.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(dev): drop dev environment Dockerfile, entrypoint, and Ubuntu bootstrap

Deletes scripts/environment/Dockerfile and scripts/environment/entrypoint.sh,
which only existed to build the timberio/vector-dev:latest image used by
`make environment` and the Environment Suite workflow (both removed in
this PR).

Also deletes scripts/environment/bootstrap-ubuntu-24.04.sh. Its callers
in .github/workflows/publish.yml and vdev_publish.yml were removed in
d1524c480a (Apr 2026), leaving only the deleted Dockerfile as a caller;
with that gone the script has no live consumers in the tree. The
remaining environment scripts (`prepare.sh`, `binstall.sh`,
`install-protoc.sh`, the macOS/Windows bootstraps) stay; they are still
consumed by CI, cross/e2e/regression/tilt Dockerfiles, and the install
docs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(rfc): archive dev-workflow RFC 2685

The Docker/Podman dev environment this RFC proposed is no longer
maintained; this PR removes the last of its wiring. Marks the RFC as
archived and points readers to CONTRIBUTING.md and docs/DEVELOPING.md
for current instructions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(internal docs): point contributors at prepare.sh for tooling

Adds a tooling-shortcut note in docs/DEVELOPING.md showing
`bash scripts/environment/prepare.sh` as the one-shot way to install
the Rust and npm tooling that the bullet list otherwise enumerates
manually. Same script CI uses, so what contributors get locally
matches what CI installs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(dev): drop orphaned setup-helm.sh

scripts/environment/setup-helm.sh has had no consumers in the tree
since 2022, when nightly.yml / release.yml / CODEOWNERS stopped
referencing it. Only the now-deleted scripts/environment/Dockerfile
kept it alive. Its pins (kubectl v1.18.6, helm v3.2.4, kubeval) are
~5 years old; current Vector k8s e2e drives a separate minikube setup
via scripts/test-e2e-kubernetes.sh.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* enhancement(dev): make prepare.sh safer on workstations

prepare.sh is primarily a CI bootstrap, but docs/DEVELOPING.md now
points contributors at it as the one-shot install. This adds three
CI-gated guards so running the script on a personal laptop is less
surprising. Each guard preserves the existing CI behavior; the
differences only apply when `CI` is unset.

1. `git config --global --add safe.directory "$(pwd)"` is skipped
   outside CI. Contributors own their checkouts and do not hit git's
   dubious-ownership error, so the global config write is avoided.

2. The version-pin check no longer downgrades cargo tools the user has
   already installed at a newer version. CI starts from nothing and
   keeps installing the exact pin; on workstations, a newer-than-pin
   version is kept and the script prints a notice. `CI=1` forces the
   pin if a contributor wants it.

3. The npm tool symlinks into the global npm bin dir are skipped
   outside CI. Avoids `sudo ln -sf` into /usr/local/bin (or equivalent)
   without the user opting in. To keep the make-driven workflow working
   without any contributor PATH edits, the Makefile prepends
   scripts/environment/npm-tools/node_modules/.bin to PATH so vdev's
   bare-name spawns of `markdownlint-cli2` and `prettier` resolve from
   the project-local install.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci-review-trigger.yml       |  10 -
 .github/workflows/environment.yml             |  98 -------
 Makefile                                      | 242 +++++-------------
 docs/DEVELOPING.md                            |  88 +------
 ...-05-25-2685-dev-workflow-simplification.md |   2 +
 scripts/environment/Dockerfile                |  36 ---
 scripts/environment/bootstrap-ubuntu-24.04.sh | 178 -------------
 scripts/environment/entrypoint.sh             |  16 --
 scripts/environment/prepare.sh                |  38 ++-
 scripts/environment/setup-helm.sh             |  17 --
 10 files changed, 102 insertions(+), 623 deletions(-)
 delete mode 100644 .github/workflows/environment.yml
 delete mode 100644 scripts/environment/Dockerfile
 delete mode 100755 scripts/environment/bootstrap-ubuntu-24.04.sh
 delete mode 100755 scripts/environment/entrypoint.sh
 delete mode 100755 scripts/environment/setup-helm.sh

diff --git a/.github/workflows/ci-review-trigger.yml b/.github/workflows/ci-review-trigger.yml
index d7534297d5afb..99e5f648a894d 100644
--- a/.github/workflows/ci-review-trigger.yml
+++ b/.github/workflows/ci-review-trigger.yml
@@ -19,7 +19,6 @@
 # /ci-run-component-features  : runs Component Features - Linux
 # /ci-run-unit-mac            : runs Unit - Mac
 # /ci-run-unit-windows        : runs Unit - Windows
-# /ci-run-environment         : runs Environment Suite
 # /ci-run-k8s                 : runs K8s E2E Suite
 # /ci-run-packaging           : builds and verifies packages (without publishing to Docker/S3/GitHub)
 #
@@ -79,7 +78,6 @@ jobs:
       || startsWith(github.event.review.body, '/ci-run-cross')
       || startsWith(github.event.review.body, '/ci-run-unit-mac')
       || startsWith(github.event.review.body, '/ci-run-unit-windows')
-      || startsWith(github.event.review.body, '/ci-run-environment')
       || startsWith(github.event.review.body, '/ci-run-k8s')
       || startsWith(github.event.review.body, '/ci-run-packaging')
       || startsWith(github.event.review.body, '/ci-run-regression')
@@ -194,14 +192,6 @@ jobs:
       ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
-  environment:
-    needs: validate
-    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-environment')
-    uses: ./.github/workflows/environment.yml
-    with:
-      ref: ${{ github.event.review.commit_id }}
-    secrets: inherit
-
   k8s:
     needs: validate
     if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-k8s')
diff --git a/.github/workflows/environment.yml b/.github/workflows/environment.yml
deleted file mode 100644
index a989886548df6..0000000000000
--- a/.github/workflows/environment.yml
+++ /dev/null
@@ -1,98 +0,0 @@
-name: Environment Suite
-
-on:
-  workflow_call:
-    inputs:
-      ref:
-        description: "Git ref to checkout"
-        required: false
-        type: string
-
-  workflow_dispatch:
-    inputs:
-      push:
-        description: "Push image when manually triggered"
-        type: boolean
-        default: false
-      ref:
-        description: "Git ref to checkout"
-        required: false
-        type: string
-
-  schedule:
-    - cron: "0 6 * * 1" # Every Monday at 06:00 UTC
-
-env:
-  VERBOSE: true
-  CI: true
-  SHOULD_PUBLISH: ${{ (github.event_name != 'workflow_dispatch' && github.ref == 'refs/heads/master') || (github.event_name == 'workflow_dispatch' && github.event.inputs.push == 'true') }}
-
-permissions:
-  contents: read
-
-jobs:
-  publish-new-environment:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    steps:
-      - name: Checkout branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ inputs.ref }}
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-      - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        if: env.SHOULD_PUBLISH == 'true'
-        with:
-          username: ${{ secrets.CI_DOCKER_USERNAME }}
-          password: ${{ secrets.CI_DOCKER_PASSWORD }}
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
-        with:
-          images: timberio/vector-dev
-          flavor: |
-            latest=true
-          tags: type=sha, format=long
-          labels: |
-            org.opencontainers.image.description=Image for Vector's Docker development environment
-            org.opencontainers.image.source=https://github.com/vectordotdev/vector/tree/master/scripts/environment/Dockerfile
-            org.opencontainers.image.title=Vector development environment
-            org.opencontainers.image.url=https://github.com/vectordotdev/vector
-
-      - name: Free disk space
-        shell: bash
-        run: sudo -E bash scripts/ci-free-disk-space.sh
-
-      - name: Build image (no push)
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          file: ./scripts/environment/Dockerfile
-          load: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-      - name: Test built image
-        run: |
-          IMAGE_TAG=$(echo "${{ steps.meta.outputs.tags }}" | head -n1)
-          echo "Running build test inside container: ${IMAGE_TAG}"
-          docker run --rm \
-            -v "${GITHUB_WORKSPACE}:/src" \
-            -w /src \
-            "${IMAGE_TAG}" \
-            cargo run --bin vector -- --version
-
-      - name: Push image
-        if: env.SHOULD_PUBLISH == 'true'
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          file: ./scripts/environment/Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
diff --git a/Makefile b/Makefile
index 905798634b2cd..67aac49ffb60a 100644
--- a/Makefile
+++ b/Makefile
@@ -4,6 +4,11 @@
 mkfile_path := $(abspath $(lastword $(MAKEFILE_LIST)))
 mkfile_dir := $(dir $(mkfile_path))
 
+# Make project-local npm tools (installed by scripts/environment/prepare.sh on
+# laptops) discoverable to recipes without requiring contributors to edit PATH.
+# CI installs the same tools globally and is unaffected by the prefix.
+export PATH := $(mkfile_dir)scripts/environment/npm-tools/node_modules/.bin:$(PATH)
+
 # Begin OS detection
 ifeq ($(OS),Windows_NT) # is Windows_NT on XP, 2000, 7, Vista, 10...
     export OPERATING_SYSTEM := Windows
@@ -54,33 +59,9 @@ endif
 # If we're using podman create pods else if we're using docker create networks.
 export CURRENT_DIR = $(shell pwd)
 
-# Override this to automatically enter a container containing the correct, full, official build environment for Vector, ready for development
-export ENVIRONMENT ?= false
-# The upstream container we publish artifacts to on a successful master build.
-export ENVIRONMENT_UPSTREAM ?= docker.io/timberio/vector-dev:latest
-# Override to disable building the container, having it pull from the GitHub packages repo instead
-# TODO: Disable this by default. Blocked by `docker pull` from GitHub Packages requiring authenticated login
-export ENVIRONMENT_AUTOBUILD ?= true
-# Override to disable force pulling the image, leaving the container tool to pull it only when necessary instead
-export ENVIRONMENT_AUTOPULL ?= true
-# Override this when appropriate to disable a TTY being available in commands with `ENVIRONMENT=true`
-export ENVIRONMENT_TTY ?= true
-# Override to specify which network the environment will be connected to (leave empty to use the container tool default)
-export ENVIRONMENT_NETWORK ?= host
-# Override to specify environment port(s) to publish to the host (leave empty to not configure any port publishing)
-# Multiple port publishing can be provided using spaces, for example: 8686:8686 8080:8080/udp
-export ENVIRONMENT_PUBLISH ?=
-
-# If ENVIRONMENT is true, always use cargo vdev since it may be running inside the container
-ifeq ($(origin VDEV), environment)
-ifeq ($(ENVIRONMENT), true)
-VDEV := cargo vdev
-else
-# VDEV is already set from environment, keep it
-endif
-else
-VDEV := cargo vdev
-endif
+# Preserve any caller-supplied VDEV (e.g. CI exports the pinned prebuilt binary
+# via .github/actions/setup; falling back to `cargo vdev` recompiles vdev).
+VDEV ?= cargo vdev
 
 # Set dummy AWS credentials if not present - used for AWS and ES integration tests
 export AWS_ACCESS_KEY_ID ?= "dummy"
@@ -109,117 +90,23 @@ help:
 	@printf -- "                                      V E C T O R\n"
 	@printf -- "\n"
 	@printf -- "---------------------------------------------------------------------------------------\n"
-	@printf -- "Want to use ${FORMATTING_BEGIN_YELLOW}\`docker\`${FORMATTING_END} or ${FORMATTING_BEGIN_YELLOW}\`podman\`${FORMATTING_END}? See ${FORMATTING_BEGIN_YELLOW}\`ENVIRONMENT=true\`${FORMATTING_END} commands. (Default ${FORMATTING_BEGIN_YELLOW}\`CONTAINER_TOOL=docker\`${FORMATTING_END})\n"
+	@printf -- "Default ${FORMATTING_BEGIN_YELLOW}\`CONTAINER_TOOL=docker\`${FORMATTING_END} (auto-detects ${FORMATTING_BEGIN_YELLOW}\`docker\`${FORMATTING_END} or ${FORMATTING_BEGIN_YELLOW}\`podman\`${FORMATTING_END}).\n"
 	@printf -- "\n"
 	@awk 'BEGIN {FS = ":.*##"; printf "Usage: make ${FORMATTING_BEGIN_BLUE}<target>${FORMATTING_END}\n"} /^[a-zA-Z0-9_-]+:.*?##/ { printf "  ${FORMATTING_BEGIN_BLUE}%-46s${FORMATTING_END} %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
 
 ##@ Environment
 
-# These are some predefined macros, please use them!
-ifeq ($(ENVIRONMENT), true)
-define MAYBE_ENVIRONMENT_EXEC
-${ENVIRONMENT_EXEC}
-endef
-else
-define MAYBE_ENVIRONMENT_EXEC
-
-endef
-endif
-
-ifeq ($(ENVIRONMENT), true)
-define MAYBE_ENVIRONMENT_COPY_ARTIFACTS
-${ENVIRONMENT_COPY_ARTIFACTS}
-endef
-else
-define MAYBE_ENVIRONMENT_COPY_ARTIFACTS
-
-endef
-endif
-
-# docker container id file needs to live in the host machine and is later mounted into the container
-CIDFILE := $(shell mktemp -u /tmp/vector-environment-docker-cid.XXXXXX)
-
-# We use a volume here as non-Linux hosts are extremely slow to share disks, and Linux hosts tend to get permissions clobbered.
-define ENVIRONMENT_EXEC
-	${ENVIRONMENT_PREPARE}
-	@echo "Entering environment..."
-	@mkdir -p target
-	$(CONTAINER_TOOL) run \
-			--name vector-environment \
-			--rm \
-			$(if $(findstring true,$(ENVIRONMENT_TTY)),--tty,) \
-			--init \
-			--interactive \
-			--env INSIDE_ENVIRONMENT=true \
-			$(if $(ENVIRONMENT_NETWORK),--network $(ENVIRONMENT_NETWORK),) \
-			--mount type=bind,source=${CURRENT_DIR},target=/git/vectordotdev/vector \
-			$(if $(findstring docker,$(CONTAINER_TOOL)),--mount type=bind$(COMMA)source=/var/run/docker.sock$(COMMA)target=/var/run/docker.sock,) \
-			$(if $(findstring docker,$(CONTAINER_TOOL)),--cidfile $(CIDFILE),) \
-			$(if $(findstring docker,$(CONTAINER_TOOL)),--mount type=bind$(COMMA)source=$(CIDFILE)$(COMMA)target=/.docker-container-id,) \
-			--mount type=volume,source=vector-target,target=/git/vectordotdev/vector/target \
-			--mount type=volume,source=vector-cargo-cache,target=/root/.cargo \
-			--mount type=volume,source=vector-rustup-cache,target=/root/.rustup \
-			$(foreach publish,$(ENVIRONMENT_PUBLISH),--publish $(publish)) \
-			$(ENVIRONMENT_UPSTREAM); rm -f $(CIDFILE)
-endef
-
-
-ifneq ($(CONTAINER_TOOL), unknown)
-ifeq ($(ENVIRONMENT_AUTOBUILD), true)
-define ENVIRONMENT_PREPARE
-	@echo "Building the environment. (ENVIRONMENT_AUTOBUILD=true) This may take a few minutes..."
-	$(CONTAINER_TOOL) build \
-		$(if $(findstring true,$(VERBOSE)),,--quiet) \
-		--tag $(ENVIRONMENT_UPSTREAM) \
-		--file scripts/environment/Dockerfile \
-		.
-endef
-else ifeq ($(ENVIRONMENT_AUTOPULL), true)
-define ENVIRONMENT_PREPARE
-	@echo "Pulling the environment image. (ENVIRONMENT_AUTOPULL=true)"
-	$(CONTAINER_TOOL) pull $(ENVIRONMENT_UPSTREAM)
-endef
-endif
-else
-define ENVIRONMENT_PREPARE
-$(error "Please install a container tool such as Docker or Podman")
-endef
-endif
-
 .PHONY: check-container-tool
 check-container-tool: ## Checks what container tool is installed
 	@echo -n "Checking if $(CONTAINER_TOOL) is available..." && \
 	$(CONTAINER_TOOL) version 1>/dev/null && echo "yes"
 
-.PHONY: environment
-environment: export ENVIRONMENT_TTY = true ## Enter a full Vector dev shell in $CONTAINER_TOOL, binding this folder to the container.
-environment:
-	${ENVIRONMENT_EXEC}
-
-.PHONY: environment-prepare
-environment-prepare: ## Prepare the Vector dev shell using $CONTAINER_TOOL.
-	${ENVIRONMENT_PREPARE}
-
-.PHONY: environment-clean
-environment-clean: ## Clean the Vector dev shell using $CONTAINER_TOOL.
-	@$(CONTAINER_TOOL) volume rm -f vector-target vector-cargo-cache vector-rustup-cache
-	@$(CONTAINER_TOOL) rmi $(ENVIRONMENT_UPSTREAM) || true
-
-.PHONY: environment-push
-environment-push: environment-prepare ## Publish a new version of the container image.
-	$(CONTAINER_TOOL) push $(ENVIRONMENT_UPSTREAM)
-
 ##@ Building
 .PHONY: build
 build: check-build-tools
 build: export CFLAGS += -g0 -O3
-build: ## Build the project in release mode (Supports `ENVIRONMENT=true`)
-	${MAYBE_ENVIRONMENT_EXEC} cargo build --release --no-default-features --features ${FEATURES}
-	${MAYBE_ENVIRONMENT_COPY_ARTIFACTS}
-
-.PHONY: build-dev
-build-dev: ## Build the project in development mode (Supports `ENVIRONMENT=true`)
-	${MAYBE_ENVIRONMENT_EXEC} cargo build --no-default-features --features ${FEATURES}
+build: ## Build the project in release mode
+	cargo build --release --no-default-features --features ${FEATURES}
 
 .PHONY: build-x86_64-unknown-linux-gnu
 build-x86_64-unknown-linux-gnu: target/x86_64-unknown-linux-gnu/release/vector ## Build a release binary for the x86_64-unknown-linux-gnu triple.
@@ -253,17 +140,11 @@ build-arm-unknown-linux-gnueabi: target/arm-unknown-linux-gnueabi/release/vector
 build-arm-unknown-linux-musleabi: target/arm-unknown-linux-musleabi/release/vector ## Build a release binary for the arm-unknown-linux-musleabi triple.
 	@echo "Output to ${<}"
 
-.PHONY: build-graphql-schema
-build-graphql-schema: ## Generate the `schema.json` for Vector's GraphQL API
-	${MAYBE_ENVIRONMENT_EXEC} cargo run --bin graphql-schema --no-default-features --features=default-no-api-client
-
 .PHONY: check-build-tools
 check-build-tools:
-ifneq ($(ENVIRONMENT), true)
 ifeq ($(shell command -v cargo >/dev/null || echo not-found), not-found)
 	$(error "Please install Rust: https://www.rust-lang.org/tools/install")
 endif
-endif
 
 ##@ Cross Compiling
 .PHONY: cross-enable
@@ -366,7 +247,7 @@ target/%/vector.tar.gz: target/%/vector CARGO_HANDLES_FRESHNESS
 		./vector-${TRIPLE}
 	rm -rf target/scratch/
 
-##@ Testing (Supports `ENVIRONMENT=true`)
+##@ Testing
 
 # nextest doesn't support running doc tests yet so this is split out as
 # `test-docs`
@@ -381,11 +262,11 @@ target/%/vector.tar.gz: target/%/vector CARGO_HANDLES_FRESHNESS
 # https://github.com/rust-lang/cargo/issues/6454
 .PHONY: test
 test: ## Run the unit test suite
-	${MAYBE_ENVIRONMENT_EXEC} ${TEST_RUNNER} --workspace --no-fail-fast --no-default-features --features "${FEATURES}" ${SCOPE}
+	${TEST_RUNNER} --workspace --no-fail-fast --no-default-features --features "${FEATURES}" ${SCOPE}
 
 .PHONY: test-docs
 test-docs: ## Run the docs test suite
-	${MAYBE_ENVIRONMENT_EXEC} cargo test --doc --workspace --no-fail-fast --no-default-features --features "${FEATURES}" ${SCOPE}
+	cargo test --doc --workspace --no-fail-fast --no-default-features --features "${FEATURES}" ${SCOPE}
 
 .PHONY: test-all
 test-all: test test-docs test-behavior test-integration test-component-validation ## Runs all tests: unit, docs, behavioral, integration, and component validation.
@@ -400,12 +281,12 @@ test-aarch64-unknown-linux-gnu: cross-test-aarch64-unknown-linux-gnu ## Runs uni
 
 .PHONY: test-behavior-config
 test-behavior-config: ## Runs configuration related behavioral tests
-	${MAYBE_ENVIRONMENT_EXEC} cargo build --no-default-features --features secret-backend-example --bin secret-backend-example
-	${MAYBE_ENVIRONMENT_EXEC} cargo run --no-default-features --features transforms -- test tests/behavior/config/*
+	cargo build --no-default-features --features secret-backend-example --bin secret-backend-example
+	cargo run --no-default-features --features transforms -- test tests/behavior/config/*
 
 .PHONY: test-behavior-%
 test-behavior-%: ## Runs behavioral test for a given category
-	${MAYBE_ENVIRONMENT_EXEC} cargo run --no-default-features --features transforms,vrl-functions-env,vrl-functions-system,vrl-functions-network,vrl-functions-crypto -- test tests/behavior/$*/*
+	cargo run --no-default-features --features transforms,vrl-functions-env,vrl-functions-system,vrl-functions-network,vrl-functions-crypto -- test tests/behavior/$*/*
 
 .PHONY: test-behavior
 test-behavior: ## Runs all behavioral tests
@@ -424,7 +305,7 @@ test-integration: test-integration-datadog-traces test-integration-shutdown
 .PHONY: test-integration-windows-event-log
 test-integration-windows-event-log: ## Runs Windows Event Log integration tests (Windows only)
 ifeq ($(OS),Windows_NT)
-	${MAYBE_ENVIRONMENT_EXEC} cargo test -p vector --no-default-features --features sources-windows_event_log-integration-tests windows_event_log::integration_tests
+	cargo test -p vector --no-default-features --features sources-windows_event_log-integration-tests windows_event_log::integration_tests
 else
 	@echo "Skipping windows-event-log integration tests (Windows only)"
 endif
@@ -439,78 +320,69 @@ ifeq ($(AUTODESPAWN), true)
 endif
 
 .PHONY: test-e2e-kubernetes
-test-e2e-kubernetes: ## Runs Kubernetes E2E tests (Sorry, no `ENVIRONMENT=true` support)
+test-e2e-kubernetes: ## Runs Kubernetes E2E tests
 	RUST_VERSION=${RUST_VERSION} scripts/test-e2e-kubernetes.sh
 
 .PHONY: test-cli
 test-cli: ## Runs cli tests
-	${MAYBE_ENVIRONMENT_EXEC} ${TEST_RUNNER} --no-fail-fast --no-default-features --features cli-tests --test integration --test-threads 4
+	${TEST_RUNNER} --no-fail-fast --no-default-features --features cli-tests --test integration --test-threads 4
 
 .PHONY: test-vector-api
 test-vector-api: ## Runs vector API tests (top and tap)
-	${MAYBE_ENVIRONMENT_EXEC} ${TEST_RUNNER} --no-fail-fast --no-default-features --features vector-api-tests --test vector_api
+	${TEST_RUNNER} --no-fail-fast --no-default-features --features vector-api-tests --test vector_api
 
 .PHONY: test-component-validation
 test-component-validation: ## Runs component validation tests
-	${MAYBE_ENVIRONMENT_EXEC} ${TEST_RUNNER} --no-fail-fast --no-default-features --features component-validation-tests --status-level pass --test-threads 4 --lib components::validation::tests
+	${TEST_RUNNER} --no-fail-fast --no-default-features --features component-validation-tests --status-level pass --test-threads 4 --lib components::validation::tests
 
 .PHONY: coverage-report
 coverage-report: ## Generate lcov report after running tests with COVERAGE=true (outputs lcov.info)
 	cargo llvm-cov report --lcov --output-path lcov.info
 
-##@ Benching (Supports `ENVIRONMENT=true`)
+##@ Benching
 
 .PHONY: bench
 bench: ## Run benchmarks in /benches
-	${MAYBE_ENVIRONMENT_EXEC} cargo bench --no-default-features --features "benches" ${CARGO_BENCH_FLAGS}
-	${MAYBE_ENVIRONMENT_COPY_ARTIFACTS}
+	cargo bench --no-default-features --features "benches" ${CARGO_BENCH_FLAGS}
 
 .PHONY: bench-dnstap
 bench-dnstap: ## Run dnstap benches
-	${MAYBE_ENVIRONMENT_EXEC} cargo bench --no-default-features --features "dnstap-benches" --bench dnstap ${CARGO_BENCH_FLAGS}
-	${MAYBE_ENVIRONMENT_COPY_ARTIFACTS}
+	cargo bench --no-default-features --features "dnstap-benches" --bench dnstap ${CARGO_BENCH_FLAGS}
 
 .PHONY: bench-dnsmsg-parser
 bench-dnsmsg-parser: ## Run dnsmsg-parser benches
-	${MAYBE_ENVIRONMENT_EXEC} CRITERION_HOME="$(CRITERION_HOME)" cargo bench --manifest-path lib/dnsmsg-parser/Cargo.toml ${CARGO_BENCH_FLAGS}
-	${MAYBE_ENVIRONMENT_COPY_ARTIFACTS}
+	CRITERION_HOME="$(CRITERION_HOME)" cargo bench --manifest-path lib/dnsmsg-parser/Cargo.toml ${CARGO_BENCH_FLAGS}
 
 .PHONY: bench-remap-functions
 bench-remap-functions: ## Run remap-functions benches
-	${MAYBE_ENVIRONMENT_EXEC} CRITERION_HOME="$(CRITERION_HOME)" cargo bench --manifest-path lib/vrl/stdlib/Cargo.toml ${CARGO_BENCH_FLAGS}
-	${MAYBE_ENVIRONMENT_COPY_ARTIFACTS}
+	CRITERION_HOME="$(CRITERION_HOME)" cargo bench --manifest-path lib/vrl/stdlib/Cargo.toml ${CARGO_BENCH_FLAGS}
 
 .PHONY: bench-remap
 bench-remap: ## Run remap benches
-	${MAYBE_ENVIRONMENT_EXEC} cargo bench --no-default-features --features "remap-benches" --bench remap ${CARGO_BENCH_FLAGS}
-	${MAYBE_ENVIRONMENT_COPY_ARTIFACTS}
+	cargo bench --no-default-features --features "remap-benches" --bench remap ${CARGO_BENCH_FLAGS}
 
 .PHONY: bench-transform
 bench-transform: ## Run transform benches
-	${MAYBE_ENVIRONMENT_EXEC} cargo bench --no-default-features --features "transform-benches" --bench transform ${CARGO_BENCH_FLAGS}
-	${MAYBE_ENVIRONMENT_COPY_ARTIFACTS}
+	cargo bench --no-default-features --features "transform-benches" --bench transform ${CARGO_BENCH_FLAGS}
 
 .PHONY: bench-languages
 bench-languages:  ### Run language comparison benches
-	${MAYBE_ENVIRONMENT_EXEC} cargo bench --no-default-features --features "language-benches" --bench languages ${CARGO_BENCH_FLAGS}
-	${MAYBE_ENVIRONMENT_COPY_ARTIFACTS}
+	cargo bench --no-default-features --features "language-benches" --bench languages ${CARGO_BENCH_FLAGS}
 
 .PHONY: bench-metrics
 bench-metrics: ## Run metrics benches
-	${MAYBE_ENVIRONMENT_EXEC} cargo bench --no-default-features --features "metrics-benches" ${CARGO_BENCH_FLAGS}
-	${MAYBE_ENVIRONMENT_COPY_ARTIFACTS}
+	cargo bench --no-default-features --features "metrics-benches" ${CARGO_BENCH_FLAGS}
 
 .PHONY: bench-all
 bench-all: ### Run all benches
 bench-all: bench-remap-functions
-	${MAYBE_ENVIRONMENT_EXEC} cargo bench --no-default-features --features "benches remap-benches  metrics-benches language-benches ${DNSTAP_BENCHES}" ${CARGO_BENCH_FLAGS}
-	${MAYBE_ENVIRONMENT_COPY_ARTIFACTS}
+	cargo bench --no-default-features --features "benches remap-benches  metrics-benches language-benches ${DNSTAP_BENCHES}" ${CARGO_BENCH_FLAGS}
 
 ##@ Checking
 
 .PHONY: check
 check: ## Run prerequisite code checks
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check rust
+	$(VDEV) check rust
 
 .PHONY: check-all
 check-all: ## Check everything
@@ -520,38 +392,38 @@ check-all: check-scripts check-deny check-generated-docs check-licenses
 
 .PHONY: check-component-features
 check-component-features: ## Check that all component features are setup properly
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check component-features
+	$(VDEV) check component-features
 
 .PHONY: check-clippy
 check-clippy: ## Check code with Clippy
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check rust
+	$(VDEV) check rust
 
 .PHONY: check-docs
 check-docs: generate-vrl-docs ## Check that all /docs file are valid - vrl docs due to remap.functions.* references
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check docs
+	$(VDEV) check docs
 
 .PHONY: check-fmt
 check-fmt: ## Check that all files are formatted properly
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check fmt
+	$(VDEV) check fmt
 
 .PHONY: check-licenses
 check-licenses: ## Check that the 3rd-party license file is up to date
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check licenses
+	$(VDEV) check licenses
 
 .PHONY: check-markdown
 check-markdown: ## Check that markdown is styled properly
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check markdown
+	$(VDEV) check markdown
 
 .PHONY: fix-markdown
 fix-markdown: ## Auto-fix markdown style issues
-	${MAYBE_ENVIRONMENT_EXEC} markdownlint-cli2 --fix $(shell git ls-files '*.md')
+	markdownlint-cli2 --fix $(shell git ls-files '*.md')
 
 .PHONY: check-prettier
 check-prettier: ## Check that JS/TS/YAML/JSON files are formatted with prettier
 	@for ext in yml yaml js ts tsx json; do \
 		files=$$(git ls-files "*.$$ext"); \
 		if [ -n "$$files" ]; then \
-			${MAYBE_ENVIRONMENT_EXEC} prettier --ignore-path .prettierignore --check $$files || exit 1; \
+		prettier --ignore-path .prettierignore --check $$files || exit 1; \
 		fi; \
 	done
 
@@ -560,38 +432,38 @@ fix-prettier: ## Auto-fix JS/TS/YAML/JSON formatting with prettier
 	@for ext in yml yaml js ts tsx json; do \
 		files=$$(git ls-files "*.$$ext"); \
 		if [ -n "$$files" ]; then \
-			${MAYBE_ENVIRONMENT_EXEC} prettier --ignore-path .prettierignore --write $$files || exit 1; \
+		prettier --ignore-path .prettierignore --write $$files || exit 1; \
 		fi; \
 	done
 
 .PHONY: check-examples
 check-examples: ## Check that the config/examples files are valid
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check examples
+	$(VDEV) check examples
 
 .PHONY: check-scripts
 check-scripts: ## Check that scripts do not have common mistakes
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check scripts
+	$(VDEV) check scripts
 
 .PHONY: check-deny
 check-deny: ## Check advisories licenses and sources for crate dependencies
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check deny
+	$(VDEV) check deny
 
 .PHONY: check-deny-licenses
 check-deny-licenses: ## Check licenses for crate dependencies
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check deny --licenses-only
+	$(VDEV) check deny --licenses-only
 
 .PHONY: check-events
 check-events: ## Check that events satisfy patterns set in https://github.com/vectordotdev/vector/blob/master/rfcs/2020-03-17-2064-event-driven-observability.md
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check events
+	$(VDEV) check events
 
 .PHONY: check-generated-docs
 check-generated-docs: generate-docs ## Checks that the machine-generated component Cue docs are up-to-date.
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check generated-docs
+	$(VDEV) check generated-docs
 
 ##@ Rustdoc
 build-rustdoc: ## Build Vector's Rustdocs
 	# This command is mostly intended for use by the build process in vectordotdev/vector-rustdoc
-	${MAYBE_ENVIRONMENT_EXEC} cargo doc --no-deps --workspace
+	cargo doc --no-deps --workspace
 
 ##@ Packaging (forwarded to Makefile.packaging)
 
@@ -600,7 +472,7 @@ build-rustdoc: ## Build Vector's Rustdocs
 
 .PHONY: package
 package: build ## Build the Vector archive
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) package archive
+	$(VDEV) package archive
 
 package-%:
 	$(MAKE) -f Makefile.packaging $@
@@ -644,7 +516,7 @@ compile-vrl-wasm: ## Compile VRL crates to WASM target
 ##@ Utility
 
 .PHONY: clean
-clean: environment-clean ## Clean everything
+clean: ## Clean everything
 	cargo clean
 
 .PHONY: generate-kubernetes-manifests
@@ -653,9 +525,9 @@ generate-kubernetes-manifests: ## Generate Kubernetes manifests from latest Helm
 
 .PHONY: generate-component-docs
 generate-component-docs: ## Generate per-component Cue docs from the configuration schema.
-	${MAYBE_ENVIRONMENT_EXEC} cargo build $(if $(findstring true,$(CI)),--quiet,)
+	cargo build $(if $(findstring true,$(CI)),--quiet,)
 	target/debug/vector generate-schema > /tmp/vector-config-schema.json 2>/dev/null
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) build component-docs /tmp/vector-config-schema.json \
+	$(VDEV) build component-docs /tmp/vector-config-schema.json \
 		$(if $(findstring true,$(CI)),>/dev/null,)
 	./scripts/cue.sh fmt
 
@@ -668,7 +540,7 @@ endif
 
 .PHONY: generate-vector-vrl-docs
 generate-vector-vrl-docs: ## Generate VRL function documentation from Rust source.
-	${MAYBE_ENVIRONMENT_EXEC} $(VRL_DOC_BUILDER_CMD) --output docs/generated/ \
+	$(VRL_DOC_BUILDER_CMD) --output docs/generated/ \
 		$(if $(findstring true,$(CI)),>/dev/null,)
 
 .PHONY: generate-vrl-docs
@@ -701,12 +573,12 @@ ci-generate-publish-metadata: ## Generates the necessary metadata required for b
 
 .PHONY: clippy-fix
 clippy-fix:
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) check rust --fix
+	$(VDEV) check rust --fix
 
 .PHONY: fmt
 fmt:
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) fmt
+	$(VDEV) fmt
 
 .PHONY: build-licenses
 build-licenses:
-	${MAYBE_ENVIRONMENT_EXEC} $(VDEV) build licenses
+	$(VDEV) build licenses
diff --git a/docs/DEVELOPING.md b/docs/DEVELOPING.md
index 9d3d50f7d6243..b22e78a1d8e11 100644
--- a/docs/DEVELOPING.md
+++ b/docs/DEVELOPING.md
@@ -1,8 +1,6 @@
 # Developing
 
 - [Setup](#setup)
-  - [Using a Docker or Podman environment](#using-a-docker-or-podman-environment)
-  - [Bring your own toolbox](#bring-your-own-toolbox)
 - [The basics](#the-basics)
   - [Directory structure](#directory-structure)
   - [Makefile](#makefile)
@@ -41,82 +39,7 @@
 
 ## Setup
 
-We're super excited to have you interested in working on Vector! Before you start you should pick how you want to develop.
-
-For small or first-time contributions, we recommend the Docker method. Prefer to do it yourself? That's fine too!
-
-### Using a Docker or Podman environment
-
-> **Targets:** You can use this method to produce AARCH64, Arm6/7, as well as x86/64 Linux builds.
-
-Since not everyone has a full working native environment, we took our environment and stuffed it into a Docker (or Podman) container!
-
-This is ideal for users who want it to "Just work" and just want to start contributing. It's also what we use for our CI, so you know if it breaks we can't do anything else until we fix it. 😉
-
-**Before you go further, install Docker or Podman through your official package manager, or from the [Docker](https://docs.docker.com/get-docker/) or [Podman](https://podman.io/) sites.**
-
-```bash
-# Optional: Only if you use `podman`
-export CONTAINER_TOOL="podman"
-```
-
-If your Linux environment runs SELinux in Enforcing mode, you will need to relabel the vector source code checkout with `container_home_t` context. Otherwise, the container environment cannot read/write the code:
-
-```bash
-cd your/checkout/of/vector/
-sudo semanage fcontext -a "${PWD}(/.*)?" -t container_file_t
-sudo restorecon . -R
-```
-
-By default, `make environment` style tasks will do a `docker pull` from GitHub's container repository, you can **optionally** build your own environment while you make your morning coffee ☕:
-
-```bash
-# Optional: Only if you want to go make a coffee
-make environment-prepare
-```
-
-Now that you have your coffee, you can enter the shell!
-
-```bash
-# Enter a shell with optimized mounts for interactive processes.
-# Inside here, you can use Vector like you have full toolchain (See below!)
-make environment
-# Try out a specific container tool. (Docker/Podman)
-make environment CONTAINER_TOOL="podman"
-# Add extra cli opts
-make environment CLI_OPTS="--publish 3000:2000"
-```
-
-Now you can use the jobs detailed in **"Bring your own toolbox"** below.
-
-Want to run from outside of the environment? _Clever. Good thinking._ You can run any of the following:
-
-```bash
-# Validate your code can compile
-make check ENVIRONMENT=true
-# Validate your code actually does compile (in dev mode)
-make build-dev ENVIRONMENT=true
-# Validate your test pass
-make test SCOPE="sources::example" ENVIRONMENT=true
-# Validate tests (that do not require other services) pass
-make test ENVIRONMENT=true
-# Validate your tests pass (starting required services in Docker)
-make test-integration SCOPE="sources::example" ENVIRONMENT=true
-# Validate your tests pass against a live service.
-make test-integration SCOPE="sources::example" AUTOSPAWN=false ENVIRONMENT=true
-# Validate all tests pass (starting required services in Docker)
-make test-integration ENVIRONMENT=true
-# Run your benchmarks
-make bench SCOPE="transforms::example" ENVIRONMENT=true
-# Format your code before pushing!
-make fmt ENVIRONMENT=true
-```
-
-We use explicit environment opt-in as many contributors choose to keep their Rust toolchain local.
-
-### Bring your own toolbox
-
-> **Targets:** This option is required for MSVC/Mac/FreeBSD toolchains. It can be used to build for any environment or OS.
+We're super excited to have you interested in working on Vector!
 
 To build Vector on your own host will require a fairly complete development environment!
 
@@ -142,7 +65,13 @@ Loosely, you'll need the following:
 - **To run `make check-licenses` or `make build-licenses`:** Have `dd-rust-license-tool` [installed](https://github.com/DataDog/rust-license-tool).
 - **To run `make generate-docs`:** Have `cue` [installed](https://cuelang.org/docs/install/).
 
-If you find yourself needing to run something inside the Docker environment described above, that's totally fine, they won't collide or hurt each other. In this case, you'd just run `make environment-generate`.
+**Tooling shortcut:** Once the system-level dependencies above are in place, you can install the Rust and npm tooling (`cargo-nextest`, `cargo-deny`, `dd-rust-license-tool`, `vdev`, `markdownlint-cli2`, `prettier`, and others) in one shot:
+
+```bash
+bash scripts/environment/prepare.sh
+```
+
+This is the same script CI uses to provision its toolchain, so what you get locally matches what CI installs.
 
 We're interested in reducing our dependencies if simple options exist. Got an idea? Try it out, we'd love to hear of your successes and failures!
 
@@ -154,7 +83,6 @@ cargo check
 make check
 # Validate your code actually does compile (in dev mode)
 cargo build
-make build-dev
 # Validate your test pass
 cargo test sources::example
 make test SCOPE="sources::example"
diff --git a/rfcs/2020-05-25-2685-dev-workflow-simplification.md b/rfcs/2020-05-25-2685-dev-workflow-simplification.md
index 99a186c843f0c..ae50463376f76 100644
--- a/rfcs/2020-05-25-2685-dev-workflow-simplification.md
+++ b/rfcs/2020-05-25-2685-dev-workflow-simplification.md
@@ -1,5 +1,7 @@
 # RFC 2685 - 2020-05-28 - Dev Workflow Simplification
 
+> **Archived:** This RFC is kept for historical reference only. The Docker/Podman dev environment it proposed (`make environment`, `ENVIRONMENT=true`, the `timberio/vector-dev` image) is no longer maintained and the supporting Makefile targets, workflow, and image have been removed. For current contributor instructions, see [CONTRIBUTING.md](../CONTRIBUTING.md) and [docs/DEVELOPING.md](../docs/DEVELOPING.md).
+
 Vector's `Makefile` serves a variety of purposes, and this RFC attempts to tame the complexity of common dev tasks, improving contributor and team member experience.
 
 It proposes a practical base `environment` container that merges the functionality of our non-integration test containers into one. It then suggests making common dev `make` tasks to rely on the caller environment having all dependencies, done at the same time it suggests adding `make` tasks to run common `make` tasks inside the environment. Finally, it suggests updating documentation to suggest users can use their native toolchains, `docker`.
diff --git a/scripts/environment/Dockerfile b/scripts/environment/Dockerfile
deleted file mode 100644
index 4502f2f71ddba..0000000000000
--- a/scripts/environment/Dockerfile
+++ /dev/null
@@ -1,36 +0,0 @@
-FROM docker.io/ubuntu:24.04@sha256:d1e2e92c075e5ca139d51a140fff46f84315c0fdce203eab2807c7e495eff4f9
-ENV DEBIAN_FRONTEND=noninteractive \
-    TZ='America/New York' \
-    PATH=/root/.cargo/bin:/root/.local/bin/:$PATH \
-    LANG=en_US.UTF-8 \
-    LANGUAGE=en_US.UTF-8 \
-    LC_ALL=en_US.UTF-8 \
-    CROSS_DOCKER_IN_DOCKER=true
-
-# Container junk
-RUN echo $TZ > /etc/timezone
-
-RUN apt-get update && apt-get install -y git
-
-WORKDIR /git/vectordotdev/vector
-
-# Setup the env
-COPY scripts/environment/*.sh scripts/environment/
-COPY scripts/environment/npm-tools/ scripts/environment/npm-tools/
-RUN ./scripts/environment/bootstrap-ubuntu-24.04.sh
-
-# Setup the toolchain
-COPY rust-toolchain.toml \
-    /git/vectordotdev/vector/
-RUN ./scripts/environment/prepare.sh && ./scripts/environment/setup-helm.sh
-
-# Declare volumes
-VOLUME /vector
-VOLUME /vector/target
-VOLUME /root/.cargo
-VOLUME /root/.rustup
-
-# Prepare for use
-COPY ./scripts/environment/entrypoint.sh /
-ENTRYPOINT [ "/entrypoint.sh" ]
-CMD [ "bash" ]
diff --git a/scripts/environment/bootstrap-ubuntu-24.04.sh b/scripts/environment/bootstrap-ubuntu-24.04.sh
deleted file mode 100755
index 6cc2c010157d6..0000000000000
--- a/scripts/environment/bootstrap-ubuntu-24.04.sh
+++ /dev/null
@@ -1,178 +0,0 @@
-#!/usr/bin/env bash
-# Refer to https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md
-# for all runner information such as OS version and installed software.
-
-set -e -o verbose
-
-if [ -n "$RUSTFLAGS" ]
-then
-  # shellcheck disable=SC2016
-  echo '$RUSTFLAGS MUST NOT be set in CI configs as it overrides settings in `.cargo/config.toml`.'
-  exit 1
-fi
-
-export DEBIAN_FRONTEND=noninteractive
-export ACCEPT_EULA=Y
-
-# Configure apt for speed and efficiency
-cat > /etc/apt/apt.conf.d/90-vector-optimizations <<EOF
-Acquire::Retries "5";
-Acquire::Queue-Mode "host";
-Acquire::Languages "none";
-APT::Install-Recommends "false";
-EOF
-
-apt-get update --yes
-
-# Install all base dependencies in one go
-apt-get install --yes \
-    software-properties-common \
-    apt-utils \
-    apt-transport-https \
-    build-essential \
-    ca-certificates \
-    cmake \
-    cmark-gfm \
-    curl \
-    gawk \
-    gnupg2 \
-    gnupg-agent \
-    gnuplot \
-    jq \
-    libclang-dev \
-    libsasl2-dev \
-    libssl-dev \
-    llvm \
-    locales \
-    pkg-config \
-    rename \
-    rpm \
-    shellcheck \
-    sudo \
-    unzip \
-    wget
-
-# Cue
-TEMP=$(mktemp -d)
-curl \
-    -L https://github.com/cue-lang/cue/releases/download/v0.16.1/cue_v0.16.1_linux_amd64.tar.gz \
-    -o "${TEMP}/cue_v0.16.1_linux_amd64.tar.gz"
-tar \
-    -xvf "${TEMP}/cue_v0.16.1_linux_amd64.tar.gz" \
-    -C "${TEMP}"
-cp "${TEMP}/cue" /usr/bin/cue
-rm -rf "$TEMP"
-
-# Locales
-locale-gen en_US.UTF-8
-
-if ! command -v rustup ; then
-  # https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md#rust-tools
-  curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal
-fi
-
-# Rust/Cargo should already be installed on both GH Actions-provided Ubuntu 24.04 images _and_
-# by our own Ubuntu 24.04 images, so this is really just make sure the path is configured.
-if [ -n "${CI-}" ] ; then
-    echo "${HOME}/.cargo/bin" >> "${GITHUB_PATH}"
-    # we often run into OOM issues in CI due to the low memory vs. CPU ratio on c5 instances
-    echo "CARGO_BUILD_JOBS=$(($(nproc) /2))" >> "${GITHUB_ENV}"
-else
-    echo "export PATH=\"$HOME/.cargo/bin:\$PATH\"" >> "${HOME}/.bash_profile"
-fi
-
-# Add repositories for Docker and Node.js first, then do a single update
-NEED_UPDATE=0
-
-if ! [ -x "$(command -v docker)" ]; then
-    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add -
-    add-apt-repository \
-        "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu \
-        xenial \
-        stable"
-    NEED_UPDATE=1
-fi
-
-if ! [ -x "$(command -v node)" ]; then
-    curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | apt-key add -
-    add-apt-repository \
-        "deb [arch=$(dpkg --print-architecture)] https://deb.nodesource.com/node_18.x \
-        nodistro \
-        main"
-    NEED_UPDATE=1
-fi
-
-# Only update if we added new repositories
-if [ $NEED_UPDATE -eq 1 ]; then
-    apt-get update --yes
-fi
-
-# Install Docker if needed
-if ! [ -x "$(command -v docker)" ]; then
-    apt-get install --yes docker-ce docker-ce-cli containerd.io
-    # ubuntu user doesn't exist in scripts/environment/Dockerfile which runs this
-    usermod --append --groups docker ubuntu || true
-fi
-
-bash scripts/environment/install-protoc.sh
-
-# Install Node.js if needed
-if ! [ -x "$(command -v node)" ]; then
-    apt-get install --yes nodejs
-    # enable corepack (enables the yarn and pnpm package managers)
-    # ref: https://nodejs.org/docs/latest-v18.x/api/corepack.html
-    corepack enable
-fi
-
-# Apt cleanup
-apt-get clean
-
-# Set up the default "deny all warnings" build flags
-CARGO_OVERRIDE_DIR="${HOME}/.cargo"
-CARGO_OVERRIDE_CONF="${CARGO_OVERRIDE_DIR}/config.toml"
-cat <<EOF >>"$CARGO_OVERRIDE_CONF"
-[target.'cfg(linux)']
-rustflags = [ "-D", "warnings" ]
-EOF
-
-# Install mold, because the system linker wastes a bunch of time.
-#
-# Notably, we don't install/configure it when we're going to do anything with `cross`, as `cross` takes the Cargo
-# configuration from the host system and ships it over...  which isn't good when we're overriding the `rustc-wrapper`
-# and all of that.
-if [ -z "${DISABLE_MOLD:-""}" ] ; then
-    # We explicitly put `mold-wrapper.so` right beside `mold` itself because it's hard-coded to look in the same directory
-    # first when trying to load the shared object, so we can dodge having to care about the "right" lib folder to put it in.
-    TEMP=$(mktemp -d)
-    MOLD_VERSION=2.40.4
-    MOLD_TARGET=mold-${MOLD_VERSION}-$(uname -m)-linux
-    curl -fsSL "https://github.com/rui314/mold/releases/download/v${MOLD_VERSION}/${MOLD_TARGET}.tar.gz" \
-        --output "$TEMP/${MOLD_TARGET}.tar.gz"
-    tar \
-        -xvf "${TEMP}/${MOLD_TARGET}.tar.gz" \
-        -C "${TEMP}"
-    cp "${TEMP}/${MOLD_TARGET}/bin/mold" /usr/bin/mold
-    cp "${TEMP}/${MOLD_TARGET}/lib/mold/mold-wrapper.so" /usr/bin/mold-wrapper.so
-    rm -rf "$TEMP"
-
-    # Create our rustc wrapper script that we'll use to actually invoke `rustc` such that `mold` will wrap it and intercept
-    # anything linking calls to use `mold` instead of `ld`, etc.
-    CARGO_BIN_DIR="${CARGO_OVERRIDE_DIR}/bin"
-    mkdir -p "$CARGO_BIN_DIR"
-
-    RUSTC_WRAPPER="${CARGO_BIN_DIR}/wrap-rustc"
-    cat <<EOF >"$RUSTC_WRAPPER"
-#!/bin/sh
-exec mold -run "\$@"
-EOF
-    chmod +x "$RUSTC_WRAPPER"
-
-    # Now configure Cargo to use our rustc wrapper script.
-    {
-        echo "[build]"
-        echo "rustc-wrapper = \"${RUSTC_WRAPPER}\""
-    } >> "$CARGO_OVERRIDE_CONF"
-fi
-
-mkdir -p /var/lib/vector
-chmod 777 /var/lib/vector
diff --git a/scripts/environment/entrypoint.sh b/scripts/environment/entrypoint.sh
deleted file mode 100755
index b97484e991fc6..0000000000000
--- a/scripts/environment/entrypoint.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-# set HOSTNAME to container id for `cross`
-if [ -f /.docker-container-id ]; then
-  HOSTNAME="$(cat /.docker-container-id)"
-  export HOSTNAME
-fi
-
-if [ -z "$HOSTNAME" ]; then
-  echo "Failed to properly set HOSTNAME, cross may not work"
-  # Fallback if everything else fails
-  HOSTNAME="vector-environment"
-  export HOSTNAME
-fi
-
-exec "$@"
diff --git a/scripts/environment/prepare.sh b/scripts/environment/prepare.sh
index 6371db0a32c1d..41c9d6de5fbb5 100755
--- a/scripts/environment/prepare.sh
+++ b/scripts/environment/prepare.sh
@@ -147,7 +147,24 @@ maybe_install_cargo_tool() {
   fi
 
   if ! $version_cmd --version 2>/dev/null | grep -q "^${version_pattern}"; then
-    cargo "${installer[@]}" "$tool" --version "$version" --force --locked
+    local should_install=true
+    # Outside CI, preserve a newer-than-pin version the user already has.
+    # `cargo install --force` would otherwise silently downgrade them.
+    if [[ -z "${CI:-}" ]]; then
+      local current
+      current=$($version_cmd --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
+      if [[ -n "$current" ]] && [[ "$current" != "$version" ]]; then
+        local newest
+        newest=$(printf '%s\n%s\n' "$current" "$version" | sort -V | tail -1)
+        if [[ "$newest" == "$current" ]]; then
+          echo "Keeping ${tool} ${current} (newer than pin ${version}). Set CI=1 to force the pin."
+          should_install=false
+        fi
+      fi
+    fi
+    if [[ "$should_install" == "true" ]]; then
+      cargo "${installer[@]}" "$tool" --version "$version" --force --locked
+    fi
   fi
 
   # cargo-llvm-cov requires the llvm-tools-preview rustup component
@@ -199,6 +216,17 @@ maybe_install_npm_tools() {
 
   npm ci --prefix "${npm_tools_dir}"
 
+  # Outside CI, skip the global symlink to avoid a sudo write to /usr/local/bin
+  # (or equivalent). The Makefile prepends this directory to PATH, so `make`
+  # recipes find the tools automatically.
+  if [[ -z "${CI:-}" ]]; then
+    echo "npm tools installed under ${npm_tools_dir}/node_modules/.bin"
+    echo "Make recipes discover them automatically. To invoke directly from a"
+    echo "shell, add the directory to your PATH:"
+    echo "  export PATH=\"${npm_tools_dir}/node_modules/.bin:\$PATH\""
+    return 0
+  fi
+
   # Use sudo only when the target directory is not writable (e.g. /usr/local/bin
   # on Linux CI runners is root-owned, but Homebrew dirs on macOS are user-owned).
   local ln_cmd=(ln -sf)
@@ -210,8 +238,12 @@ maybe_install_npm_tools() {
   done
 }
 
-# Always ensure git safe.directory is set
-git config --global --add safe.directory "$(pwd)"
+# Set git safe.directory in CI where the repo may be checked out by a different
+# uid than the user running git. Skipped on workstations: the contributor owns
+# the checkout and a global config write is unnecessary.
+if [[ -n "${CI:-}" ]]; then
+  git config --global --add safe.directory "$(pwd)"
+fi
 
 REQUIRES_RUSTUP=(dd-rust-license-tool cargo-deb cross cargo-nextest cargo-deny cargo-msrv cargo-hack cargo-llvm-cov wasm-pack vdev)
 REQUIRES_BINSTALL=(cargo-deb cross cargo-nextest cargo-deny cargo-msrv cargo-hack cargo-llvm-cov wasm-pack vdev)
diff --git a/scripts/environment/setup-helm.sh b/scripts/environment/setup-helm.sh
deleted file mode 100755
index a16b731957b3c..0000000000000
--- a/scripts/environment/setup-helm.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-KUBERNETES_VERSION="v1.18.6"
-HELM_VERSION="v3.2.4"
-
-curl -Lo kubectl \
-  "https://storage.googleapis.com/kubernetes-release/release/${KUBERNETES_VERSION}/bin/linux/amd64/kubectl"
-sudo install kubectl /usr/local/bin/ && rm kubectl
-
-curl -L "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz" \
-  | tar -xzv --strip-components=1 --occurrence linux-amd64/helm
-sudo install helm /usr/local/bin/ && rm helm
-
-curl -L "https://github.com/instrumenta/kubeval/releases/latest/download/kubeval-linux-amd64.tar.gz" \
-    | tar -xzv
-sudo install kubeval /usr/local/bin/ && rm kubeval && rm README.md && rm LICENSE

From 45b6d2b8faa9d89005abefd5d6311db9d730cd0a Mon Sep 17 00:00:00 2001
From: ArunPiduguDD <arun.pidugu@datadoghq.com>
Date: Thu, 14 May 2026 12:08:30 -0400
Subject: [PATCH 241/326] enhancement(tag_cardinality_limit transform): Add
 more fine grained controls tag cardinality (#25360)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Implement per tag control in tag cardinality processor

* refactor(tag_cardinality_limit): simplify per-tag config to LimitOverride/Excluded enum

Replace the PerTagInner struct (with ambiguous optional fields) with a
PerTagConfig struct wrapping a PerTagMode tagged enum:

  - mode: limit_override + value_limit: N  — track with explicit cap
  - mode: excluded                          — opt out of tracking entirely

Removes PerTagInner, PerTagModeKind, and the old `excluded: bool` field.
The new shape is unambiguous: every per-tag entry must be one or the other.
YAML format is consistent with per-metric `mode: excluded`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Make tag cardinality limit new public

* Update comments

* remove schema value limit min value enforcement and handle limit equals zero case

* add additional unit test covering zero limit case

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 ...y_limit_per_tag_and_exclude.enhancement.md |   6 +
 .../tag_cardinality_limit/config.rs           | 193 +++++++--
 src/transforms/tag_cardinality_limit/mod.rs   | 171 ++++++--
 src/transforms/tag_cardinality_limit/tests.rs | 403 +++++++++++++++++-
 .../generated/tag_cardinality_limit.cue       |  58 ++-
 .../transforms/tag_cardinality_limit.cue      |  38 +-
 6 files changed, 747 insertions(+), 122 deletions(-)
 create mode 100644 changelog.d/tag_cardinality_limit_per_tag_and_exclude.enhancement.md

diff --git a/changelog.d/tag_cardinality_limit_per_tag_and_exclude.enhancement.md b/changelog.d/tag_cardinality_limit_per_tag_and_exclude.enhancement.md
new file mode 100644
index 0000000000000..9d05f3170b305
--- /dev/null
+++ b/changelog.d/tag_cardinality_limit_per_tag_and_exclude.enhancement.md
@@ -0,0 +1,6 @@
+The `tag_cardinality_limit` transform gained two new configuration capabilities:
+
+- **Per-tag overrides** (`per_tag_limits`): configure cardinality limits per tag key within a metric, or exclude individual tags from tracking.
+- **Metric exclusion**: opt entire metrics out of cardinality tracking via `mode: excluded` in `per_metric_limits`.
+
+authors: ArunPiduguDD
diff --git a/src/transforms/tag_cardinality_limit/config.rs b/src/transforms/tag_cardinality_limit/config.rs
index 9bfb9f86ab8a4..8f53711214910 100644
--- a/src/transforms/tag_cardinality_limit/config.rs
+++ b/src/transforms/tag_cardinality_limit/config.rs
@@ -11,19 +11,7 @@ use crate::{
     transforms::{Transform, tag_cardinality_limit::TagCardinalityLimit},
 };
 
-/// Configuration of internal metrics for the TagCardinalityLimit transform.
-#[configurable_component]
-#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
-#[serde(deny_unknown_fields)]
-pub struct InternalMetricsConfig {
-    /// Whether to include extended tags (metric_name, tag_key) in the `tag_value_limit_exceeded_total` metric.
-    ///
-    /// This helps identify which metrics and tag keys are hitting cardinality limits, but can significantly
-    /// increase metric cardinality. Defaults to `false` because these tags have potentially unbounded cardinality.
-    #[serde(default = "default_include_extended_tags")]
-    #[configurable(metadata(docs::human_name = "Include Extended Tags"))]
-    pub include_extended_tags: bool,
-}
+// Top-level configuration
 
 /// Configuration for the `tag_cardinality_limit` transform.
 #[configurable_component(transform(
@@ -79,7 +67,7 @@ pub enum TrackingScope {
     PerMetric,
 }
 
-/// Configuration for the `tag_cardinality_limit` transform for a specific group of metrics.
+/// Configuration block used at the global level.
 #[configurable_component]
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct Inner {
@@ -99,7 +87,7 @@ pub struct Inner {
     pub internal_metrics: InternalMetricsConfig,
 }
 
-/// Controls the approach taken for tracking tag cardinality.
+/// Controls the approach taken for tracking tag cardinality at the global level.
 #[configurable_component]
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 #[serde(tag = "mode", rename_all = "snake_case", deny_unknown_fields)]
@@ -122,19 +110,131 @@ pub enum Mode {
     Probabilistic(BloomFilterConfig),
 }
 
-/// Bloom filter configuration in probabilistic mode.
+/// Per-metric name tag cardinality limit configuration.
 #[configurable_component]
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub struct BloomFilterConfig {
-    /// The size of the cache for detecting duplicate tags, in bytes.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct PerMetricConfig {
+    /// Namespace of the metric this configuration refers to.
+    #[serde(default)]
+    pub namespace: Option<String>,
+
+    /// Per-tag-key overrides scoped to this metric. Each entry sets a `mode`:
+    /// - `mode: limit_override` + `value_limit: N` — track with a per-tag cap.
+    /// - `mode: excluded` — opt this tag out of tracking entirely.
     ///
-    /// The larger the cache size, the less likely it is to have a false positive, or a case where
-    /// we allow a new value for tag even after we have reached the configured limits.
-    #[serde(default = "default_cache_size")]
-    #[configurable(metadata(docs::human_name = "Cache Size per Key"))]
-    pub cache_size_per_key: usize,
+    ///  All other settings (tracking algorithm, `limit_exceeded_action`, etc.)
+    /// are inherited from the enclosing per-metric configuration.
+    /// Tags not listed here use the per-metric configuration.
+    #[configurable(
+        derived,
+        metadata(docs::additional_props_description = "An individual tag configuration.")
+    )]
+    #[serde(default)]
+    pub per_tag_limits: HashMap<String, PerTagConfig>,
+
+    #[serde(flatten)]
+    pub config: OverrideInner,
 }
 
+/// Configuration block used at per-metric level. Same shape as the global configuration but
+/// with `OverrideMode`, which adds `excluded` for opting that metric out of cardinality
+/// control entirely.
+#[configurable_component]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct OverrideInner {
+    /// How many distinct values to accept for any given key. Ignored when `mode: excluded`.
+    #[serde(default = "default_value_limit")]
+    pub value_limit: usize,
+
+    #[configurable(derived)]
+    #[serde(default = "default_limit_exceeded_action")]
+    pub limit_exceeded_action: LimitExceededAction,
+
+    #[serde(flatten)]
+    pub mode: OverrideMode,
+
+    #[configurable(derived)]
+    #[serde(default)]
+    pub internal_metrics: InternalMetricsConfig,
+}
+
+/// Controls the approach taken for tracking tag cardinality at the per-metric level.
+/// Adds `excluded` to the global `Mode` variants to allow opting a metric out entirely.
+#[configurable_component]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[serde(tag = "mode", rename_all = "snake_case", deny_unknown_fields)]
+#[configurable(metadata(
+    docs::enum_tag_description = "Controls the approach taken for tracking tag cardinality."
+))]
+pub enum OverrideMode {
+    /// Tracks cardinality exactly. See `Mode::Exact` for details.
+    Exact,
+
+    /// Tracks cardinality probabilistically. See `Mode::Probabilistic` for details.
+    Probabilistic(BloomFilterConfig),
+
+    /// Skip cardinality tracking for this metric. All tag values pass through and nothing is
+    /// limited. Other fields in this per-metric configuration are ignored when this is selected.
+    Excluded,
+}
+
+impl OverrideMode {
+    /// Returns the equivalent global `Mode` if this scope is tracked, or `None` if excluded.
+    pub const fn as_mode(&self) -> Option<Mode> {
+        match self {
+            OverrideMode::Exact => Some(Mode::Exact),
+            OverrideMode::Probabilistic(b) => Some(Mode::Probabilistic(*b)),
+            OverrideMode::Excluded => None,
+        }
+    }
+}
+
+/// Per-tag cardinality configuration.
+///
+/// Specify `mode` to control how this tag is handled:
+///
+/// Example:
+/// ```yaml
+/// per_tag_limits:
+///   environment:
+///     mode: limit_override  # track with a per-tag cap
+///     value_limit: 3
+///   trace_id:
+///     mode: excluded        # opt out of tracking entirely
+/// ```
+#[configurable_component]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct PerTagConfig {
+    #[configurable(derived)]
+    #[serde(flatten)]
+    pub mode: PerTagMode,
+}
+
+/// Mode applied to a specific tag key within a per-metric override.
+///
+/// The tracking algorithm (`exact`/`probabilistic`), `cache_size_per_key`,
+/// `limit_exceeded_action`, and `internal_metrics` are always inherited from the
+/// enclosing per-metric configuration.
+#[configurable_component]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[serde(tag = "mode", rename_all = "snake_case", deny_unknown_fields)]
+#[configurable(metadata(docs::enum_tag_description = "Controls how this tag key is handled."))]
+pub enum PerTagMode {
+    /// Track this tag with a per-tag value limit. The enclosing per-metric tracking
+    /// algorithm and all other settings still apply.
+    LimitOverride {
+        /// Maximum number of distinct values to accept for this tag key.
+        value_limit: usize,
+    },
+    /// Opt this tag out of cardinality tracking entirely. All values pass through
+    /// without being recorded or checked against any `value_limit`.
+    Excluded,
+}
+
+// =============================================================================
+// Shared building blocks
+// =============================================================================
+
 /// Possible actions to take when an event arrives that would exceed the cardinality limit for one
 /// or more of its tags.
 #[configurable_component]
@@ -148,26 +248,45 @@ pub enum LimitExceededAction {
     DropEvent,
 }
 
-/// Tag cardinality limit configuration per metric name.
+/// Bloom filter configuration in probabilistic mode.
 #[configurable_component]
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub struct PerMetricConfig {
-    /// Namespace of the metric this configuration refers to.
-    #[serde(default)]
-    pub namespace: Option<String>,
-
-    #[serde(flatten)]
-    pub config: Inner,
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct BloomFilterConfig {
+    /// The size of the cache for detecting duplicate tags, in bytes.
+    ///
+    /// The larger the cache size, the less likely it is to have a false positive, or a case where
+    /// we allow a new value for tag even after we have reached the configured limits.
+    #[serde(default = "default_cache_size")]
+    #[configurable(metadata(docs::human_name = "Cache Size per Key"))]
+    pub cache_size_per_key: usize,
 }
 
-const fn default_limit_exceeded_action() -> LimitExceededAction {
-    LimitExceededAction::DropTag
+/// Configuration of internal metrics for the TagCardinalityLimit transform.
+#[configurable_component]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+#[serde(deny_unknown_fields)]
+pub struct InternalMetricsConfig {
+    /// Whether to include extended tags (metric_name, tag_key) in the `tag_value_limit_exceeded_total` metric.
+    ///
+    /// This helps identify which metrics and tag keys are hitting cardinality limits, but can significantly
+    /// increase metric cardinality. Defaults to `false` because these tags have potentially unbounded cardinality.
+    #[serde(default = "default_include_extended_tags")]
+    #[configurable(metadata(docs::human_name = "Include Extended Tags"))]
+    pub include_extended_tags: bool,
 }
 
+// =============================================================================
+// Defaults
+// =============================================================================
+
 const fn default_value_limit() -> usize {
     500
 }
 
+const fn default_limit_exceeded_action() -> LimitExceededAction {
+    LimitExceededAction::DropTag
+}
+
 const fn default_include_extended_tags() -> bool {
     false
 }
@@ -176,6 +295,10 @@ pub(crate) const fn default_cache_size() -> usize {
     5 * 1024 // 5KB
 }
 
+// =============================================================================
+// Transform plumbing
+// =============================================================================
+
 impl GenerateConfig for Config {
     fn generate_config() -> toml::Value {
         toml::Value::try_from(Self {
diff --git a/src/transforms/tag_cardinality_limit/mod.rs b/src/transforms/tag_cardinality_limit/mod.rs
index 83e4a02aff1d4..f037d70b44673 100644
--- a/src/transforms/tag_cardinality_limit/mod.rs
+++ b/src/transforms/tag_cardinality_limit/mod.rs
@@ -16,8 +16,10 @@ mod tag_value_set;
 mod tests;
 
 pub use config::{
-    BloomFilterConfig, Config, Inner, LimitExceededAction, Mode, PerMetricConfig, TrackingScope,
+    BloomFilterConfig, Config, Inner, LimitExceededAction, Mode, OverrideInner, OverrideMode,
+    PerMetricConfig, PerTagConfig, PerTagMode, TrackingScope,
 };
+
 use tag_value_set::AcceptedTagValueSet;
 
 use crate::event::metric::TagValueSet;
@@ -27,7 +29,8 @@ type MetricId = (Option<String>, String);
 /// Outcome of applying tag cardinality tracking to a tag value.
 #[derive(Debug, Eq, PartialEq)]
 enum AcceptResult {
-    /// The tag value was tracked and is within the configured `value_limit`.
+    /// The tag value was tracked and is within the configured `value_limit`,
+    /// or the tag is excluded and passes through unconditionally.
     Tracked,
     /// The tag value was tracked and exceeded the configured `value_limit`.
     Dropped,
@@ -35,6 +38,14 @@ enum AcceptResult {
     Untracked,
 }
 
+/// Tag tracking settings for a single (metric, tag) pair.
+enum TagSettings {
+    /// The tag is excluded from cardinality control; pass values through unchanged.
+    Excluded,
+    /// The tag is tracked using these settings.
+    Tracked(Inner),
+}
+
 #[derive(Debug)]
 pub struct TagCardinalityLimit {
     config: Config,
@@ -45,7 +56,7 @@ pub struct TagCardinalityLimit {
 }
 
 impl TagCardinalityLimit {
-    fn new(config: Config) -> Self {
+    pub fn new(config: Config) -> Self {
         Self {
             config,
             accepted_tags: HashMap::new(),
@@ -71,26 +82,84 @@ impl TagCardinalityLimit {
         });
     }
 
-    fn get_config_for_metric(&self, metric_key: Option<&MetricId>) -> &Inner {
-        match metric_key {
-            Some(id) => self
-                .config
-                .per_metric_limits
-                .iter()
-                .find(|(name, config)| {
-                    **name == id.1 && (config.namespace.is_none() || config.namespace == id.0)
+    /// Resolve the configuration that applies to a specific (metric, tag) pair.
+    ///
+    /// Per-tag entries support two modes:
+    /// - `mode: limit_override` — uses the per-tag `value_limit`; all other settings
+    ///   (`mode`, `cache_size_per_key`, `limit_exceeded_action`, `internal_metrics`)
+    ///   are inherited from the per-metric config.
+    /// - `mode: excluded` — opts the tag out entirely; all values pass through.
+    ///
+    /// Per-metric exclusion is blanket: `mode: excluded` on a per-metric entry opts out
+    /// every tag on that metric and `per_tag_limits` is ignored.
+    fn get_config_for_metric_tag(
+        &self,
+        metric_key: Option<&MetricId>,
+        tag_key: &str,
+    ) -> TagSettings {
+        // No matching per-metric override → use the global config as-is.
+        let Some((metric_namespace, metric_name)) = metric_key else {
+            return TagSettings::Tracked(self.config.global);
+        };
+        let Some((_, per_metric)) = self.config.per_metric_limits.iter().find(|(name, cfg)| {
+            *name == metric_name && (cfg.namespace.is_none() || cfg.namespace == *metric_namespace)
+        }) else {
+            return TagSettings::Tracked(self.config.global);
+        };
+
+        // Per-metric exclusion is blanket — per-tag overrides do not apply.
+        let Some(metric_mode) = per_metric.config.mode.as_mode() else {
+            return TagSettings::Excluded;
+        };
+        let limit_exceeded_action = per_metric.config.limit_exceeded_action;
+        let metric_value_limit = per_metric.config.value_limit;
+        let internal_metrics = per_metric.config.internal_metrics;
+
+        // Per-tag entry: LimitOverride uses an explicit value_limit; Excluded opts
+        // the tag out. All other settings are always inherited from per-metric.
+        if let Some(per_tag) = per_metric.per_tag_limits.get(tag_key) {
+            match per_tag.mode {
+                PerTagMode::Excluded => return TagSettings::Excluded,
+                PerTagMode::LimitOverride { value_limit } => {
+                    // Tracking algorithm and all other settings are always inherited
+                    // from the per-metric config.
+                    return TagSettings::Tracked(Inner {
+                        value_limit,
+                        limit_exceeded_action,
+                        mode: metric_mode,
+                        internal_metrics,
+                    });
+                }
+            }
+        }
+        TagSettings::Tracked(Inner {
+            value_limit: metric_value_limit,
+            limit_exceeded_action,
+            mode: metric_mode,
+            internal_metrics,
+        })
+    }
+
+    /// Returns the `limit_exceeded_action` that applies to this metric. Decided once per event:
+    /// per-metric override if any, else global.
+    fn metric_action(&self, metric_key: Option<&MetricId>) -> LimitExceededAction {
+        if let Some(id) = metric_key
+            && let Some((_, pmc)) =
+                self.config.per_metric_limits.iter().find(|(name, c)| {
+                    **name == id.1 && (c.namespace.is_none() || c.namespace == id.0)
                 })
-                .map(|(_, c)| &c.config)
-                .unwrap_or(&self.config.global),
-            None => &self.config.global,
+        {
+            return pmc.config.limit_exceeded_action;
         }
+        self.config.global.limit_exceeded_action
     }
 
     /// Attempts to accept a tag value for a (metric, tag-key) pair.
     ///
     /// Returns:
-    /// - `Tracked` if the value is already tracked, or fits under the configured
-    ///   `value_limit` and is now recorded.
+    /// - `Tracked` if the value is already tracked, fits under the configured
+    ///   `value_limit` and is now recorded, or the per-tag entry is `mode: excluded`
+    ///   (pass-through).
     /// - `Dropped` if the value would exceed `value_limit`; the caller should drop
     ///   the tag.
     /// - `Untracked` if a new (metric, tag-key) pair would have to be allocated but
@@ -102,7 +171,10 @@ impl TagCardinalityLimit {
         key: &str,
         value: &TagValueSet,
     ) -> AcceptResult {
-        let config = *self.get_config_for_metric(metric_key);
+        let config = match self.get_config_for_metric_tag(metric_key, key) {
+            TagSettings::Excluded => return AcceptResult::Tracked,
+            TagSettings::Tracked(inner) => inner,
+        };
         let metric_key_owned = metric_key.cloned();
 
         // Determine whether this (metric, tag-key) pair already has a bucket.
@@ -152,28 +224,42 @@ impl TagCardinalityLimit {
         key: &str,
         value: &TagValueSet,
     ) -> bool {
-        self.accepted_tags
+        let resolved = match self.get_config_for_metric_tag(metric_key, key) {
+            TagSettings::Excluded => return false,
+            TagSettings::Tracked(inner) => inner,
+        };
+        match self
+            .accepted_tags
             .get(&metric_key.cloned())
-            .and_then(|metric_accepted_tags| {
-                metric_accepted_tags.get(key).map(|value_set| {
-                    !value_set.contains(value)
-                        && value_set.len() >= self.get_config_for_metric(metric_key).value_limit
-                })
-            })
-            .unwrap_or(false)
+            .and_then(|metric_accepted_tags| metric_accepted_tags.get(key))
+        {
+            // Already accepted — never exceeds.
+            Some(value_set) if value_set.contains(value) => false,
+            // Adding this value would push us at or past the configured cap. Treat a
+            // missing bucket as an empty set so `value_limit: 0` correctly rejects
+            // the first occurrence too.
+            Some(value_set) => value_set.len() >= resolved.value_limit,
+            None => resolved.value_limit == 0,
+        }
     }
 
-    /// Record a key and value corresponding to a tag on an incoming Metric.
+    /// Record an accepted tag value (mutation-only, no limit check). Used by the `DropEvent`
+    /// path's record pass after a mutation-free pre-check has confirmed every tag has room.
+    /// Excluded tags are skipped — no storage allocated.
     ///
     /// Returns `true` if the (metric, tag-key) pair could not be allocated due to
-    /// `max_tracked_keys` (and therefore the value is not recorded), `false` otherwise.
+    /// `max_tracked_keys` (the value is then not recorded). Returns `false` for
+    /// successful records and for excluded tags.
     fn record_tag_value(
         &mut self,
         metric_key: Option<&MetricId>,
         key: &str,
         value: &TagValueSet,
     ) -> bool {
-        let config = *self.get_config_for_metric(metric_key);
+        let config = match self.get_config_for_metric_tag(metric_key, key) {
+            TagSettings::Excluded => return false,
+            TagSettings::Tracked(inner) => inner,
+        };
         let metric_key_owned = metric_key.cloned();
 
         let pair_exists = self
@@ -216,22 +302,21 @@ impl TagCardinalityLimit {
             }
         };
         if let Some(tags_map) = metric.tags_mut() {
-            let include_extended_tags = self
-                .get_config_for_metric(metric_key.as_ref())
-                .internal_metrics
-                .include_extended_tags;
             let mut any_untracked = false;
 
-            match self
-                .get_config_for_metric(metric_key.as_ref())
-                .limit_exceeded_action
-            {
+            match self.metric_action(metric_key.as_ref()) {
                 LimitExceededAction::DropEvent => {
-                    // This needs to check all the tags, to ensure that the ordering of tag names
-                    // doesn't change the behavior of the check.
-
+                    // This needs to check all the tags, to ensure that the ordering of tag
+                    // names doesn't change the behavior of the check.
                     for (key, value) in tags_map.iter_sets() {
+                        let TagSettings::Tracked(resolved) =
+                            self.get_config_for_metric_tag(metric_key.as_ref(), key)
+                        else {
+                            continue; // excluded tags can never trigger DropEvent
+                        };
                         if self.tag_limit_exceeded(metric_key.as_ref(), key, value) {
+                            let include_extended_tags =
+                                resolved.internal_metrics.include_extended_tags;
                             emit!(TagCardinalityLimitRejectingEvent {
                                 metric_name: &metric_name,
                                 tag_key: key,
@@ -252,6 +337,14 @@ impl TagCardinalityLimit {
                         match self.try_accept_tag(metric_key.as_ref(), key, value) {
                             AcceptResult::Tracked => true,
                             AcceptResult::Dropped => {
+                                let include_extended_tags = match self
+                                    .get_config_for_metric_tag(metric_key.as_ref(), key)
+                                {
+                                    TagSettings::Tracked(inner) => {
+                                        inner.internal_metrics.include_extended_tags
+                                    }
+                                    TagSettings::Excluded => false, // unreachable: excluded tags return Tracked
+                                };
                                 emit!(TagCardinalityLimitRejectingTag {
                                     metric_name: &metric_name,
                                     tag_key: key,
diff --git a/src/transforms/tag_cardinality_limit/tests.rs b/src/transforms/tag_cardinality_limit/tests.rs
index 6435be9ed0ca6..6d7ad5aefbf73 100644
--- a/src/transforms/tag_cardinality_limit/tests.rs
+++ b/src/transforms/tag_cardinality_limit/tests.rs
@@ -1,6 +1,6 @@
 use std::{collections::HashMap, sync::Arc};
 
-use config::PerMetricConfig;
+use config::{PerMetricConfig, PerTagConfig};
 use tokio::sync::mpsc;
 use tokio_stream::wrappers::ReceiverStream;
 use vector_lib::{
@@ -415,6 +415,26 @@ fn drop_event_checks_all_tags(make_tags: impl Fn(&str, &str) -> MetricTags) {
     assert_eq!(new_event4, Some(event4));
 }
 
+fn override_inner_hashset(value_limit: usize, action: LimitExceededAction) -> OverrideInner {
+    OverrideInner {
+        value_limit,
+        limit_exceeded_action: action,
+        mode: OverrideMode::Exact,
+        internal_metrics: InternalMetricsConfig::default(),
+    }
+}
+
+fn override_inner_bloom(value_limit: usize, action: LimitExceededAction) -> OverrideInner {
+    OverrideInner {
+        value_limit,
+        limit_exceeded_action: action,
+        mode: OverrideMode::Probabilistic(BloomFilterConfig {
+            cache_size_per_key: default_cache_size(),
+        }),
+        internal_metrics: InternalMetricsConfig::default(),
+    }
+}
+
 #[tokio::test]
 async fn tag_cardinality_limit_separate_value_limit_per_metric_name_hashset() {
     separate_value_limit_per_metric_name(make_transform_hashset_with_per_metric_limits(
@@ -425,14 +445,16 @@ async fn tag_cardinality_limit_separate_value_limit_per_metric_name_hashset() {
                 "metricA".to_string(),
                 PerMetricConfig {
                     namespace: None,
-                    config: make_transform_hashset(1, LimitExceededAction::DropTag).global,
+                    per_tag_limits: HashMap::new(),
+                    config: override_inner_hashset(1, LimitExceededAction::DropTag),
                 },
             ),
             (
                 "metricB".to_string(),
                 PerMetricConfig {
                     namespace: None,
-                    config: make_transform_hashset(5, LimitExceededAction::DropTag).global,
+                    per_tag_limits: HashMap::new(),
+                    config: override_inner_hashset(5, LimitExceededAction::DropTag),
                 },
             ),
         ]),
@@ -450,14 +472,16 @@ async fn tag_cardinality_limit_separate_value_limit_per_metric_name_bloom() {
                 "metricA".to_string(),
                 PerMetricConfig {
                     namespace: None,
-                    config: make_transform_bloom(1, LimitExceededAction::DropTag).global,
+                    per_tag_limits: HashMap::new(),
+                    config: override_inner_bloom(1, LimitExceededAction::DropTag),
                 },
             ),
             (
                 "metricB".to_string(),
                 PerMetricConfig {
                     namespace: None,
-                    config: make_transform_bloom(5, LimitExceededAction::DropTag).global,
+                    per_tag_limits: HashMap::new(),
+                    config: override_inner_bloom(5, LimitExceededAction::DropTag),
                 },
             ),
         ]),
@@ -738,3 +762,372 @@ fn max_tracked_keys_caps_across_per_metric_buckets() {
         .unwrap();
     assert_eq!("v2", e.as_metric().tags().unwrap().get("k").unwrap());
 }
+
+fn make_per_tag(value_limit: usize) -> PerTagConfig {
+    PerTagConfig {
+        mode: PerTagMode::LimitOverride { value_limit },
+    }
+}
+
+fn make_per_metric(
+    value_limit: usize,
+    action: LimitExceededAction,
+    per_tag_limits: HashMap<String, PerTagConfig>,
+) -> PerMetricConfig {
+    PerMetricConfig {
+        namespace: None,
+        per_tag_limits,
+        config: OverrideInner {
+            value_limit,
+            limit_exceeded_action: action,
+            mode: OverrideMode::Exact,
+            internal_metrics: InternalMetricsConfig::default(),
+        },
+    }
+}
+
+fn make_per_metric_excluded(per_tag_limits: HashMap<String, PerTagConfig>) -> PerMetricConfig {
+    PerMetricConfig {
+        namespace: None,
+        per_tag_limits,
+        config: OverrideInner {
+            value_limit: 0,
+            limit_exceeded_action: LimitExceededAction::DropTag,
+            mode: OverrideMode::Excluded,
+            internal_metrics: InternalMetricsConfig::default(),
+        },
+    }
+}
+
+fn make_per_tag_excluded() -> PerTagConfig {
+    PerTagConfig {
+        mode: PerTagMode::Excluded,
+    }
+}
+
+/// A per-tag `value_limit` override caps that tag below the per-metric limit while sibling
+/// tags continue to use the per-metric limit.
+#[test]
+fn per_tag_value_limit() {
+    let config = make_transform_hashset_with_per_metric_limits(
+        500,
+        LimitExceededAction::DropTag,
+        HashMap::from([(
+            "metricA".to_string(),
+            make_per_metric(
+                5,
+                LimitExceededAction::DropTag,
+                HashMap::from([("tag1".to_string(), make_per_tag(2))]),
+            ),
+        )]),
+    );
+    let mut transform = TagCardinalityLimit::new(config);
+
+    // Fill tag1 to its per-tag limit of 2 and tag2 to 2 of its per-metric limit of 5.
+    let e1 = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag1" => "v1", "tag2" => "v1"),
+            "metricA",
+        ))
+        .unwrap();
+    assert!(e1.as_metric().tags().unwrap().contains_key("tag1"));
+    assert!(e1.as_metric().tags().unwrap().contains_key("tag2"));
+
+    let e2 = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag1" => "v2", "tag2" => "v2"),
+            "metricA",
+        ))
+        .unwrap();
+    assert!(e2.as_metric().tags().unwrap().contains_key("tag1"));
+    assert!(e2.as_metric().tags().unwrap().contains_key("tag2"));
+
+    // tag1 is at its per-tag limit; new value should be dropped. tag2 still has room.
+    let e3 = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag1" => "v3", "tag2" => "v3"),
+            "metricA",
+        ))
+        .unwrap();
+    assert!(!e3.as_metric().tags().unwrap().contains_key("tag1"));
+    assert_eq!("v3", e3.as_metric().tags().unwrap().get("tag2").unwrap());
+
+    // Fill tag2 to the per-metric limit of 5.
+    let e4 = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag2" => "v4"),
+            "metricA",
+        ))
+        .unwrap();
+    assert_eq!("v4", e4.as_metric().tags().unwrap().get("tag2").unwrap());
+
+    let e5 = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag2" => "v5"),
+            "metricA",
+        ))
+        .unwrap();
+    assert_eq!("v5", e5.as_metric().tags().unwrap().get("tag2").unwrap());
+
+    // tag2 is now at its per-metric limit; new value should be dropped.
+    let e6 = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag2" => "v6"),
+            "metricA",
+        ))
+        .unwrap();
+    assert!(!e6.as_metric().tags().unwrap().contains_key("tag2"));
+}
+
+/// Tags with no per-tag override fall back to the per-metric configuration; metrics with no
+/// per-metric override fall back to the global configuration.
+#[test]
+fn per_tag_falls_back_to_per_metric() {
+    let config = make_transform_hashset_with_per_metric_limits(
+        2,
+        LimitExceededAction::DropTag,
+        HashMap::from([(
+            "metricA".to_string(),
+            make_per_metric(
+                3,
+                LimitExceededAction::DropTag,
+                HashMap::from([("tag1".to_string(), make_per_tag(1))]),
+            ),
+        )]),
+    );
+    let mut transform = TagCardinalityLimit::new(config);
+
+    // metricA: tag1 capped at 1 (per-tag), tag2 capped at 3 (per-metric).
+    transform.transform_one(make_metric_with_name(
+        metric_tags!("tag1" => "v1", "tag2" => "v1"),
+        "metricA",
+    ));
+    let e2 = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag1" => "v2", "tag2" => "v2"),
+            "metricA",
+        ))
+        .unwrap();
+    // tag1 already at its per-tag limit of 1 → dropped. tag2 accepted (now 2/3).
+    assert!(!e2.as_metric().tags().unwrap().contains_key("tag1"));
+    assert_eq!("v2", e2.as_metric().tags().unwrap().get("tag2").unwrap());
+
+    let e3 = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag2" => "v3"),
+            "metricA",
+        ))
+        .unwrap();
+    assert_eq!("v3", e3.as_metric().tags().unwrap().get("tag2").unwrap());
+
+    // tag2 now at per-metric limit of 3 → dropped.
+    let e4 = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag2" => "v4"),
+            "metricA",
+        ))
+        .unwrap();
+    assert!(!e4.as_metric().tags().unwrap().contains_key("tag2"));
+
+    // metricB has no per-metric entry → uses global limit of 2.
+    transform.transform_one(make_metric_with_name(
+        metric_tags!("tag1" => "v1"),
+        "metricB",
+    ));
+    transform.transform_one(make_metric_with_name(
+        metric_tags!("tag1" => "v2"),
+        "metricB",
+    ));
+    let b3 = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag1" => "v3"),
+            "metricB",
+        ))
+        .unwrap();
+    assert!(!b3.as_metric().tags().unwrap().contains_key("tag1"));
+}
+
+/// An excluded metric passes all tag values through unbounded; storage is never allocated for
+/// it, and other metrics are unaffected.
+#[test]
+fn metric_excluded_passes_through_unbounded() {
+    let config = make_transform_hashset_with_per_metric_limits(
+        1,
+        LimitExceededAction::DropTag,
+        HashMap::from([(
+            "metricA".to_string(),
+            make_per_metric_excluded(HashMap::new()),
+        )]),
+    );
+    let mut transform = TagCardinalityLimit::new(config);
+
+    // Send 100 distinct values for metricA's tag — all should pass through.
+    for i in 0..100 {
+        let v = format!("v{i}");
+        let e = transform
+            .transform_one(make_metric_with_name(
+                metric_tags!("tag1" => v.clone()),
+                "metricA",
+            ))
+            .unwrap();
+        assert_eq!(
+            v.as_str(),
+            e.as_metric().tags().unwrap().get("tag1").unwrap()
+        );
+    }
+    // Excluded metric must not have allocated any storage.
+    assert!(
+        transform
+            .accepted_tags
+            .get(&Some((None, "metricA".to_string())))
+            .is_none()
+    );
+
+    // metricB has no per-metric override → uses global limit of 1.
+    transform.transform_one(make_metric_with_name(
+        metric_tags!("tag1" => "v1"),
+        "metricB",
+    ));
+    let e = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag1" => "v2"),
+            "metricB",
+        ))
+        .unwrap();
+    assert!(!e.as_metric().tags().unwrap().contains_key("tag1"));
+}
+
+/// An excluded tag is unbounded; sibling tags on the same metric remain limited.
+#[test]
+fn tag_excluded_unbounded_sibling_limited() {
+    let config = make_transform_hashset_with_per_metric_limits(
+        500,
+        LimitExceededAction::DropTag,
+        HashMap::from([(
+            "metricA".to_string(),
+            make_per_metric(
+                2,
+                LimitExceededAction::DropTag,
+                HashMap::from([("trace_id".to_string(), make_per_tag_excluded())]),
+            ),
+        )]),
+    );
+    let mut transform = TagCardinalityLimit::new(config);
+
+    // 100 distinct trace_id values pass; host capped at 2.
+    for i in 0..100 {
+        let trace = format!("t{i}");
+        let host = format!("h{}", i % 5);
+        let e = transform
+            .transform_one(make_metric_with_name(
+                metric_tags!("trace_id" => trace.clone(), "host" => host.clone()),
+                "metricA",
+            ))
+            .unwrap();
+        assert_eq!(
+            trace.as_str(),
+            e.as_metric().tags().unwrap().get("trace_id").unwrap(),
+            "trace_id should always be retained (excluded)"
+        );
+        if i >= 2 && (host != "h0" && host != "h1") {
+            assert!(
+                !e.as_metric().tags().unwrap().contains_key("host"),
+                "host {host} beyond limit should be dropped"
+            );
+        }
+    }
+}
+
+/// A per-tag `LimitOverride` entry caps that tag at its explicit `value_limit`,
+/// independent of the per-metric limit.
+#[test]
+fn per_tag_limit_override_caps_at_explicit_value() {
+    let per_tag = PerTagConfig {
+        mode: PerTagMode::LimitOverride { value_limit: 2 },
+    };
+    let config = make_transform_hashset_with_per_metric_limits(
+        500,
+        LimitExceededAction::DropTag,
+        HashMap::from([(
+            "metricA".to_string(),
+            make_per_metric(
+                10,
+                LimitExceededAction::DropTag,
+                HashMap::from([("tag1".to_string(), per_tag)]),
+            ),
+        )]),
+    );
+    let mut transform = TagCardinalityLimit::new(config);
+
+    // First 2 values pass (per-tag limit = 2).
+    for v in ["v0", "v1"] {
+        let e = transform
+            .transform_one(make_metric_with_name(metric_tags!("tag1" => v), "metricA"))
+            .unwrap();
+        assert_eq!(v, e.as_metric().tags().unwrap().get("tag1").unwrap());
+    }
+
+    // 3rd value dropped — proves the per-tag limit (2) applies, not the per-metric (10).
+    let e3 = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag1" => "v2"),
+            "metricA",
+        ))
+        .unwrap();
+    assert!(!e3.as_metric().tags().unwrap().contains_key("tag1"));
+}
+
+#[test]
+fn per_tag_zero_limit_drop_event_drops_first_event() {
+    let config = make_transform_hashset_with_per_metric_limits(
+        500,
+        LimitExceededAction::DropTag,
+        HashMap::from([(
+            "metricA".to_string(),
+            make_per_metric(
+                10,
+                LimitExceededAction::DropEvent,
+                HashMap::from([("tag1".to_string(), make_per_tag(0))]),
+            ),
+        )]),
+    );
+    let mut transform = TagCardinalityLimit::new(config);
+
+    let dropped = transform.transform_one(make_metric_with_name(
+        metric_tags!("tag1" => "v0"),
+        "metricA",
+    ));
+    assert_eq!(dropped, None);
+
+    let passed = transform.transform_one(make_metric_with_name(
+        metric_tags!("tag1" => "v0"),
+        "metricB",
+    ));
+    assert!(passed.is_some());
+}
+
+/// Per-tag YAML syntax: `mode: limit_override` with `value_limit`, and `mode: excluded`.
+#[test]
+fn per_tag_modes_deserialize() {
+    let yaml = r#"
+value_limit: 5
+mode: exact
+per_metric_limits:
+  metric_a:
+    mode: exact
+    per_tag_limits:
+      capped_tag:
+        mode: limit_override
+        value_limit: 10
+      excluded_tag:
+        mode: excluded
+"#;
+    let parsed: Config = serde_yaml::from_str(yaml).expect("yaml should deserialize");
+    let per_metric = parsed.per_metric_limits.get("metric_a").unwrap();
+
+    let capped = per_metric.per_tag_limits.get("capped_tag").unwrap();
+    assert_eq!(capped.mode, PerTagMode::LimitOverride { value_limit: 10 });
+
+    let excluded = per_metric.per_tag_limits.get("excluded_tag").unwrap();
+    assert_eq!(excluded.mode, PerTagMode::Excluded);
+}
diff --git a/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue b/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue
index 88a96837b220a..6f5a7be575b57 100644
--- a/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue
+++ b/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue
@@ -126,20 +126,12 @@ generated: components: transforms: tag_cardinality_limit: configuration: {
 					description: "Controls the approach taken for tracking tag cardinality."
 					required:    true
 					type: string: enum: {
-						exact: """
-																			Tracks cardinality exactly.
-
-																			This mode has higher memory requirements than `probabilistic`, but never falsely outputs
-																			metrics with new tags after the limit has been hit.
-																			"""
-						probabilistic: """
-																			Tracks cardinality probabilistically.
-
-																			This mode has lower memory requirements than `exact`, but may occasionally allow metric
-																			events to pass through the transform even when they contain new tags that exceed the
-																			configured limit. The rate at which this happens can be controlled by changing the value of
-																			`cache_size_per_key`.
+						exact: "Tracks cardinality exactly. See `Mode::Exact` for details."
+						excluded: """
+																			Skip cardinality tracking for this metric. All tag values pass through and nothing is
+																			limited. Other fields in this per-metric configuration are ignored when this is selected.
 																			"""
+						probabilistic: "Tracks cardinality probabilistically. See `Mode::Probabilistic` for details."
 					}
 				}
 				namespace: {
@@ -147,8 +139,46 @@ generated: components: transforms: tag_cardinality_limit: configuration: {
 					required:    false
 					type: string: {}
 				}
+				per_tag_limits: {
+					description: """
+						Per-tag-key overrides scoped to this metric. Each entry sets a `mode`:
+						- `mode: limit_override` + `value_limit: N` — track with a per-tag cap.
+						- `mode: excluded` — opt this tag out of tracking entirely.
+
+						All other settings (tracking algorithm, `limit_exceeded_action`, etc.)
+						are inherited from the enclosing per-metric configuration.
+						Tags not listed here use the per-metric configuration.
+						"""
+					required: false
+					type: object: options: "*": {
+						description: "An individual tag configuration."
+						required:    true
+						type: object: options: {
+							mode: {
+								description: "Controls how this tag key is handled."
+								required:    true
+								type: string: enum: {
+									excluded: """
+																											Opt this tag out of cardinality tracking entirely. All values pass through
+																											without being recorded or checked against any `value_limit`.
+																											"""
+									limit_override: """
+																											Track this tag with a per-tag value limit. The enclosing per-metric tracking
+																											algorithm and all other settings still apply.
+																											"""
+								}
+							}
+							value_limit: {
+								description:   "Maximum number of distinct values to accept for this tag key."
+								relevant_when: "mode = \"limit_override\""
+								required:      true
+								type: uint: {}
+							}
+						}
+					}
+				}
 				value_limit: {
-					description: "How many distinct values to accept for any given key."
+					description: "How many distinct values to accept for any given key. Ignored when `mode: excluded`."
 					required:    false
 					type: uint: default: 500
 				}
diff --git a/website/cue/reference/components/transforms/tag_cardinality_limit.cue b/website/cue/reference/components/transforms/tag_cardinality_limit.cue
index f8ca250786f32..2b291b905409e 100644
--- a/website/cue/reference/components/transforms/tag_cardinality_limit.cue
+++ b/website/cue/reference/components/transforms/tag_cardinality_limit.cue
@@ -22,9 +22,7 @@ components: transforms: tag_cardinality_limit: {
 		stateful:      true
 	}
 
-	features: {
-		filter: {}
-	}
+	features: filter: {}
 
 	support: {
 		requirements: []
@@ -51,11 +49,7 @@ components: transforms: tag_cardinality_limit: {
 		traces: false
 	}
 
-	output: {
-		metrics: "": {
-			description: "The modified input `metric` event."
-		}
-	}
+	output: metrics: "": description: "The modified input `metric` event."
 
 	examples: [
 		{
@@ -74,41 +68,27 @@ components: transforms: tag_cardinality_limit: {
 				{metric: {
 					kind: "incremental"
 					name: "logins"
-					counter: {
-						value: 2.0
-					}
-					tags: {
-						user_id: "user_id_1"
-					}
+					counter: value: 2.0
+					tags: user_id:  "user_id_1"
 				}},
 				{metric: {
 					kind: "incremental"
 					name: "logins"
-					counter: {
-						value: 2.0
-					}
-					tags: {
-						user_id: "user_id_2"
-					}
+					counter: value: 2.0
+					tags: user_id:  "user_id_2"
 				}},
 			]
 			output: [
 				{metric: {
 					kind: "incremental"
 					name: "logins"
-					counter: {
-						value: 2.0
-					}
-					tags: {
-						user_id: "user_id_1"
-					}
+					counter: value: 2.0
+					tags: user_id:  "user_id_1"
 				}},
 				{metric: {
 					kind: "incremental"
 					name: "logins"
-					counter: {
-						value: 2.0
-					}
+					counter: value: 2.0
 					tags: {}
 				}},
 			]

From 11ad4e7df2f16203357c875557230905a94cfe0d Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 14 May 2026 13:33:09 -0400
Subject: [PATCH 242/326] chore(internal docs): clarify
 JEMALLOC_SYS_WITH_LG_PAGE comment (#25435)

chore: clarify JEMALLOC_SYS_WITH_LG_PAGE comment

CentOS 7 is EOL; the setting is still needed for aarch64 hosts whose
kernels ship with 64K pages (notably EL8 aarch64).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .cargo/config.toml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.cargo/config.toml b/.cargo/config.toml
index b74d481a4f475..ef954fd8fe73a 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -2,8 +2,10 @@
 vdev = "run --quiet --package vdev --"
 
 [env]
-# Build with large pages so that Vector runs on systems with 64k pages or less (e.g. 4k) to support
-# CentOS 7, 8, and a few other Linux distributions.
+# Build jemalloc assuming 64K pages so binaries also run on aarch64 hosts whose
+# kernels ship with a 64K page size (notably EL8 aarch64). On 4K-page hosts this
+# coarsens jemalloc's allocation granularity; no regression was measured in
+# https://github.com/vectordotdev/vector/pull/18481.
 JEMALLOC_SYS_WITH_LG_PAGE = "16"
 
 [target.'cfg(all())']

From 45c4010e78a8470177061b8257648499ba1f61fe Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 14 May 2026 15:33:52 -0400
Subject: [PATCH 243/326] feat(external docs): add "View open issues" link to
 component pages (#25437)

* fix(external docs): skip empty input/output badge rows on component pages

The hero section in website/layouts/partials/docs/component-under-hero.html
unconditionally rendered the input and output badge rows, leaving an empty
`<div class="w-full mt-4">` (and a stray ~1rem of vertical whitespace) when
a component had no inputs (sources) or no outputs (sinks). Wrap each row in
an {{ if }} so the markup only renders when there's a badge to show.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(external docs): add "View open issues" link to component pages

Each component page now renders a small `View open issues for this
component on GitHub` link in the hero area, linking to a pre-filtered
GitHub issue search using the component's label
(e.g. `label:"source: syslog"`, `label:"sink: aws_s3"`,
`label:"transform: remap"`). The link uses an inline GitHub mark SVG
and the same `text-primary-dark dark:text-primary` styling used by
body-prose links elsewhere on the docs site.

Closes part of #21735.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(external docs): use ion-icon for GitHub issues link

Drop the inlined GitHub SVG in favour of <ion-icon name="logo-github">,
matching the navbar social button. Ionicons is already loaded
site-wide via partials/javascript/head.html.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../partials/docs/component-under-hero.html        | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/website/layouts/partials/docs/component-under-hero.html b/website/layouts/partials/docs/component-under-hero.html
index bdf86bbe7c075..d145d9c739286 100644
--- a/website/layouts/partials/docs/component-under-hero.html
+++ b/website/layouts/partials/docs/component-under-hero.html
@@ -8,6 +8,9 @@
 {{ $input := $config.input }}
 {{ $output := $config.output }}
 
+{{ $singularType := strings.TrimSuffix "s" $type }}
+{{ $issuesUrl := printf "https://github.com/vectordotdev/vector/issues?q=sort%%3Aupdated-desc+is%%3Aissue+is%%3Aopen+label%%3A%%22%s%%3A+%s%%22" $singularType $tag }}
+
 <div class="block space-y-1">
   {{ if eq $classes.development "beta" }}
   {{ partial "badge.html" (dict "prefix" "status" "word" "beta" "color" "red" "inline" true) }}
@@ -56,6 +59,7 @@
   {{ end }}
 </div>
 
+{{ if or $input.logs $input.metrics $input.traces }}
 <div class="w-full mt-4">
   {{ if $input.logs }}
   {{ partial "badge.html" (dict "prefix" "input" "word" "logs" "color" "blue" "inline" true) }}
@@ -67,7 +71,9 @@
   {{ partial "badge.html" (dict "prefix" "input" "word" "traces" "color" "blue" "inline" true) }}
   {{ end }}
 </div>
+{{ end }}
 
+{{ if $output }}
 <div class="w-full mt-4">
   {{ range $k, $v := $output }}
   {{ if eq $k "logs" }}
@@ -83,6 +89,7 @@
   {{ end }}
   {{ end }}
 </div>
+{{ end }}
 
 
 {{ if .Params.deprecated }}
@@ -90,3 +97,10 @@
   {{ partial "badge.html" (dict "prefix" "status" "word" "deprecated" "color" "red" "inline" true) }}
 </div>
 {{ end }}
+
+<div class="mt-4 text-sm">
+  <a href="{{ $issuesUrl }}" rel="noopener" target="_blank" class="inline-flex items-center space-x-2 text-primary-dark dark:text-primary hover:underline">
+    <ion-icon name="logo-github" aria-hidden="true"></ion-icon>
+    <span>View open issues for this component on GitHub</span>
+  </a>
+</div>

From a1a56fe123829ab224361648165973d6ba9a5292 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 14 May 2026 16:04:48 -0400
Subject: [PATCH 244/326] chore(deps): drop gssapi from default cargo feature
 (#25256)

* chore(deps): drop gssapi from default cargo feature

Drops `rdkafka?/gssapi` from the `default` Cargo feature so dev builds
(`cargo build`, `make build`) compile librdkafka without GSSAPI/Kerberos
SASL support. As a direct consequence, `libsasl2-dev` / `cyrus-sasl` no
longer needs to be installed for local development.

Splits the previous `vendored` umbrella into three composable features:

- `gssapi`: dynamic linkage against system libsasl2. Reuses pre-PR
  `default` semantics on macOS (where Apple ships libsasl2 + GSS).
- `gssapi-vendored`: static-bundled libsasl2 + krb5-src. Linux-only in
  practice; the bundled path does not link on macOS arm64 (unresolved
  gss_* symbols).
- `vendored`: umbrella for static C deps, currently just
  `gssapi-vendored`. Intended to grow as more vendored deps land.

Adds a `target-aarch64-apple-darwin` entry to the target-* feature
table so the apple-darwin publish job picks up `gssapi` via Cargo
rather than overriding `FEATURES` inline. Released macOS binaries
retain GSSAPI via the same dynamic linkage as pre-PR. Linux x86_64-gnu
archives are byte-equivalent (same vendored static linkage as before).

Updates `docs/DEVELOPING.md` to document the three options and their
prereqs, and adds `gssapi` to the spelling allow-list.

Verified locally on aarch64-apple-darwin:
`cargo check --release --no-default-features --features default,gssapi`.

Follow-up: flip `default` to `rdkafka?/dynamic_linking` so dev builds
link to a system librdkafka and skip the multi-minute source compile.
An earlier attempt on this branch was reverted because Ubuntu 24.04's
apt librdkafka-dev ships 2.3.0 but rdkafka-sys 4.10.0+2.12.1 requires
2.12.1+; the follow-up will install/cache a compatible librdkafka in
the setup action.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(deps): allowlist `krb` for spell check

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/actions/spelling/allow.txt |  2 ++
 .github/workflows/publish.yml      |  1 +
 Cargo.toml                         | 31 +++++++++++++++++++++++++++---
 docs/DEVELOPING.md                 | 16 ++++-----------
 4 files changed, 35 insertions(+), 15 deletions(-)

diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index b38f18f38d1eb..79f0d10a9a33b 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -209,6 +209,7 @@ greptime
 greptimecloud
 greptimedb
 GSM
+gssapi
 gvisor
 gws
 gzip'd
@@ -286,6 +287,7 @@ keybinds
 Kingcom
 Kolkata
 konqueror
+krb
 Kruno
 Ktouch
 KTtech
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2899cea0c6e04..ac21f85356f73 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -215,6 +215,7 @@ jobs:
         env:
           TARGET: "${{ matrix.architecture }}-apple-darwin"
           NATIVE_BUILD: true
+          FEATURES: "target-aarch64-apple-darwin"
         run: |
           export PATH="$HOME/.cargo/bin:$PATH"
           make package
diff --git a/Cargo.toml b/Cargo.toml
index e94fa97574624..82377242a739a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -516,14 +516,35 @@ zstd = { version = "0.13.0", default-features = false }
 ntapi = { git = "https://github.com/MSxDOS/ntapi.git", rev = "24fc1e47677fc9f6e38e5f154e6011dc9b270da6" }
 
 [features]
-# Default features for *-unknown-linux-gnu and *-apple-darwin
-default = ["enable-unix", "rdkafka?/gssapi"]
+# Default features for *-unknown-linux-gnu and *-apple-darwin.
+#
+# Note on kafka: the `gssapi` feature is intentionally NOT enabled here. Linux GA releases
+# pick it up through the `vendored` feature on the x86_64-unknown-linux-gnu target, and
+# macOS releases pick it up through the `target-aarch64-apple-darwin` feature (see target
+# table below). Local dev builds skip it so they don't need `libsasl2-dev` / cyrus-sasl
+# installed, and so rdkafka's build script doesn't link GSSAPI.
+default = ["enable-unix"]
 # Default features for `cargo docs`. We're not using `gssapi` which would require installing libsasl2 in our doc environment.
 docs = ["enable-unix"]
 # Default features for *-unknown-linux-* which make use of `cmake` for dependencies
 default-cmake = ["enable-unix", "vendored", "rdkafka?/cmake_build"]
 
-vendored = ["rdkafka?/gssapi-vendored"]
+# Enables Kerberos / GSSAPI SASL support for kafka via dynamic linkage to a
+# system-provided libsasl2 (and the host's GSS implementation). Requires
+# `libsasl2-dev` / cyrus-sasl at compile time and a libsasl2 dylib at runtime.
+# This mirrors pre-PR `default` behavior on macOS, where the runner ships
+# libsasl2 + Apple's GSS framework.
+gssapi = ["rdkafka?/gssapi"]
+
+# Static-bundled variant of `gssapi`: builds libsasl2 (via `sasl2-sys`) and
+# `krb5-src` from source. Self-contained at runtime; produces larger binaries.
+# Note: the bundled libsasl2 + krb5 path does not currently link on
+# macOS arm64 (unresolved gss_* symbols), so this is Linux-only in practice.
+gssapi-vendored = ["gssapi", "rdkafka?/gssapi-vendored"]
+
+# Umbrella feature that opts into all bundled/static C dependencies. Currently
+# just `gssapi-vendored`; intended to grow as more vendored deps are introduced.
+vendored = ["gssapi-vendored"]
 
 # Default features for *-pc-windows-msvc
 # TODO: Enable SASL https://github.com/vectordotdev/vector/pull/3081#issuecomment-659298042
@@ -562,6 +583,10 @@ target-arm-unknown-linux-gnueabi =      ["target-unix"]
 target-arm-unknown-linux-musleabi =     ["target-base"]
 target-x86_64-unknown-linux-gnu =       ["target-unix", "vendored"]
 target-x86_64-unknown-linux-musl =      ["target-unix"]
+# Apple targets opt into `gssapi` (dynamic linkage to system libsasl2 + Apple's
+# GSS framework). The `gssapi-vendored` path does not currently link on
+# macOS arm64 (unresolved gss_* symbols).
+target-aarch64-apple-darwin =           ["enable-unix", "gssapi"]
 
 # Enables features that work only on systems providing `cfg(unix)`
 unix = ["tikv-jemallocator", "allocation-tracing"]
diff --git a/docs/DEVELOPING.md b/docs/DEVELOPING.md
index b22e78a1d8e11..70aca379ec774 100644
--- a/docs/DEVELOPING.md
+++ b/docs/DEVELOPING.md
@@ -46,18 +46,10 @@ To build Vector on your own host will require a fairly complete development envi
 Loosely, you'll need the following:
 
 - **To build Vector:** Have working Rustup, Protobuf tools, C++/C build tools (LLVM, GCC, or MSVC), Python, and Perl, `make` (the GNU one preferably), `bash`, `cmake`, `GNU coreutils`, and `autotools`.
-  - You may also need to install `libsasl2` if you are compiling with default features or with any `kafka`-related features.
-    - Installing libsasl2 on Ubuntu
-      - Run `sudo apt-get install -y libsasl2-dev`
-    - Installing libsasl2 on MacOS
-      - Run `brew install cyrus-sasl`
-      - You will need to set the following environment variables:
-
-        ```bash
-        export LDFLAGS="-L$(brew --prefix cyrus-sasl)/lib $LDFLAGS"
-        export CPPFLAGS="-I$(brew --prefix cyrus-sasl)/include $CPPFLAGS"
-        export PKG_CONFIG_PATH="$(brew --prefix cyrus-sasl)/lib/pkgconfig:$PKG_CONFIG_PATH"
-        ```
+  - The `default` feature does not enable Kerberos/GSSAPI SASL for kafka, so local dev builds (`cargo build`, `make build`) have no extra system prerequisites beyond the C build tools above.
+  - To enable GSSAPI for kafka, choose one of:
+    - `gssapi`: dynamically links against system `libsasl2`. Requires `libsasl2-dev` (Ubuntu: `sudo apt-get install -y libsasl2-dev`) or `cyrus-sasl` (macOS: `brew install cyrus-sasl`) installed.
+    - `gssapi-vendored` (or `vendored`, which includes it): builds `libsasl2` and `krb5` from bundled source. No system install needed. Linux only; the bundled path does not currently link on macOS arm64.
 
 - **To run `make test`:** Install [`cargo-nextest`](https://nexte.st/)
 - **To run integration tests:** Have `docker` available, or a real live version of that service. (Use `AUTOSPAWN=false`)

From ec27f907e50dacdc7d1124720f1b29dfe967aac7 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 14 May 2026 16:20:46 -0400
Subject: [PATCH 245/326] chore(ci): unify Dockerfile apt deps into one script
 (#25436)

chore(ci): unify Dockerfile apt deps into install-debian-build-deps.sh

Extract the apt list shared by regression/Dockerfile and tests/e2e/Dockerfile
into scripts/environment/install-debian-build-deps.sh. Resolves the unify TODO
left in regression/Dockerfile.

Side effects:
- Adds mold back to the regression builder (dropped inadvertently in #25411
  when the regression image was switched off the timberio/vector-dev base).
  Regression is a release build, so the link step benefits the most.
- Removes a redundant zlib1g from the e2e list (already pulled in by
  zlib1g-dev).
- Adds perl and pkg-config to the e2e list (they were missing).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 regression/Dockerfile                         | 21 +++---------------
 .../environment/install-debian-build-deps.sh  | 22 +++++++++++++++++++
 tests/e2e/Dockerfile                          | 17 ++------------
 3 files changed, 27 insertions(+), 33 deletions(-)
 create mode 100755 scripts/environment/install-debian-build-deps.sh

diff --git a/regression/Dockerfile b/regression/Dockerfile
index 0220f266f6703..01be4e593b546 100644
--- a/regression/Dockerfile
+++ b/regression/Dockerfile
@@ -4,27 +4,12 @@
 ARG RUST_VERSION=1
 FROM docker.io/rust:${RUST_VERSION}-slim-trixie AS builder
 
-# TODO: unify this apt list with tests/e2e/Dockerfile.
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential \
-    clang \
-    cmake \
-    curl \
-    git \
-    libclang-dev \
-    libsasl2-dev \
-    libssl-dev \
-    libxxhash-dev \
-    perl \
-    pkg-config \
-    unzip \
-    zlib1g-dev \
-  && rm -rf /var/lib/apt/lists/*
-
 # Copy the whole scripts/environment/ tree so prepare.sh can source its sibling
 # scripts on older checkouts in regression baseline builds.
 COPY scripts/environment/ /scripts/environment/
 
+RUN bash /scripts/environment/install-debian-build-deps.sh
+
 WORKDIR /vector
 COPY rust-toolchain.toml .
 
@@ -35,7 +20,7 @@ COPY . .
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git \
     --mount=type=cache,target=/vector/target \
-    cargo build --bin vector --release && \
+    /usr/bin/mold -run cargo build --bin vector --release && \
     cp target/release/vector .
 
 #
diff --git a/scripts/environment/install-debian-build-deps.sh b/scripts/environment/install-debian-build-deps.sh
new file mode 100755
index 0000000000000..4de7028a4fbb5
--- /dev/null
+++ b/scripts/environment/install-debian-build-deps.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Canonical apt-get build dependencies for Vector's Debian-based builder images.
+
+apt-get update
+apt-get install -y --no-install-recommends \
+  build-essential \
+  clang \
+  cmake \
+  curl \
+  git \
+  libclang-dev \
+  libsasl2-dev \
+  libssl-dev \
+  libxxhash-dev \
+  mold \
+  perl \
+  pkg-config \
+  unzip \
+  zlib1g-dev
+rm -rf /var/lib/apt/lists/*
diff --git a/tests/e2e/Dockerfile b/tests/e2e/Dockerfile
index c7c438d02002b..5851b961c37dd 100644
--- a/tests/e2e/Dockerfile
+++ b/tests/e2e/Dockerfile
@@ -4,21 +4,8 @@ ARG BUILD=false
 
 FROM docker.io/rust:${RUST_VERSION}-slim-trixie
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential \
-    cmake \
-    curl \
-    git \
-    clang \
-    libclang-dev \
-    libsasl2-dev \
-    libssl-dev \
-    libxxhash-dev \
-    zlib1g-dev \
-    zlib1g \
-    unzip \
-    mold \
-  && rm -rf /var/lib/apt/lists/*
+COPY scripts/environment/install-debian-build-deps.sh /
+RUN bash /install-debian-build-deps.sh
 
 COPY tests/data/ca/certs /certs
 

From f06f820a9f66a6518e01f0d7a3d43b5a2826bd9b Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 14 May 2026 16:32:54 -0400
Subject: [PATCH 246/326] fix(releasing): make libz.so.1 a consistent dynamic
 runtime dependency in distroless-libc (#25434)

---
 .github/workflows/publish.yml                  | 2 +-
 Cargo.lock                                     | 4 ++--
 distribution/docker/distroless-libc/Dockerfile | 7 +++++++
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ac21f85356f73..c3f735b4308dd 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -91,7 +91,7 @@ jobs:
         run: |
           dnf install -y --setopt=install_weak_deps=False \
             gcc gcc-c++ make cmake perl perl-IPC-Cmd \
-            openssl-devel cyrus-sasl-devel \
+            openssl-devel cyrus-sasl-devel zlib-devel \
             pkgconfig clang \
             rpm-build sudo \
             git tar gzip xz which findutils \
diff --git a/Cargo.lock b/Cargo.lock
index e0fd75819866b..a32618e6f13ca 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6671,9 +6671,9 @@ dependencies = [
 
 [[package]]
 name = "libz-sys"
-version = "1.1.22"
+version = "1.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b70e7a7df205e92a1a4cd9aaae7898dac0aa555503cc0a649494d0d60e7651d"
+checksum = "fc3a226e576f50782b3305c5ccf458698f92798987f551c6a02efe8276721e22"
 dependencies = [
  "cc",
  "libc",
diff --git a/distribution/docker/distroless-libc/Dockerfile b/distribution/docker/distroless-libc/Dockerfile
index 0ae19e00e17d8..08722b3d76f0a 100644
--- a/distribution/docker/distroless-libc/Dockerfile
+++ b/distribution/docker/distroless-libc/Dockerfile
@@ -7,6 +7,12 @@ RUN dpkg -i vector_*_"$(dpkg --print-architecture)".deb
 
 RUN mkdir -p /var/lib/vector
 
+# Stage libz at its arch-specific path so it can be copied into the distroless
+# runtime. distroless/cc does not include zlib; vector (via rdkafka) links
+# against it dynamically and we deliberately keep it as a runtime dependency.
+RUN src=$(dpkg -L zlib1g | grep -E '/libz\.so\.1$') && \
+    install -D "$(realpath "$src")" "/staging${src}"
+
 # distroless doesn't use static tags
 # hadolint ignore=DL3007
 FROM gcr.io/distroless/cc-debian12:latest@sha256:329e54034ce498f9c6b345044e8f530c6691f99e94a92446f68c0adf9baa8464
@@ -21,6 +27,7 @@ COPY --from=builder /usr/share/doc/vector /usr/share/doc/vector
 COPY --from=builder /usr/share/vector /usr/share/vector
 COPY --from=builder /etc/vector /etc/vector
 COPY --from=builder /var/lib/vector /var/lib/vector
+COPY --from=builder /staging/ /
 
 # Smoke test
 RUN ["vector", "--version"]

From fa2d51fb996b140f7ef725323a95d9b9ca0a8b51 Mon Sep 17 00:00:00 2001
From: Jed Laundry <jlaundry@jlaundry.com>
Date: Sat, 16 May 2026 06:35:13 +1200
Subject: [PATCH 247/326] chore(deps): update Azure crates (March 2026 release)
 (#25169)

* update Azure crates (March 2026 release)

* fix Cargo.lock post-merge

* change reqwest features to remove aws-lc-rs

* Update licenses

---------

Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 Cargo.lock                                  | 202 +++++++++++++-------
 Cargo.toml                                  |  12 +-
 LICENSE-3rdparty.csv                        |   6 +-
 src/sinks/azure_blob/integration_tests.rs   |   4 +-
 src/sinks/azure_common/config.rs            |  17 +-
 src/sinks/azure_common/service.rs           |   5 +-
 tests/integration/azure/config/compose.yaml |   2 +-
 7 files changed, 158 insertions(+), 90 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a32618e6f13ca..33b29000d9af5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1914,9 +1914,9 @@ dependencies = [
 
 [[package]]
 name = "azure_core"
-version = "0.30.1"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f35444aeeb91e29ca82d04dbb8ad904570f837c82093454dc1989c64a33554a7"
+checksum = "bd0160068f7a3021b5e749dc552374e82360463e9fb51e1127631a69fdde641f"
 dependencies = [
  "async-lock 3.4.0",
  "async-trait",
@@ -1935,9 +1935,9 @@ dependencies = [
 
 [[package]]
 name = "azure_core_macros"
-version = "0.4.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94f7cc1bbae04cfe11de9e39e2c6dc755947901e0f4e76180ab542b6deb5e15e"
+checksum = "1bd69a8e70ec6be32ebf7e947cf9a58f6c7255e4cd9c48e640532ef3e37adc6d"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.45",
@@ -1947,9 +1947,9 @@ dependencies = [
 
 [[package]]
 name = "azure_identity"
-version = "0.30.0"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f07bb0ee212021e75c3645e82d078e436b4b4184bde1295e9e81fcbcef923af"
+checksum = "d7c89484f1ce8b81471c897150ec748b02beef8870bd0d43693bc5ef42365b8f"
 dependencies = [
  "async-lock 3.4.0",
  "async-trait",
@@ -1958,6 +1958,7 @@ dependencies = [
  "openssl",
  "pin-project",
  "serde",
+ "serde_json",
  "time",
  "tracing 0.1.44",
  "url",
@@ -1965,17 +1966,19 @@ dependencies = [
 
 [[package]]
 name = "azure_storage_blob"
-version = "0.7.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c38e589153b04af727a736f435d07b48b1a2b17df9353e5d439698fe8b718412"
+checksum = "72693fc24f79adee4b3df7469b29724aa7ea25b908ea0e23f62b93f01f098283"
 dependencies = [
  "async-trait",
  "azure_core",
+ "bytes",
+ "futures",
+ "percent-encoding",
+ "pin-project",
  "serde",
  "serde_json",
- "typespec_client_core",
- "url",
- "uuid",
+ "time",
 ]
 
 [[package]]
@@ -2447,10 +2450,11 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.15"
+version = "1.2.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c736e259eea577f443d5c86c304f9f4ae0295c43f3ba05c21f1d66b5f06001af"
+checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
 dependencies = [
+ "find-msvc-tools",
  "jobserver",
  "libc",
  "shlex",
@@ -4352,6 +4356,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
 [[package]]
 name = "finl_unicode"
 version = "1.2.0"
@@ -5672,11 +5682,9 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "socket2 0.6.0",
- "system-configuration 0.6.1",
  "tokio",
  "tower-service",
  "tracing 0.1.44",
- "windows-registry",
 ]
 
 [[package]]
@@ -9055,6 +9063,15 @@ name = "quick-xml"
 version = "0.38.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.39.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "958f21e8e7ceb5a1aa7fa87fab28e7c75976e0bfe7e23ff069e0a260f894067d"
 dependencies = [
  "memchr",
  "serde",
@@ -9662,7 +9679,6 @@ dependencies = [
  "bytes",
  "cookie",
  "cookie_store",
- "encoding_rs",
  "futures-channel",
  "futures-core",
  "futures-util",
@@ -9676,7 +9692,6 @@ dependencies = [
  "hyper-util",
  "js-sys",
  "log",
- "mime",
  "mime_guess",
  "native-tls",
  "percent-encoding",
@@ -9699,11 +9714,53 @@ dependencies = [
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
- "wasm-streams",
+ "wasm-streams 0.4.0",
  "web-sys",
  "webpki-roots 1.0.4",
 ]
 
+[[package]]
+name = "reqwest"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62e0021ea2c22aed41653bc7e1419abb2c97e038ff2c33d0e1309e49a97deec0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http 1.3.1",
+ "http-body 1.0.1",
+ "http-body-util",
+ "hyper 1.7.0",
+ "hyper-rustls 0.27.5",
+ "hyper-tls 0.6.0",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "native-tls",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls 0.23.37",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "serde_json",
+ "sync_wrapper 1.0.2",
+ "tokio",
+ "tokio-native-tls",
+ "tokio-rustls 0.26.2",
+ "tokio-util",
+ "tower 0.5.3",
+ "tower-http 0.6.8",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams 0.5.0",
+ "web-sys",
+]
+
 [[package]]
 name = "reqwest-middleware"
 version = "0.4.2"
@@ -10091,6 +10148,33 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni 0.22.4",
+ "log",
+ "once_cell",
+ "rustls 0.23.37",
+ "rustls-native-certs 0.8.1",
+ "rustls-platform-verifier-android",
+ "rustls-webpki 0.103.13",
+ "security-framework 3.6.0",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.0",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
 [[package]]
 name = "rustls-webpki"
 version = "0.101.7"
@@ -11434,17 +11518,6 @@ dependencies = [
  "system-configuration-sys 0.5.0",
 ]
 
-[[package]]
-name = "system-configuration"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
-dependencies = [
- "bitflags 2.10.0",
- "core-foundation 0.9.3",
- "system-configuration-sys 0.6.0",
-]
-
 [[package]]
 name = "system-configuration"
 version = "0.7.0"
@@ -11673,7 +11746,6 @@ checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
 dependencies = [
  "deranged",
  "itoa",
- "js-sys",
  "libc",
  "num-conv",
  "num_threads",
@@ -12598,14 +12670,14 @@ checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
 name = "typespec"
-version = "0.10.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44f91ea93fdd5fd4985fcc0a197ed8e8da18705912bef63c9b9b3148d6f35510"
+checksum = "b63559a2aab9c7694fa8d2658a828d6b36f1e3904b1860d820c7cc6a2ead61c7"
 dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures",
- "quick-xml 0.38.4",
+ "quick-xml 0.39.2",
  "serde",
  "serde_json",
  "url",
@@ -12613,22 +12685,20 @@ dependencies = [
 
 [[package]]
 name = "typespec_client_core"
-version = "0.9.1"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a0f6f7345c3389663551a64fc4dca78fa9689ece758c5ca76e82d6da69349dc"
+checksum = "de81ecf3a175da5a10ed60344caa8b53fe6d8ce28c6c978a7e3e09ca1e1b4131"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
  "dyn-clone",
  "futures",
- "getrandom 0.3.4",
  "pin-project",
- "rand 0.9.4",
- "reqwest 0.12.28",
+ "rand 0.10.1",
+ "reqwest 0.13.3",
  "serde",
  "serde_json",
  "time",
- "tokio",
  "tracing 0.1.44",
  "typespec",
  "typespec_macros",
@@ -12638,9 +12708,9 @@ dependencies = [
 
 [[package]]
 name = "typespec_macros"
-version = "0.9.1"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ecee5b05c459ea4cd97df7685db58699c32e070465f88dc806d7c98a5088edc"
+checksum = "07108c5d18e00ec7bb09d2e48df95ebfab6b7179112d1e4216e9968ac2a0a429"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.45",
@@ -13075,7 +13145,7 @@ dependencies = [
  "redis",
  "regex",
  "reqwest 0.11.26",
- "reqwest 0.12.28",
+ "reqwest 0.13.3",
  "rmp-serde",
  "rmpv",
  "roaring",
@@ -13804,14 +13874,12 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.38"
+version = "0.4.70"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9afec9963e3d0994cac82455b2b3502b81a7f40f9a0d32181f7528d9f4b43e02"
+checksum = "af934872acec734c2d80e6617bbb5ff4f12b052dd8e6332b0817bce889516084"
 dependencies = [
- "cfg-if",
  "js-sys",
  "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
@@ -13881,6 +13949,19 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "wasmparser"
 version = "0.244.0"
@@ -13944,6 +14025,15 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "webpki-roots"
 version = "0.26.1"
@@ -14173,17 +14263,6 @@ dependencies = [
  "windows-link 0.1.3",
 ]
 
-[[package]]
-name = "windows-registry"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c44a98275e31bfd112bb06ba96c8ab13c03383a3753fdddd715406a1824c7e0"
-dependencies = [
- "windows-link 0.1.3",
- "windows-result 0.3.4",
- "windows-strings 0.3.1",
-]
-
 [[package]]
 name = "windows-result"
 version = "0.2.0"
@@ -14223,15 +14302,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "windows-strings"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87fa48cc5d406560701792be122a10132491cff9d0aeb23583cc2dcafc847319"
-dependencies = [
- "windows-link 0.1.3",
-]
-
 [[package]]
 name = "windows-strings"
 version = "0.4.2"
diff --git a/Cargo.toml b/Cargo.toml
index 82377242a739a..4e8a7cb26d5eb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -226,7 +226,7 @@ strum = { version = "0.28", features = ["derive"] }
 [dependencies]
 cfg-if.workspace = true
 reqwest.workspace = true
-reqwest_12 = { package = "reqwest", version = "0.12", features = ["json"] }
+reqwest_13 = { package = "reqwest", version = "0.13", default-features = false, features = ["json", "rustls-no-provider"] }
 clap.workspace = true
 clap_complete.workspace = true
 indoc.workspace = true
@@ -306,11 +306,11 @@ aws-smithy-runtime-api = { version = "1.7.3", default-features = false, optional
 aws-smithy-types = { version = "1.2.11", default-features = false, features = ["rt-tokio"], optional = true }
 
 # Azure
-azure_core = { version = "0.30", features = ["reqwest", "hmac_openssl"], optional = true }
-azure_identity = { version = "0.30", features = ["client_certificate"], optional = true }
+azure_core = { version = "0.33", features = ["reqwest", "hmac_openssl"], optional = true }
+azure_identity = { version = "0.33", features = ["client_certificate"], optional = true }
 
 # Azure Storage
-azure_storage_blob = { version = "0.7", optional = true }
+azure_storage_blob = { version = "0.10.1", optional = true }
 
 # OpenDAL
 opendal = { version = "0.54", default-features = false, features = ["services-webhdfs"], optional = true }
@@ -920,8 +920,8 @@ sinks-aws_s3 = ["dep:base64", "dep:md-5", "aws-core", "dep:aws-sdk-s3"]
 sinks-aws_sqs = ["aws-core", "dep:aws-sdk-sqs"]
 sinks-aws_sns = ["aws-core", "dep:aws-sdk-sns"]
 sinks-axiom = ["sinks-http"]
-sinks-azure_blob = ["dep:azure_core", "dep:azure_identity", "dep:azure_storage_blob", "dep:base64"]
-sinks-azure_logs_ingestion = ["dep:azure_core", "dep:azure_identity", "dep:azure_storage_blob", "dep:base64"]
+sinks-azure_blob = ["dep:azure_core", "dep:azure_identity", "dep:azure_storage_blob"]
+sinks-azure_logs_ingestion = ["dep:azure_core", "dep:azure_identity", "dep:azure_storage_blob"]
 sinks-azure_monitor_logs = []
 sinks-blackhole = []
 sinks-chronicle = []
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 7fa52a3e51141..b66b8aaf51d59 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -667,6 +667,8 @@ rustls,https://github.com/rustls/rustls,Apache-2.0 OR ISC OR MIT,The rustls Auth
 rustls-native-certs,https://github.com/rustls/rustls-native-certs,Apache-2.0 OR ISC OR MIT,The rustls-native-certs Authors
 rustls-pemfile,https://github.com/rustls/pemfile,Apache-2.0 OR ISC OR MIT,The rustls-pemfile Authors
 rustls-pki-types,https://github.com/rustls/pki-types,MIT OR Apache-2.0,The rustls-pki-types Authors
+rustls-platform-verifier,https://github.com/rustls/rustls-platform-verifier,MIT OR Apache-2.0,The rustls-platform-verifier Authors
+rustls-platform-verifier-android,https://github.com/rustls/rustls-platform-verifier,MIT OR Apache-2.0,The rustls-platform-verifier-android Authors
 rustls-webpki,https://github.com/rustls/webpki,ISC,The rustls-webpki Authors
 rustversion,https://github.com/dtolnay/rustversion,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 rusty-fork,https://github.com/altsysrq/rusty-fork,MIT OR Apache-2.0,Jason Lingle
@@ -867,7 +869,7 @@ wasip2,https://github.com/bytecodealliance/wasi-rs,Apache-2.0 WITH LLVM-exceptio
 wasip3,https://github.com/bytecodealliance/wasi-rs,Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT,The wasip3 Authors
 wasite,https://github.com/ardaku/wasite,Apache-2.0 OR BSL-1.0 OR MIT,The wasite Authors
 wasm-bindgen,https://github.com/wasm-bindgen/wasm-bindgen,MIT OR Apache-2.0,The wasm-bindgen Developers
-wasm-bindgen-futures,https://github.com/rustwasm/wasm-bindgen/tree/master/crates/futures,MIT OR Apache-2.0,The wasm-bindgen Developers
+wasm-bindgen-futures,https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/futures,MIT OR Apache-2.0,The wasm-bindgen Developers
 wasm-bindgen-macro,https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/macro,MIT OR Apache-2.0,The wasm-bindgen Developers
 wasm-bindgen-macro-support,https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/macro-support,MIT OR Apache-2.0,The wasm-bindgen Developers
 wasm-bindgen-shared,https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/shared,MIT OR Apache-2.0,The wasm-bindgen Developers
@@ -879,6 +881,7 @@ wasmtimer,https://github.com/whizsid/wasmtimer-rs,MIT,"WhizSid <whizsid@aol.com>
 web-sys,https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/web-sys,MIT OR Apache-2.0,The wasm-bindgen Developers
 web-time,https://github.com/daxpedda/web-time,MIT OR Apache-2.0,The web-time Authors
 webbrowser,https://github.com/amodm/webbrowser-rs,MIT OR Apache-2.0,Amod Malviya @amodm
+webpki-root-certs,https://github.com/rustls/webpki-roots,CDLA-Permissive-2.0,The webpki-root-certs Authors
 webpki-roots,https://github.com/rustls/webpki-roots,CDLA-Permissive-2.0,The webpki-roots Authors
 webpki-roots,https://github.com/rustls/webpki-roots,MPL-2.0,The webpki-roots Authors
 whoami,https://github.com/ardaku/whoami,Apache-2.0 OR BSL-1.0 OR MIT,The whoami Authors
@@ -899,7 +902,6 @@ windows-interface,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,The
 windows-link,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
 windows-link,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,The windows-link Authors
 windows-numerics,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,The windows-numerics Authors
-windows-registry,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
 windows-result,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
 windows-service,https://github.com/mullvad/windows-service-rs,MIT OR Apache-2.0,Mullvad VPN
 windows-strings,https://github.com/microsoft/windows-rs,MIT OR Apache-2.0,Microsoft
diff --git a/src/sinks/azure_blob/integration_tests.rs b/src/sinks/azure_blob/integration_tests.rs
index dbe20a884ff86..f7cd38970a847 100644
--- a/src/sinks/azure_blob/integration_tests.rs
+++ b/src/sinks/azure_blob/integration_tests.rs
@@ -335,7 +335,7 @@ impl AzureBlobSinkConfig {
         let mut names = Vec::new();
         while let Some(result) = pager.next().await {
             let item = result.expect("Failed to fetch blobs");
-            if let Some(name) = item.name.and_then(|bn| bn.content)
+            if let Some(name) = item.name
                 && name.starts_with(&prefix)
             {
                 names.push(name);
@@ -403,7 +403,7 @@ impl AzureBlobSinkConfig {
 
     async fn ensure_container(&self) {
         let client = self.build_test_client().await;
-        let result = client.create_container(None).await;
+        let result = client.create(None).await;
 
         let response = match result {
             Ok(_) => Ok(()),
diff --git a/src/sinks/azure_common/config.rs b/src/sinks/azure_common/config.rs
index 800e0a6eb3f23..357c66f1ce5e8 100644
--- a/src/sinks/azure_common/config.rs
+++ b/src/sinks/azure_common/config.rs
@@ -3,6 +3,7 @@ use std::io::Read;
 use std::path::PathBuf;
 use std::sync::Arc;
 
+#[cfg(test)]
 use base64::prelude::*;
 
 use azure_core::error::Error as AzureCoreError;
@@ -278,10 +279,6 @@ impl SpecificAzureCredential {
                     )
                 })?;
 
-                // Note: in azure_identity 0.33.0+, this changes to SecretBytes, and the base64 encoding is no longer needed
-                let certificate_base64: azure_core::credentials::Secret =
-                    BASE64_STANDARD.encode(&certificate_bytes).into();
-
                 let mut options: ClientCertificateCredentialOptions =
                     ClientCertificateCredentialOptions::default();
                 if let Some(password) = certificate_password {
@@ -291,7 +288,7 @@ impl SpecificAzureCredential {
                 ClientCertificateCredential::new(
                     azure_tenant_id.clone(),
                     azure_client_id.clone(),
-                    certificate_base64,
+                    certificate_bytes.into(),
                     Some(options),
                 )?
             }
@@ -596,8 +593,8 @@ pub async fn build_client(
         }
     }
 
-    // Use reqwest v0.12 since Azure SDK only implements HttpClient for reqwest::Client v0.12
-    let mut reqwest_builder = reqwest_12::ClientBuilder::new();
+    // Use reqwest v0.13 since Azure SDK only implements HttpClient for reqwest::Client v0.13
+    let mut reqwest_builder = reqwest_13::ClientBuilder::new();
     let bypass_proxy = {
         let host = url.host_str().unwrap_or("");
         let port = url.port();
@@ -611,13 +608,13 @@ pub async fn build_client(
         reqwest_builder = reqwest_builder.no_proxy();
     } else {
         if let Some(http) = &proxy.http {
-            let p = reqwest_12::Proxy::http(http)
+            let p = reqwest_13::Proxy::http(http)
                 .map_err(|e| format!("Invalid HTTP proxy URL: {e}"))?;
             // If credentials are embedded in the proxy URL, reqwest will handle them.
             reqwest_builder = reqwest_builder.proxy(p);
         }
         if let Some(https) = &proxy.https {
-            let p = reqwest_12::Proxy::https(https)
+            let p = reqwest_13::Proxy::https(https)
                 .map_err(|e| format!("Invalid HTTPS proxy URL: {e}"))?;
             // If credentials are embedded in the proxy URL, reqwest will handle them.
             reqwest_builder = reqwest_builder.proxy(p);
@@ -629,7 +626,7 @@ pub async fn build_client(
     {
         let mut buf = Vec::new();
         File::open(ca_file)?.read_to_end(&mut buf)?;
-        let cert = reqwest_12::Certificate::from_pem(&buf)?;
+        let cert = reqwest_13::Certificate::from_pem(&buf)?;
 
         warn!("Adding TLS root certificate from {}", ca_file.display());
         reqwest_builder = reqwest_builder.add_root_certificate(cert);
diff --git a/src/sinks/azure_common/service.rs b/src/sinks/azure_common/service.rs
index 1f1d322156f78..68f75d9afe8f0 100644
--- a/src/sinks/azure_common/service.rs
+++ b/src/sinks/azure_common/service.rs
@@ -47,13 +47,12 @@ impl Service<AzureBlobRequest> for AzureBlobService {
                 blob_content_type: Some(request.content_type.to_string()),
                 blob_content_encoding: request.content_encoding.map(|e| e.to_string()),
                 ..Default::default()
-            };
+            }
+            .with_if_not_exists();
 
             let result = blob_client
                 .upload(
                     RequestContent::from(request.blob_data.to_vec()),
-                    false,
-                    byte_size as u64,
                     Some(upload_options),
                 )
                 .instrument(info_span!("request").or_current())
diff --git a/tests/integration/azure/config/compose.yaml b/tests/integration/azure/config/compose.yaml
index 384a65ab0e42d..f7186a61cb00b 100644
--- a/tests/integration/azure/config/compose.yaml
+++ b/tests/integration/azure/config/compose.yaml
@@ -9,7 +9,7 @@ services:
 
   azurite:
     image: mcr.microsoft.com/azure-storage/azurite:${CONFIG_VERSION}
-    command: azurite --blobHost 0.0.0.0 --blobPort 14430 --queuePort 14431 --tablePort 14432 --loose --oauth basic --cert /certs/azurite-chain.cert.pem --key /private/azurite.key.pem
+    command: azurite --skipApiVersionCheck --blobHost 0.0.0.0 --blobPort 14430 --queuePort 14431 --tablePort 14432 --loose --oauth basic --cert /certs/azurite-chain.cert.pem --key /private/azurite.key.pem
     volumes:
       - /var/run:/var/run
       - ../../../data/ca/intermediate_server/certs:/certs

From 020ff6d3cc7dd134f558f66b0bb66bc22d01f25b Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 15 May 2026 16:12:24 -0400
Subject: [PATCH 248/326] fix(ci): validate dd-sts credentials with exponential
 backoff before export (#25443)

* fix(ci): validate dd-sts credentials with exponential backoff before export

* fix(ci): include app key header in dd-sts credential validation

* fix(ci): handle curl transport failures in dd-sts credential retry loop
---
 .github/actions/dd-token/action.yml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/actions/dd-token/action.yml b/.github/actions/dd-token/action.yml
index a1fe17b21a803..8e5c0a43d3291 100644
--- a/.github/actions/dd-token/action.yml
+++ b/.github/actions/dd-token/action.yml
@@ -38,7 +38,26 @@ runs:
         DD_STS_APP_KEY: ${{ steps.dd-sts.outputs.app_key }}
       run: |
         if [ -n "${DD_STS_API_KEY}" ]; then
-          echo "DD_API_KEY=${DD_STS_API_KEY}" >> "$GITHUB_ENV"
+          # Poll until the API key is valid; the DD API can be slow to propagate
+          # permissions after token issuance.
+          app_key_header=()
+          if [ -n "${DD_STS_APP_KEY}" ]; then
+            app_key_header=(-H "DD-APPLICATION-KEY: ${DD_STS_APP_KEY}")
+          fi
+          delay=1
+          for i in $(seq 1 6); do
+            status=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 \
+              -H "DD-API-KEY: ${DD_STS_API_KEY}" \
+              "${app_key_header[@]}" \
+              "https://api.datadoghq.com/api/v1/validate") || status="000"
+            if [ "$status" = "200" ]; then
+              echo "DD_API_KEY=${DD_STS_API_KEY}" >> "$GITHUB_ENV"
+              break
+            fi
+            echo "Credentials not yet valid (attempt ${i}/6, HTTP ${status}), retrying in ${delay}s..."
+            sleep "${delay}"
+            delay=$((delay * 2))
+          done
         fi
         if [ -n "${DD_STS_APP_KEY}" ]; then
           echo "DD_APP_KEY=${DD_STS_APP_KEY}" >> "$GITHUB_ENV"

From 6de2414520cb29c6265d5abb4ce74d14961195b5 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 18 May 2026 14:33:13 -0400
Subject: [PATCH 249/326] fix(ci): use each commit's own Dockerfile for
 regression baseline/comparison builds (#25452)

---
 .github/workflows/regression.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 6ffe79b24e2f2..5fbfdbc262156 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -220,7 +220,7 @@ jobs:
           context: baseline-vector/
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          file: regression/Dockerfile
+          file: baseline-vector/regression/Dockerfile
           builder: ${{ steps.buildx.outputs.name }}
           outputs: type=docker,dest=${{ runner.temp }}/baseline-image.tar
           tags: |
@@ -259,7 +259,7 @@ jobs:
           context: comparison-vector/
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          file: regression/Dockerfile
+          file: comparison-vector/regression/Dockerfile
           builder: ${{ steps.buildx.outputs.name }}
           outputs: type=docker,dest=${{ runner.temp }}/comparison-image.tar
           tags: |

From 0e468d73dc563f75df0246c9fd16f0838a203e6b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 18 May 2026 17:21:26 -0400
Subject: [PATCH 250/326] chore(deps): bump clap_complete from 4.5.66 to 4.6.5
 in the clap group across 1 directory (#25279)

chore(deps): bump clap_complete in the clap group across 1 directory

Bumps the clap group with 1 update in the / directory: [clap_complete](https://github.com/clap-rs/clap).


Updates `clap_complete` from 4.5.66 to 4.6.5
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.66...clap_complete-v4.6.5)

---
updated-dependencies:
- dependency-name: clap_complete
  dependency-version: 4.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: clap
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 12 ++++++------
 Cargo.toml |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 33b29000d9af5..265e2e38e7d8e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2070,7 +2070,7 @@ dependencies = [
  "bitflags 2.10.0",
  "cexpr",
  "clang-sys",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "regex",
@@ -2656,9 +2656,9 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.5.66"
+version = "4.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c757a3b7e39161a4e56f9365141ada2a6c915a8622c408ab6bb4b5d047371031"
+checksum = "e0a7a9bfdb35811f9e59832f0f05975114d2251b415fb534108e6f34060fd772"
 dependencies = [
  "clap",
 ]
@@ -8756,7 +8756,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
  "heck 0.5.0",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "log",
  "multimap",
  "once_cell",
@@ -8789,7 +8789,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
@@ -8802,7 +8802,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27c6023962132f4b30eb4c172c91ce92d933da334c59c23cddee82358ddafb0b"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "proc-macro2 1.0.106",
  "quote 1.0.45",
  "syn 2.0.117",
diff --git a/Cargo.toml b/Cargo.toml
index 4e8a7cb26d5eb..f10e1c4a638e7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -146,7 +146,7 @@ cfg-if = { version = "1.0.4", default-features = false }
 chrono = { version = "0.4.44", default-features = false, features = ["clock", "serde"] }
 chrono-tz = { version = "0.10.4", default-features = false, features = ["serde"] }
 clap = { version = "4.5.60", default-features = false, features = ["derive", "error-context", "env", "help", "std", "string", "usage", "wrap_help"] }
-clap_complete = "4.5.66"
+clap_complete = "4.6.5"
 colored = { version = "3.1.1", default-features = false }
 const-str = { version = "1.1.0", default-features = false }
 convert_case = { version = "0.8", default-features = false }

From 4e547d2e4076d0413e5307497063b57b043e4236 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 18 May 2026 18:19:54 -0400
Subject: [PATCH 251/326] chore(buffers): replace str metric names with
 GaugeName/HistogramName (#25445)

* chore(buffers): replace string metric prefixes with typed BufferChannelKind enum

* fmt

* fix(buffers): update test usages of ChannelMetricMetadata to use BufferChannelKind

* fix(buffers): import BufferChannelKind in test module

* fmt

* Refactor match into kind-only/kind + limit matches

* Add transform test
---
 .../src/topology/channel/limited_queue.rs     | 114 +++++++++++++-----
 .../src/topology/channel/mod.rs               |   4 +-
 .../src/internal_event/metric_name.rs         |  28 +++++
 lib/vector-core/src/source_sender/output.rs   |   8 +-
 src/topology/builder.rs                       |   8 +-
 5 files changed, 124 insertions(+), 38 deletions(-)

diff --git a/lib/vector-buffers/src/topology/channel/limited_queue.rs b/lib/vector-buffers/src/topology/channel/limited_queue.rs
index 3e1f3f7c98c93..b420396664c20 100644
--- a/lib/vector-buffers/src/topology/channel/limited_queue.rs
+++ b/lib/vector-buffers/src/topology/channel/limited_queue.rs
@@ -16,14 +16,23 @@ use std::sync::Mutex;
 use async_stream::stream;
 use crossbeam_queue::{ArrayQueue, SegQueue};
 use futures::Stream;
-use metrics::{Gauge, Histogram, gauge, histogram};
+use metrics::{Gauge, Histogram};
 use tokio::sync::{Notify, OwnedSemaphorePermit, Semaphore, TryAcquireError};
+use vector_common::internal_event::{GaugeName, HistogramName};
 use vector_common::stats::TimeEwmaGauge;
+use vector_common::{gauge, histogram};
 
 use crate::{InMemoryBufferable, config::MemoryBufferSize};
 
 pub const DEFAULT_EWMA_HALF_LIFE_SECONDS: f64 = 5.0;
 
+/// Identifies which buffer channel is being instrumented, determining the metric name prefix.
+#[derive(Clone, Copy, Debug)]
+pub enum BufferChannelKind {
+    Source,
+    Transform,
+}
+
 /// Error returned by `LimitedSender::send` when the receiver has disconnected.
 #[derive(Debug, PartialEq, Eq)]
 pub struct SendError<T>(pub T);
@@ -99,13 +108,13 @@ where
 
 #[derive(Clone, Debug)]
 pub struct ChannelMetricMetadata {
-    prefix: &'static str,
+    kind: BufferChannelKind,
     output: Option<String>,
 }
 
 impl ChannelMetricMetadata {
-    pub fn new(prefix: &'static str, output: Option<String>) -> Self {
-        Self { prefix, output }
+    pub fn new(kind: BufferChannelKind, output: Option<String>) -> Self {
+        Self { kind, output }
     }
 }
 
@@ -127,7 +136,6 @@ struct Metrics {
 
 impl Metrics {
     #[expect(clippy::cast_precision_loss)] // We have to convert buffer sizes for a gauge, it's okay to lose precision here.
-    #[allow(clippy::disallowed_macros)] // Metric names are constructed dynamically from runtime prefixes.
     fn new(
         limit: MemoryBufferSize,
         metadata: ChannelMetricMetadata,
@@ -135,34 +143,55 @@ impl Metrics {
     ) -> Self {
         let ewma_half_life_seconds =
             ewma_half_life_seconds.unwrap_or(DEFAULT_EWMA_HALF_LIFE_SECONDS);
-        let ChannelMetricMetadata { prefix, output } = metadata;
-        let (legacy_suffix, gauge_suffix, max_value) = match limit {
-            MemoryBufferSize::MaxEvents(max_events) => (
-                "_max_event_size",
-                "_max_size_events",
-                max_events.get() as f64,
+        let ChannelMetricMetadata { kind, output } = metadata;
+
+        let (histogram_name, level_name, mean_name) = match kind {
+            BufferChannelKind::Source => (
+                HistogramName::SourceBufferUtilization,
+                GaugeName::SourceBufferUtilizationLevel,
+                GaugeName::SourceBufferUtilizationMean,
+            ),
+            BufferChannelKind::Transform => (
+                HistogramName::TransformBufferUtilization,
+                GaugeName::TransformBufferUtilizationLevel,
+                GaugeName::TransformBufferUtilizationMean,
+            ),
+        };
+
+        let (max_name, legacy_name, max_value) = match (kind, limit) {
+            (BufferChannelKind::Source, MemoryBufferSize::MaxEvents(n)) => (
+                GaugeName::SourceBufferMaxSizeEvents,
+                GaugeName::SourceBufferMaxEventSize,
+                n.get() as f64,
+            ),
+            (BufferChannelKind::Source, MemoryBufferSize::MaxSize(n)) => (
+                GaugeName::SourceBufferMaxSizeBytes,
+                GaugeName::SourceBufferMaxByteSize,
+                n.get() as f64,
+            ),
+            (BufferChannelKind::Transform, MemoryBufferSize::MaxEvents(n)) => (
+                GaugeName::TransformBufferMaxSizeEvents,
+                GaugeName::TransformBufferMaxEventSize,
+                n.get() as f64,
+            ),
+            (BufferChannelKind::Transform, MemoryBufferSize::MaxSize(n)) => (
+                GaugeName::TransformBufferMaxSizeBytes,
+                GaugeName::TransformBufferMaxByteSize,
+                n.get() as f64,
             ),
-            MemoryBufferSize::MaxSize(max_bytes) => {
-                ("_max_byte_size", "_max_size_bytes", max_bytes.get() as f64)
-            }
         };
-        let max_gauge_name = format!("{prefix}{gauge_suffix}");
-        let legacy_max_gauge_name = format!("{prefix}{legacy_suffix}");
-        let histogram_name = format!("{prefix}_utilization");
-        let gauge_name = format!("{prefix}_utilization_level");
-        let mean_name = format!("{prefix}_utilization_mean");
         #[cfg(test)]
         let recorded_values = Arc::new(Mutex::new(Vec::new()));
         if let Some(label_value) = output {
-            let max_gauge = gauge!(max_gauge_name, "output" => label_value.clone());
+            let max_gauge = gauge!(max_name, "output" => label_value.clone());
             max_gauge.set(max_value);
             let mean_gauge_handle = gauge!(mean_name, "output" => label_value.clone());
             // DEPRECATED: buffer-bytes-events-metrics
-            let legacy_max_gauge = gauge!(legacy_max_gauge_name, "output" => label_value.clone());
+            let legacy_max_gauge = gauge!(legacy_name, "output" => label_value.clone());
             legacy_max_gauge.set(max_value);
             Self {
                 histogram: histogram!(histogram_name, "output" => label_value.clone()),
-                gauge: gauge!(gauge_name, "output" => label_value.clone()),
+                gauge: gauge!(level_name, "output" => label_value.clone()),
                 mean_gauge: TimeEwmaGauge::new(mean_gauge_handle, ewma_half_life_seconds),
                 max_gauge,
                 legacy_max_gauge,
@@ -170,15 +199,15 @@ impl Metrics {
                 recorded_values,
             }
         } else {
-            let max_gauge = gauge!(max_gauge_name);
+            let max_gauge = gauge!(max_name);
             max_gauge.set(max_value);
             let mean_gauge_handle = gauge!(mean_name);
             // DEPRECATED: buffer-bytes-events-metrics
-            let legacy_max_gauge = gauge!(legacy_max_gauge_name);
+            let legacy_max_gauge = gauge!(legacy_name);
             legacy_max_gauge.set(max_value);
             Self {
                 histogram: histogram!(histogram_name),
-                gauge: gauge!(gauge_name),
+                gauge: gauge!(level_name),
                 mean_gauge: TimeEwmaGauge::new(mean_gauge_handle, ewma_half_life_seconds),
                 max_gauge,
                 legacy_max_gauge,
@@ -474,7 +503,9 @@ mod tests {
     use tokio_test::{assert_pending, assert_ready, task::spawn};
     use vector_common::byte_size_of::ByteSizeOf;
 
-    use super::{ChannelMetricMetadata, LimitedReceiver, LimitedSender, limited};
+    use super::{
+        BufferChannelKind, ChannelMetricMetadata, LimitedReceiver, LimitedSender, limited,
+    };
     use crate::{
         MemoryBufferSize,
         test::MultiEventRecord,
@@ -515,7 +546,32 @@ mod tests {
         let limit = MemoryBufferSize::MaxEvents(NonZeroUsize::new(2).unwrap());
         let (mut tx, mut rx) = limited(
             limit,
-            Some(ChannelMetricMetadata::new("test_channel", None)),
+            Some(ChannelMetricMetadata::new(BufferChannelKind::Source, None)),
+            None,
+        );
+
+        let metrics = tx.inner.metrics.as_ref().unwrap().recorded_values.clone();
+
+        tx.send(Sample::new(1)).await.expect("send should succeed");
+        let records = metrics.lock().unwrap().clone();
+        assert_eq!(records.len(), 1);
+        assert_eq!(records.last().copied(), Some(1));
+
+        assert_eq!(Sample::new(1), rx.next().await.unwrap());
+        let records = metrics.lock().unwrap();
+        assert_eq!(records.len(), 2);
+        assert_eq!(records.last().copied(), Some(0));
+    }
+
+    #[tokio::test]
+    async fn records_utilization_transform_channel() {
+        let limit = MemoryBufferSize::MaxEvents(NonZeroUsize::new(2).unwrap());
+        let (mut tx, mut rx) = limited(
+            limit,
+            Some(ChannelMetricMetadata::new(
+                BufferChannelKind::Transform,
+                None,
+            )),
             None,
         );
 
@@ -537,7 +593,7 @@ mod tests {
         let limit = MemoryBufferSize::MaxEvents(NonZeroUsize::new(2).unwrap());
         let (mut tx, mut rx) = limited(
             limit,
-            Some(ChannelMetricMetadata::new("test_channel_oversized", None)),
+            Some(ChannelMetricMetadata::new(BufferChannelKind::Source, None)),
             None,
         );
         let metrics = tx.inner.metrics.as_ref().unwrap().recorded_values.clone();
@@ -920,7 +976,7 @@ mod tests {
             let limit = NonZeroUsize::new(size * 10).unwrap();
             let (tx, rx) = limited(
                 MemoryBufferSize::MaxEvents(limit),
-                Some(ChannelMetricMetadata::new("test_channel_concurrent", None)),
+                Some(ChannelMetricMetadata::new(BufferChannelKind::Source, None)),
                 None,
             );
             let metrics = tx.inner.metrics.as_ref().unwrap().recorded_values.clone();
diff --git a/lib/vector-buffers/src/topology/channel/mod.rs b/lib/vector-buffers/src/topology/channel/mod.rs
index e0180111819cb..ab8e0fa62e5ce 100644
--- a/lib/vector-buffers/src/topology/channel/mod.rs
+++ b/lib/vector-buffers/src/topology/channel/mod.rs
@@ -3,8 +3,8 @@ mod receiver;
 mod sender;
 
 pub use limited_queue::{
-    ChannelMetricMetadata, DEFAULT_EWMA_HALF_LIFE_SECONDS, LimitedReceiver, LimitedSender,
-    SendError, limited,
+    BufferChannelKind, ChannelMetricMetadata, DEFAULT_EWMA_HALF_LIFE_SECONDS, LimitedReceiver,
+    LimitedSender, SendError, limited,
 };
 pub use receiver::*;
 pub use sender::*;
diff --git a/lib/vector-common/src/internal_event/metric_name.rs b/lib/vector-common/src/internal_event/metric_name.rs
index a1438465518e2..f520a3ecee316 100644
--- a/lib/vector-common/src/internal_event/metric_name.rs
+++ b/lib/vector-common/src/internal_event/metric_name.rs
@@ -127,6 +127,8 @@ pub enum HistogramName {
     HttpClientRttSeconds,
     HttpClientResponseRttSeconds,
     HttpClientErrorRttSeconds,
+    SourceBufferUtilization,
+    TransformBufferUtilization,
 }
 
 impl HistogramName {
@@ -160,6 +162,8 @@ impl HistogramName {
             Self::HttpClientRttSeconds => "http_client_rtt_seconds",
             Self::HttpClientResponseRttSeconds => "http_client_response_rtt_seconds",
             Self::HttpClientErrorRttSeconds => "http_client_error_rtt_seconds",
+            Self::SourceBufferUtilization => "source_buffer_utilization",
+            Self::TransformBufferUtilization => "transform_buffer_utilization",
         }
     }
 }
@@ -168,6 +172,18 @@ impl HistogramName {
 #[strum(serialize_all = "snake_case")]
 pub enum GaugeName {
     ComponentLatencyMeanSeconds,
+    SourceBufferMaxSizeEvents,
+    SourceBufferMaxSizeBytes,
+    SourceBufferMaxEventSize,
+    SourceBufferMaxByteSize,
+    SourceBufferUtilizationLevel,
+    SourceBufferUtilizationMean,
+    TransformBufferMaxSizeEvents,
+    TransformBufferMaxSizeBytes,
+    TransformBufferMaxEventSize,
+    TransformBufferMaxByteSize,
+    TransformBufferUtilizationLevel,
+    TransformBufferUtilizationMean,
     BufferMaxSizeEvents,
     BufferMaxEventSize,
     BufferMaxSizeBytes,
@@ -199,6 +215,18 @@ impl GaugeName {
     pub const fn as_str(self) -> &'static str {
         match self {
             Self::ComponentLatencyMeanSeconds => "component_latency_mean_seconds",
+            Self::SourceBufferMaxSizeEvents => "source_buffer_max_size_events",
+            Self::SourceBufferMaxSizeBytes => "source_buffer_max_size_bytes",
+            Self::SourceBufferMaxEventSize => "source_buffer_max_event_size",
+            Self::SourceBufferMaxByteSize => "source_buffer_max_byte_size",
+            Self::SourceBufferUtilizationLevel => "source_buffer_utilization_level",
+            Self::SourceBufferUtilizationMean => "source_buffer_utilization_mean",
+            Self::TransformBufferMaxSizeEvents => "transform_buffer_max_size_events",
+            Self::TransformBufferMaxSizeBytes => "transform_buffer_max_size_bytes",
+            Self::TransformBufferMaxEventSize => "transform_buffer_max_event_size",
+            Self::TransformBufferMaxByteSize => "transform_buffer_max_byte_size",
+            Self::TransformBufferUtilizationLevel => "transform_buffer_utilization_level",
+            Self::TransformBufferUtilizationMean => "transform_buffer_utilization_mean",
             Self::BufferMaxSizeEvents => "buffer_max_size_events",
             Self::BufferMaxEventSize => "buffer_max_event_size",
             Self::BufferMaxSizeBytes => "buffer_max_size_bytes",
diff --git a/lib/vector-core/src/source_sender/output.rs b/lib/vector-core/src/source_sender/output.rs
index 4a194cc3e1c1f..fc596c6b9a50b 100644
--- a/lib/vector-core/src/source_sender/output.rs
+++ b/lib/vector-core/src/source_sender/output.rs
@@ -11,7 +11,9 @@ use metrics::Histogram;
 use tracing::Span;
 use vector_buffers::{
     config::MemoryBufferSize,
-    topology::channel::{self, ChannelMetricMetadata, LimitedReceiver, LimitedSender},
+    topology::channel::{
+        self, BufferChannelKind, ChannelMetricMetadata, LimitedReceiver, LimitedSender,
+    },
 };
 use vector_common::{
     byte_size_of::ByteSizeOf,
@@ -30,8 +32,6 @@ use crate::{
     schema::Definition,
 };
 
-const UTILIZATION_METRIC_PREFIX: &str = "source_buffer";
-
 /// UnsentEvents tracks the number of events yet to be sent in the buffer. This is used to
 /// increment the appropriate counters when a future is not polled to completion. Particularly,
 /// this is known to happen in a Warp server when a client sends a new HTTP request on a TCP
@@ -140,7 +140,7 @@ impl Output {
     ) -> (Self, LimitedReceiver<SourceSenderItem>) {
         let limit = MemoryBufferSize::MaxEvents(NonZeroUsize::new(n).unwrap());
         let channel_metrics =
-            ChannelMetricMetadata::new(UTILIZATION_METRIC_PREFIX, Some(output.clone()));
+            ChannelMetricMetadata::new(BufferChannelKind::Source, Some(output.clone()));
         let (tx, rx) = channel::limited(limit, Some(channel_metrics), ewma_half_life_seconds);
         (
             Self {
diff --git a/src/topology/builder.rs b/src/topology/builder.rs
index a25a99d337a26..2d9d9f7d5cf81 100644
--- a/src/topology/builder.rs
+++ b/src/topology/builder.rs
@@ -21,7 +21,10 @@ use vector_lib::{
         BufferType, WhenFull,
         topology::{
             builder::TopologyBuilder,
-            channel::{BufferReceiver, BufferSender, ChannelMetricMetadata, LimitedReceiver},
+            channel::{
+                BufferChannelKind, BufferReceiver, BufferSender, ChannelMetricMetadata,
+                LimitedReceiver,
+            },
         },
     },
     internal_event::{self, CountByteSize, EventsSent, InternalEventHandle as _, Registered},
@@ -67,7 +70,6 @@ pub(crate) static SOURCE_SENDER_BUFFER_SIZE: LazyLock<usize> =
 
 const READY_ARRAY_CAPACITY: NonZeroUsize = NonZeroUsize::new(CHUNK_SIZE * 4).unwrap();
 pub(crate) const TOPOLOGY_BUFFER_SIZE: NonZeroUsize = NonZeroUsize::new(100).unwrap();
-const TRANSFORM_CHANNEL_METRIC_PREFIX: &str = "transform_buffer";
 
 static TRANSFORM_CONCURRENCY_LIMIT: LazyLock<usize> = LazyLock::new(|| {
     crate::app::worker_threads()
@@ -508,7 +510,7 @@ impl<'a> Builder<'a> {
                 Ok(transform) => transform,
             };
 
-            let metrics = ChannelMetricMetadata::new(TRANSFORM_CHANNEL_METRIC_PREFIX, None);
+            let metrics = ChannelMetricMetadata::new(BufferChannelKind::Transform, None);
             let (input_tx, input_rx) = TopologyBuilder::standalone_memory(
                 TOPOLOGY_BUFFER_SIZE,
                 WhenFull::Block,

From 689800ad1b8d63c83ec2fe60b4f72b57c441176d Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 19 May 2026 09:14:59 -0400
Subject: [PATCH 252/326] chore(releasing): use gh CLI to fetch VRL release
 notes instead of unauthenticated GitHub API (#25444)

* chore(releasing): use gh CLI to fetch VRL release notes instead of unauthenticated GitHub API

* fmt
---
 vdev/src/commands/release/prepare.rs | 79 ++++++++++++++--------------
 1 file changed, 40 insertions(+), 39 deletions(-)

diff --git a/vdev/src/commands/release/prepare.rs b/vdev/src/commands/release/prepare.rs
index 8cdb4a2341db6..9fc317869cf6e 100644
--- a/vdev/src/commands/release/prepare.rs
+++ b/vdev/src/commands/release/prepare.rs
@@ -3,8 +3,7 @@
 
 use crate::commands::release::generate_cue;
 use crate::utils::{command::run_command, git, paths};
-use anyhow::{Context, Result, anyhow};
-use reqwest::blocking::Client;
+use anyhow::{Context, Result, anyhow, bail};
 use semver::Version;
 use std::{
     env, fs,
@@ -13,7 +12,6 @@ use std::{
     path::{Path, PathBuf},
     process::Command,
 };
-use toml::Value;
 use toml_edit::DocumentMut;
 
 const ALPINE_PREFIX: &str = "FROM docker.io/alpine:";
@@ -460,53 +458,56 @@ fn insert_block_after_changelog(original: &str, block: &str) -> String {
 }
 
 fn get_latest_vrl_tag_and_changelog() -> Result<String> {
-    let client = Client::new();
-
-    // Step 1: Get latest tag from GitHub API
-    let tags_url = "https://api.github.com/repos/vectordotdev/vrl/tags";
-    let tags_response = client
-        .get(tags_url)
-        .header("User-Agent", "rust-reqwest") // GitHub API requires User-Agent
-        .send()?
-        .text()?;
-
-    let tags: Vec<Value> = serde_json::from_str(&tags_response)?;
-    let latest_tag = tags
-        .first()
-        .and_then(|tag| tag.get("name"))
-        .and_then(|name| name.as_str())
-        .ok_or_else(|| anyhow!("Failed to extract latest tag"))?
-        .to_string();
-
-    // Step 2: Download CHANGELOG.md for the specific tag
-    let changelog_url =
-        format!("https://raw.githubusercontent.com/vectordotdev/vrl/{latest_tag}/CHANGELOG.md",);
-    let changelog = client
-        .get(&changelog_url)
-        .header("User-Agent", "rust-reqwest")
-        .send()?
-        .text()?;
-
-    // Step 3: Extract text from first ## to next ##
-    let lines: Vec<&str> = changelog.lines().collect();
+    // Step 1: get the latest tag
+    let tag_output = Command::new("gh")
+        .args(["api", "repos/vectordotdev/vrl/tags", "--jq", ".[0].name"])
+        .output()
+        .context("Failed to run `gh api` for VRL tags")?;
+
+    if !tag_output.status.success() {
+        let stderr = String::from_utf8_lossy(&tag_output.stderr);
+        bail!("gh api tags failed: {stderr}");
+    }
+
+    let tag = String::from_utf8(tag_output.stdout).context("gh api output is not valid UTF-8")?;
+    let tag = tag.trim().to_string();
+
+    // Step 2: fetch CHANGELOG.md for that tag
+    let changelog_output = Command::new("gh")
+        .args([
+            "api",
+            &format!("repos/vectordotdev/vrl/contents/CHANGELOG.md?ref={tag}"),
+            "-H",
+            "Accept: application/vnd.github.raw+json",
+        ])
+        .output()
+        .context("Failed to run `gh api` for VRL CHANGELOG.md")?;
+
+    if !changelog_output.status.success() {
+        let stderr = String::from_utf8_lossy(&changelog_output.stderr);
+        bail!("gh api CHANGELOG.md failed: {stderr}");
+    }
+
+    let changelog =
+        String::from_utf8(changelog_output.stdout).context("CHANGELOG.md is not valid UTF-8")?;
+
+    // Extract the first release section (from the first ## to the next ##)
     let mut section = Vec::new();
     let mut found_first = false;
-
-    for line in lines {
+    for line in changelog.lines() {
         if line.starts_with("## ") {
             if found_first {
-                section.push(line.to_string());
                 break;
             }
             found_first = true;
-            section.push(line.to_string());
-        } else if found_first {
-            section.push(line.to_string());
+        }
+        if found_first {
+            section.push(line);
         }
     }
 
     if !found_first {
-        return Err(anyhow!("No ## headers found in CHANGELOG.md"));
+        bail!("No ## headers found in VRL CHANGELOG.md");
     }
 
     Ok(section.join("\n"))

From 891ffbd6196835360cd5ae4fa9a50d2611a7eb03 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 19 May 2026 11:45:57 -0400
Subject: [PATCH 253/326] fix(file source): fix checkpoint write race on
 shutdown and flaky tests (#25447)

* fix(file source): fix checkpoint write race on shutdown and flaky tests

* fix clippy: use Arc::clone instead of .clone() on ref-counted pointer

* refactor(tests): rename wait_for_atomic_usize_timeout to wait_for_atomic_usize_timeout_ms

* changelog: file source checkpoint write race fix

* Format

* Remove data loss from changelog
---
 ...x_file_source_checkpoint_write_race.fix.md |   3 +
 lib/file-source/src/file_server.rs            |   4 +-
 src/sources/file.rs                           | 361 +++++++++++-------
 src/test_util/mod.rs                          |  13 +
 4 files changed, 247 insertions(+), 134 deletions(-)
 create mode 100644 changelog.d/25447_fix_file_source_checkpoint_write_race.fix.md

diff --git a/changelog.d/25447_fix_file_source_checkpoint_write_race.fix.md b/changelog.d/25447_fix_file_source_checkpoint_write_race.fix.md
new file mode 100644
index 0000000000000..305d64109712a
--- /dev/null
+++ b/changelog.d/25447_fix_file_source_checkpoint_write_race.fix.md
@@ -0,0 +1,3 @@
+Fixed a bug in the `file` source where checkpoints recording the last-read file position were not always fully written before Vector shut down. On the next startup, the `file` source could start reading from an earlier position, causing events to be re-processed.
+
+authors: thomasqueirozb
diff --git a/lib/file-source/src/file_server.rs b/lib/file-source/src/file_server.rs
index 79f7273e3746c..87a436298ca16 100644
--- a/lib/file-source/src/file_server.rs
+++ b/lib/file-source/src/file_server.rs
@@ -411,7 +411,7 @@ where
             };
             futures::pin_mut!(sleep);
             match select(shutdown_data, sleep).await {
-                Either::Left((_, _)) => {
+                Either::Left((_shutdown_token, _)) => {
                     chans
                         .close()
                         .await
@@ -423,6 +423,8 @@ where
                         error!(?error, "Error writing checkpoints before shutdown");
                     }
                     return Ok(Shutdown);
+                    // _shutdown_token is dropped here, after checkpoints are written,
+                    // which signals shutdown_done to the caller.
                 }
                 Either::Right((_, future)) => shutdown_data = future,
             }
diff --git a/src/sources/file.rs b/src/sources/file.rs
index df51a5a73788a..93f4e188be97a 100644
--- a/src/sources/file.rs
+++ b/src/sources/file.rs
@@ -832,6 +832,10 @@ mod tests {
         fs::{self, File},
         future::Future,
         io::{Seek, Write},
+        sync::{
+            Arc,
+            atomic::{AtomicUsize, Ordering},
+        },
     };
 
     use encoding_rs::UTF_16LE;
@@ -847,7 +851,10 @@ mod tests {
         event::{Event, EventStatus, Value},
         shutdown::ShutdownSignal,
         sources::file,
-        test_util::components::{FILE_SOURCE_TAGS, assert_source_compliance},
+        test_util::{
+            components::{FILE_SOURCE_TAGS, assert_source_compliance},
+            wait_for_atomic_usize_timeout_ms,
+        },
     };
 
     #[test]
@@ -856,12 +863,16 @@ mod tests {
     }
 
     fn test_default_file_config(dir: &tempfile::TempDir) -> file::FileConfig {
+        // Store checkpoints in a subdirectory so they don't appear in the
+        // glob-watched directory (which covers dir.path()/*).
+        let data_dir = dir.path().join(".data");
+        fs::create_dir_all(&data_dir).unwrap();
         file::FileConfig {
             fingerprint: FingerprintConfig::Checksum {
                 ignored_header_bytes: 0,
                 lines: 1,
             },
-            data_dir: Some(dir.path().to_path_buf()),
+            data_dir: Some(data_dir),
             glob_minimum_cooldown_ms: Duration::from_millis(100),
             internal_metrics: FileInternalMetricsConfig {
                 include_file_tag: true,
@@ -962,9 +973,10 @@ mod tests {
         config.global.data_dir = global_dir.keep().into();
 
         // local path given -- local should win
+        let local_data_dir = Some(local_dir.path().to_path_buf());
         let res = config
             .global
-            .resolve_and_validate_data_dir(test_default_file_config(&local_dir).data_dir.as_ref())
+            .resolve_and_validate_data_dir(local_data_dir.as_ref())
             .unwrap();
         assert_eq!(res, local_dir.path());
 
@@ -1153,7 +1165,7 @@ mod tests {
         let path1 = dir.path().join("file1");
         let path2 = dir.path().join("file2");
 
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, None, async {
             let mut file1 = File::create(&path1).unwrap();
             let mut file2 = File::create(&path2).unwrap();
 
@@ -1208,7 +1220,7 @@ mod tests {
 
         let path = dir.path().join("file");
 
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, None, async {
             let mut file = File::create(&path).unwrap();
 
             writeln!(&mut file, "line for checkpointing").unwrap();
@@ -1234,7 +1246,7 @@ mod tests {
             ..test_default_file_config(&dir)
         };
         let path = dir.path().join("file");
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, None, async {
             let mut file = File::create(&path).unwrap();
 
             for i in 0..n {
@@ -1297,7 +1309,7 @@ mod tests {
 
         let path = dir.path().join("file");
         let archive_path = dir.path().join("file");
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, None, async {
             let mut file = File::create(&path).unwrap();
 
             for i in 0..n {
@@ -1365,7 +1377,7 @@ mod tests {
         let path2 = dir.path().join("b.txt");
         let path3 = dir.path().join("a.log");
         let path4 = dir.path().join("a.ignore.txt");
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, None, async {
             let mut file1 = File::create(&path1).unwrap();
             let mut file2 = File::create(&path2).unwrap();
             let mut file3 = File::create(&path3).unwrap();
@@ -1416,7 +1428,7 @@ mod tests {
 
         let path1 = dir.path().join("a//b/a.log.1");
         let path2 = dir.path().join("a//b/test.log.1");
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, None, async {
             std::fs::create_dir_all(dir.path().join("a/b")).unwrap();
             let mut file1 = File::create(&path1).unwrap();
             let mut file2 = File::create(&path2).unwrap();
@@ -1469,15 +1481,16 @@ mod tests {
             };
 
             let path = dir.path().join("file");
-            let received = run_file_source(&config, true, acks, LogNamespace::Legacy, async {
-                let mut file = File::create(&path).unwrap();
+            let received =
+                run_file_source(&config, true, acks, LogNamespace::Legacy, None, async {
+                    let mut file = File::create(&path).unwrap();
 
-                writeln!(&mut file, "hello there").unwrap();
-                file.flush().unwrap();
+                    writeln!(&mut file, "hello there").unwrap();
+                    file.flush().unwrap();
 
-                sleep_500_millis().await;
-            })
-            .await;
+                    sleep_500_millis().await;
+                })
+                .await;
 
             assert_eq!(received.len(), 1);
             assert_eq!(
@@ -1496,15 +1509,16 @@ mod tests {
             };
 
             let path = dir.path().join("file");
-            let received = run_file_source(&config, true, acks, LogNamespace::Legacy, async {
-                let mut file = File::create(&path).unwrap();
+            let received =
+                run_file_source(&config, true, acks, LogNamespace::Legacy, None, async {
+                    let mut file = File::create(&path).unwrap();
 
-                writeln!(&mut file, "hello there").unwrap();
-                file.flush().unwrap();
+                    writeln!(&mut file, "hello there").unwrap();
+                    file.flush().unwrap();
 
-                sleep_500_millis().await;
-            })
-            .await;
+                    sleep_500_millis().await;
+                })
+                .await;
 
             assert_eq!(received.len(), 1);
             assert_eq!(
@@ -1522,15 +1536,16 @@ mod tests {
             };
 
             let path = dir.path().join("file");
-            let received = run_file_source(&config, true, acks, LogNamespace::Legacy, async {
-                let mut file = File::create(&path).unwrap();
+            let received =
+                run_file_source(&config, true, acks, LogNamespace::Legacy, None, async {
+                    let mut file = File::create(&path).unwrap();
 
-                writeln!(&mut file, "hello there").unwrap();
+                    writeln!(&mut file, "hello there").unwrap();
 
-                file.flush().unwrap();
-                sleep_500_millis().await;
-            })
-            .await;
+                    file.flush().unwrap();
+                    sleep_500_millis().await;
+                })
+                .await;
 
             assert_eq!(received.len(), 1);
             assert_eq!(
@@ -1576,26 +1591,28 @@ mod tests {
 
         // First time server runs it picks up existing lines.
         {
-            let received = run_file_source(&config, true, acking, LogNamespace::Legacy, async {
-                sleep_500_millis().await;
-                writeln!(&mut file, "first line").unwrap();
-                file.flush().unwrap();
-                sleep_500_millis().await;
-            })
-            .await;
+            let received =
+                run_file_source(&config, true, acking, LogNamespace::Legacy, None, async {
+                    sleep_500_millis().await;
+                    writeln!(&mut file, "first line").unwrap();
+                    file.flush().unwrap();
+                    sleep_500_millis().await;
+                })
+                .await;
 
             let lines = extract_messages_string(received);
             assert_eq!(lines, vec!["zeroth line", "first line"]);
         }
         // Restart server, read file from checkpoint.
         {
-            let received = run_file_source(&config, true, acking, LogNamespace::Legacy, async {
-                sleep_500_millis().await;
-                writeln!(&mut file, "second line").unwrap();
-                file.flush().unwrap();
-                sleep_500_millis().await;
-            })
-            .await;
+            let received =
+                run_file_source(&config, true, acking, LogNamespace::Legacy, None, async {
+                    sleep_500_millis().await;
+                    writeln!(&mut file, "second line").unwrap();
+                    file.flush().unwrap();
+                    sleep_500_millis().await;
+                })
+                .await;
 
             let lines = extract_messages_string(received);
             assert_eq!(lines, vec!["second line"]);
@@ -1608,13 +1625,14 @@ mod tests {
                 read_from: ReadFromConfig::Beginning,
                 ..test_default_file_config(&dir)
             };
-            let received = run_file_source(&config, false, acking, LogNamespace::Legacy, async {
-                sleep_500_millis().await;
-                writeln!(&mut file, "third line").unwrap();
-                file.flush().unwrap();
-                sleep_500_millis().await;
-            })
-            .await;
+            let received =
+                run_file_source(&config, false, acking, LogNamespace::Legacy, None, async {
+                    sleep_500_millis().await;
+                    writeln!(&mut file, "third line").unwrap();
+                    file.flush().unwrap();
+                    sleep_500_millis().await;
+                })
+                .await;
 
             let lines = extract_messages_string(received);
             assert_eq!(
@@ -1643,6 +1661,7 @@ mod tests {
             false,
             Unfinalized,
             LogNamespace::Legacy,
+            None,
             sleep(Duration::from_secs(5)),
         )
         .await;
@@ -1655,6 +1674,7 @@ mod tests {
             false,
             Unfinalized,
             LogNamespace::Legacy,
+            None,
             sleep(Duration::from_secs(5)),
         )
         .await;
@@ -1685,6 +1705,7 @@ mod tests {
             true,
             Acks,
             LogNamespace::Legacy,
+            None,
             // shutdown signal is sent after this duration
             sleep_500_millis(),
         )
@@ -1695,13 +1716,26 @@ mod tests {
         // bug we're testing for, which happens if the finalizer stream exits on shutdown with pending acks
         assert!(lines.len() < line_count);
 
-        // Restart the server, and it should read the rest without duplicating any
+        // Restart the server, and it should read the rest without duplicating any.
+        // Use the event counter to drain rx continuously (removing backpressure so
+        // the file server can read all remaining lines without being stalled), then
+        // trigger shutdown once all expected events have been received.
+        let remaining = line_count - lines.len();
+        let event_count = Arc::new(AtomicUsize::new(0));
         let received = run_file_source(
             &config,
             true,
             Acks,
             LogNamespace::Legacy,
-            sleep(Duration::from_secs(5)),
+            Some(Arc::clone(&event_count)),
+            async {
+                wait_for_atomic_usize_timeout_ms(
+                    Arc::clone(&event_count),
+                    |n| n >= remaining,
+                    5_000,
+                )
+                .await;
+            },
         )
         .await;
         let lines2 = extract_messages_string(received);
@@ -1731,13 +1765,14 @@ mod tests {
         let path_for_old_file = dir.path().join("file.old");
         // Run server first time, collect some lines.
         {
-            let received = run_file_source(&config, true, acking, LogNamespace::Legacy, async {
-                let mut file = File::create(&path).unwrap();
-                writeln!(&mut file, "first line").unwrap();
-                file.flush().unwrap();
-                sleep_500_millis().await;
-            })
-            .await;
+            let received =
+                run_file_source(&config, true, acking, LogNamespace::Legacy, None, async {
+                    let mut file = File::create(&path).unwrap();
+                    writeln!(&mut file, "first line").unwrap();
+                    file.flush().unwrap();
+                    sleep_500_millis().await;
+                })
+                .await;
 
             let lines = extract_messages_string(received);
             assert_eq!(lines, vec!["first line"]);
@@ -1747,13 +1782,14 @@ mod tests {
         // Restart the server and make sure it does not re-read the old file
         // even though it has a new name.
         {
-            let received = run_file_source(&config, false, acking, LogNamespace::Legacy, async {
-                let mut file = File::create(&path).unwrap();
-                writeln!(&mut file, "second line").unwrap();
-                file.flush().unwrap();
-                sleep_500_millis().await;
-            })
-            .await;
+            let received =
+                run_file_source(&config, false, acking, LogNamespace::Legacy, None, async {
+                    let mut file = File::create(&path).unwrap();
+                    writeln!(&mut file, "second line").unwrap();
+                    file.flush().unwrap();
+                    sleep_500_millis().await;
+                })
+                .await;
 
             let lines = extract_messages_string(received);
             assert_eq!(lines, vec!["second line"]);
@@ -1815,7 +1851,7 @@ mod tests {
         before_file.sync_all().unwrap();
         after_file.sync_all().unwrap();
 
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, None, async {
             sleep_500_millis().await;
             writeln!(&mut before_file, "second line").unwrap();
             writeln!(&mut after_file, "_second line").unwrap();
@@ -1854,7 +1890,7 @@ mod tests {
         };
 
         let path = dir.path().join("file");
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, None, async {
             let mut file = File::create(&path).unwrap();
 
             writeln!(&mut file, "short").unwrap();
@@ -1891,37 +1927,48 @@ mod tests {
         let config = file::FileConfig {
             include: vec![dir.path().join("*")],
             message_start_indicator: Some("INFO".into()),
-            multi_line_timeout: 25, // less than 50 in sleep()
+            multi_line_timeout: 25,
             ..test_default_file_config(&dir)
         };
 
         let path = dir.path().join("file");
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
-            let mut file = File::create(&path).unwrap();
-
-            writeln!(&mut file, "leftover foo").unwrap();
-            writeln!(&mut file, "INFO hello").unwrap();
-            writeln!(&mut file, "INFO goodbye").unwrap();
-            writeln!(&mut file, "part of goodbye").unwrap();
-
-            file.flush().unwrap();
-            sleep_500_millis().await;
+        let event_count = Arc::new(AtomicUsize::new(0));
+        let received = run_file_source(
+            &config,
+            false,
+            NoAcks,
+            LogNamespace::Legacy,
+            Some(Arc::clone(&event_count)),
+            async {
+                let mut file = File::create(&path).unwrap();
 
-            writeln!(&mut file, "INFO hi again").unwrap();
-            writeln!(&mut file, "and some more").unwrap();
-            writeln!(&mut file, "INFO hello").unwrap();
+                // Write all lines through the second "INFO hello". Events 1-4
+                // are emitted immediately by EndExclude; event 5 ("INFO hello"
+                // standalone) requires the 25ms timeout to fire.
+                writeln!(&mut file, "leftover foo").unwrap();
+                writeln!(&mut file, "INFO hello").unwrap();
+                writeln!(&mut file, "INFO goodbye").unwrap();
+                writeln!(&mut file, "part of goodbye").unwrap();
+                writeln!(&mut file, "INFO hi again").unwrap();
+                writeln!(&mut file, "and some more").unwrap();
+                writeln!(&mut file, "INFO hello").unwrap();
+                file.flush().unwrap();
 
-            file.flush().unwrap();
-            sleep_500_millis().await;
+                // Block until event 5 is observed: the timeout fired and
+                // "INFO hello" was emitted before we write "too slow".
+                wait_for_atomic_usize_timeout_ms(Arc::clone(&event_count), |n| n >= 5, 500).await;
 
-            writeln!(&mut file, "too slow").unwrap();
-            writeln!(&mut file, "INFO doesn't have").unwrap();
-            writeln!(&mut file, "to be INFO in").unwrap();
-            writeln!(&mut file, "the middle").unwrap();
+                writeln!(&mut file, "too slow").unwrap();
+                writeln!(&mut file, "INFO doesn't have").unwrap();
+                writeln!(&mut file, "to be INFO in").unwrap();
+                writeln!(&mut file, "the middle").unwrap();
+                file.flush().unwrap();
 
-            file.flush().unwrap();
-            sleep_500_millis().await;
-        })
+                // Wait for events 6 ("too slow") and 7 ("INFO doesn't have")
+                // before triggering shutdown.
+                wait_for_atomic_usize_timeout_ms(Arc::clone(&event_count), |n| n >= 7, 500).await;
+            },
+        )
         .await;
 
         let received = extract_messages_value(received);
@@ -1950,38 +1997,49 @@ mod tests {
                 start_pattern: "INFO".to_owned(),
                 condition_pattern: "INFO".to_owned(),
                 mode: line_agg::Mode::HaltBefore,
-                timeout_ms: Duration::from_millis(25), // less than 50 in sleep()
+                timeout_ms: Duration::from_millis(25),
             }),
             ..test_default_file_config(&dir)
         };
 
         let path = dir.path().join("file");
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
-            let mut file = File::create(&path).unwrap();
-
-            writeln!(&mut file, "leftover foo").unwrap();
-            writeln!(&mut file, "INFO hello").unwrap();
-            writeln!(&mut file, "INFO goodbye").unwrap();
-            writeln!(&mut file, "part of goodbye").unwrap();
-
-            file.flush().unwrap();
-            sleep_500_millis().await;
+        let event_count = Arc::new(AtomicUsize::new(0));
+        let received = run_file_source(
+            &config,
+            false,
+            NoAcks,
+            LogNamespace::Legacy,
+            Some(Arc::clone(&event_count)),
+            async {
+                let mut file = File::create(&path).unwrap();
 
-            writeln!(&mut file, "INFO hi again").unwrap();
-            writeln!(&mut file, "and some more").unwrap();
-            writeln!(&mut file, "INFO hello").unwrap();
+                // Write all lines through the second "INFO hello". Events 1-4
+                // are emitted immediately by EndExclude; event 5 ("INFO hello"
+                // standalone) requires the 25ms timeout to fire.
+                writeln!(&mut file, "leftover foo").unwrap();
+                writeln!(&mut file, "INFO hello").unwrap();
+                writeln!(&mut file, "INFO goodbye").unwrap();
+                writeln!(&mut file, "part of goodbye").unwrap();
+                writeln!(&mut file, "INFO hi again").unwrap();
+                writeln!(&mut file, "and some more").unwrap();
+                writeln!(&mut file, "INFO hello").unwrap();
+                file.flush().unwrap();
 
-            file.flush().unwrap();
-            sleep_500_millis().await;
+                // Block until event 5 is observed: the timeout fired and
+                // "INFO hello" was emitted before we write "too slow".
+                wait_for_atomic_usize_timeout_ms(Arc::clone(&event_count), |n| n >= 5, 500).await;
 
-            writeln!(&mut file, "too slow").unwrap();
-            writeln!(&mut file, "INFO doesn't have").unwrap();
-            writeln!(&mut file, "to be INFO in").unwrap();
-            writeln!(&mut file, "the middle").unwrap();
+                writeln!(&mut file, "too slow").unwrap();
+                writeln!(&mut file, "INFO doesn't have").unwrap();
+                writeln!(&mut file, "to be INFO in").unwrap();
+                writeln!(&mut file, "the middle").unwrap();
+                file.flush().unwrap();
 
-            file.flush().unwrap();
-            sleep_500_millis().await;
-        })
+                // Wait for events 6 ("too slow") and 7 ("INFO doesn't have")
+                // before triggering shutdown.
+                wait_for_atomic_usize_timeout_ms(Arc::clone(&event_count), |n| n >= 7, 500).await;
+            },
+        )
         .await;
 
         let received = extract_messages_value(received);
@@ -2024,12 +2082,14 @@ mod tests {
 
         file.sync_all().unwrap();
 
-        // Read and aggregate existing lines
+        // Read and aggregate existing lines. wait_shutdown=true ensures the
+        // checkpoint is fully written to disk before the second run reads it.
         let received = run_file_source(
             &config,
-            false,
+            true,
             Acks,
             LogNamespace::Legacy,
+            None,
             sleep_500_millis(),
         )
         .await;
@@ -2041,7 +2101,7 @@ mod tests {
 
         // After restart, we should not see any part of the previously aggregated lines
         let received_after_restart =
-            run_file_source(&config, false, Acks, LogNamespace::Legacy, async {
+            run_file_source(&config, false, Acks, LogNamespace::Legacy, None, async {
                 writeln!(&mut file, "INFO goodbye").unwrap();
                 file.flush().unwrap();
                 sleep_500_millis().await;
@@ -2086,6 +2146,7 @@ mod tests {
             false,
             NoAcks,
             LogNamespace::Legacy,
+            None,
             sleep_500_millis(),
         )
         .await;
@@ -2148,6 +2209,7 @@ mod tests {
             false,
             NoAcks,
             LogNamespace::Legacy,
+            None,
             sleep_500_millis(),
         )
         .await;
@@ -2182,7 +2244,7 @@ mod tests {
         writeln!(&mut file, "hello i am a normal line").unwrap();
         file.sync_all().unwrap();
 
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, None, async {
             sleep_500_millis().await;
 
             write!(&mut file, "i am not a full line").unwrap();
@@ -2229,6 +2291,7 @@ mod tests {
             false,
             NoAcks,
             LogNamespace::Legacy,
+            None,
             sleep_500_millis(),
         )
         .await;
@@ -2261,6 +2324,7 @@ mod tests {
             false,
             NoAcks,
             LogNamespace::Legacy,
+            None,
             sleep_500_millis(),
         )
         .await;
@@ -2289,7 +2353,7 @@ mod tests {
         };
 
         let path = dir.path().join("file");
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, None, async {
             let mut file = File::create(&path).unwrap();
 
             write!(&mut file, "hello i am a line\r\n").unwrap();
@@ -2328,7 +2392,7 @@ mod tests {
         };
 
         let path = dir.path().join("file");
-        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, NoAcks, LogNamespace::Legacy, None, async {
             let mut file = File::create(&path).unwrap();
 
             sleep_500_millis().await;
@@ -2417,7 +2481,7 @@ mod tests {
         };
 
         let path = dir.path().join("file");
-        let received = run_file_source(&config, false, Acks, LogNamespace::Legacy, async {
+        let received = run_file_source(&config, false, Acks, LogNamespace::Legacy, None, async {
             let mut file = File::create(&path).unwrap();
 
             for i in 0..n {
@@ -2459,6 +2523,11 @@ mod tests {
         wait_shutdown: bool,
         acking_mode: AckingMode,
         log_namespace: LogNamespace,
+        // When `Some`, events are relayed through an unbounded channel and the
+        // counter is incremented for each event received.  The inner future can
+        // call `wait_for_atomic_usize` on this counter to gate writes on
+        // observed events instead of relying on wall-clock sleeps.
+        event_counter: Option<Arc<AtomicUsize>>,
         inner: impl Future<Output = ()>,
     ) -> Vec<Event> {
         assert_source_compliance(&FILE_SOURCE_TAGS, async move {
@@ -2494,21 +2563,47 @@ mod tests {
                 log_namespace,
             ));
 
-            inner.await;
+            let result = if let Some(counter) = event_counter {
+                // Relay mode: a background task forwards events and increments
+                // the counter so `inner` can observe them without arbitrary sleeps.
+                let (relay_tx, mut relay_rx) = tokio::sync::mpsc::unbounded_channel::<Event>();
+                tokio::spawn(async move {
+                    let mut rx = rx;
+                    while let Some(event) = rx.next().await {
+                        counter.fetch_add(1, Ordering::SeqCst);
+                        let _ = relay_tx.send(event);
+                    }
+                });
 
-            drop(trigger_shutdown);
+                inner.await;
+                drop(trigger_shutdown);
 
-            let result = if acking_mode == Unfinalized {
-                rx.take_until(tokio::time::sleep(Duration::from_secs(5)))
-                    .collect::<Vec<_>>()
-                    .await
+                timeout(Duration::from_secs(5), async move {
+                    let mut events = Vec::new();
+                    while let Some(event) = relay_rx.recv().await {
+                        events.push(event);
+                    }
+                    events
+                })
+                .await
+                .expect("Unclosed channel: may indicate file-server could not shutdown gracefully.")
             } else {
-                timeout(Duration::from_secs(5), rx.collect::<Vec<_>>())
-                    .await
-                    .expect(
-                        "Unclosed channel: may indicate file-server could not shutdown gracefully.",
-                    )
+                inner.await;
+                drop(trigger_shutdown);
+
+                if acking_mode == Unfinalized {
+                    rx.take_until(tokio::time::sleep(Duration::from_secs(5)))
+                        .collect::<Vec<_>>()
+                        .await
+                } else {
+                    timeout(Duration::from_secs(5), rx.collect::<Vec<_>>())
+                        .await
+                        .expect(
+                            "Unclosed channel: may indicate file-server could not shutdown gracefully.",
+                        )
+                }
             };
+
             if wait_shutdown {
                 shutdown_done.await;
             }
diff --git a/src/test_util/mod.rs b/src/test_util/mod.rs
index 58b0ada3e8c6f..c2700ceeae2aa 100644
--- a/src/test_util/mod.rs
+++ b/src/test_util/mod.rs
@@ -554,6 +554,19 @@ where
     wait_for(|| ready(unblock(value.load(Ordering::SeqCst)))).await
 }
 
+pub async fn wait_for_atomic_usize_timeout_ms<T, F>(value: T, unblock: F, timeout_ms: u64)
+where
+    T: AsRef<AtomicUsize>,
+    F: Fn(usize) -> bool,
+{
+    let value = value.as_ref();
+    wait_for_duration(
+        || ready(unblock(value.load(Ordering::SeqCst))),
+        Duration::from_millis(timeout_ms),
+    )
+    .await
+}
+
 // Retries a func every `retry` duration until given an Ok(T); panics after `until` elapses
 pub async fn retry_until<'a, F, Fut, T, E>(mut f: F, retry: Duration, until: Duration) -> T
 where

From 610ea5c5c266fdb1e529c6303f3d68efaa4dd027 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 10:26:15 -0400
Subject: [PATCH 254/326] chore(deps): bump the docker-images group across 1
 directory with 2 updates (#25273)

Bumps the docker-images group with 2 updates in the /distribution/docker/distroless-libc directory: debian and distroless/cc-debian12.


Updates `debian` from `26f98cc` to `109e2c6`

Updates `distroless/cc-debian12` from `329e540` to `8474338`

---
updated-dependencies:
- dependency-name: debian
  dependency-version: trixie-slim
  dependency-type: direct:production
  dependency-group: docker-images
- dependency-name: distroless/cc-debian12
  dependency-version: latest
  dependency-type: direct:production
  dependency-group: docker-images
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 distribution/docker/distroless-libc/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/distribution/docker/distroless-libc/Dockerfile b/distribution/docker/distroless-libc/Dockerfile
index 08722b3d76f0a..3dd880354b1d0 100644
--- a/distribution/docker/distroless-libc/Dockerfile
+++ b/distribution/docker/distroless-libc/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/debian:trixie-slim@sha256:26f98ccd92fd0a44d6928ce8ff8f4921b4d2f535bfa07555ee5d18f61429cf0c AS builder
+FROM docker.io/debian:trixie-slim@sha256:109e2c65005bf160609e4ba6acf7783752f8502ad218e298253428690b9eaa4b AS builder
 
 WORKDIR /vector
 
@@ -15,7 +15,7 @@ RUN src=$(dpkg -L zlib1g | grep -E '/libz\.so\.1$') && \
 
 # distroless doesn't use static tags
 # hadolint ignore=DL3007
-FROM gcr.io/distroless/cc-debian12:latest@sha256:329e54034ce498f9c6b345044e8f530c6691f99e94a92446f68c0adf9baa8464
+FROM gcr.io/distroless/cc-debian12:latest@sha256:847433844c7e04bcf07a3a0f0f5a8de554c6df6fa9e3e3ab14d3f6b73d780235
 
 # https://github.com/opencontainers/image-spec/blob/main/annotations.md
 LABEL org.opencontainers.image.url="https://vector.dev"

From 227f66a94e5d8dd0a63320af31f2d07dd86a634a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 10:27:06 -0400
Subject: [PATCH 255/326] chore(deps): bump alpine from `2510918` to `5b10f43`
 in /distribution/docker/distroless-static in the docker-images group across 1
 directory (#25275)

chore(deps): bump alpine

Bumps the docker-images group with 1 update in the /distribution/docker/distroless-static directory: alpine.


Updates `alpine` from `2510918` to `5b10f43`

---
updated-dependencies:
- dependency-name: alpine
  dependency-version: '3.23'
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker-images
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 distribution/docker/distroless-static/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/distribution/docker/distroless-static/Dockerfile b/distribution/docker/distroless-static/Dockerfile
index e91eb6b3038f7..ee24bc2fc7aca 100644
--- a/distribution/docker/distroless-static/Dockerfile
+++ b/distribution/docker/distroless-static/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 AS builder
+FROM docker.io/alpine:3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 AS builder
 
 WORKDIR /vector
 

From d45cc2150ea78b7b86926dfada464bd7b9bc2586 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 10:27:20 -0400
Subject: [PATCH 256/326] chore(deps): bump alpine from `2510918` to `5b10f43`
 in /distribution/docker/alpine in the docker-images group across 1 directory
 (#25274)

chore(deps): bump alpine

Bumps the docker-images group with 1 update in the /distribution/docker/alpine directory: alpine.


Updates `alpine` from `2510918` to `5b10f43`

---
updated-dependencies:
- dependency-name: alpine
  dependency-version: '3.23'
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker-images
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 distribution/docker/alpine/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/distribution/docker/alpine/Dockerfile b/distribution/docker/alpine/Dockerfile
index f0cdf4210bc8f..7da74246e0826 100644
--- a/distribution/docker/alpine/Dockerfile
+++ b/distribution/docker/alpine/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 AS builder
+FROM docker.io/alpine:3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 AS builder
 
 WORKDIR /vector
 
@@ -12,7 +12,7 @@ RUN ARCH=$(if [ "$TARGETPLATFORM" = "linux/arm/v6" ]; then echo "arm"; else cat
 
 RUN mkdir -p /var/lib/vector
 
-FROM docker.io/alpine:3.23@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
+FROM docker.io/alpine:3.23@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11
 
 # https://github.com/opencontainers/image-spec/blob/main/annotations.md
 LABEL org.opencontainers.image.url="https://vector.dev"

From 43a4921376c44071082b6f83bdd9329d39ac82ab Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 14:27:40 +0000
Subject: [PATCH 257/326] chore(deps): bump debian from `26f98cc` to `cedb1ef`
 in /distribution/docker/debian in the docker-images group across 1 directory
 (#25272)

chore(deps): bump debian

Bumps the docker-images group with 1 update in the /distribution/docker/debian directory: debian.


Updates `debian` from `26f98cc` to `cedb1ef`

---
updated-dependencies:
- dependency-name: debian
  dependency-version: trixie-slim
  dependency-type: direct:production
  dependency-group: docker-images
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 distribution/docker/debian/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/distribution/docker/debian/Dockerfile b/distribution/docker/debian/Dockerfile
index 4922e12ef9a60..bbebc6fd48a0e 100644
--- a/distribution/docker/debian/Dockerfile
+++ b/distribution/docker/debian/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/debian:trixie-slim@sha256:26f98ccd92fd0a44d6928ce8ff8f4921b4d2f535bfa07555ee5d18f61429cf0c AS builder
+FROM docker.io/debian:trixie-slim@sha256:cedb1ef40439206b673ee8b33a46a03a0c9fa90bf3732f54704f99cb061d2c5a AS builder
 
 WORKDIR /vector
 
@@ -7,7 +7,7 @@ RUN dpkg -i vector_*_"$(dpkg --print-architecture)".deb
 
 RUN mkdir -p /var/lib/vector
 
-FROM docker.io/debian:trixie-slim@sha256:26f98ccd92fd0a44d6928ce8ff8f4921b4d2f535bfa07555ee5d18f61429cf0c
+FROM docker.io/debian:trixie-slim@sha256:cedb1ef40439206b673ee8b33a46a03a0c9fa90bf3732f54704f99cb061d2c5a
 
 # https://github.com/opencontainers/image-spec/blob/main/annotations.md
 LABEL org.opencontainers.image.url="https://vector.dev"

From 02f7271461ab0a12566aaf0f750bfc47c418a9ed Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 20 May 2026 10:36:42 -0400
Subject: [PATCH 258/326] chore(ci): consolidate dependabot cargo groups
 (#25465)

* chore(ci): bundle remaining cargo updates via catch-all dependabot groups

Add two catch-all groups at the end of the cargo ecosystem block so
updates that don't match any named group still get bundled into one PR
instead of generating one PR per crate:

- cargo-other: catches all non-patch version updates outside named groups
  (patches already has its own catch-all for patch-level bumps).
- cargo-security: catches all security updates outside aws-security.

Named groups (aws, tokio, serde, etc.) keep their precedence because
dependabot resolves groups in declaration order and these are listed
last.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(ci): drop redundant aws-security dependabot group

The new cargo-security catch-all (applies-to: security-updates, patterns: *)
already covers aws-* security updates, so aws-security is redundant. Removing
it keeps the security PR consolidated into a single group.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ade867f95145f..803d1df80a389 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -25,10 +25,6 @@ updates:
       aws:
         patterns:
           - "aws-*"
-      aws-security:
-        applies-to: security-updates
-        patterns:
-          - "aws-*"
       azure:
         patterns:
           - "azure_*"
@@ -86,6 +82,15 @@ updates:
       zstd:
         patterns:
           - "zstd*"
+
+      cargo-other:
+        applies-to: version-updates
+        patterns:
+          - "*"
+      cargo-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
   - package-ecosystem: "docker"
     directory: "/distribution/docker/alpine"
     schedule:

From f1717b53ae61022a65a69224ad012a7d3f5d961b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 10:39:17 -0400
Subject: [PATCH 259/326] chore(ci): bump docker/setup-qemu-action from 3.7.0
 to 4.0.0 (#25348)

Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.7.0 to 4.0.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/c7c53464625b32c7a7e944ae62b3e17d2b600130...ce360397dd3f832beb865e1373c09c0e9f86d70a)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c3f735b4308dd..3cab2b2687570 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -438,7 +438,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
         with:
           platforms: all
       - name: Set up Docker Buildx

From 54af3b0196887a3cb76e86b9dca0616c6eae2faf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 10:52:36 -0400
Subject: [PATCH 260/326] chore(deps): bump distroless/static from `47b2d72` to
 `3592aa8` in /distribution/docker/distroless-static in the docker-images
 group (#25467)

chore(deps): bump distroless/static

Bumps the docker-images group in /distribution/docker/distroless-static with 1 update: distroless/static.


Updates `distroless/static` from `47b2d72` to `3592aa8`

---
updated-dependencies:
- dependency-name: distroless/static
  dependency-version: latest
  dependency-type: direct:production
  dependency-group: docker-images
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 distribution/docker/distroless-static/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/distribution/docker/distroless-static/Dockerfile b/distribution/docker/distroless-static/Dockerfile
index ee24bc2fc7aca..fd1abf4d74960 100644
--- a/distribution/docker/distroless-static/Dockerfile
+++ b/distribution/docker/distroless-static/Dockerfile
@@ -9,7 +9,7 @@ RUN mkdir -p /var/lib/vector
 
 # distroless doesn't use static tags
 # hadolint ignore=DL3007
-FROM gcr.io/distroless/static:latest@sha256:47b2d72ff90843eb8a768b5c2f89b40741843b639d065b9b937b07cd59b479c6
+FROM gcr.io/distroless/static:latest@sha256:3592aa8171c77482f62bbc4164e6a2d141c6122554ace66e5cc910cadb961ff0
 
 # https://github.com/opencontainers/image-spec/blob/main/annotations.md
 LABEL org.opencontainers.image.url="https://vector.dev"

From 1a451bd3c99dc584fb96831f0a12baa672159721 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 14:53:18 +0000
Subject: [PATCH 261/326] chore(deps): bump the docker-images group in
 /distribution/docker/distroless-libc with 2 updates (#25466)

chore(deps): bump the docker-images group

Bumps the docker-images group in /distribution/docker/distroless-libc with 2 updates: debian and distroless/cc-debian12.


Updates `debian` from `109e2c6` to `b6e2a15`

Updates `distroless/cc-debian12` from `8474338` to `aa0b7af`

---
updated-dependencies:
- dependency-name: debian
  dependency-version: trixie-slim
  dependency-type: direct:production
  dependency-group: docker-images
- dependency-name: distroless/cc-debian12
  dependency-version: latest
  dependency-type: direct:production
  dependency-group: docker-images
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 distribution/docker/distroless-libc/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/distribution/docker/distroless-libc/Dockerfile b/distribution/docker/distroless-libc/Dockerfile
index 3dd880354b1d0..c78cda7e7d7ee 100644
--- a/distribution/docker/distroless-libc/Dockerfile
+++ b/distribution/docker/distroless-libc/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/debian:trixie-slim@sha256:109e2c65005bf160609e4ba6acf7783752f8502ad218e298253428690b9eaa4b AS builder
+FROM docker.io/debian:trixie-slim@sha256:b6e2a152f22a40ff69d92cb397223c906017e1391a73c952b588e51af8883bf8 AS builder
 
 WORKDIR /vector
 
@@ -15,7 +15,7 @@ RUN src=$(dpkg -L zlib1g | grep -E '/libz\.so\.1$') && \
 
 # distroless doesn't use static tags
 # hadolint ignore=DL3007
-FROM gcr.io/distroless/cc-debian12:latest@sha256:847433844c7e04bcf07a3a0f0f5a8de554c6df6fa9e3e3ab14d3f6b73d780235
+FROM gcr.io/distroless/cc-debian12:latest@sha256:aa0b7af67fa8211751ea6e00baa8373ba56cc1417ffc986ec9619bd0e1556b56
 
 # https://github.com/opencontainers/image-spec/blob/main/annotations.md
 LABEL org.opencontainers.image.url="https://vector.dev"

From fd1d4518a16d0bef8a03df87536be7105da8e0d0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 10:53:27 -0400
Subject: [PATCH 262/326] chore(deps): bump debian from `cedb1ef` to `b6e2a15`
 in /distribution/docker/debian in the docker-images group (#25468)

chore(deps): bump debian

Bumps the docker-images group in /distribution/docker/debian with 1 update: debian.


Updates `debian` from `cedb1ef` to `b6e2a15`

---
updated-dependencies:
- dependency-name: debian
  dependency-version: trixie-slim
  dependency-type: direct:production
  dependency-group: docker-images
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 distribution/docker/debian/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/distribution/docker/debian/Dockerfile b/distribution/docker/debian/Dockerfile
index bbebc6fd48a0e..6f1d232a0a163 100644
--- a/distribution/docker/debian/Dockerfile
+++ b/distribution/docker/debian/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/debian:trixie-slim@sha256:cedb1ef40439206b673ee8b33a46a03a0c9fa90bf3732f54704f99cb061d2c5a AS builder
+FROM docker.io/debian:trixie-slim@sha256:b6e2a152f22a40ff69d92cb397223c906017e1391a73c952b588e51af8883bf8 AS builder
 
 WORKDIR /vector
 
@@ -7,7 +7,7 @@ RUN dpkg -i vector_*_"$(dpkg --print-architecture)".deb
 
 RUN mkdir -p /var/lib/vector
 
-FROM docker.io/debian:trixie-slim@sha256:cedb1ef40439206b673ee8b33a46a03a0c9fa90bf3732f54704f99cb061d2c5a
+FROM docker.io/debian:trixie-slim@sha256:b6e2a152f22a40ff69d92cb397223c906017e1391a73c952b588e51af8883bf8
 
 # https://github.com/opencontainers/image-spec/blob/main/annotations.md
 LABEL org.opencontainers.image.url="https://vector.dev"

From 35c7d5a844ebacabe57e44e29e06b679ab8ea1bf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 15:10:22 +0000
Subject: [PATCH 263/326] chore(deps): bump serde_with from 3.18.0 to 3.20.0 in
 the serde group (#25474)

* chore(deps): bump serde_with from 3.18.0 to 3.20.0 in the serde group

Bumps the serde group with 1 update: [serde_with](https://github.com/jonasbb/serde_with).


Updates `serde_with` from 3.18.0 to 3.20.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](https://github.com/jonasbb/serde_with/compare/v3.18.0...v3.20.0)

---
updated-dependencies:
- dependency-name: serde_with
  dependency-version: 3.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serde
...

Signed-off-by: dependabot[bot] <support@github.com>

* update licenses

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 Cargo.lock           | 18 ++++++++++++++----
 Cargo.toml           |  2 +-
 LICENSE-3rdparty.csv |  1 +
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 265e2e38e7d8e..f8841d4be18e1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2296,6 +2296,15 @@ dependencies = [
  "alloc-stdlib",
 ]
 
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
 [[package]]
 name = "bson"
 version = "2.15.0"
@@ -10590,11 +10599,12 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.18.0"
+version = "3.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd5414fad8e6907dbdd5bc441a50ae8d6e26151a03b1de04d89a5576de61d01f"
+checksum = "e72c1c2cb7b223fafb600a619537a871c2818583d619401b785e7c0b746ccde2"
 dependencies = [
  "base64 0.22.1",
+ "bs58",
  "chrono",
  "hex",
  "indexmap 1.9.3",
@@ -10609,9 +10619,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.18.0"
+version = "3.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3db8978e608f1fe7357e211969fd9abdcae80bac1ba7a3369bb7eb6b404eb65"
+checksum = "b90c488738ecb4fb0262f41f43bc40efc5868d9fb744319ddf5f5317f417bfac"
 dependencies = [
  "darling 0.23.0",
  "proc-macro2 1.0.106",
diff --git a/Cargo.toml b/Cargo.toml
index f10e1c4a638e7..3290b7192da7d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -190,7 +190,7 @@ rust_decimal = { version = "1.40.0", default-features = false, features = ["std"
 semver = { version = "1.0.28", default-features = false, features = ["serde", "std"] }
 serde = { version = "1.0.219", default-features = false, features = ["alloc", "derive", "rc"] }
 serde_json = { version = "1.0.149", default-features = false, features = ["preserve_order", "raw_value", "std"] }
-serde_with = { version = "3.18.0", default-features = false, features = ["std", "macros", "chrono_0_4"] }
+serde_with = { version = "3.20.0", default-features = false, features = ["std", "macros", "chrono_0_4"] }
 serde_yaml = { version = "0.9.34", default-features = false }
 snafu = { version = "0.9.0", default-features = false, features = ["futures", "std"] }
 socket2 = { version = "0.5.10", default-features = false }
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index b66b8aaf51d59..fa77ca0482eb8 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -129,6 +129,7 @@ borsh,https://github.com/near/borsh-rs,MIT OR Apache-2.0,Near Inc <hello@near.or
 borsh-derive,https://github.com/near/borsh-rs,Apache-2.0,Near Inc <hello@nearprotocol.com>
 brotli,https://github.com/dropbox/rust-brotli,BSD-3-Clause AND MIT,"Daniel Reiter Horn <danielrh@dropbox.com>, The Brotli Authors"
 brotli-decompressor,https://github.com/dropbox/rust-brotli-decompressor,BSD-3-Clause OR MIT,"Daniel Reiter Horn <danielrh@dropbox.com>, The Brotli Authors"
+bs58,https://github.com/Nullus157/bs58-rs,MIT OR Apache-2.0,The bs58 Authors
 bson,https://github.com/mongodb/bson-rust,MIT,"Y. T. Chung <zonyitoo@gmail.com>, Kevin Yeh <kevinyeah@utexas.edu>, Saghm Rossi <saghmrossi@gmail.com>, Patrick Freed <patrick.freed@mongodb.com>, Isabel Atkinson <isabel.atkinson@mongodb.com>, Abraham Egnor <abraham.egnor@mongodb.com>"
 bstr,https://github.com/BurntSushi/bstr,MIT OR Apache-2.0,Andrew Gallant <jamslam@gmail.com>
 bumpalo,https://github.com/fitzgen/bumpalo,MIT OR Apache-2.0,Nick Fitzgerald <fitzgen@gmail.com>

From f3828fe8e6ecdad8355216001c40abdc93c7a59f Mon Sep 17 00:00:00 2001
From: Karol Chrapek <kchrapek@zendesk.com>
Date: Wed, 20 May 2026 18:16:13 +0200
Subject: [PATCH 264/326] enhancement(tag_cardinality_limit transform): add
 exclude_tags option to bypass cardinality limiting (#25316)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* enhancement(tag_cardinality_limit transform): add top-level per_tag_limits

Adds a `per_tag_limits` map at the top level of the `tag_cardinality_limit`
config, reusing the `PerTagConfig` / `PerTagMode` types introduced in #25360
for the per-metric variant. Each entry uses the same `mode: limit_override`
(with a custom `value_limit`) or `mode: excluded` shape, applied to every
metric that does not match a `per_metric_limits` entry.

Per-metric overrides shadow the global per-tag map: a matched metric only
consults its own `per_tag_limits` (consistent with how the rest of the
transform resolves per-metric vs. global config).

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(tag_cardinality_limit transform): preserve untracked passthrough when value_limit is zero

`tag_limit_exceeded` previously returned `true` for any missing-bucket lookup when
`value_limit == 0`, which under `drop_event` caused events to be rejected before
`record_tag_value` could detect that `max_tracked_keys` was exhausted. New
(metric, tag-key) pairs that cannot be allocated must instead pass through
unchecked and emit `tag_cardinality_untracked_events_total`. Guard the
`value_limit == 0` rejection on `can_allocate_new_key()` so the untracked path
runs whenever the pair would not actually be tracked.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs(tag_cardinality_limit transform): explain global per_tag_limits with example

Address review feedback from @pront: the field doc comment was correct but
dense. Move the precedence rules and a worked YAML example into a new
"Per-tag overrides" section under "How it works", and trim the field
doc-comment to a one-line description that points at the new section.

Also fix CRLF → LF line endings in the changelog fragment caught by
`vdev check fmt`.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 ...nality_limit_global_per_tag.enhancement.md |   6 +
 .../tag_cardinality_limit/config.rs           |  14 +
 src/transforms/tag_cardinality_limit/mod.rs   |  35 +-
 src/transforms/tag_cardinality_limit/tests.rs | 330 ++++++++++++++++++
 .../generated/tag_cardinality_limit.cue       |  37 ++
 .../transforms/tag_cardinality_limit.cue      |  56 +++
 6 files changed, 472 insertions(+), 6 deletions(-)
 create mode 100644 changelog.d/tag_cardinality_limit_global_per_tag.enhancement.md

diff --git a/changelog.d/tag_cardinality_limit_global_per_tag.enhancement.md b/changelog.d/tag_cardinality_limit_global_per_tag.enhancement.md
new file mode 100644
index 0000000000000..37d26ffaaed89
--- /dev/null
+++ b/changelog.d/tag_cardinality_limit_global_per_tag.enhancement.md
@@ -0,0 +1,6 @@
+The `tag_cardinality_limit` transform now accepts a top-level `per_tag_limits` map,
+mirroring the per-metric one: `mode: limit_override` to set a per-tag cap, or
+`mode: excluded` to bypass cardinality tracking for that tag on every metric without a
+`per_metric_limits` entry.
+
+authors: kaarolch
diff --git a/src/transforms/tag_cardinality_limit/config.rs b/src/transforms/tag_cardinality_limit/config.rs
index 8f53711214910..a1471746972fa 100644
--- a/src/transforms/tag_cardinality_limit/config.rs
+++ b/src/transforms/tag_cardinality_limit/config.rs
@@ -49,6 +49,19 @@ pub struct Config {
     )]
     #[serde(default)]
     pub per_metric_limits: HashMap<String, PerMetricConfig>,
+
+    /// Global per-tag-key overrides, applied to every metric that does not match a
+    /// `per_metric_limits` entry. Each entry sets `mode: limit_override` (with a
+    /// per-tag `value_limit`) or `mode: excluded` (bypass tracking for that tag).
+    ///
+    /// See the "Per-tag overrides" section under "How it works" for a worked example
+    /// and the precedence rules.
+    #[configurable(
+        derived,
+        metadata(docs::additional_props_description = "An individual tag configuration.")
+    )]
+    #[serde(default)]
+    pub per_tag_limits: HashMap<String, PerTagConfig>,
 }
 
 /// Controls how tag tracking state is partitioned across metrics.
@@ -311,6 +324,7 @@ impl GenerateConfig for Config {
             tracking_scope: TrackingScope::default(),
             max_tracked_keys: None,
             per_metric_limits: HashMap::default(),
+            per_tag_limits: HashMap::default(),
         })
         .unwrap()
     }
diff --git a/src/transforms/tag_cardinality_limit/mod.rs b/src/transforms/tag_cardinality_limit/mod.rs
index f037d70b44673..471d44661d752 100644
--- a/src/transforms/tag_cardinality_limit/mod.rs
+++ b/src/transforms/tag_cardinality_limit/mod.rs
@@ -87,24 +87,30 @@ impl TagCardinalityLimit {
     /// Per-tag entries support two modes:
     /// - `mode: limit_override` — uses the per-tag `value_limit`; all other settings
     ///   (`mode`, `cache_size_per_key`, `limit_exceeded_action`, `internal_metrics`)
-    ///   are inherited from the per-metric config.
+    ///   are inherited from the enclosing per-metric (or, for global overrides, the
+    ///   global) config.
     /// - `mode: excluded` — opts the tag out entirely; all values pass through.
     ///
     /// Per-metric exclusion is blanket: `mode: excluded` on a per-metric entry opts out
     /// every tag on that metric and `per_tag_limits` is ignored.
+    ///
+    /// Per-metric `per_tag_limits` take precedence over the top-level
+    /// `Config::per_tag_limits`: when a metric matches a per-metric entry, the global
+    /// per-tag overrides are not consulted for that metric.
     fn get_config_for_metric_tag(
         &self,
         metric_key: Option<&MetricId>,
         tag_key: &str,
     ) -> TagSettings {
-        // No matching per-metric override → use the global config as-is.
+        // No matching per-metric override → use the global config, with global
+        // per-tag overrides layered on top.
         let Some((metric_namespace, metric_name)) = metric_key else {
-            return TagSettings::Tracked(self.config.global);
+            return self.apply_global_per_tag(tag_key);
         };
         let Some((_, per_metric)) = self.config.per_metric_limits.iter().find(|(name, cfg)| {
             *name == metric_name && (cfg.namespace.is_none() || cfg.namespace == *metric_namespace)
         }) else {
-            return TagSettings::Tracked(self.config.global);
+            return self.apply_global_per_tag(tag_key);
         };
 
         // Per-metric exclusion is blanket — per-tag overrides do not apply.
@@ -140,6 +146,20 @@ impl TagCardinalityLimit {
         })
     }
 
+    /// Apply the top-level `per_tag_limits` (if any) on top of the global `Inner`.
+    /// Used for metrics that do not match any `per_metric_limits` entry.
+    fn apply_global_per_tag(&self, tag_key: &str) -> TagSettings {
+        let global = self.config.global;
+        match self.config.per_tag_limits.get(tag_key).map(|c| c.mode) {
+            Some(PerTagMode::Excluded) => TagSettings::Excluded,
+            Some(PerTagMode::LimitOverride { value_limit }) => TagSettings::Tracked(Inner {
+                value_limit,
+                ..global
+            }),
+            None => TagSettings::Tracked(global),
+        }
+    }
+
     /// Returns the `limit_exceeded_action` that applies to this metric. Decided once per event:
     /// per-metric override if any, else global.
     fn metric_action(&self, metric_key: Option<&MetricId>) -> LimitExceededAction {
@@ -237,9 +257,12 @@ impl TagCardinalityLimit {
             Some(value_set) if value_set.contains(value) => false,
             // Adding this value would push us at or past the configured cap. Treat a
             // missing bucket as an empty set so `value_limit: 0` correctly rejects
-            // the first occurrence too.
+            // the first occurrence too — but only when the (metric, tag) pair would
+            // actually be tracked. If `max_tracked_keys` is exhausted, `record_tag_value`
+            // will pass the tag through unchecked and emit `TagCardinalityLimitUntracked`,
+            // so we must not pre-empt that path by reporting the limit as exceeded here.
             Some(value_set) => value_set.len() >= resolved.value_limit,
-            None => resolved.value_limit == 0,
+            None => resolved.value_limit == 0 && self.can_allocate_new_key(),
         }
     }
 
diff --git a/src/transforms/tag_cardinality_limit/tests.rs b/src/transforms/tag_cardinality_limit/tests.rs
index 6d7ad5aefbf73..b8a453a3c4844 100644
--- a/src/transforms/tag_cardinality_limit/tests.rs
+++ b/src/transforms/tag_cardinality_limit/tests.rs
@@ -60,6 +60,7 @@ fn make_transform_hashset(
         tracking_scope: TrackingScope::default(),
         max_tracked_keys: None,
         per_metric_limits: HashMap::new(),
+        per_tag_limits: HashMap::new(),
     }
 }
 
@@ -76,6 +77,7 @@ fn make_transform_bloom(value_limit: usize, limit_exceeded_action: LimitExceeded
         tracking_scope: TrackingScope::default(),
         max_tracked_keys: None,
         per_metric_limits: HashMap::new(),
+        per_tag_limits: HashMap::new(),
     }
 }
 
@@ -94,6 +96,7 @@ fn make_transform_hashset_with_per_metric_limits(
         tracking_scope: TrackingScope::default(),
         max_tracked_keys: None,
         per_metric_limits,
+        per_tag_limits: HashMap::new(),
     }
 }
 
@@ -114,6 +117,27 @@ fn make_transform_bloom_with_per_metric_limits(
         tracking_scope: TrackingScope::default(),
         max_tracked_keys: None,
         per_metric_limits,
+        per_tag_limits: HashMap::new(),
+    }
+}
+
+fn make_transform_with_global_per_tag_limits(
+    value_limit: usize,
+    limit_exceeded_action: LimitExceededAction,
+    mode: Mode,
+    per_tag_limits: HashMap<String, PerTagConfig>,
+) -> Config {
+    Config {
+        global: Inner {
+            value_limit,
+            limit_exceeded_action,
+            mode,
+            internal_metrics: InternalMetricsConfig::default(),
+        },
+        tracking_scope: TrackingScope::default(),
+        max_tracked_keys: None,
+        per_metric_limits: HashMap::new(),
+        per_tag_limits,
     }
 }
 
@@ -733,6 +757,66 @@ fn max_tracked_keys_unlimited_by_default() {
     }
 }
 
+/// Regression: with `value_limit: 0`, `limit_exceeded_action: drop_event`, and
+/// `max_tracked_keys` exhausted, the documented untracked-passthrough behavior must
+/// still apply. `tag_limit_exceeded` previously rejected *any* missing-bucket lookup
+/// when `value_limit == 0`, causing events to be dropped before `record_tag_value`
+/// could detect the allocation cap. New (metric, tag-key) pairs that cannot be
+/// allocated must instead pass through unchecked.
+#[test]
+fn max_tracked_keys_passthrough_with_zero_value_limit_drop_event() {
+    // metric_a uses a normal per-metric override with room for a value, so the first
+    // event reserves the only allocation slot. metric_b inherits the global config,
+    // which combines `value_limit: 0` + `drop_event` — the corner case that originally
+    // dropped events even when the pair couldn't be tracked.
+    let config = make_transform_hashset_with_per_metric_limits(
+        0,
+        LimitExceededAction::DropEvent,
+        HashMap::from([(
+            "metric_a".to_string(),
+            make_per_metric(5, LimitExceededAction::DropEvent, HashMap::new()),
+        )]),
+    );
+    let mut transform = {
+        let mut c = config;
+        c.tracking_scope = TrackingScope::PerMetric;
+        c.max_tracked_keys = Some(1);
+        TagCardinalityLimit::new(c)
+    };
+
+    // metric_a consumes the only allocation slot (its per-metric value_limit is 5).
+    let a1 = make_metric_with_name(metric_tags!("tag" => "v1"), "metric_a");
+    assert_eq!(transform.transform_one(a1.clone()), Some(a1));
+
+    // metric_b inherits the global config: value_limit=0, drop_event. A new
+    // (metric_b, "tag") pair would need a fresh bucket, but max_tracked_keys is
+    // already at the cap. The event MUST pass through unchecked rather than being
+    // dropped by the value_limit=0 guard.
+    let untracked = make_metric_with_name(metric_tags!("tag" => "v2"), "metric_b");
+    assert_eq!(
+        transform.transform_one(untracked.clone()),
+        Some(untracked),
+        "untracked pair beyond max_tracked_keys must not trigger DropEvent under value_limit=0"
+    );
+
+    // A second distinct value for the same untracked pair also passes through:
+    // no bucket exists, no enforcement applies.
+    let untracked2 = make_metric_with_name(metric_tags!("tag" => "v3"), "metric_b");
+    assert_eq!(
+        transform.transform_one(untracked2.clone()),
+        Some(untracked2)
+    );
+
+    // metric_b never allocated any storage.
+    assert!(
+        transform
+            .accepted_tags
+            .get(&Some((None, "metric_b".to_string())))
+            .is_none(),
+        "untracked pair must not occupy a tracking bucket"
+    );
+}
+
 /// With `tracking_scope: per_metric`, the cap is enforced across *all* per-metric
 /// buckets — not per bucket. Once the cap is hit, further metrics pass through
 /// unchecked.
@@ -1131,3 +1215,249 @@ per_metric_limits:
     let excluded = per_metric.per_tag_limits.get("excluded_tag").unwrap();
     assert_eq!(excluded.mode, PerTagMode::Excluded);
 }
+
+// ============================================================================
+// Global per_tag_limits tests (top-level `Config::per_tag_limits`)
+//
+// Mirror the per-metric per-tag suite: covers `excluded` and `limit_override`
+// at the global level, fallback semantics, and YAML deserialization.
+// ============================================================================
+
+#[test]
+fn global_per_tag_excluded_drop_tag_passthrough_hashset() {
+    global_per_tag_excluded_drop_tag_passthrough(Mode::Exact);
+}
+
+#[test]
+fn global_per_tag_excluded_drop_tag_passthrough_bloom() {
+    global_per_tag_excluded_drop_tag_passthrough(Mode::Probabilistic(BloomFilterConfig {
+        cache_size_per_key: default_cache_size(),
+    }));
+}
+
+/// A globally-excluded tag passes through unchanged on every metric, even when its values
+/// would have exceeded `value_limit`. Sibling non-excluded tags still respect the limit.
+fn global_per_tag_excluded_drop_tag_passthrough(mode: Mode) {
+    let config = make_transform_with_global_per_tag_limits(
+        2,
+        LimitExceededAction::DropTag,
+        mode,
+        HashMap::from([("kube_pod_name".to_string(), make_per_tag_excluded())]),
+    );
+    let mut transform = TagCardinalityLimit::new(config);
+
+    let event1 = make_metric(metric_tags!("kube_pod_name" => "pod-a", "tag1" => "val1"));
+    let event2 = make_metric(metric_tags!("kube_pod_name" => "pod-b", "tag1" => "val2"));
+    // value_limit=2 is hit on tag1, but kube_pod_name keeps passing through.
+    let event3 = make_metric(metric_tags!("kube_pod_name" => "pod-c", "tag1" => "val3"));
+
+    let new_event1 = transform.transform_one(event1).unwrap();
+    let new_event2 = transform.transform_one(event2).unwrap();
+    let new_event3 = transform.transform_one(event3).unwrap();
+
+    for ev in [&new_event1, &new_event2, &new_event3] {
+        assert!(
+            ev.as_metric().tags().unwrap().contains_key("kube_pod_name"),
+            "excluded tag should always pass through"
+        );
+    }
+    assert_eq!(
+        "val1",
+        new_event1.as_metric().tags().unwrap().get("tag1").unwrap()
+    );
+    assert_eq!(
+        "val2",
+        new_event2.as_metric().tags().unwrap().get("tag1").unwrap()
+    );
+    assert!(
+        !new_event3.as_metric().tags().unwrap().contains_key("tag1"),
+        "non-excluded tag should still be subject to the limit"
+    );
+}
+
+#[test]
+fn global_per_tag_excluded_drop_event_passthrough_hashset() {
+    global_per_tag_excluded_drop_event_passthrough(Mode::Exact);
+}
+
+#[test]
+fn global_per_tag_excluded_drop_event_passthrough_bloom() {
+    global_per_tag_excluded_drop_event_passthrough(Mode::Probabilistic(BloomFilterConfig {
+        cache_size_per_key: default_cache_size(),
+    }));
+}
+
+/// Under `DropEvent`, a globally-excluded tag never triggers a drop, but a non-excluded
+/// tag exceeding `value_limit` still does.
+fn global_per_tag_excluded_drop_event_passthrough(mode: Mode) {
+    let config = make_transform_with_global_per_tag_limits(
+        2,
+        LimitExceededAction::DropEvent,
+        mode,
+        HashMap::from([("kube_pod_name".to_string(), make_per_tag_excluded())]),
+    );
+    let mut transform = TagCardinalityLimit::new(config);
+
+    let event1 = make_metric(metric_tags!("kube_pod_name" => "pod-a", "tag1" => "val1"));
+    let event2 = make_metric(metric_tags!("kube_pod_name" => "pod-b", "tag1" => "val2"));
+    // 3rd value on non-excluded tag1 → DropEvent.
+    let event3 = make_metric(metric_tags!("kube_pod_name" => "pod-c", "tag1" => "val3"));
+    // tag1 reuses an accepted value, so a new pod name alone must not drop the event.
+    let event4 = make_metric(metric_tags!("kube_pod_name" => "pod-d", "tag1" => "val1"));
+
+    assert_eq!(transform.transform_one(event1.clone()), Some(event1));
+    assert_eq!(transform.transform_one(event2.clone()), Some(event2));
+    assert_eq!(transform.transform_one(event3), None);
+    assert_eq!(transform.transform_one(event4.clone()), Some(event4));
+}
+
+/// A globally-excluded tag must never enter the cache, even after seeing many distinct
+/// values. Asserting directly on `accepted_tags` pins the "never allocate" contract.
+#[test]
+fn global_per_tag_excluded_never_populates_cache() {
+    let config = make_transform_with_global_per_tag_limits(
+        2,
+        LimitExceededAction::DropTag,
+        Mode::Exact,
+        HashMap::from([("kube_pod_name".to_string(), make_per_tag_excluded())]),
+    );
+    let mut transform = TagCardinalityLimit::new(config);
+
+    for i in 0..10 {
+        let event = make_metric(metric_tags!(
+            "kube_pod_name" => format!("pod-{i}").as_str(),
+            "tag1" => "val1"
+        ));
+        transform.transform_one(event).unwrap();
+    }
+
+    let bucket = transform
+        .accepted_tags
+        .get(&None)
+        .expect("non-excluded tag1 should still allocate a global bucket");
+    assert!(
+        bucket.contains_key("tag1"),
+        "non-excluded tag must still be tracked"
+    );
+    assert!(
+        !bucket.contains_key("kube_pod_name"),
+        "excluded tag key must never enter the cache"
+    );
+}
+
+/// A global `LimitOverride` caps that tag at its own `value_limit` even though the global
+/// `value_limit` is much higher. Other tags continue to use the global limit.
+#[test]
+fn global_per_tag_limit_override_caps_at_explicit_value() {
+    let config = make_transform_with_global_per_tag_limits(
+        500,
+        LimitExceededAction::DropTag,
+        Mode::Exact,
+        HashMap::from([("tag1".to_string(), make_per_tag(2))]),
+    );
+    let mut transform = TagCardinalityLimit::new(config);
+
+    // First 2 values pass (per-tag limit = 2).
+    for v in ["v0", "v1"] {
+        let e = transform
+            .transform_one(make_metric(metric_tags!("tag1" => v)))
+            .unwrap();
+        assert_eq!(v, e.as_metric().tags().unwrap().get("tag1").unwrap());
+    }
+
+    // 3rd value dropped — proves the per-tag limit (2) applies, not the global (500).
+    let e3 = transform
+        .transform_one(make_metric(metric_tags!("tag1" => "v2")))
+        .unwrap();
+    assert!(!e3.as_metric().tags().unwrap().contains_key("tag1"));
+
+    // tag2 has no override → still uses the global limit (500), so we can push a new value.
+    let e_other = transform
+        .transform_one(make_metric(metric_tags!("tag2" => "v0")))
+        .unwrap();
+    assert_eq!(
+        "v0",
+        e_other.as_metric().tags().unwrap().get("tag2").unwrap()
+    );
+}
+
+/// Per-metric `per_tag_limits` shadows the global `per_tag_limits` for matched metrics:
+/// when a metric has its own `per_metric_limits` entry, the global per-tag overrides are
+/// not consulted for that metric. Metrics without a per-metric entry continue to use the
+/// global per-tag overrides.
+#[test]
+fn global_per_tag_overridden_by_per_metric_entry() {
+    let config = Config {
+        global: Inner {
+            value_limit: 2,
+            limit_exceeded_action: LimitExceededAction::DropTag,
+            mode: Mode::Exact,
+            internal_metrics: InternalMetricsConfig::default(),
+        },
+        tracking_scope: TrackingScope::default(),
+        max_tracked_keys: None,
+        per_metric_limits: HashMap::from([(
+            "metricA".to_string(),
+            make_per_metric(5, LimitExceededAction::DropTag, HashMap::new()),
+        )]),
+        per_tag_limits: HashMap::from([("tag1".to_string(), make_per_tag_excluded())]),
+    };
+    let mut transform = TagCardinalityLimit::new(config);
+
+    // metricA matches per_metric_limits → global per_tag_limits is ignored.
+    // tag1 must therefore be tracked under metricA's per-metric `value_limit: 5`.
+    for v in ["a0", "a1", "a2", "a3", "a4"] {
+        let e = transform
+            .transform_one(make_metric_with_name(metric_tags!("tag1" => v), "metricA"))
+            .unwrap();
+        assert_eq!(v, e.as_metric().tags().unwrap().get("tag1").unwrap());
+    }
+    // 6th value on metricA's tag1 must be dropped: per-metric limit reached.
+    let dropped = transform
+        .transform_one(make_metric_with_name(
+            metric_tags!("tag1" => "a5"),
+            "metricA",
+        ))
+        .unwrap();
+    assert!(
+        !dropped.as_metric().tags().unwrap().contains_key("tag1"),
+        "per-metric per_tag_limits is empty → metricA falls back to per-metric value_limit, \
+         not the global excluded entry"
+    );
+
+    // metricB has no per-metric entry → global `tag1: excluded` applies, so values pass
+    // through unbounded even though the global value_limit is 2.
+    for v in ["b0", "b1", "b2", "b3", "b4"] {
+        let e = transform
+            .transform_one(make_metric_with_name(metric_tags!("tag1" => v), "metricB"))
+            .unwrap();
+        assert_eq!(
+            v,
+            e.as_metric().tags().unwrap().get("tag1").unwrap(),
+            "globally-excluded tag should pass through on unmatched metrics"
+        );
+    }
+}
+
+/// Global per-tag YAML syntax mirrors per-metric `per_tag_limits`: `mode: limit_override`
+/// with `value_limit`, and `mode: excluded`.
+#[test]
+fn global_per_tag_modes_deserialize() {
+    let yaml = r#"
+value_limit: 5
+mode: exact
+per_tag_limits:
+  capped_tag:
+    mode: limit_override
+    value_limit: 10
+  excluded_tag:
+    mode: excluded
+"#;
+    let parsed: Config = serde_yaml::from_str(yaml).expect("yaml should deserialize");
+
+    let capped = parsed.per_tag_limits.get("capped_tag").unwrap();
+    assert_eq!(capped.mode, PerTagMode::LimitOverride { value_limit: 10 });
+
+    let excluded = parsed.per_tag_limits.get("excluded_tag").unwrap();
+    assert_eq!(excluded.mode, PerTagMode::Excluded);
+}
diff --git a/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue b/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue
index 6f5a7be575b57..fe47c37655f90 100644
--- a/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue
+++ b/website/cue/reference/components/transforms/generated/tag_cardinality_limit.cue
@@ -185,6 +185,43 @@ generated: components: transforms: tag_cardinality_limit: configuration: {
 			}
 		}
 	}
+	per_tag_limits: {
+		description: """
+			Global per-tag-key overrides, applied to every metric that does not match a
+			`per_metric_limits` entry. Each entry sets `mode: limit_override` (with a
+			per-tag `value_limit`) or `mode: excluded` (bypass tracking for that tag).
+
+			See the "Per-tag overrides" section under "How it works" for a worked example
+			and the precedence rules.
+			"""
+		required: false
+		type: object: options: "*": {
+			description: "An individual tag configuration."
+			required:    true
+			type: object: options: {
+				mode: {
+					description: "Controls how this tag key is handled."
+					required:    true
+					type: string: enum: {
+						excluded: """
+																			Opt this tag out of cardinality tracking entirely. All values pass through
+																			without being recorded or checked against any `value_limit`.
+																			"""
+						limit_override: """
+																			Track this tag with a per-tag value limit. The enclosing per-metric tracking
+																			algorithm and all other settings still apply.
+																			"""
+					}
+				}
+				value_limit: {
+					description:   "Maximum number of distinct values to accept for this tag key."
+					relevant_when: "mode = \"limit_override\""
+					required:      true
+					type: uint: {}
+				}
+			}
+		}
+	}
 	tracking_scope: {
 		description: "Controls how tag tracking state is partitioned across metrics."
 		required:    false
diff --git a/website/cue/reference/components/transforms/tag_cardinality_limit.cue b/website/cue/reference/components/transforms/tag_cardinality_limit.cue
index 2b291b905409e..91cf2962185b4 100644
--- a/website/cue/reference/components/transforms/tag_cardinality_limit.cue
+++ b/website/cue/reference/components/transforms/tag_cardinality_limit.cue
@@ -164,6 +164,62 @@ components: transforms: tag_cardinality_limit: {
 				for more info.
 				"""
 		}
+
+		per_tag_limits: {
+			title: "Per-tag overrides"
+			body: """
+				`per_tag_limits` lets you override the cardinality settings for individual
+				tag keys instead of changing the metric-level `value_limit`. It is supported
+				at two scopes — the top level (applies to every metric that does not match a
+				`per_metric_limits` entry) and inside a `per_metric_limits.<name>` block
+				(applies only to that metric).
+
+				Each entry uses one of two `mode` values:
+
+				- `mode: limit_override` — track the tag with its own `value_limit`,
+				  independent of the surrounding metric's `value_limit`.
+				- `mode: excluded` — bypass cardinality tracking for this tag entirely.
+				  Values pass through unchanged on every event, are not counted against any
+				  `value_limit`, and are never added to the cache.
+
+				```yaml
+				type: tag_cardinality_limit
+				value_limit: 500
+				mode: exact
+
+				# Applies to every metric that does NOT match a per_metric_limits entry below.
+				per_tag_limits:
+				  kube_pod_name:
+				    # High cardinality is intentional for this tag — never track it.
+				    mode: excluded
+				  request_id:
+				    # Tighten the cap for this tag without lowering the metric-level limit.
+				    mode: limit_override
+				    value_limit: 50
+
+				per_metric_limits:
+				  http_requests_total:
+				    value_limit: 1000
+				    mode: exact
+				    # This metric has its own per-tag rules. The top-level per_tag_limits
+				    # above is IGNORED for http_requests_total — `kube_pod_name` on this
+				    # metric is therefore tracked against value_limit=1000.
+				    per_tag_limits:
+				      trace_id:
+				        mode: excluded
+				```
+
+				Precedence is "nearest wins":
+
+				1. If the metric matches a `per_metric_limits` entry, only that entry's
+				   `per_tag_limits` is consulted; the top-level `per_tag_limits` is ignored
+				   for that metric. (This mirrors how a per-metric `value_limit` shadows the
+				   global `value_limit`.)
+				2. Otherwise, the top-level `per_tag_limits` is consulted.
+				3. Tags not listed in the applicable `per_tag_limits` fall back to the
+				   surrounding metric's `value_limit` (per-metric, or global).
+				"""
+		}
 	}
 
 	telemetry: metrics: {

From c5959d7c37ad9ba8f2444f75c3d62e7930d8a8e9 Mon Sep 17 00:00:00 2001
From: ArunPiduguDD <arun.pidugu@datadoghq.com>
Date: Thu, 21 May 2026 08:39:40 -0400
Subject: [PATCH 265/326] enhancement(tag_cardinality_limit transform): Remove
 HashSet initialization with capacity to improve memory usage (#25480)

Remove HashSet initialization with capacity
---
 ..._cardinality_limit_improve_memory_usage.enhancement.md | 3 +++
 src/transforms/tag_cardinality_limit/mod.rs               | 4 ++--
 src/transforms/tag_cardinality_limit/tag_value_set.rs     | 8 ++++----
 3 files changed, 9 insertions(+), 6 deletions(-)
 create mode 100644 changelog.d/tag_cardinality_limit_improve_memory_usage.enhancement.md

diff --git a/changelog.d/tag_cardinality_limit_improve_memory_usage.enhancement.md b/changelog.d/tag_cardinality_limit_improve_memory_usage.enhancement.md
new file mode 100644
index 0000000000000..37e2fbdb77527
--- /dev/null
+++ b/changelog.d/tag_cardinality_limit_improve_memory_usage.enhancement.md
@@ -0,0 +1,3 @@
+Reduce the memory usage of the `tag_cardinality_limit` transform when running in `exact` mode by allocating less unused memory on initialization.
+
+authors: ArunPiduguDD
diff --git a/src/transforms/tag_cardinality_limit/mod.rs b/src/transforms/tag_cardinality_limit/mod.rs
index 471d44661d752..755a23c8d1006 100644
--- a/src/transforms/tag_cardinality_limit/mod.rs
+++ b/src/transforms/tag_cardinality_limit/mod.rs
@@ -213,7 +213,7 @@ impl TagCardinalityLimit {
         let metric_accepted_tags = self.accepted_tags.entry(metric_key_owned).or_default();
         let tag_value_set = metric_accepted_tags
             .entry_ref(key)
-            .or_insert_with(|| AcceptedTagValueSet::new(config.value_limit, &config.mode));
+            .or_insert_with(|| AcceptedTagValueSet::new(&config.mode));
 
         if tag_value_set.contains(value) {
             // Tag value has already been accepted, nothing more to do.
@@ -300,7 +300,7 @@ impl TagCardinalityLimit {
         let metric_accepted_tags = self.accepted_tags.entry(metric_key_owned).or_default();
         metric_accepted_tags
             .entry_ref(key)
-            .or_insert_with(|| AcceptedTagValueSet::new(config.value_limit, &config.mode))
+            .or_insert_with(|| AcceptedTagValueSet::new(&config.mode))
             .insert(value.clone());
         false
     }
diff --git a/src/transforms/tag_cardinality_limit/tag_value_set.rs b/src/transforms/tag_cardinality_limit/tag_value_set.rs
index abb7c9f80ac03..0d9bbc216db25 100644
--- a/src/transforms/tag_cardinality_limit/tag_value_set.rs
+++ b/src/transforms/tag_cardinality_limit/tag_value_set.rs
@@ -59,9 +59,9 @@ impl fmt::Debug for TagValueSetStorage {
 }
 
 impl AcceptedTagValueSet {
-    pub fn new(value_limit: usize, mode: &Mode) -> Self {
+    pub fn new(mode: &Mode) -> Self {
         let storage = match &mode {
-            Mode::Exact => TagValueSetStorage::Set(HashSet::with_capacity(value_limit)),
+            Mode::Exact => TagValueSetStorage::Set(HashSet::new()),
             Mode::Probabilistic(config) => {
                 TagValueSetStorage::Bloom(BloomFilterStorage::new(config.cache_size_per_key))
             }
@@ -100,7 +100,7 @@ mod tests {
 
     #[test]
     fn test_accepted_tag_value_set_exact() {
-        let mut accepted_tag_value_set = AcceptedTagValueSet::new(2, &Mode::Exact);
+        let mut accepted_tag_value_set = AcceptedTagValueSet::new(&Mode::Exact);
 
         assert!(!accepted_tag_value_set.contains(&TagValueSet::from(["value1".to_string()])));
         assert_eq!(accepted_tag_value_set.len(), 0);
@@ -116,7 +116,7 @@ mod tests {
 
     #[test]
     fn test_accepted_tag_value_set_probabilistic() {
-        let mut accepted_tag_value_set = AcceptedTagValueSet::new(2, &Mode::Exact);
+        let mut accepted_tag_value_set = AcceptedTagValueSet::new(&Mode::Exact);
 
         assert!(!accepted_tag_value_set.contains(&TagValueSet::from(["value1".to_string()])));
         assert_eq!(accepted_tag_value_set.len(), 0);

From a4b23cf1bf2786236e0cae2795d022ff39d4697c Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 22 May 2026 14:51:06 -0400
Subject: [PATCH 266/326] chore(releasing): extend deb-verify and rpm-verify to
 cover aarch64 (#25487)

* ci(releasing): extend deb-verify and rpm-verify to cover aarch64

* ci(releasing): use POSIX-compatible shell substitution for dd-pkg arch mapping
---
 .github/workflows/publish.yml | 34 ++++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3cab2b2687570..778fce2fb4b2c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -273,7 +273,7 @@ jobs:
 
   deb-verify:
     name: Verify DEB Packages
-    runs-on: ubuntu-24.04
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 5
     needs:
       - generate-publish-metadata
@@ -284,6 +284,9 @@ jobs:
       DD_PKG_VERSION: "latest"
     strategy:
       matrix:
+        runner:
+          - ubuntu-24.04
+          - ubuntu-24.04-arm
         container:
           - ubuntu:20.04
           - ubuntu:22.04
@@ -304,25 +307,29 @@ jobs:
           make
       - name: Install dd-pkg for linting
         run: |
-          curl -sSL "https://dd-package-tools.s3.amazonaws.com/dd-pkg/${DD_PKG_VERSION}/dd-pkg_Linux_x86_64.tar.gz" | tar -xz -C /usr/local/bin dd-pkg
+          ARCH=$(uname -m)
+          case "$ARCH" in aarch64) ARCH_DL=arm64 ;; *) ARCH_DL="$ARCH" ;; esac
+          curl -sSL "https://dd-package-tools.s3.amazonaws.com/dd-pkg/${DD_PKG_VERSION}/dd-pkg_Linux_${ARCH_DL}.tar.gz" | tar -xz -C /usr/local/bin dd-pkg
       - name: Fix Git safe directories issue when in containers (actions/checkout#760)
         run: git config --global --add safe.directory /__w/vector/vector
       - name: Checkout Vector
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.git_ref }}
-      - name: Download staged package artifacts (x86_64-unknown-linux-gnu)
+      - name: Set artifact name
+        run: echo "ARTIFACT=$(uname -m)-unknown-linux-gnu" >> "$GITHUB_ENV"
+      - name: Download staged package artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: vector-${{ env.VECTOR_VERSION }}-x86_64-unknown-linux-gnu
+          name: vector-${{ env.VECTOR_VERSION }}-${{ env.ARTIFACT }}
           path: target/artifacts
       - name: Verify install of DEB package.
         run: |
-          ./scripts/verify-install.sh target/artifacts/vector_${{ env.VECTOR_VERSION }}-1_amd64.deb
+          ./scripts/verify-install.sh "target/artifacts/vector_${{ env.VECTOR_VERSION }}-1_$(dpkg --print-architecture).deb"
 
   rpm-verify:
     name: Verify RPM Packages
-    runs-on: ubuntu-24.04
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 10
     needs:
       - generate-publish-metadata
@@ -333,6 +340,9 @@ jobs:
       DD_PKG_VERSION: "latest"
     strategy:
       matrix:
+        runner:
+          - ubuntu-24.04
+          - ubuntu-24.04-arm
         container:
           # Lowest supported glibc tier (EL8 family, glibc 2.28). Catches glibc-floor regressions.
           - "almalinux:8@sha256:ca871b110064fe81bff0250ed5cc56fbb0a9840715f09811c33bbf9d72cef56c"
@@ -358,21 +368,25 @@ jobs:
           fi
       - name: Install dd-pkg for linting
         run: |
-          curl -sSL "https://dd-package-tools.s3.amazonaws.com/dd-pkg/${DD_PKG_VERSION}/dd-pkg_Linux_x86_64.tar.gz" | tar -xz -C /usr/local/bin dd-pkg
+          ARCH=$(uname -m)
+          case "$ARCH" in aarch64) ARCH_DL=arm64 ;; *) ARCH_DL="$ARCH" ;; esac
+          curl -sSL "https://dd-package-tools.s3.amazonaws.com/dd-pkg/${DD_PKG_VERSION}/dd-pkg_Linux_${ARCH_DL}.tar.gz" | tar -xz -C /usr/local/bin dd-pkg
       - name: Fix Git safe directories issue when in containers (actions/checkout#760)
         run: git config --global --add safe.directory /__w/vector/vector
       - name: Checkout Vector
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.git_ref }}
-      - name: Download staged package artifacts (x86_64-unknown-linux-gnu)
+      - name: Set artifact name
+        run: echo "ARTIFACT=$(uname -m)-unknown-linux-gnu" >> "$GITHUB_ENV"
+      - name: Download staged package artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: vector-${{ env.VECTOR_VERSION }}-x86_64-unknown-linux-gnu
+          name: vector-${{ env.VECTOR_VERSION }}-${{ env.ARTIFACT }}
           path: target/artifacts
       - name: Verify install of RPM package.
         run: |
-          ./scripts/verify-install.sh target/artifacts/vector-${{ env.VECTOR_VERSION }}-1.x86_64.rpm
+          ./scripts/verify-install.sh "target/artifacts/vector-${{ env.VECTOR_VERSION }}-1.$(uname -m).rpm"
 
   macos-verify:
     name: Verify macOS Package

From 2084d534f269bb1fa2d508bbc28a634d57d4dc32 Mon Sep 17 00:00:00 2001
From: Flavio Cruz <87035001+flaviofcruz@users.noreply.github.com>
Date: Fri, 22 May 2026 15:51:35 -0400
Subject: [PATCH 267/326] chore(ci): Add databricks_zerobus sink to semantic PR
 scope list (#25490)

---
 .github/workflows/semantic.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/semantic.yml b/.github/workflows/semantic.yml
index 1e134a9f96007..6d801c49d5de9 100644
--- a/.github/workflows/semantic.yml
+++ b/.github/workflows/semantic.yml
@@ -127,6 +127,7 @@ jobs:
             aws service
             azure service
             confluent service
+            databricks_zerobus sink
             datadog service
             elastic service
             gcp service

From 3df9e43140d1326bbd0058ed4f24d69ad1ee16ad Mon Sep 17 00:00:00 2001
From: Yoenn Burban <62966490+gwenaskell@users.noreply.github.com>
Date: Tue, 26 May 2026 10:31:26 +0200
Subject: [PATCH 268/326] fix(observability): do not hold span guards across
 await points (#25482)

* add clippy rule

* remove span.enter from topology builders

* fix internal_logs source unit test holding a span guard across an await. The test still works because tokio:: test runs single-threaded by default, but better fixing it than silencing the clippy error

* add changelog

* apply suggestion
---
 changelog.d/fix_topology_build_spans.fix.md |   7 +
 clippy.toml                                 |   5 +
 src/sources/internal_logs.rs                |   8 +-
 src/topology/builder.rs                     | 753 ++++++++++----------
 4 files changed, 411 insertions(+), 362 deletions(-)
 create mode 100644 changelog.d/fix_topology_build_spans.fix.md

diff --git a/changelog.d/fix_topology_build_spans.fix.md b/changelog.d/fix_topology_build_spans.fix.md
new file mode 100644
index 0000000000000..9ea5d755bbd04
--- /dev/null
+++ b/changelog.d/fix_topology_build_spans.fix.md
@@ -0,0 +1,7 @@
+Fixed a bug in the topology builder causing component metrics registered at build
+time to miss the component tags if the component build function awaits non-trivially.
+
+This notably affected sinks using a disk buffer, and source or sinks performing
+IO work in the build function.
+
+authors: gwenaskell
diff --git a/clippy.toml b/clippy.toml
index 4aaa1eb15b360..7cb042eba5a2d 100644
--- a/clippy.toml
+++ b/clippy.toml
@@ -20,3 +20,8 @@ disallowed-types = [
   { path = "once_cell::sync::Lazy", reason = "Use `std::sync::LazyLock` instead." },
   { path = "once_cell::unsync::Lazy", reason = "Use `std::sync::LazyCell` instead." },
 ]
+
+
+await-holding-invalid-types = [
+    { path = "tracing::span::Entered", reason = "Holding a tracing span guard across an `.await` is thread-local and silently breaks when the task resumes on a different thread. Use `#[tracing::instrument]`, `future.instrument(span)`, or `Span::in_scope(|| ...)` instead." },
+]
diff --git a/src/sources/internal_logs.rs b/src/sources/internal_logs.rs
index e7873a7e8a560..54b8c1acf12ac 100644
--- a/src/sources/internal_logs.rs
+++ b/src/sources/internal_logs.rs
@@ -256,12 +256,16 @@ mod tests {
             component_id = "foo",
             component_type = "internal_logs",
         );
-        let _enter = span.enter();
+        let enter = span.enter();
 
         error!(message = "Before source started.", %test_id);
 
+        drop(enter); // don't hold the span guard across an await point
+
         let rx = start_source().await;
 
+        let enter = span.enter();
+
         error!(message = "After source started.", %test_id);
 
         {
@@ -276,6 +280,8 @@ mod tests {
             error!(message = "In a nested span.", %test_id);
         }
 
+        drop(enter);
+
         sleep(Duration::from_millis(1)).await;
         let mut events = collect_ready(rx).await;
         let test_id = Value::from(test_id.to_string());
diff --git a/src/topology/builder.rs b/src/topology/builder.rs
index 2d9d9f7d5cf81..8be9a0ce73d7a 100644
--- a/src/topology/builder.rs
+++ b/src/topology/builder.rs
@@ -14,7 +14,7 @@ use tokio::{
     sync::{mpsc::UnboundedSender, oneshot},
     time::timeout,
 };
-use tracing::Instrument;
+use tracing::{Instrument, Span};
 use vector_lib::{
     EstimatedJsonEncodedSizeOf,
     buffers::{
@@ -46,7 +46,8 @@ use crate::{
     SourceSender,
     config::{
         ComponentKey, Config, DataType, EnrichmentTableConfig, Input, Inputs, OutputId,
-        ProxyConfig, SinkContext, SourceContext, TransformContext, TransformOuter, TransformOutput,
+        ProxyConfig, SinkContext, SinkOuter, SourceContext, SourceOuter, TransformContext,
+        TransformOuter, TransformOutput,
     },
     event::{EventArray, EventContainer},
     extra_context::ExtraContext,
@@ -252,173 +253,188 @@ impl<'a> Builder<'a> {
         {
             debug!(component_id = %key, "Building new source.");
 
-            let typetag = source.inner.get_component_name();
-            let source_outputs = source.inner.outputs(self.config.schema.log_namespace());
-
             let span = error_span!(
                 "source",
                 component_kind = "source",
                 component_id = %key.id(),
                 component_type = %source.inner.get_component_name(),
             );
-            let _entered_span = span.enter();
 
-            let task_name = format!(
-                ">> {} ({}, pump) >>",
-                source.inner.get_component_name(),
-                key.id()
+            if let Ok(server) = self
+                .build_instrumented_source(key, source, enrichment_tables)
+                .instrument(span)
+                .await
+            {
+                source_tasks.insert(key.clone(), server);
+            }
+        }
+
+        source_tasks
+    }
+
+    async fn build_instrumented_source(
+        &mut self,
+        key: &ComponentKey,
+        source: &SourceOuter,
+        enrichment_tables: &vector_lib::enrichment::TableRegistry,
+    ) -> Result<Task, ()> {
+        let typetag = source.inner.get_component_name();
+        let source_outputs = source.inner.outputs(self.config.schema.log_namespace());
+
+        let task_name = format!(
+            ">> {} ({}, pump) >>",
+            source.inner.get_component_name(),
+            key.id()
+        );
+
+        let mut builder = SourceSender::builder()
+            .with_buffer(*SOURCE_SENDER_BUFFER_SIZE)
+            .with_timeout(source.inner.send_timeout())
+            .with_ewma_half_life_seconds(
+                self.config.global.buffer_utilization_ewma_half_life_seconds,
+            );
+        let mut pumps = Vec::new();
+        let mut controls = HashMap::new();
+        let mut schema_definitions = HashMap::with_capacity(source_outputs.len());
+
+        for output in source_outputs.into_iter() {
+            let rx = builder.add_source_output(output.clone(), key.clone());
+
+            let (fanout, control) = Fanout::new();
+            let source_type = source.inner.get_component_name();
+            let source = Arc::new(key.clone());
+
+            let pump = run_source_output_pump(rx, fanout, source, source_type);
+
+            pumps.push(pump.instrument(Span::current()));
+            controls.insert(
+                OutputId {
+                    component: key.clone(),
+                    port: output.port.clone(),
+                },
+                control,
             );
 
-            let mut builder = SourceSender::builder()
-                .with_buffer(*SOURCE_SENDER_BUFFER_SIZE)
-                .with_timeout(source.inner.send_timeout())
-                .with_ewma_half_life_seconds(
-                    self.config.global.buffer_utilization_ewma_half_life_seconds,
-                );
-            let mut pumps = Vec::new();
-            let mut controls = HashMap::new();
-            let mut schema_definitions = HashMap::with_capacity(source_outputs.len());
-
-            for output in source_outputs.into_iter() {
-                let rx = builder.add_source_output(output.clone(), key.clone());
-
-                let (fanout, control) = Fanout::new();
-                let source_type = source.inner.get_component_name();
-                let source = Arc::new(key.clone());
-
-                let pump = run_source_output_pump(rx, fanout, source, source_type);
-
-                pumps.push(pump.instrument(span.clone()));
-                controls.insert(
-                    OutputId {
-                        component: key.clone(),
-                        port: output.port.clone(),
-                    },
-                    control,
-                );
-
-                let port = output.port.clone();
-                if let Some(definition) = output.schema_definition(self.config.schema.enabled) {
-                    schema_definitions.insert(port, definition);
-                }
+            let port = output.port.clone();
+            if let Some(definition) = output.schema_definition(self.config.schema.enabled) {
+                schema_definitions.insert(port, definition);
             }
+        }
 
-            let (pump_error_tx, mut pump_error_rx) = oneshot::channel();
-            let pump = async move {
-                debug!("Source pump supervisor starting.");
+        let (pump_error_tx, mut pump_error_rx) = oneshot::channel();
+        let pump = async move {
+            debug!("Source pump supervisor starting.");
 
-                // Spawn all of the per-output pumps and then await their completion.
-                //
-                // If any of the pumps complete with an error, or panic/are cancelled, we return
-                // immediately.
-                let mut handles = FuturesUnordered::new();
-                for pump in pumps {
-                    handles.push(spawn_named(pump, task_name.as_ref()));
-                }
+            // Spawn all of the per-output pumps and then await their completion.
+            //
+            // If any of the pumps complete with an error, or panic/are cancelled, we return
+            // immediately.
+            let mut handles = FuturesUnordered::new();
+            for pump in pumps {
+                handles.push(spawn_named(pump, task_name.as_ref()));
+            }
 
-                let mut had_pump_error = false;
-                while let Some(output) = handles.try_next().await? {
-                    if let Err(e) = output {
-                        // Immediately send the error to the source's wrapper future, but ignore any
-                        // errors during the send, since nested errors wouldn't make any sense here.
-                        _ = pump_error_tx.send(e);
-                        had_pump_error = true;
-                        break;
-                    }
+            let mut had_pump_error = false;
+            while let Some(output) = handles.try_next().await? {
+                if let Err(e) = output {
+                    // Immediately send the error to the source's wrapper future, but ignore any
+                    // errors during the send, since nested errors wouldn't make any sense here.
+                    _ = pump_error_tx.send(e);
+                    had_pump_error = true;
+                    break;
                 }
+            }
 
-                if had_pump_error {
-                    debug!("Source pump supervisor task finished with an error.");
-                } else {
-                    debug!("Source pump supervisor task finished normally.");
-                }
-                Ok(TaskOutput::Source)
-            };
-            let pump = Task::new(key.clone(), typetag, pump);
+            if had_pump_error {
+                debug!("Source pump supervisor task finished with an error.");
+            } else {
+                debug!("Source pump supervisor task finished normally.");
+            }
+            Ok(TaskOutput::Source)
+        };
+        let pump = Task::new(key.clone(), typetag, pump);
+
+        let (shutdown_signal, force_shutdown_tripwire) = self
+            .shutdown_coordinator
+            .register_source(key, INTERNAL_SOURCES.contains(&typetag));
+
+        let context = SourceContext {
+            key: key.clone(),
+            globals: self.config.global.clone(),
+            enrichment_tables: enrichment_tables.clone(),
+            metrics_storage: METRICS_STORAGE.clone(),
+            shutdown: shutdown_signal,
+            out: builder.build(),
+            proxy: ProxyConfig::merge_with_env(&self.config.global.proxy, &source.proxy),
+            acknowledgements: source.sink_acknowledgements,
+            schema_definitions,
+            schema: self.config.schema,
+            extra_context: self.extra_context.clone(),
+        };
+        let server = match source.inner.build(context).await {
+            Err(error) => {
+                self.errors.push(format!("Source \"{key}\": {error}"));
+                return Err(());
+            }
+            Ok(server) => server,
+        };
 
-            let (shutdown_signal, force_shutdown_tripwire) = self
-                .shutdown_coordinator
-                .register_source(key, INTERNAL_SOURCES.contains(&typetag));
+        // Build a wrapper future that drives the actual source future, but returns early if we've
+        // been signalled to forcefully shutdown, or if the source pump encounters an error.
+        //
+        // The forceful shutdown will only resolve if the source itself doesn't shutdown gracefully
+        // within the allotted time window. This can occur normally for certain sources, like stdin,
+        // where the I/O is blocking (in a separate thread) and won't wake up to check if it's time
+        // to shutdown unless some input is given.
+        let server = async move {
+            debug!("Source starting.");
+
+            let mut result = select! {
+                biased;
 
-            let context = SourceContext {
-                key: key.clone(),
-                globals: self.config.global.clone(),
-                enrichment_tables: enrichment_tables.clone(),
-                metrics_storage: METRICS_STORAGE.clone(),
-                shutdown: shutdown_signal,
-                out: builder.build(),
-                proxy: ProxyConfig::merge_with_env(&self.config.global.proxy, &source.proxy),
-                acknowledgements: source.sink_acknowledgements,
-                schema_definitions,
-                schema: self.config.schema,
-                extra_context: self.extra_context.clone(),
-            };
-            let server = match source.inner.build(context).await {
-                Err(error) => {
-                    self.errors.push(format!("Source \"{key}\": {error}"));
-                    continue;
-                }
-                Ok(server) => server,
+                // We've been told that we must forcefully shut down.
+                _ = force_shutdown_tripwire => Ok(()),
+
+                // The source pump encountered an error, which we're now bubbling up here to stop
+                // the source as well, since the source running makes no sense without the pump.
+                //
+                // We only match receiving a message, not the error of the sender being dropped,
+                // just to keep things simpler.
+                Ok(e) = &mut pump_error_rx => Err(e),
+
+                // The source finished normally.
+                result = server => result.map_err(|_| TaskError::Opaque),
             };
 
-            // Build a wrapper future that drives the actual source future, but returns early if we've
-            // been signalled to forcefully shutdown, or if the source pump encounters an error.
+            // Even though we already tried to receive any pump task error above, we may have exited
+            // on the source itself returning an error due to task scheduling, where the pump task
+            // encountered an error, sent it over the oneshot, but we were polling the source
+            // already and hit an error trying to send to the now-shutdown pump task.
             //
-            // The forceful shutdown will only resolve if the source itself doesn't shutdown gracefully
-            // within the allotted time window. This can occur normally for certain sources, like stdin,
-            // where the I/O is blocking (in a separate thread) and won't wake up to check if it's time
-            // to shutdown unless some input is given.
-            let server = async move {
-                debug!("Source starting.");
-
-                let mut result = select! {
-                    biased;
-
-                    // We've been told that we must forcefully shut down.
-                    _ = force_shutdown_tripwire => Ok(()),
-
-                    // The source pump encountered an error, which we're now bubbling up here to stop
-                    // the source as well, since the source running makes no sense without the pump.
-                    //
-                    // We only match receiving a message, not the error of the sender being dropped,
-                    // just to keep things simpler.
-                    Ok(e) = &mut pump_error_rx => Err(e),
-
-                    // The source finished normally.
-                    result = server => result.map_err(|_| TaskError::Opaque),
-                };
+            // Since the error from the source is opaque at the moment (i.e. `()`), we try a final
+            // time to see if the pump task encountered an error, using _that_ instead if so, to
+            // propagate the true error that caused the source to have to stop.
+            if let Ok(e) = pump_error_rx.try_recv() {
+                result = Err(e);
+            }
 
-                // Even though we already tried to receive any pump task error above, we may have exited
-                // on the source itself returning an error due to task scheduling, where the pump task
-                // encountered an error, sent it over the oneshot, but we were polling the source
-                // already and hit an error trying to send to the now-shutdown pump task.
-                //
-                // Since the error from the source is opaque at the moment (i.e. `()`), we try a final
-                // time to see if the pump task encountered an error, using _that_ instead if so, to
-                // propagate the true error that caused the source to have to stop.
-                if let Ok(e) = pump_error_rx.try_recv() {
-                    result = Err(e);
+            match result {
+                Ok(()) => {
+                    debug!("Source finished normally.");
+                    Ok(TaskOutput::Source)
                 }
-
-                match result {
-                    Ok(()) => {
-                        debug!("Source finished normally.");
-                        Ok(TaskOutput::Source)
-                    }
-                    Err(e) => {
-                        debug!("Source finished with an error.");
-                        Err(e)
-                    }
+                Err(e) => {
+                    debug!("Source finished with an error.");
+                    Err(e)
                 }
-            };
-            let server = Task::new(key.clone(), typetag, server);
+            }
+        };
+        let server = Task::new(key.clone(), typetag, server);
 
-            self.outputs.extend(controls);
-            self.tasks.insert(key.clone(), pump);
-            source_tasks.insert(key.clone(), server);
-        }
+        self.outputs.extend(controls);
+        self.tasks.insert(key.clone(), pump);
 
-        source_tasks
+        Ok(server)
     }
 
     async fn build_transforms(
@@ -449,85 +465,94 @@ impl<'a> Builder<'a> {
                 }
             };
 
-            let merged_definition: Definition = input_definitions
-                .iter()
-                .map(|(_output_id, definition)| definition.clone())
-                .reduce(Definition::merge)
-                // We may not have any definitions if all the inputs are from metrics sources.
-                .unwrap_or_else(Definition::any);
-
             let span = error_span!(
                 "transform",
                 component_kind = "transform",
                 component_id = %key.id(),
                 component_type = %transform.inner.get_component_name(),
             );
-            let _span = span.enter();
-
-            // Create a map of the outputs to the list of possible definitions from those outputs.
-            let schema_definitions = transform
-                .inner
-                .outputs(
-                    &TransformContext {
-                        enrichment_tables: enrichment_tables.clone(),
-                        metrics_storage: METRICS_STORAGE.clone(),
-                        schema: self.config.schema,
-                        ..Default::default()
-                    },
-                    &input_definitions,
-                )
-                .into_iter()
-                .map(|output| {
-                    let definitions = output.schema_definitions(self.config.schema.enabled);
-                    (output.port, definitions)
-                })
-                .collect::<HashMap<_, _>>();
-
-            let context = TransformContext {
-                key: Some(key.clone()),
-                globals: self.config.global.clone(),
-                enrichment_tables: enrichment_tables.clone(),
-                metrics_storage: METRICS_STORAGE.clone(),
-                schema_definitions,
-                merged_schema_definition: merged_definition.clone(),
-                schema: self.config.schema,
-                extra_context: self.extra_context.clone(),
-            };
 
-            let node =
-                TransformNode::from_parts(key.clone(), &context, transform, &input_definitions);
+            self.build_instrumented_transform(key, transform, enrichment_tables, input_definitions)
+                .instrument(span)
+                .await;
+        }
+    }
 
-            let transform = match transform
-                .inner
-                .build(&context)
-                .instrument(span.clone())
-                .await
-            {
-                Err(error) => {
-                    self.errors.push(format!("Transform \"{key}\": {error}"));
-                    continue;
-                }
-                Ok(transform) => transform,
-            };
+    async fn build_instrumented_transform(
+        &mut self,
+        key: &ComponentKey,
+        transform: &TransformOuter<OutputId>,
+        enrichment_tables: &vector_lib::enrichment::TableRegistry,
+        input_definitions: Vec<(OutputId, Definition)>,
+    ) {
+        let merged_definition: Definition = input_definitions
+            .iter()
+            .map(|(_output_id, definition)| definition.clone())
+            .reduce(Definition::merge)
+            // We may not have any definitions if all the inputs are from metrics sources.
+            .unwrap_or_else(Definition::any);
+
+        // Create a map of the outputs to the list of possible definitions from those outputs.
+        let schema_definitions = transform
+            .inner
+            .outputs(
+                &TransformContext {
+                    enrichment_tables: enrichment_tables.clone(),
+                    metrics_storage: METRICS_STORAGE.clone(),
+                    schema: self.config.schema,
+                    ..Default::default()
+                },
+                &input_definitions,
+            )
+            .into_iter()
+            .map(|output| {
+                let definitions = output.schema_definitions(self.config.schema.enabled);
+                (output.port, definitions)
+            })
+            .collect::<HashMap<_, _>>();
+
+        let context = TransformContext {
+            key: Some(key.clone()),
+            globals: self.config.global.clone(),
+            enrichment_tables: enrichment_tables.clone(),
+            metrics_storage: METRICS_STORAGE.clone(),
+            schema_definitions,
+            merged_schema_definition: merged_definition.clone(),
+            schema: self.config.schema,
+            extra_context: self.extra_context.clone(),
+        };
 
-            let metrics = ChannelMetricMetadata::new(BufferChannelKind::Transform, None);
-            let (input_tx, input_rx) = TopologyBuilder::standalone_memory(
-                TOPOLOGY_BUFFER_SIZE,
-                WhenFull::Block,
-                &span,
-                Some(metrics),
-                self.config.global.buffer_utilization_ewma_half_life_seconds,
-            );
+        let node = TransformNode::from_parts(key.clone(), &context, transform, &input_definitions);
+
+        let transform = match transform
+            .inner
+            .build(&context)
+            .instrument(Span::current())
+            .await
+        {
+            Err(error) => {
+                self.errors.push(format!("Transform \"{key}\": {error}"));
+                return;
+            }
+            Ok(transform) => transform,
+        };
 
-            self.inputs
-                .insert(key.clone(), (input_tx, node.inputs.clone()));
+        let metrics = ChannelMetricMetadata::new(BufferChannelKind::Transform, None);
+        let (input_tx, input_rx) = TopologyBuilder::standalone_memory(
+            TOPOLOGY_BUFFER_SIZE,
+            WhenFull::Block,
+            &Span::current(),
+            Some(metrics),
+            self.config.global.buffer_utilization_ewma_half_life_seconds,
+        );
 
-            let (transform_task, transform_outputs) =
-                self.build_transform(transform, node, input_rx);
+        self.inputs
+            .insert(key.clone(), (input_tx, node.inputs.clone()));
 
-            self.outputs.extend(transform_outputs);
-            self.tasks.insert(key.clone(), transform_task);
-        }
+        let (transform_task, transform_outputs) = self.build_transform(transform, node, input_rx);
+
+        self.outputs.extend(transform_outputs);
+        self.tasks.insert(key.clone(), transform_task);
     }
 
     async fn build_sinks(&mut self, enrichment_tables: &vector_lib::enrichment::TableRegistry) {
@@ -550,172 +575,178 @@ impl<'a> Builder<'a> {
         {
             debug!(component_id = %key, "Building new sink.");
 
-            let sink_inputs = &sink.inputs;
-            let healthcheck = sink.healthcheck();
-            let enable_healthcheck = healthcheck.enabled && self.config.healthchecks.enabled;
-            let healthcheck_timeout = healthcheck.timeout;
-
-            let typetag = sink.inner.get_component_name();
-            let input_type = sink.inner.input().data_type();
-
             let span = error_span!(
                 "sink",
                 component_kind = "sink",
                 component_id = %key.id(),
                 component_type = %sink.inner.get_component_name(),
             );
-            let _entered_span = span.enter();
-
-            // At this point, we've validated that all transforms are valid, including any
-            // transform that mutates the schema provided by their sources. We can now validate the
-            // schema expectations of each individual sink.
-            if let Err(mut err) = schema::validate_sink_expectations(
-                key,
-                sink,
-                self.config,
-                enrichment_tables.clone(),
-            ) {
-                self.errors.append(&mut err);
-            };
 
-            let (tx, rx) = match self.buffers.remove(key) {
-                Some(buffer) => buffer,
-                _ => {
-                    let buffer_type =
-                        match sink.buffer.stages().first().expect("cant ever be empty") {
-                            BufferType::Memory { .. } => "memory",
-                            BufferType::DiskV2 { .. } => "disk",
-                        };
-                    let buffer_span = error_span!("sink", buffer_type);
-                    let buffer = sink
-                        .buffer
-                        .build(
-                            self.config.global.data_dir.clone(),
-                            key.to_string(),
-                            buffer_span,
-                        )
-                        .await;
-                    match buffer {
-                        Err(error) => {
-                            self.errors.push(format!("Sink \"{key}\": {error}"));
-                            continue;
-                        }
-                        Ok((tx, rx)) => (tx, Arc::new(Mutex::new(Some(rx.into_stream())))),
+            self.build_instrumented_sink(key, sink, enrichment_tables)
+                .instrument(span)
+                .await;
+        }
+    }
+
+    async fn build_instrumented_sink(
+        &mut self,
+        key: &ComponentKey,
+        sink: &SinkOuter<OutputId>,
+        enrichment_tables: &vector_lib::enrichment::TableRegistry,
+    ) {
+        let sink_inputs = &sink.inputs;
+        let healthcheck = sink.healthcheck();
+        let enable_healthcheck = healthcheck.enabled && self.config.healthchecks.enabled;
+        let healthcheck_timeout = healthcheck.timeout;
+
+        let typetag = sink.inner.get_component_name();
+        let input_type = sink.inner.input().data_type();
+
+        // At this point, we've validated that all transforms are valid, including any
+        // transform that mutates the schema provided by their sources. We can now validate the
+        // schema expectations of each individual sink.
+        if let Err(mut err) =
+            schema::validate_sink_expectations(key, sink, self.config, enrichment_tables.clone())
+        {
+            self.errors.append(&mut err);
+        };
+
+        let (tx, rx) = match self.buffers.remove(key) {
+            Some(buffer) => buffer,
+            _ => {
+                let buffer_type = match sink.buffer.stages().first().expect("cant ever be empty") {
+                    BufferType::Memory { .. } => "memory",
+                    BufferType::DiskV2 { .. } => "disk",
+                };
+                let buffer_span = error_span!("sink", buffer_type);
+                let buffer = sink
+                    .buffer
+                    .build(
+                        self.config.global.data_dir.clone(),
+                        key.to_string(),
+                        buffer_span,
+                    )
+                    .await;
+                match buffer {
+                    Err(error) => {
+                        self.errors.push(format!("Sink \"{key}\": {error}"));
+                        return;
                     }
+                    Ok((tx, rx)) => (tx, Arc::new(Mutex::new(Some(rx.into_stream())))),
                 }
-            };
+            }
+        };
 
-            let cx = SinkContext {
-                healthcheck,
-                globals: self.config.global.clone(),
-                enrichment_tables: enrichment_tables.clone(),
-                metrics_storage: METRICS_STORAGE.clone(),
-                proxy: ProxyConfig::merge_with_env(&self.config.global.proxy, sink.proxy()),
-                schema: self.config.schema,
-                app_name: crate::get_app_name().to_string(),
-                app_name_slug: crate::get_slugified_app_name(),
-                extra_context: self.extra_context.clone(),
-            };
+        let cx = SinkContext {
+            healthcheck,
+            globals: self.config.global.clone(),
+            enrichment_tables: enrichment_tables.clone(),
+            metrics_storage: METRICS_STORAGE.clone(),
+            proxy: ProxyConfig::merge_with_env(&self.config.global.proxy, sink.proxy()),
+            schema: self.config.schema,
+            app_name: crate::get_app_name().to_string(),
+            app_name_slug: crate::get_slugified_app_name(),
+            extra_context: self.extra_context.clone(),
+        };
 
-            let (sink, healthcheck) = match sink.inner.build(cx).await {
-                Err(error) => {
-                    self.errors.push(format!("Sink \"{key}\": {error}"));
-                    continue;
-                }
-                Ok(built) => built,
-            };
+        let (sink, healthcheck) = match sink.inner.build(cx).await {
+            Err(error) => {
+                self.errors.push(format!("Sink \"{key}\": {error}"));
+                return;
+            }
+            Ok(built) => built,
+        };
 
-            let (trigger, tripwire) = Tripwire::new();
-
-            let utilization_sender = self
-                .utilization_registry
-                .add_component(key.clone(), gauge!(GaugeName::Utilization));
-            let component_key = key.clone();
-            let sink = async move {
-                debug!("Sink starting.");
-
-                // Why is this Arc<Mutex<Option<_>>> needed you ask.
-                // In case when this function build_pieces errors
-                // this future won't be run so this rx won't be taken
-                // which will enable us to reuse rx to rebuild
-                // old configuration by passing this Arc<Mutex<Option<_>>>
-                // yet again.
-                let rx = rx
-                    .lock()
-                    .unwrap()
-                    .take()
-                    .expect("Task started but input has been taken.");
-
-                let mut rx = Utilization::new(utilization_sender, component_key.clone(), rx);
-
-                let events_received = register!(EventsReceived);
-                sink.run(
-                    rx.by_ref()
-                        .filter(|events: &EventArray| ready(filter_events_type(events, input_type)))
-                        .inspect(|events| {
-                            events_received.emit(CountByteSize(
-                                events.len(),
-                                events.estimated_json_encoded_size_of(),
-                            ))
-                        })
-                        .take_until_if(tripwire),
-                )
-                .await
-                .map(|_| {
-                    debug!("Sink finished normally.");
-                    TaskOutput::Sink(rx)
-                })
-                .map_err(|_| {
-                    debug!("Sink finished with an error.");
-                    TaskError::Opaque
-                })
-            };
+        let (trigger, tripwire) = Tripwire::new();
+
+        let utilization_sender = self
+            .utilization_registry
+            .add_component(key.clone(), gauge!(GaugeName::Utilization));
+        let component_key = key.clone();
+        let sink = async move {
+            debug!("Sink starting.");
+
+            // Why is this Arc<Mutex<Option<_>>> needed you ask.
+            // In case when this function build_pieces errors
+            // this future won't be run so this rx won't be taken
+            // which will enable us to reuse rx to rebuild
+            // old configuration by passing this Arc<Mutex<Option<_>>>
+            // yet again.
+            let rx = rx
+                .lock()
+                .unwrap()
+                .take()
+                .expect("Task started but input has been taken.");
+
+            let mut rx = Utilization::new(utilization_sender, component_key.clone(), rx);
+
+            let events_received = register!(EventsReceived);
+            sink.run(
+                rx.by_ref()
+                    .filter(|events: &EventArray| ready(filter_events_type(events, input_type)))
+                    .inspect(|events| {
+                        events_received.emit(CountByteSize(
+                            events.len(),
+                            events.estimated_json_encoded_size_of(),
+                        ))
+                    })
+                    .take_until_if(tripwire),
+            )
+            .await
+            .map(|_| {
+                debug!("Sink finished normally.");
+                TaskOutput::Sink(rx)
+            })
+            .map_err(|_| {
+                debug!("Sink finished with an error.");
+                TaskError::Opaque
+            })
+        };
 
-            let task = Task::new(key.clone(), typetag, sink);
+        let task = Task::new(key.clone(), typetag, sink);
 
-            let component_key = key.clone();
-            let healthcheck_task = async move {
-                if enable_healthcheck {
-                    timeout(healthcheck_timeout, healthcheck)
-                        .map(|result| match result {
-                            Ok(Ok(_)) => {
-                                info!("Healthcheck passed.");
-                                Ok(TaskOutput::Healthcheck)
-                            }
-                            Ok(Err(error)) => {
-                                error!(
-                                    msg = "Healthcheck failed.",
-                                    %error,
-                                    component_kind = "sink",
-                                    component_type = typetag,
-                                    component_id = %component_key.id(),
-                                );
-                                Err(TaskError::wrapped(error))
-                            }
-                            Err(e) => {
-                                error!(
-                                    msg = "Healthcheck timed out.",
-                                    component_kind = "sink",
-                                    component_type = typetag,
-                                    component_id = %component_key.id(),
-                                );
-                                Err(TaskError::wrapped(Box::new(e)))
-                            }
-                        })
-                        .await
-                } else {
-                    info!("Healthcheck disabled.");
-                    Ok(TaskOutput::Healthcheck)
-                }
-            };
+        let component_key = key.clone();
+        let healthcheck_task = async move {
+            if enable_healthcheck {
+                timeout(healthcheck_timeout, healthcheck)
+                    .map(|result| match result {
+                        Ok(Ok(_)) => {
+                            info!("Healthcheck passed.");
+                            Ok(TaskOutput::Healthcheck)
+                        }
+                        Ok(Err(error)) => {
+                            error!(
+                                msg = "Healthcheck failed.",
+                                %error,
+                                component_kind = "sink",
+                                component_type = typetag,
+                                component_id = %component_key.id(),
+                            );
+                            Err(TaskError::wrapped(error))
+                        }
+                        Err(e) => {
+                            error!(
+                                msg = "Healthcheck timed out.",
+                                component_kind = "sink",
+                                component_type = typetag,
+                                component_id = %component_key.id(),
+                            );
+                            Err(TaskError::wrapped(Box::new(e)))
+                        }
+                    })
+                    .await
+            } else {
+                info!("Healthcheck disabled.");
+                Ok(TaskOutput::Healthcheck)
+            }
+        };
 
-            let healthcheck_task = Task::new(key.clone(), typetag, healthcheck_task);
+        let healthcheck_task = Task::new(key.clone(), typetag, healthcheck_task);
 
-            self.inputs.insert(key.clone(), (tx, sink_inputs.clone()));
-            self.healthchecks.insert(key.clone(), healthcheck_task);
-            self.tasks.insert(key.clone(), task);
-            self.detach_triggers.insert(key.clone(), trigger);
-        }
+        self.inputs.insert(key.clone(), (tx, sink_inputs.clone()));
+        self.healthchecks.insert(key.clone(), healthcheck_task);
+        self.tasks.insert(key.clone(), task);
+        self.detach_triggers.insert(key.clone(), trigger);
     }
 
     fn build_transform(

From 5027cd691412d9d76145486fdf185d3938241b1e Mon Sep 17 00:00:00 2001
From: Rob Blafford <robert.blafford@datadoghq.com>
Date: Tue, 26 May 2026 10:44:40 -0400
Subject: [PATCH 269/326] fix(core): Drop empty batches before they reach
 downstream buffers (#25489)

* fix(fanout): drop empty event batches before they reach downstream buffers

* Add changelog fragment

* Remove conditional compilation release build for test case

* fix(fanout): Remove release_build variant of test

* Update changelog.d/drop_empty_batches_fanout.fix.md

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>

* Update comment in lib/vector-core/src/fanout.rs

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>

---------

Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
---
 changelog.d/drop_empty_batches_fanout.fix.md |  4 ++
 lib/vector-core/src/fanout.rs                | 43 ++++++++++++++++++--
 lib/vector-core/src/transform/outputs.rs     |  2 +-
 src/topology/builder.rs                      |  4 +-
 4 files changed, 46 insertions(+), 7 deletions(-)
 create mode 100644 changelog.d/drop_empty_batches_fanout.fix.md

diff --git a/changelog.d/drop_empty_batches_fanout.fix.md b/changelog.d/drop_empty_batches_fanout.fix.md
new file mode 100644
index 0000000000000..12ebfcd682555
--- /dev/null
+++ b/changelog.d/drop_empty_batches_fanout.fix.md
@@ -0,0 +1,4 @@
+Fixed a crash that could occur when a source or transform emitted an empty event batch into a topology with downstream buffers. Vector now
+drops empty batches before they reach those buffers and logs a warning identifying the upstream component.
+
+authors: graphcareful
diff --git a/lib/vector-core/src/fanout.rs b/lib/vector-core/src/fanout.rs
index 97e21bcc8db17..33ff30ae3e72a 100644
--- a/lib/vector-core/src/fanout.rs
+++ b/lib/vector-core/src/fanout.rs
@@ -7,7 +7,10 @@ use tokio::sync::mpsc;
 use tokio_util::sync::ReusableBoxFuture;
 use vector_buffers::topology::channel::BufferSender;
 
-use crate::{config::ComponentKey, event::EventArray};
+use crate::{
+    config::ComponentKey,
+    event::{EventArray, EventContainer},
+};
 
 pub enum ControlMessage {
     /// Adds a new sink to the fanout.
@@ -45,15 +48,17 @@ pub type ControlChannel = mpsc::UnboundedSender<ControlMessage>;
 pub struct Fanout {
     senders: IndexMap<ComponentKey, Option<Sender>>,
     control_channel: mpsc::UnboundedReceiver<ControlMessage>,
+    upstream_component: ComponentKey,
 }
 
 impl Fanout {
-    pub fn new() -> (Self, ControlChannel) {
+    pub fn new(upstream_component: ComponentKey) -> (Self, ControlChannel) {
         let (control_tx, control_rx) = mpsc::unbounded_channel();
 
         let fanout = Self {
             senders: Default::default(),
             control_channel: control_rx,
+            upstream_component,
         };
 
         (fanout, control_tx)
@@ -220,6 +225,27 @@ impl Fanout {
         // Wait for any senders that are paused to be replaced first before continuing with the send.
         self.wait_for_replacements().await;
 
+        // Drop empty event batches before they reach any downstream buffer, this is technically
+        // programmer error. In debug/test builds the `debug_assert!` makes the underlying bug fail
+        // loudly.
+        debug_assert!(
+            !events.is_empty(),
+            "Fanout received empty event batch from upstream component '{}'",
+            self.upstream_component,
+        );
+        // TODO: Wrap the conditional below with `std::hint::unlikely` once it stabilizes. This is an
+        // applicable situation to use it in since the following conditional should never evaluate to
+        // true.
+        #[cfg(not(debug_assertions))]
+        if events.is_empty() {
+            warn!(
+                message = "Dropping empty event batch emitted by upstream component. This is likely a bug in that component.",
+                component_id = %self.upstream_component,
+                downstream_count = self.senders.len(),
+            );
+            return Ok(());
+        }
+
         // Nothing to send if we have no sender.
         if self.senders.is_empty() {
             trace!("No senders present.");
@@ -525,7 +551,7 @@ mod tests {
         UnboundedSender<ControlMessage>,
         Vec<BufferReceiver<EventArray>>,
     ) {
-        let (mut fanout, control) = Fanout::new();
+        let (mut fanout, control) = Fanout::new(ComponentKey::from("test_upstream"));
         let pairs = build_sender_pairs(capacities);
 
         let mut receivers = Vec::new();
@@ -827,7 +853,7 @@ mod tests {
 
     #[tokio::test]
     async fn fanout_no_sinks() {
-        let (mut fanout, _) = Fanout::new();
+        let (mut fanout, _) = Fanout::new(ComponentKey::from("test_upstream"));
         let events = make_events(2);
 
         fanout
@@ -840,6 +866,15 @@ mod tests {
             .expect("should not fail");
     }
 
+    #[tokio::test]
+    #[should_panic(expected = "Fanout received empty event batch from upstream component")]
+    async fn fanout_panics_on_empty_event_array_in_debug_builds() {
+        let (mut fanout, _, _receivers) = fanout_from_senders(&[2, 2]);
+        let empty: EventArray = Vec::<LogEvent>::new().into();
+
+        let _ = fanout.send(empty, None).await;
+    }
+
     #[tokio::test]
     async fn fanout_replace() {
         let (mut fanout, control, mut receivers) = fanout_from_senders(&[4, 4, 4]);
diff --git a/lib/vector-core/src/transform/outputs.rs b/lib/vector-core/src/transform/outputs.rs
index 7918fb008f764..113f5f2b3418f 100644
--- a/lib/vector-core/src/transform/outputs.rs
+++ b/lib/vector-core/src/transform/outputs.rs
@@ -42,7 +42,7 @@ impl TransformOutputs {
         let mut controls = HashMap::new();
 
         for output in outputs_in {
-            let (fanout, control) = Fanout::new();
+            let (fanout, control) = Fanout::new(component_key.clone());
 
             let log_schema_definitions = output
                 .log_schema_definitions
diff --git a/src/topology/builder.rs b/src/topology/builder.rs
index 8be9a0ce73d7a..6ed0206446597 100644
--- a/src/topology/builder.rs
+++ b/src/topology/builder.rs
@@ -300,7 +300,7 @@ impl<'a> Builder<'a> {
         for output in source_outputs.into_iter() {
             let rx = builder.add_source_output(output.clone(), key.clone());
 
-            let (fanout, control) = Fanout::new();
+            let (fanout, control) = Fanout::new(key.clone());
             let source_type = source.inner.get_component_name();
             let source = Arc::new(key.clone());
 
@@ -832,7 +832,7 @@ impl<'a> Builder<'a> {
         key: &ComponentKey,
         outputs: &[TransformOutput],
     ) -> (Task, HashMap<OutputId, fanout::ControlChannel>) {
-        let (mut fanout, control) = Fanout::new();
+        let (mut fanout, control) = Fanout::new(key.clone());
 
         let sender = self
             .utilization_registry

From 2663ec744472213d9d2f16b8eb36e4e1c4df86ae Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Tue, 26 May 2026 16:40:41 -0400
Subject: [PATCH 270/326] chore(deps): bump mongodb to 3.7.0 and fix
 RUSTSEC-2026-0119 (#25499)

* chore(deps): bump mongodb to 3.7.0, fix RUSTSEC-2026-0119

* Update licenses
---
 Cargo.lock           | 159 ++++++++++---------------------------------
 Cargo.toml           |   2 +-
 LICENSE-3rdparty.csv |   5 +-
 deny.toml            |   1 -
 4 files changed, 37 insertions(+), 130 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f8841d4be18e1..7002061aa95b5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1035,7 +1035,7 @@ dependencies = [
  "cfg-if",
  "futures-core",
  "futures-io",
- "hickory-resolver 0.26.0",
+ "hickory-resolver",
  "tokio",
  "tokio-stream",
 ]
@@ -2731,7 +2731,7 @@ dependencies = [
  "chrono-tz",
  "csv-core",
  "derivative",
- "derive_more 2.1.1",
+ "derive_more",
  "dyn-clone",
  "flate2",
  "futures",
@@ -2977,12 +2977,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "18f12cc9948ed9604230cdddc7c86e270f9401ccbe3c2e98a4378c5e7632212f"
 
-[[package]]
-name = "convert_case"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6245d59a3e82a7fc217c5828a6692dbc6dfb63a0c8c90495621f7b9d79704a0e"
-
 [[package]]
 name = "convert_case"
 version = "0.7.1"
@@ -3233,7 +3227,7 @@ checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
 dependencies = [
  "bitflags 2.10.0",
  "crossterm_winapi",
- "derive_more 2.1.1",
+ "derive_more",
  "document-features",
  "futures-core",
  "mio",
@@ -3696,19 +3690,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "derive_more"
-version = "0.99.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fb810d30a7c1953f91334de7244731fc3f3c10d7fe163338a35b9f640960321"
-dependencies = [
- "convert_case 0.4.0",
- "proc-macro2 1.0.106",
- "quote 1.0.45",
- "rustc_version",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "derive_more"
 version = "2.1.1"
@@ -3821,7 +3802,7 @@ version = "0.1.0"
 dependencies = [
  "criterion",
  "data-encoding",
- "hickory-proto 0.26.1",
+ "hickory-proto",
  "snafu 0.9.0",
 ]
 
@@ -3835,7 +3816,7 @@ dependencies = [
  "chrono",
  "chrono-tz",
  "dnsmsg-parser",
- "hickory-proto 0.26.1",
+ "hickory-proto",
  "pastey",
  "prost 0.12.6",
  "prost-build 0.12.6",
@@ -4074,18 +4055,6 @@ dependencies = [
  "vrl",
 ]
 
-[[package]]
-name = "enum-as-inner"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ffccbb6966c05b32ef8fbac435df276c4ae4d3dc55a8cd0eb9745e6c12f546a"
-dependencies = [
- "heck 0.4.1",
- "proc-macro2 1.0.106",
- "quote 1.0.45",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "enum-ordinalize"
 version = "4.3.2"
@@ -5203,7 +5172,7 @@ dependencies = [
  "futures-channel",
  "futures-io",
  "futures-util",
- "hickory-proto 0.26.1",
+ "hickory-proto",
  "idna",
  "ipnet",
  "jni 0.22.4",
@@ -5215,30 +5184,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "hickory-proto"
-version = "0.24.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92652067c9ce6f66ce53cc38d1169daa36e6e7eb7dd3b63b5103bd9d97117248"
-dependencies = [
- "async-trait",
- "cfg-if",
- "data-encoding",
- "enum-as-inner",
- "futures-channel",
- "futures-io",
- "futures-util",
- "idna",
- "ipnet",
- "once_cell",
- "rand 0.8.5",
- "thiserror 1.0.68",
- "tinyvec",
- "tokio",
- "tracing 0.1.44",
- "url",
-]
-
 [[package]]
 name = "hickory-proto"
 version = "0.26.1"
@@ -5262,27 +5207,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "hickory-resolver"
-version = "0.24.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbb117a1ca520e111743ab2f6688eddee69db4e0ea242545a604dce8a66fd22e"
-dependencies = [
- "cfg-if",
- "futures-util",
- "hickory-proto 0.24.4",
- "ipconfig",
- "lru-cache",
- "once_cell",
- "parking_lot",
- "rand 0.8.5",
- "resolv-conf",
- "smallvec",
- "thiserror 1.0.68",
- "tokio",
- "tracing 0.1.44",
-]
-
 [[package]]
 name = "hickory-resolver"
 version = "0.26.0"
@@ -5292,7 +5216,7 @@ dependencies = [
  "cfg-if",
  "futures-util",
  "hickory-net",
- "hickory-proto 0.26.1",
+ "hickory-proto",
  "ipconfig",
  "ipnet",
  "jni 0.22.4",
@@ -6433,7 +6357,7 @@ version = "3.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7aeade7d2e9f165f96b3c1749ff01a8e2dc7ea954bd333bcfcecc37d5226bdd"
 dependencies = [
- "derive_more 2.1.1",
+ "derive_more",
  "form_urlencoded",
  "http 1.3.1",
  "jiff",
@@ -6797,15 +6721,6 @@ dependencies = [
  "hashbrown 0.16.0",
 ]
 
-[[package]]
-name = "lru-cache"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31e24f1ad8321ca0e8a1e0ac13f23cb668e6f5466c2c57319f6a5cf1cc8e3b1c"
-dependencies = [
- "linked-hash-map",
-]
-
 [[package]]
 name = "lru-slab"
 version = "0.1.2"
@@ -7221,9 +7136,9 @@ dependencies = [
 
 [[package]]
 name = "mongocrypt"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22426d6318d19c5c0773f783f85375265d6a8f0fa76a733da8dc4355516ec63d"
+checksum = "8da0cd419a51a5fb44819e290fbdb0665a54f21dead8923446a799c7f4d26ad9"
 dependencies = [
  "bson",
  "mongocrypt-sys",
@@ -7233,65 +7148,61 @@ dependencies = [
 
 [[package]]
 name = "mongocrypt-sys"
-version = "0.1.4+1.12.0"
+version = "0.1.5+1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dda42df21d035f88030aad8e877492fac814680e1d7336a57b2a091b989ae388"
+checksum = "224484c5d09285a7b8cb0a0c117e847ebd14cb6e4470ecf68cdb89c503b0edb9"
 
 [[package]]
 name = "mongodb"
-version = "3.3.0"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "622f272c59e54a3c85f5902c6b8e7b1653a6b6681f45e4c42d6581301119a4b8"
+checksum = "276ba0cd571553d1f6936c6f180964776ece6ab7507dc8765f8a9c9c49d8cd00"
 dependencies = [
- "async-trait",
- "base64 0.13.1",
- "bitflags 1.3.2",
+ "base64 0.22.1",
+ "bitflags 2.10.0",
  "bson",
- "chrono",
  "derive-where",
- "derive_more 0.99.17",
+ "derive_more",
  "futures-core",
- "futures-executor",
  "futures-io",
  "futures-util",
  "hex",
- "hickory-proto 0.24.4",
- "hickory-resolver 0.24.4",
+ "hickory-net",
+ "hickory-proto",
+ "hickory-resolver",
  "hmac",
  "macro_magic",
  "md-5",
  "mongocrypt",
  "mongodb-internal-macros",
- "once_cell",
  "pbkdf2",
  "percent-encoding",
- "rand 0.8.5",
+ "rand 0.9.4",
  "rustc_version_runtime",
  "rustls 0.23.37",
- "rustversion",
  "serde",
  "serde_bytes",
  "serde_with",
  "sha1",
  "sha2",
- "socket2 0.5.10",
+ "socket2 0.6.0",
  "stringprep",
  "strsim",
  "take_mut",
- "thiserror 1.0.68",
+ "thiserror 2.0.17",
  "tokio",
  "tokio-rustls 0.26.2",
  "tokio-util",
- "typed-builder 0.20.1",
+ "typed-builder 0.22.0",
  "uuid",
- "webpki-roots 0.26.1",
+ "webpki-roots 1.0.4",
 ]
 
 [[package]]
 name = "mongodb-internal-macros"
-version = "3.3.0"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63981427a0f26b89632fd2574280e069d09fb2912a3138da15de0174d11dd077"
+checksum = "99ceb1a9a1018e470077ec94cf3a8c2d0e6da542b2c05ea95a59a0a627147375"
 dependencies = [
  "macro_magic",
  "proc-macro2 1.0.106",
@@ -8149,9 +8060,9 @@ checksum = "c5a797f0e07bdf071d15742978fc3128ec6c22891c31a3a931513263904c982a"
 
 [[package]]
 name = "pbkdf2"
-version = "0.11.0"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83a0692ec44e4cf1ef28ca317f14f8f07da2d95ec3fa01f86e4467b725e60917"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
 dependencies = [
  "digest",
 ]
@@ -12643,11 +12554,11 @@ dependencies = [
 
 [[package]]
 name = "typed-builder"
-version = "0.20.1"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd9d30e3a08026c78f246b173243cf07b3696d274debd26680773b6773c2afc7"
+checksum = "398a3a3c918c96de527dc11e6e846cd549d4508030b8a33e1da12789c856b81a"
 dependencies = [
- "typed-builder-macro 0.20.1",
+ "typed-builder-macro 0.22.0",
 ]
 
 [[package]]
@@ -12663,9 +12574,9 @@ dependencies = [
 
 [[package]]
 name = "typed-builder-macro"
-version = "0.20.1"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c36781cc0e46a83726d9879608e4cf6c2505237e263a8eb8c24502989cfdb28"
+checksum = "0e48cea23f68d1f78eb7bc092881b6bb88d3d6b5b7e6234f6f9c911da1ffb221"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.45",
@@ -13095,7 +13006,7 @@ dependencies = [
  "headers 0.3.9",
  "heim",
  "hex",
- "hickory-proto 0.26.1",
+ "hickory-proto",
  "hostname 0.4.2",
  "http 0.2.12",
  "http 1.3.1",
diff --git a/Cargo.toml b/Cargo.toml
index 3290b7192da7d..12d52f20f20b1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -413,7 +413,7 @@ listenfd = { version = "1.0.2", default-features = false, optional = true }
 lru = { version = "0.16.3", default-features = false }
 maxminddb = { version = "0.27.0", default-features = false, optional = true, features = ["simdutf8"] }
 md-5 = { version = "0.10", default-features = false, optional = true }
-mongodb = { version = "3.3.0", default-features = false, optional = true, features = ["compat-3-0-0", "dns-resolver", "rustls-tls"] }
+mongodb = { version = "3.7.0", default-features = false, optional = true, features = ["compat-3-0-0", "dns-resolver", "rustls-tls"] }
 async-nats = { version = "0.46.0", default-features = false, optional = true, features = ["ring", "websockets", "jetstream", "nkeys"] }
 nkeys = { version = "0.4.5", default-features = false, optional = true }
 nom = { workspace = true, optional = true }
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index fa77ca0482eb8..11a06036ba8d8 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -180,7 +180,6 @@ const-oid,https://github.com/RustCrypto/formats/tree/master/const-oid,Apache-2.0
 const-random,https://github.com/tkaitchuck/constrandom,MIT OR Apache-2.0,Tom Kaitchuck <Tom.Kaitchuck@gmail.com>
 const-random-macro,https://github.com/tkaitchuck/constrandom,MIT OR Apache-2.0,Tom Kaitchuck <Tom.Kaitchuck@gmail.com>
 const-str,https://github.com/Nugine/const-str,MIT,Nugine <nugine@foxmail.com>
-convert_case,https://github.com/rutrum/convert-case,MIT,David Purdum <purdum41@gmail.com>
 convert_case,https://github.com/rutrum/convert-case,MIT,rutrum <dave@rutrum.net>
 cookie,https://github.com/SergioBenitez/cookie-rs,MIT OR Apache-2.0,"Sergio Benitez <sb@sergio.bz>, Alex Crichton <alex@alexcrichton.com>"
 cookie-factory,https://github.com/rust-bakery/cookie-factory,MIT,"Geoffroy Couprie <geo.couprie@gmail.com>, Pierre Chifflier <chifflier@wzdftpd.net>"
@@ -255,7 +254,6 @@ email_address,https://github.com/johnstonskj/rust-email_address,MIT,Simon Johnst
 encode_unicode,https://github.com/tormol/encode_unicode,Apache-2.0 OR MIT,Torbjørn Birch Moltu <t.b.moltu@lyse.net>
 encoding_rs,https://github.com/hsivonen/encoding_rs,(Apache-2.0 OR MIT) AND BSD-3-Clause,Henri Sivonen <hsivonen@hsivonen.fi>
 endian-type,https://github.com/Lolirofle/endian-type,MIT,Lolirofle <lolipopple@hotmail.com>
-enum-as-inner,https://github.com/bluejekyll/enum-as-inner,MIT OR Apache-2.0,Benjamin Fry <benjaminfry@me.com>
 enum-ordinalize,https://github.com/magiclen/enum-ordinalize,MIT,The enum-ordinalize Authors
 enum-ordinalize-derive,https://github.com/magiclen/enum-ordinalize,MIT,The enum-ordinalize-derive Authors
 enum_dispatch,https://gitlab.com/antonok/enum_dispatch,MIT OR Apache-2.0,Anton Lazarev <https://antonok.com>
@@ -449,7 +447,6 @@ lock_api,https://github.com/Amanieu/parking_lot,MIT OR Apache-2.0,Amanieu d'Antr
 lockfree-object-pool,https://github.com/EVaillant/lockfree-object-pool,BSL-1.0,Etienne Vaillant <vaillant.etienne@gmail.com>
 log,https://github.com/rust-lang/log,MIT OR Apache-2.0,The Rust Project Developers
 lru,https://github.com/jeromefroe/lru-rs,MIT,Jerome Froelich <jeromefroelic@hotmail.com>
-lru-cache,https://github.com/contain-rs/lru-cache,MIT OR Apache-2.0,Stepan Koltsov <stepan.koltsov@gmail.com>
 lru-slab,https://github.com/Ralith/lru-slab,MIT OR Apache-2.0 OR Zlib,Benjamin Saunders <ben.e.saunders@gmail.com>
 lz4,https://github.com/10xGenomics/lz4-rs,MIT,"Jens Heyens <jens.heyens@ewetel.net>, Artem V. Navrotskiy <bozaro@buzzsoft.ru>, Patrick Marks <pmarks@gmail.com>"
 lz4-sys,https://github.com/10xGenomics/lz4-rs,MIT,"Jens Heyens <jens.heyens@ewetel.net>, Artem V. Navrotskiy <bozaro@buzzsoft.ru>, Patrick Marks <pmarks@gmail.com>"
@@ -486,7 +483,7 @@ moka,https://github.com/moka-rs/moka,MIT OR Apache-2.0,The moka Authors
 mongocrypt,https://github.com/mongodb/libmongocrypt-rust,Apache-2.0,"Abraham Egnor <abraham.egnor@mongodb.com>, Isabel Atkinson <isabel.atkinson@mongodb.com>"
 mongocrypt-sys,https://github.com/mongodb/libmongocrypt-rust,Apache-2.0,"Abraham Egnor <abraham.egnor@mongodb.com>, Isabel Atkinson <isabel.atkinson@mongodb.com>"
 mongodb,https://github.com/mongodb/mongo-rust-driver,Apache-2.0,"Saghm Rossi <saghmrossi@gmail.com>, Patrick Freed <patrick.freed@mongodb.com>, Isabel Atkinson <isabel.atkinson@mongodb.com>, Abraham Egnor <abraham.egnor@mongodb.com>, Kaitlin Mahar <kaitlin.mahar@mongodb.com>, Patrick Meredith <pmeredit@protonmail.com>"
-mongodb-internal-macros,https://github.com/mongodb/mongo-rust-driver,Apache-2.0,The mongodb-internal-macros Authors
+mongodb-internal-macros,https://github.com/mongodb/mongo-rust-driver,Apache-2.0,"Saghm Rossi <saghmrossi@gmail.com>, Patrick Freed <patrick.freed@mongodb.com>, Isabel Atkinson <isabel.atkinson@mongodb.com>, Abraham Egnor <abraham.egnor@mongodb.com>, Kaitlin Mahar <kaitlin.mahar@mongodb.com>, Patrick Meredith <pmeredit@protonmail.com>"
 murmur3,https://github.com/stusmall/murmur3,MIT OR Apache-2.0,Stu Small <stuart.alan.small@gmail.com>
 native-tls,https://github.com/sfackler/rust-native-tls,MIT OR Apache-2.0,Steven Fackler <sfackler@gmail.com>
 ndk-context,https://github.com/rust-windowing/android-ndk-rs,MIT OR Apache-2.0,The Rust Windowing contributors
diff --git a/deny.toml b/deny.toml
index 37db54adf7956..0d563622a509e 100644
--- a/deny.toml
+++ b/deny.toml
@@ -50,5 +50,4 @@ ignore = [
   { id = "RUSTSEC-2026-0097", reason = "rand 0.8.5 unsound with custom logger - transitive dependency, upstream crates have not updated to rand 0.9+" },
   { id = "RUSTSEC-2026-0104", reason = "rustls-webpki 0.102/0.101 CRL parsing panic - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179); 0.103 already patched to 0.103.13" },
   { id = "RUSTSEC-2026-0105", reason = "core2 is unmaintained and all versions yanked - transitive dependency via libflate -> apache-avro, no safe upgrade available" },
-  { id = "RUSTSEC-2026-0119", reason = "hickory-proto 0.24 - unpatched crate (https://github.com/mongodb/mongo-rust-driver/pull/1682)" },
 ]

From 6a3711436b20944b3c86417f0454f8fc2c1e6ffc Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 27 May 2026 09:58:01 -0400
Subject: [PATCH 271/326] chore(deps): remove unused apache-avro dependency
 (#25502)

---
 Cargo.lock           | 101 ++-----------------------------------------
 Cargo.toml           |   5 +--
 LICENSE-3rdparty.csv |   7 ---
 deny.toml            |   1 -
 4 files changed, 5 insertions(+), 109 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 7002061aa95b5..0b91a3108a787 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8,12 +8,6 @@ version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
 
-[[package]]
-name = "adler32"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234"
-
 [[package]]
 name = "aead"
 version = "0.5.2"
@@ -235,29 +229,6 @@ version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
-[[package]]
-name = "apache-avro"
-version = "0.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ceb7c683b2f8f40970b70e39ff8be514c95b96fcb9c4af87e1ed2cb2e10801a0"
-dependencies = [
- "digest",
- "lazy_static",
- "libflate",
- "log",
- "num-bigint",
- "quad-rand",
- "rand 0.8.5",
- "regex-lite",
- "serde",
- "serde_json",
- "strum 0.25.0",
- "strum_macros 0.25.3",
- "thiserror 1.0.68",
- "typed-builder 0.16.2",
- "uuid",
-]
-
 [[package]]
 name = "apache-avro"
 version = "0.20.0"
@@ -2723,7 +2694,7 @@ dependencies = [
 name = "codecs"
 version = "0.1.0"
 dependencies = [
- "apache-avro 0.20.0",
+ "apache-avro",
  "arrow 56.2.0",
  "async-trait",
  "bytes",
@@ -3065,15 +3036,6 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
-[[package]]
-name = "core2"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b49ba7ef1ad6107f8824dbe97de947cbaac53c44e7f9756a1fba0d37c1eec505"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "cpufeatures"
 version = "0.2.11"
@@ -3467,12 +3429,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "dary_heap"
-version = "0.3.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06d2e3287df1c007e74221c49ca10a95d557349e54b3a75dc2fb14712c751f04"
-
 [[package]]
 name = "dashmap"
 version = "6.1.0"
@@ -6522,30 +6478,6 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
-[[package]]
-name = "libflate"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "249fa21ba2b59e8cbd69e722f5b31e1b466db96c937ae3de23e8b99ead0d1383"
-dependencies = [
- "adler32",
- "core2",
- "crc32fast",
- "dary_heap",
- "libflate_lz77",
-]
-
-[[package]]
-name = "libflate_lz77"
-version = "2.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a599cb10a9cd92b1300debcef28da8f70b935ec937f44fcd1b70a7c986a11c5c"
-dependencies = [
- "core2",
- "hashbrown 0.16.0",
- "rle-decode-fast",
-]
-
 [[package]]
 name = "libgit2-sys"
 version = "0.18.3+1.9.2"
@@ -7193,7 +7125,7 @@ dependencies = [
  "tokio",
  "tokio-rustls 0.26.2",
  "tokio-util",
- "typed-builder 0.22.0",
+ "typed-builder",
  "uuid",
  "webpki-roots 1.0.4",
 ]
@@ -9784,12 +9716,6 @@ dependencies = [
  "syn 1.0.109",
 ]
 
-[[package]]
-name = "rle-decode-fast"
-version = "1.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3582f63211428f83597b51b2ddb88e2a91a9d52d12831f9d08f5e624e8977422"
-
 [[package]]
 name = "rmp"
 version = "0.8.15"
@@ -12543,33 +12469,13 @@ version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ea3136b675547379c4bd395ca6b938e5ad3c3d20fad76e7fe85f9e0d011419c"
 
-[[package]]
-name = "typed-builder"
-version = "0.16.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34085c17941e36627a879208083e25d357243812c30e7d7387c3b954f30ade16"
-dependencies = [
- "typed-builder-macro 0.16.2",
-]
-
 [[package]]
 name = "typed-builder"
 version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "398a3a3c918c96de527dc11e6e846cd549d4508030b8a33e1da12789c856b81a"
 dependencies = [
- "typed-builder-macro 0.22.0",
-]
-
-[[package]]
-name = "typed-builder-macro"
-version = "0.16.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f03ca4cb38206e2bef0700092660bb74d696f808514dae47fa1467cbfe26e96e"
-dependencies = [
- "proc-macro2 1.0.106",
- "quote 1.0.45",
- "syn 2.0.117",
+ "typed-builder-macro",
 ]
 
 [[package]]
@@ -12927,7 +12833,6 @@ dependencies = [
 name = "vector"
 version = "0.56.0"
 dependencies = [
- "apache-avro 0.16.0",
  "approx",
  "arc-swap",
  "arr_macro",
diff --git a/Cargo.toml b/Cargo.toml
index 12d52f20f20b1..2bb3f94a54b7f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -357,7 +357,6 @@ greptimedb-ingester = { version = "0.17.0", default-features = false, optional =
 # External libs
 arc-swap = { workspace = true, default-features = false, optional = true }
 async-compression = { version = "0.4.27", default-features = false, features = ["tokio", "gzip", "zstd"], optional = true }
-apache-avro = { version = "0.16.0", default-features = false, optional = true }
 arrow = { version = "56.2.0", default-features = false, features = ["ipc"], optional = true }
 arrow-schema = { version = "56.2.0", default-features = false, optional = true }
 parquet = { version = "56.2.0", default-features = false, features = [
@@ -761,7 +760,7 @@ sources-prometheus = ["sources-prometheus-scrape", "sources-prometheus-remote-wr
 sources-prometheus-scrape = ["sinks-prometheus", "sources-utils-http-client", "vector-lib/prometheus"]
 sources-prometheus-remote-write = ["sinks-prometheus", "sources-utils-http", "vector-lib/prometheus"]
 sources-prometheus-pushgateway = ["sinks-prometheus", "sources-utils-http", "vector-lib/prometheus"]
-sources-pulsar = ["dep:apache-avro", "dep:pulsar"]
+sources-pulsar = ["dep:pulsar"]
 sources-redis = ["dep:redis"]
 sources-socket = ["sources-utils-net", "tokio-util/net"]
 sources-splunk_hec = ["dep:roaring"]
@@ -956,7 +955,7 @@ sinks-opentelemetry = ["sinks-http", "codecs-opentelemetry"]
 sinks-papertrail = ["dep:syslog"]
 sinks-prometheus = ["dep:base64", "dep:prost", "vector-lib/prometheus"]
 sinks-postgres = ["dep:sqlx"]
-sinks-pulsar = ["dep:apache-avro", "dep:pulsar"]
+sinks-pulsar = ["dep:pulsar"]
 sinks-redis = ["dep:redis"]
 sinks-sematext = ["sinks-elasticsearch", "sinks-influxdb"]
 sinks-socket = ["sinks-utils-udp"]
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 11a06036ba8d8..dec61bb1e82bd 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -1,6 +1,5 @@
 Component,Origin,License,Copyright
 adler2,https://github.com/oyvindln/adler2,0BSD OR MIT OR Apache-2.0,"Jonas Schievink <jonasschievink@gmail.com>, oyvindln <oyvindln@users.noreply.github.com>"
-adler32,https://github.com/remram44/adler32-rs,Zlib,Remi Rampin <remirampin@gmail.com>
 aead,https://github.com/RustCrypto/traits,MIT OR Apache-2.0,RustCrypto Developers
 aes,https://github.com/RustCrypto/block-ciphers,MIT OR Apache-2.0,RustCrypto Developers
 aes-siv,https://github.com/RustCrypto/AEADs,Apache-2.0 OR MIT,RustCrypto Developers
@@ -20,7 +19,6 @@ anstyle-parse,https://github.com/rust-cli/anstyle,MIT OR Apache-2.0,The anstyle-
 anstyle-query,https://github.com/rust-cli/anstyle,MIT OR Apache-2.0,The anstyle-query Authors
 anstyle-wincon,https://github.com/rust-cli/anstyle,MIT OR Apache-2.0,The anstyle-wincon Authors
 anyhow,https://github.com/dtolnay/anyhow,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
-apache-avro,https://github.com/apache/avro,Apache-2.0,Apache Avro team <dev@avro.apache.org>
 apache-avro,https://github.com/apache/avro-rs,Apache-2.0,The apache-avro Authors
 arbitrary,https://github.com/rust-fuzz/arbitrary,MIT OR Apache-2.0,"The Rust-Fuzz Project Developers, Nick Fitzgerald <fitzgen@gmail.com>, Manish Goregaokar <manishsmail@gmail.com>, Simonas Kazlauskas <arbitrary@kazlauskas.me>, Brian L. Troutwine <brian@troutwine.us>, Corey Farwell <coreyf@rwell.org>"
 arc-swap,https://github.com/vorner/arc-swap,MIT OR Apache-2.0,Michal 'vorner' Vaner <vorner@vorner.cz>
@@ -187,7 +185,6 @@ cookie_store,https://github.com/pfernie/cookie_store,MIT OR Apache-2.0,Patrick F
 core-foundation,https://github.com/servo/core-foundation-rs,MIT  OR  Apache-2.0,The Servo Project Developers
 core-foundation,https://github.com/servo/core-foundation-rs,MIT OR Apache-2.0,The Servo Project Developers
 core-foundation-sys,https://github.com/servo/core-foundation-rs,MIT OR Apache-2.0,The Servo Project Developers
-core2,https://github.com/bbqsrc/core2,Apache-2.0 OR MIT,Brendan Molloy <brendan@bbqsrc.net>
 cpufeatures,https://github.com/RustCrypto/utils,MIT OR Apache-2.0,RustCrypto Developers
 crc,https://github.com/mrhooray/crc-rs,MIT OR Apache-2.0,"Rui Hu <code@mrhooray.com>, Akhil Velagapudi <4@4khil.com>"
 crc-catalog,https://github.com/akhilles/crc-catalog,MIT OR Apache-2.0,Akhil Velagapudi <akhilvelagapudi@gmail.com>
@@ -213,7 +210,6 @@ curve25519-dalek-derive,https://github.com/dalek-cryptography/curve25519-dalek,M
 darling,https://github.com/TedDriggs/darling,MIT,Ted Driggs <ted.driggs@outlook.com>
 darling_core,https://github.com/TedDriggs/darling,MIT,Ted Driggs <ted.driggs@outlook.com>
 darling_macro,https://github.com/TedDriggs/darling,MIT,Ted Driggs <ted.driggs@outlook.com>
-dary_heap,https://github.com/hanmertens/dary_heap,MIT OR Apache-2.0,Han Mertens <hanmertens@outlook.com>
 dashmap,https://github.com/xacrimon/dashmap,MIT,Acrimon <joel.wejdenstal@gmail.com>
 data-encoding,https://github.com/ia0/data-encoding,MIT,Julien Cretin <git@ia0.eu>
 data-url,https://github.com/servo/rust-url,MIT OR Apache-2.0,Simon Sapin <simon.sapin@exyr.org>
@@ -431,8 +427,6 @@ lexical-util,https://github.com/Alexhuszagh/rust-lexical,MIT OR Apache-2.0,Alex
 lexical-write-float,https://github.com/Alexhuszagh/rust-lexical,MIT OR Apache-2.0,Alex Huszagh <ahuszagh@gmail.com>
 lexical-write-integer,https://github.com/Alexhuszagh/rust-lexical,MIT OR Apache-2.0,Alex Huszagh <ahuszagh@gmail.com>
 libc,https://github.com/rust-lang/libc,MIT OR Apache-2.0,The Rust Project Developers
-libflate,https://github.com/sile/libflate,MIT,Takeru Ohta <phjgt308@gmail.com>
-libflate_lz77,https://github.com/sile/libflate,MIT,Takeru Ohta <phjgt308@gmail.com>
 libm,https://github.com/rust-lang/libm,MIT OR Apache-2.0,Jorge Aparicio <jorge@japaric.io>
 libsqlite3-sys,https://github.com/rusqlite/rusqlite,MIT,The rusqlite developers
 libz-sys,https://github.com/rust-lang/libz-sys,MIT OR Apache-2.0,"Alex Crichton <alex@alexcrichton.com>, Josh Triplett <josh@joshtriplett.org>, Sebastian Thiel <sebastian.thiel@icloud.com>"
@@ -648,7 +642,6 @@ rfc6979,https://github.com/RustCrypto/signatures/tree/master/rfc6979,Apache-2.0
 ring,https://github.com/briansmith/ring,Apache-2.0 AND ISC,The ring Authors
 rkyv,https://github.com/rkyv/rkyv,MIT,David Koloski <djkoloski@gmail.com>
 rkyv_derive,https://github.com/rkyv/rkyv,MIT,David Koloski <djkoloski@gmail.com>
-rle-decode-fast,https://github.com/WanzenBug/rle-decode-helper,MIT OR Apache-2.0,Moritz Wanzenböck <moritz@wanzenbug.xyz>
 rmp,https://github.com/3Hren/msgpack-rust,MIT,"Evgeny Safronov <division494@gmail.com>, Kornel <kornel@geekhood.net>"
 rmp-serde,https://github.com/3Hren/msgpack-rust,MIT,Evgeny Safronov <division494@gmail.com>
 rmpv,https://github.com/3Hren/msgpack-rust,MIT,Evgeny Safronov <division494@gmail.com>
diff --git a/deny.toml b/deny.toml
index 0d563622a509e..533953462810f 100644
--- a/deny.toml
+++ b/deny.toml
@@ -49,5 +49,4 @@ ignore = [
   { id = "RUSTSEC-2024-0436", reason = "paste crate is unmaintained - transitive dependency via parquet v56.2.0, no safe upgrade available" },
   { id = "RUSTSEC-2026-0097", reason = "rand 0.8.5 unsound with custom logger - transitive dependency, upstream crates have not updated to rand 0.9+" },
   { id = "RUSTSEC-2026-0104", reason = "rustls-webpki 0.102/0.101 CRL parsing panic - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179); 0.103 already patched to 0.103.13" },
-  { id = "RUSTSEC-2026-0105", reason = "core2 is unmaintained and all versions yanked - transitive dependency via libflate -> apache-avro, no safe upgrade available" },
 ]

From 08ce7b9228fa810a5c27a3be7a934f421cc406a9 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 27 May 2026 10:38:14 -0400
Subject: [PATCH 272/326] chore(deps): bump async-nats to 0.49.0 (#25503)

---
 Cargo.lock | 13 ++++++-------
 Cargo.toml |  2 +-
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 0b91a3108a787..3af48912136f0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -920,29 +920,28 @@ dependencies = [
 
 [[package]]
 name = "async-nats"
-version = "0.46.0"
+version = "0.49.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df5af9ebfb0a14481d3eaf6101e6391261e4f30d25b26a7635ade8a39482ded0"
+checksum = "407486109ea5cfdf53fde05f46996dadf0547518a4d49f050d25f405ae31ed2d"
 dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-util",
  "memchr",
  "nkeys",
- "once_cell",
  "pin-project",
  "portable-atomic",
- "rand 0.8.5",
+ "rand 0.10.1",
  "regex",
  "ring",
- "rustls-native-certs 0.7.0",
+ "rustls-native-certs 0.8.1",
  "rustls-pki-types",
- "rustls-webpki 0.102.8",
+ "rustls-webpki 0.103.13",
  "serde",
  "serde_json",
  "serde_nanos",
  "serde_repr",
- "thiserror 1.0.68",
+ "thiserror 2.0.17",
  "time",
  "tokio",
  "tokio-rustls 0.26.2",
diff --git a/Cargo.toml b/Cargo.toml
index 2bb3f94a54b7f..48c227b62ed1e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -413,7 +413,7 @@ lru = { version = "0.16.3", default-features = false }
 maxminddb = { version = "0.27.0", default-features = false, optional = true, features = ["simdutf8"] }
 md-5 = { version = "0.10", default-features = false, optional = true }
 mongodb = { version = "3.7.0", default-features = false, optional = true, features = ["compat-3-0-0", "dns-resolver", "rustls-tls"] }
-async-nats = { version = "0.46.0", default-features = false, optional = true, features = ["ring", "websockets", "jetstream", "nkeys"] }
+async-nats = { version = "0.49.0", default-features = false, optional = true, features = ["ring", "websockets", "jetstream", "nkeys"] }
 nkeys = { version = "0.4.5", default-features = false, optional = true }
 nom = { workspace = true, optional = true }
 notify = { version = "8.1.0", default-features = false, features = ["macos_fsevent"] }

From ee870f9cdb9fa57cf917abf0f887b1f1ca5b1aac Mon Sep 17 00:00:00 2001
From: Flavio Cruz <87035001+flaviofcruz@users.noreply.github.com>
Date: Wed, 27 May 2026 11:57:54 -0400
Subject: [PATCH 273/326] fix(databricks_zerobus sink): defer Unity Catalog
 schema fetch out of build() (#25408)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(databricks_zerobus sink): defer Unity Catalog schema fetch out of build()

* Add changelog fragment

* Make schema transient errors retryable

* Format

* Avoid cloning vector of events and other misc things

* Add databricks_zerobus to semantic.yml for CI

* Remove changelog entry and fix clippy

* Defer transient zerobus failures to source via EventStatus::Errored

When the Tower retry budget is exhausted on a retryable failure (UC 5xx/408/429,
network blip, transient SDK error), the driver previously mapped the resulting
Err to EventStatus::Rejected — a permanent drop, indistinguishable from a UC
404 or an EncodingError. Ack-enabled sources and disk buffers had no way to
know a replay would have helped.

This change wires a small Tower layer outside the existing retry stack:
- Ok responses pass through unchanged.
- Err that downcasts to a retryable ZerobusSinkError (or doesn't downcast at
  all — conservative) becomes Ok(ZerobusResponse::errored()), so the driver
  sets Errored and the source / disk buffer may replay.
- Err that is permanent (EncodingError, SchemaError { retryable: false },
  MissingAckOffset, non-retryable SDK errors) still propagates so the driver
  maps it to Rejected.

ZerobusResponse now carries an EventStatus field with delivered() / errored()
constructors; ingest() returns ZerobusResponse::delivered(...).

Also brings unity_catalog_schema::status_is_retryable into line with Vector's
canonical RetryStrategy::Default by delegating to it. The visible effect: UC
501 (Not Implemented) is now classified as permanent (was retryable under the
prior blanket 5xx rule).

Co-authored-by: Isaac

* Fix wrong place
---
 .github/workflows/semantic.yml                |   2 +-
 src/sinks/databricks_zerobus/config.rs        |  29 +-
 src/sinks/databricks_zerobus/error.rs         |  66 ++-
 src/sinks/databricks_zerobus/service.rs       | 477 ++++++++++++++----
 src/sinks/databricks_zerobus/sink.rs          |  77 +--
 .../unity_catalog_schema.rs                   |  66 ++-
 6 files changed, 500 insertions(+), 217 deletions(-)

diff --git a/.github/workflows/semantic.yml b/.github/workflows/semantic.yml
index 6d801c49d5de9..616c5d15b83cc 100644
--- a/.github/workflows/semantic.yml
+++ b/.github/workflows/semantic.yml
@@ -127,7 +127,6 @@ jobs:
             aws service
             azure service
             confluent service
-            databricks_zerobus sink
             datadog service
             elastic service
             gcp service
@@ -222,6 +221,7 @@ jobs:
             blackhole sink
             clickhouse sink
             console sink
+            databricks_zerobus sink
             datadog_archives sink
             datadog_common sink
             datadog_events sink
diff --git a/src/sinks/databricks_zerobus/config.rs b/src/sinks/databricks_zerobus/config.rs
index 275d2c16a251e..1df2f62a6f1c3 100644
--- a/src/sinks/databricks_zerobus/config.rs
+++ b/src/sinks/databricks_zerobus/config.rs
@@ -9,15 +9,7 @@ use crate::sinks::{
     util::{BatchConfig, RealtimeSizeBasedDefaultBatchSettings},
 };
 
-use vector_lib::codecs::encoding::{
-    BatchEncoder, BatchSerializerConfig, ProtoBatchSerializerConfig,
-};
-
-use super::{
-    error::ZerobusSinkError,
-    service::{StreamMode, ZerobusService},
-    sink::ZerobusSink,
-};
+use super::{error::ZerobusSinkError, service::ZerobusService, sink::ZerobusSink};
 
 /// Authentication configuration for Databricks.
 #[configurable_component]
@@ -163,27 +155,12 @@ impl SinkConfig for ZerobusSinkConfig {
     async fn build(&self, cx: SinkContext) -> crate::Result<(VectorSink, Healthcheck)> {
         self.validate()?;
 
-        let descriptor = ZerobusService::resolve_descriptor(self, cx.proxy()).await?;
-
-        // The zerobus sink always encodes in proto_batch form — the stream
-        // descriptor is the one we just resolved from Unity Catalog.
-        let descriptor_proto = std::sync::Arc::new(descriptor.descriptor_proto().clone());
-        let stream_mode = StreamMode::Proto { descriptor_proto };
-
-        let proto_config = ProtoBatchSerializerConfig {
-            descriptor: Some(descriptor),
-        };
-        let batch_serializer = BatchSerializerConfig::ProtoBatch(proto_config)
-            .build_batch_serializer()
-            .map_err(|e| format!("Failed to build batch serializer: {}", e))?;
-        let encoder = BatchEncoder::new(batch_serializer);
-
-        let service = ZerobusService::new(self.clone(), stream_mode, cx.proxy()).await?;
+        let service = ZerobusService::new(self.clone(), cx.proxy()).await?;
         let healthcheck_service = service.clone();
 
         let request_limits = self.request.into_settings();
 
-        let sink = ZerobusSink::new(service, request_limits, self.batch, encoder)?;
+        let sink = ZerobusSink::new(service, request_limits, self.batch)?;
 
         let healthcheck = async move {
             healthcheck_service
diff --git a/src/sinks/databricks_zerobus/error.rs b/src/sinks/databricks_zerobus/error.rs
index e4dedddea00c8..1e9a630415724 100644
--- a/src/sinks/databricks_zerobus/error.rs
+++ b/src/sinks/databricks_zerobus/error.rs
@@ -38,6 +38,35 @@ pub enum ZerobusSinkError {
     /// will create a fresh stream via `get_or_create_stream`.
     #[snafu(display("Zerobus stream was closed concurrently"))]
     StreamClosed,
+
+    /// Resolving the table schema from Unity Catalog failed. `retryable`
+    /// distinguishes transient failures (network, 5xx, 408, 429) from
+    /// permanent ones (404, 401, 403, ...).
+    #[snafu(display("Schema resolution failed: {}", message))]
+    SchemaError { message: String, retryable: bool },
+}
+
+impl ZerobusSinkError {
+    /// Whether this error should be retried.
+    pub fn is_retryable(&self) -> bool {
+        match self {
+            Self::ZerobusError { source }
+            | Self::StreamInitError { source }
+            | Self::IngestionError { source } => source.is_retryable(),
+            Self::StreamClosed => true,
+            Self::SchemaError { retryable, .. } => *retryable,
+            Self::ConfigError { .. } | Self::EncodingError { .. } | Self::MissingAckOffset => false,
+        }
+    }
+
+    /// Event status to apply to a batch's finalizers when this error occurs.
+    pub fn event_status(&self) -> EventStatus {
+        if self.is_retryable() {
+            EventStatus::Errored
+        } else {
+            EventStatus::Rejected
+        }
+    }
 }
 
 impl From<ZerobusError> for ZerobusSinkError {
@@ -46,24 +75,9 @@ impl From<ZerobusError> for ZerobusSinkError {
     }
 }
 
-/// Convert Zerobus errors to Vector event status.
 impl From<ZerobusSinkError> for EventStatus {
     fn from(error: ZerobusSinkError) -> Self {
-        match error {
-            ZerobusSinkError::ConfigError { .. }
-            | ZerobusSinkError::EncodingError { .. }
-            | ZerobusSinkError::MissingAckOffset => EventStatus::Rejected,
-            ZerobusSinkError::StreamClosed => EventStatus::Errored,
-            ZerobusSinkError::ZerobusError { source }
-            | ZerobusSinkError::StreamInitError { source }
-            | ZerobusSinkError::IngestionError { source } => {
-                if source.is_retryable() {
-                    EventStatus::Errored
-                } else {
-                    EventStatus::Rejected
-                }
-            }
-        }
+        error.event_status()
     }
 }
 
@@ -170,4 +184,24 @@ mod tests {
         };
         assert!(!logic.is_retriable_error(&error));
     }
+
+    #[test]
+    fn retryable_schema_error_maps_to_errored() {
+        let error = ZerobusSinkError::SchemaError {
+            message: "UC 503".to_string(),
+            retryable: true,
+        };
+        assert!(ZerobusRetryLogic.is_retriable_error(&error));
+        assert_eq!(EventStatus::from(error), EventStatus::Errored);
+    }
+
+    #[test]
+    fn non_retryable_schema_error_maps_to_rejected() {
+        let error = ZerobusSinkError::SchemaError {
+            message: "UC 404".to_string(),
+            retryable: false,
+        };
+        assert!(!ZerobusRetryLogic.is_retriable_error(&error));
+        assert_eq!(EventStatus::from(error), EventStatus::Rejected);
+    }
 }
diff --git a/src/sinks/databricks_zerobus/service.rs b/src/sinks/databricks_zerobus/service.rs
index 0da433699d9c2..028d03e7a154a 100644
--- a/src/sinks/databricks_zerobus/service.rs
+++ b/src/sinks/databricks_zerobus/service.rs
@@ -1,13 +1,19 @@
 //! Zerobus service wrapper for Vector sink integration.
 
 use crate::config::ProxyConfig;
+use crate::event::Event;
+use crate::http::HttpClient;
 use crate::sinks::util::retries::RetryLogic;
+use crate::tls::TlsSettings;
 use databricks_zerobus_ingest_sdk::{ConnectorFactory, ProxyConnector, ZerobusSdk, ZerobusStream};
 use futures::future::BoxFuture;
 use std::sync::Arc;
-use tokio::sync::{Mutex, RwLock};
-use tower::Service;
+use tokio::sync::{Mutex, OnceCell, RwLock};
+use tower::{Layer, Service};
 use tracing::warn;
+use vector_lib::codecs::encoding::{
+    BatchEncoder, BatchOutput, BatchSerializerConfig, ProtoBatchSerializerConfig,
+};
 use vector_lib::finalization::{EventFinalizers, Finalizable};
 use vector_lib::request_metadata::{GroupedCountByteSize, MetaDescriptive, RequestMetadata};
 use vector_lib::stream::DriverResponse;
@@ -50,32 +56,55 @@ fn build_connector_factory(proxy: &ProxyConfig) -> Result<ConnectorFactory, Zero
     }))
 }
 
-/// The payload for a Zerobus request.
-///
-/// The zerobus sink only supports proto-encoded records.
-#[derive(Clone, Debug)]
-pub enum ZerobusPayload {
-    /// Pre-encoded protobuf records (one byte buffer per event).
-    Records(Vec<Vec<u8>>),
-}
-
 /// Request type for the Zerobus service.
-#[derive(Clone, Debug)]
+///
+/// Carries the *unencoded* batch — encoding happens inside `Service::call` so
+/// that schema-fetch failures flow through the Tower retry layer. Events live
+/// behind an `Arc` because Tower's retry policy clones the request before
+/// every call (not just on retry), and a deep clone of `Vec<Event>` per call
+/// would be wasteful.
+#[derive(Clone)]
 pub struct ZerobusRequest {
-    pub payload: ZerobusPayload,
+    pub events: Arc<Vec<Event>>,
     pub metadata: RequestMetadata,
     pub finalizers: EventFinalizers,
 }
 
 /// Response type for the Zerobus service.
+///
+/// Carries the final `EventStatus` so the driver can mark finalizers correctly:
+/// `Delivered` on success, `Errored` when the retry budget was exhausted on a
+/// transient failure (asking the source / disk buffer to replay), and `Err`
+/// from `Service::call` reserved for permanent failures (driver maps to
+/// `Rejected`).
 #[derive(Debug)]
 pub struct ZerobusResponse {
     pub events_byte_size: GroupedCountByteSize,
+    pub status: vector_lib::event::EventStatus,
+}
+
+impl ZerobusResponse {
+    const fn delivered(events_byte_size: GroupedCountByteSize) -> Self {
+        Self {
+            events_byte_size,
+            status: vector_lib::event::EventStatus::Delivered,
+        }
+    }
+
+    /// Synthesize a response signalling a transient failure that exhausted the
+    /// retry budget. Carries a telemetry-aware zero `events_byte_size` because
+    /// the driver only consumes `events_sent()` on the `Delivered` path.
+    fn errored() -> Self {
+        Self {
+            events_byte_size: vector_lib::config::telemetry().create_request_count_byte_size(),
+            status: vector_lib::event::EventStatus::Errored,
+        }
+    }
 }
 
 impl DriverResponse for ZerobusResponse {
     fn event_status(&self) -> vector_lib::event::EventStatus {
-        vector_lib::event::EventStatus::Delivered
+        self.status
     }
 
     fn events_sent(&self) -> &GroupedCountByteSize {
@@ -99,18 +128,6 @@ impl MetaDescriptive for ZerobusRequest {
     }
 }
 
-/// Determines what kind of stream the service creates and how payloads are ingested.
-///
-/// The sink only supports proto streams today; this is kept as an enum to
-/// leave room for future stream modes without reshaping all the call sites.
-#[derive(Clone)]
-pub enum StreamMode {
-    /// Proto stream using `ZerobusStream::ingest_records_offset`.
-    Proto {
-        descriptor_proto: Arc<prost_reflect::prost_types::DescriptorProto>,
-    },
-}
-
 /// The active stream.
 ///
 /// The SDK's `ZerobusStream::close()` requires `&mut self`, but ingests need
@@ -257,18 +274,24 @@ impl MockStream {
     }
 }
 
+/// Schema and encoding state derived from the Unity Catalog table.
+pub(super) struct ResolvedSchema {
+    encoder: BatchEncoder,
+    descriptor_proto: Arc<prost_reflect::prost_types::DescriptorProto>,
+}
+
 /// Service for handling Zerobus requests.
 pub struct ZerobusService {
     sdk: Arc<ZerobusSdk>,
     config: Arc<ZerobusSinkConfig>,
+    http_client: HttpClient,
     stream: Arc<Mutex<Option<Arc<ActiveStream>>>>,
-    stream_mode: StreamMode,
+    schema: Arc<OnceCell<ResolvedSchema>>,
 }
 
 impl ZerobusService {
     pub async fn new(
         config: ZerobusSinkConfig,
-        stream_mode: StreamMode,
         proxy: &ProxyConfig,
     ) -> Result<Self, ZerobusSinkError> {
         let mut builder = ZerobusSdk::builder()
@@ -279,18 +302,25 @@ impl ZerobusService {
             message: format!("Failed to create Zerobus SDK: {}", e),
         })?;
 
+        let http_client = HttpClient::new(TlsSettings::default(), proxy).map_err(|e| {
+            ZerobusSinkError::ConfigError {
+                message: format!("Failed to create HTTP client: {}", e),
+            }
+        })?;
+
         Ok(Self {
             sdk: Arc::new(sdk),
             config: Arc::new(config),
+            http_client,
             stream: Arc::new(Mutex::new(None)),
-            stream_mode,
+            schema: Arc::new(OnceCell::new()),
         })
     }
 
-    /// Resolve the protobuf message descriptor from the schema configuration.
-    pub async fn resolve_descriptor(
+    /// Resolve the protobuf message descriptor from Unity Catalog.
+    async fn resolve_descriptor(
         config: &ZerobusSinkConfig,
-        proxy: &crate::config::ProxyConfig,
+        http_client: &HttpClient,
     ) -> Result<prost_reflect::MessageDescriptor, ZerobusSinkError> {
         let (client_id, client_secret) = config.auth.credentials();
 
@@ -299,51 +329,93 @@ impl ZerobusService {
             &config.table_name,
             client_id,
             client_secret,
-            proxy,
+            http_client,
         )
         .await?;
 
         unity_catalog_schema::generate_descriptor_from_schema(&table_schema)
     }
 
+    /// Resolve the schema on first use; cache the result.
+    pub(super) async fn ensure_schema(&self) -> Result<&ResolvedSchema, ZerobusSinkError> {
+        self.schema
+            .get_or_try_init(|| async {
+                let descriptor = Self::resolve_descriptor(&self.config, &self.http_client).await?;
+                let descriptor_proto = Arc::new(descriptor.descriptor_proto().clone());
+
+                let batch_serializer =
+                    BatchSerializerConfig::ProtoBatch(ProtoBatchSerializerConfig {
+                        descriptor: Some(descriptor),
+                    })
+                    .build_batch_serializer()
+                    .map_err(|e| ZerobusSinkError::ConfigError {
+                        message: format!("Failed to build batch serializer: {}", e),
+                    })?;
+
+                Ok(ResolvedSchema {
+                    encoder: BatchEncoder::new(batch_serializer),
+                    descriptor_proto,
+                })
+            })
+            .await
+    }
+
+    pub(super) fn encode_records(
+        schema: &ResolvedSchema,
+        events: &[Event],
+    ) -> Result<Vec<Vec<u8>>, ZerobusSinkError> {
+        match schema
+            .encoder
+            .encode_batch(events)
+            .map_err(|e| ZerobusSinkError::EncodingError {
+                message: format!("Failed to encode batch: {}", e),
+            })? {
+            BatchOutput::Records(records) => Ok(records),
+            #[cfg(feature = "codecs-arrow")]
+            BatchOutput::Arrow(_) => Err(ZerobusSinkError::EncodingError {
+                message: "The Databricks Zerobus sink only supports proto-batch output.".into(),
+            }),
+        }
+    }
+
     /// Ensure we have an active stream, creating one if necessary.
     ///
-    /// Also used as the healthcheck: eagerly creating a stream verifies
-    /// OAuth credentials, endpoint connectivity, and table validity.
+    /// Also used as the healthcheck: resolving the schema verifies the table
+    /// and credentials against Unity Catalog, and creating the stream verifies
+    /// connectivity to the Zerobus endpoint.
     pub async fn ensure_stream(&self) -> Result<(), ZerobusSinkError> {
-        self.get_or_create_stream().await.map(|_| ())
+        let schema = self.ensure_schema().await?;
+        self.get_or_create_stream(schema).await.map(|_| ())
     }
 
     /// Return an `Arc` handle to the active stream, creating one if needed.
     ///
     /// The lock is held only while checking/creating the stream; callers can
     /// then use the returned `Arc` without holding the lock.
-    async fn get_or_create_stream(&self) -> Result<Arc<ActiveStream>, ZerobusSinkError> {
+    async fn get_or_create_stream(
+        &self,
+        schema: &ResolvedSchema,
+    ) -> Result<Arc<ActiveStream>, ZerobusSinkError> {
         let mut stream_guard = self.stream.lock().await;
 
         if stream_guard.is_none() {
             let (client_id, client_secret) = self.config.auth.credentials();
             let (client_id, client_secret) = (client_id.to_string(), client_secret.to_string());
 
-            let active_stream = match &self.stream_mode {
-                StreamMode::Proto { descriptor_proto } => {
-                    let stream_options = &self.config.stream_options;
-                    let stream = self
-                        .sdk
-                        .stream_builder()
-                        .table(self.config.table_name.clone())
-                        .oauth(client_id, client_secret)
-                        .compiled_proto((**descriptor_proto).clone())
-                        .server_lack_of_ack_timeout_ms(stream_options.server_lack_of_ack_timeout_ms)
-                        .flush_timeout_ms(stream_options.flush_timeout_ms)
-                        .build()
-                        .await
-                        .map_err(|e| ZerobusSinkError::StreamInitError { source: e })?;
-                    ActiveStream::proto(stream)
-                }
-            };
+            let stream_options = &self.config.stream_options;
+            let stream = self
+                .sdk
+                .stream_builder()
+                .table(self.config.table_name.clone())
+                .oauth(client_id, client_secret)
+                .compiled_proto((*schema.descriptor_proto).clone())
+                .server_lack_of_ack_timeout_ms(stream_options.server_lack_of_ack_timeout_ms)
+                .flush_timeout_ms(stream_options.flush_timeout_ms)
+                .build()
+                .await
+                .map_err(|e| ZerobusSinkError::StreamInitError { source: e })?;
 
-            *stream_guard = Some(Arc::new(active_stream));
+            *stream_guard = Some(Arc::new(ActiveStream::proto(stream)));
         }
 
         Ok(Arc::clone(stream_guard.as_ref().unwrap()))
@@ -364,25 +436,20 @@ impl ZerobusService {
         }
     }
 
-    /// Ingest a payload (proto records or Arrow batch).
-    ///
-    /// Obtains an `Arc` handle to the stream (creating one if needed) and
-    /// then releases the lock before calling into the SDK so that concurrent
-    /// ingests are not serialized.
+    /// Send encoded records to an already-resolved stream.
     ///
     /// On retryable errors the active stream is removed from the slot so that
     /// the next attempt (driven by Tower retry) creates a fresh one.
-    pub async fn ingest(
+    async fn ingest(
         &self,
-        payload: ZerobusPayload,
+        stream: Arc<ActiveStream>,
+        records: Vec<Vec<u8>>,
         events_byte_size: GroupedCountByteSize,
     ) -> Result<ZerobusResponse, ZerobusSinkError> {
-        let stream = self.get_or_create_stream().await?;
-
         // Slot lock is not held here — concurrent ingests acquire read guards
         // on the inner `RwLock` and run truly in parallel.
-        let result = match (payload, stream.as_ref()) {
-            (ZerobusPayload::Records(records), ActiveStream::Proto(lock)) => {
+        let result = match stream.as_ref() {
+            ActiveStream::Proto(lock) => {
                 let guard = lock.read().await;
                 let Some(s) = guard.as_ref() else {
                     return Err(ZerobusSinkError::StreamClosed);
@@ -396,11 +463,11 @@ impl ZerobusService {
                 }
             }
             #[cfg(test)]
-            (ZerobusPayload::Records(_), ActiveStream::Mock(mock)) => mock.try_ingest().await,
+            ActiveStream::Mock(mock) => mock.try_ingest().await,
         };
 
         match result {
-            Ok(()) => Ok(ZerobusResponse { events_byte_size }),
+            Ok(()) => Ok(ZerobusResponse::delivered(events_byte_size)),
             Err(e) => {
                 if e.is_retryable() {
                     // Clear the slot so the next attempt creates a fresh stream,
@@ -441,7 +508,12 @@ impl Service<ZerobusRequest> for ZerobusService {
         let events_byte_size =
             std::mem::take(request.metadata_mut()).into_events_estimated_json_encoded_byte_size();
 
-        Box::pin(async move { service.ingest(request.payload, events_byte_size).await })
+        Box::pin(async move {
+            let schema = service.ensure_schema().await?;
+            let records = Self::encode_records(schema, &request.events)?;
+            let stream = service.get_or_create_stream(schema).await?;
+            service.ingest(stream, records, events_byte_size).await
+        })
     }
 }
 
@@ -450,8 +522,9 @@ impl Clone for ZerobusService {
         Self {
             sdk: Arc::clone(&self.sdk),
             config: Arc::clone(&self.config),
+            http_client: self.http_client.clone(),
             stream: Arc::clone(&self.stream),
-            stream_mode: self.stream_mode.clone(),
+            schema: Arc::clone(&self.schema),
         }
     }
 }
@@ -482,13 +555,17 @@ impl ZerobusService {
                 message: format!("Failed to create Zerobus SDK: {}", e),
             })?;
 
+        let http_client = HttpClient::new(TlsSettings::default(), &ProxyConfig::default())
+            .map_err(|e| ZerobusSinkError::ConfigError {
+                message: format!("Failed to create HTTP client: {}", e),
+            })?;
+
         Ok(Self {
             sdk: Arc::new(sdk),
             config: Arc::new(config),
+            http_client,
             stream: Arc::new(Mutex::new(Some(Arc::new(ActiveStream::Mock(mock))))),
-            stream_mode: StreamMode::Proto {
-                descriptor_proto: Arc::new(Default::default()),
-            },
+            schema: Arc::new(OnceCell::new()),
         })
     }
 
@@ -504,15 +581,81 @@ impl RetryLogic for ZerobusRetryLogic {
     type Response = ZerobusResponse;
 
     fn is_retriable_error(&self, error: &Self::Error) -> bool {
-        match error {
-            ZerobusSinkError::ZerobusError { source }
-            | ZerobusSinkError::StreamInitError { source }
-            | ZerobusSinkError::IngestionError { source } => source.is_retryable(),
-            ZerobusSinkError::StreamClosed => true,
-            ZerobusSinkError::ConfigError { .. }
-            | ZerobusSinkError::EncodingError { .. }
-            | ZerobusSinkError::MissingAckOffset => false,
-        }
+        error.is_retryable()
+    }
+}
+
+/// Tower layer that converts retry-budget-exhausted retryable errors into a
+/// successful `ZerobusResponse` carrying `EventStatus::Errored`.
+///
+/// Wraps the retry layer from the outside. When the retry layer returns:
+/// - `Ok(resp)` — pass through unchanged.
+/// - `Err(e)` where `e.is_retryable()` — convert to `Ok(ZerobusResponse::errored())`
+///   so the driver marks finalizers `Errored` (transient — source / disk
+///   buffer may replay) rather than `Rejected` (permanent drop).
+/// - `Err(e)` permanent — propagate so the driver maps to `Rejected`.
+///
+/// Without this layer the driver maps every `Err` from `Service::call` to
+/// `EventStatus::Rejected`, which would drop transient-but-exhausted failures
+/// as if they were permanent.
+#[derive(Clone, Debug, Default)]
+pub struct RetryableErrorAsErroredLayer;
+
+impl<S> Layer<S> for RetryableErrorAsErroredLayer {
+    type Service = RetryableErrorAsErrored<S>;
+
+    fn layer(&self, inner: S) -> Self::Service {
+        RetryableErrorAsErrored { inner }
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct RetryableErrorAsErrored<S> {
+    inner: S,
+}
+
+impl<S> Service<ZerobusRequest> for RetryableErrorAsErrored<S>
+where
+    S: Service<ZerobusRequest, Response = ZerobusResponse, Error = crate::Error>,
+    S::Future: Send + 'static,
+{
+    type Response = ZerobusResponse;
+    type Error = crate::Error;
+    type Future = BoxFuture<'static, Result<Self::Response, Self::Error>>;
+
+    fn poll_ready(
+        &mut self,
+        cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<Result<(), Self::Error>> {
+        self.inner.poll_ready(cx)
+    }
+
+    fn call(&mut self, req: ZerobusRequest) -> Self::Future {
+        let fut = self.inner.call(req);
+        Box::pin(async move {
+            match fut.await {
+                Ok(resp) => Ok(resp),
+                Err(e) => {
+                    // The Tower stack boxes errors above us (retry, timeout,
+                    // adaptive-concurrency). Downcast to inspect retryability;
+                    // anything that isn't a `ZerobusSinkError` (e.g. a timeout
+                    // `Elapsed`) is conservatively treated as transient.
+                    let retryable = match e.downcast_ref::<ZerobusSinkError>() {
+                        Some(zb) => zb.is_retryable(),
+                        None => true,
+                    };
+                    if retryable {
+                        warn!(
+                            message = "Zerobus retry budget exhausted on transient error; signaling Errored so source or buffer may replay.",
+                            error = %e,
+                        );
+                        Ok(ZerobusResponse::errored())
+                    } else {
+                        Err(e)
+                    }
+                }
+            }
+        })
     }
 }
 
@@ -541,8 +684,12 @@ mod tests {
         }
     }
 
-    fn dummy_payload() -> ZerobusPayload {
-        ZerobusPayload::Records(vec![vec![1, 2, 3]])
+    fn dummy_records() -> Vec<Vec<u8>> {
+        vec![vec![1, 2, 3]]
+    }
+
+    async fn current_stream(service: &ZerobusService) -> Arc<ActiveStream> {
+        Arc::clone(service.stream.lock().await.as_ref().unwrap())
     }
 
     #[tokio::test]
@@ -551,8 +698,13 @@ mod tests {
             .await
             .unwrap();
 
+        let stream = current_stream(&service).await;
         let result = service
-            .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+            .ingest(
+                stream,
+                dummy_records(),
+                GroupedCountByteSize::new_untagged(),
+            )
             .await;
 
         assert!(result.is_ok());
@@ -570,8 +722,13 @@ mod tests {
 
         assert!(service.has_active_stream().await);
 
+        let stream = current_stream(&service).await;
         let err = service
-            .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+            .ingest(
+                stream,
+                dummy_records(),
+                GroupedCountByteSize::new_untagged(),
+            )
             .await
             .unwrap_err();
 
@@ -590,8 +747,13 @@ mod tests {
 
         assert!(service.has_active_stream().await);
 
+        let stream = current_stream(&service).await;
         let err = service
-            .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+            .ingest(
+                stream,
+                dummy_records(),
+                GroupedCountByteSize::new_untagged(),
+            )
             .await
             .unwrap_err();
 
@@ -610,9 +772,14 @@ mod tests {
             .unwrap();
 
         // First ingest succeeds.
+        let stream = current_stream(&service).await;
         assert!(
             service
-                .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+                .ingest(
+                    stream,
+                    dummy_records(),
+                    GroupedCountByteSize::new_untagged()
+                )
                 .await
                 .is_ok()
         );
@@ -629,8 +796,13 @@ mod tests {
         }
 
         // Second ingest fails and clears the stream.
+        let stream = current_stream(&service).await;
         let err = service
-            .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+            .ingest(
+                stream,
+                dummy_records(),
+                GroupedCountByteSize::new_untagged(),
+            )
             .await
             .unwrap_err();
         assert!(ZerobusRetryLogic.is_retriable_error(&err));
@@ -641,9 +813,14 @@ mod tests {
         *service.stream.lock().await = Some(Arc::new(ActiveStream::Mock(MockStream::succeeding())));
 
         // Third ingest succeeds on the new stream.
+        let stream = current_stream(&service).await;
         assert!(
             service
-                .ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
+                .ingest(
+                    stream,
+                    dummy_records(),
+                    GroupedCountByteSize::new_untagged()
+                )
                 .await
                 .is_ok()
         );
@@ -686,17 +863,27 @@ mod tests {
             .await
             .unwrap();
 
-        // Spawn two concurrent ingests. Each will obtain its own `Arc` clone
-        // from `get_or_create_stream`, then block in the gate.
+        // Spawn two concurrent ingests. Each clones the same stream `Arc`,
+        // then blocks in the gate.
         let s1 = service.clone();
         let t1 = tokio::spawn(async move {
-            s1.ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
-                .await
+            let stream = current_stream(&s1).await;
+            s1.ingest(
+                stream,
+                dummy_records(),
+                GroupedCountByteSize::new_untagged(),
+            )
+            .await
         });
         let s2 = service.clone();
         let t2 = tokio::spawn(async move {
-            s2.ingest(dummy_payload(), GroupedCountByteSize::new_untagged())
-                .await
+            let stream = current_stream(&s2).await;
+            s2.ingest(
+                stream,
+                dummy_records(),
+                GroupedCountByteSize::new_untagged(),
+            )
+            .await
         });
 
         // Wait until both ingests are inside the gate (both `Arc`s alive).
@@ -722,4 +909,102 @@ mod tests {
         // And the slot was cleared so the next ingest creates a fresh stream.
         assert!(!service.has_active_stream().await);
     }
+
+    fn dummy_request() -> ZerobusRequest {
+        ZerobusRequest {
+            events: Arc::new(vec![]),
+            metadata: RequestMetadata::default(),
+            finalizers: EventFinalizers::default(),
+        }
+    }
+
+    #[tokio::test]
+    async fn retryable_err_after_exhaustion_becomes_ok_errored() {
+        use tower::ServiceExt;
+        let inner = tower::service_fn(|_req: ZerobusRequest| async move {
+            let err: crate::Error = Box::new(ZerobusSinkError::SchemaError {
+                message: "UC 503".to_string(),
+                retryable: true,
+            });
+            Err::<ZerobusResponse, _>(err)
+        });
+        let mut svc = RetryableErrorAsErrored { inner };
+        let resp = svc
+            .ready()
+            .await
+            .unwrap()
+            .call(dummy_request())
+            .await
+            .unwrap();
+        assert_eq!(resp.status, vector_lib::event::EventStatus::Errored);
+    }
+
+    #[tokio::test]
+    async fn non_retryable_err_propagates() {
+        use tower::ServiceExt;
+        let inner = tower::service_fn(|_req: ZerobusRequest| async move {
+            let err: crate::Error = Box::new(ZerobusSinkError::EncodingError {
+                message: "bad".to_string(),
+            });
+            Err::<ZerobusResponse, _>(err)
+        });
+        let mut svc = RetryableErrorAsErrored { inner };
+        let err = svc
+            .ready()
+            .await
+            .unwrap()
+            .call(dummy_request())
+            .await
+            .unwrap_err();
+        let zb = err.downcast_ref::<ZerobusSinkError>().unwrap();
+        assert!(matches!(zb, ZerobusSinkError::EncodingError { .. }));
+    }
+
+    #[tokio::test]
+    async fn unknown_err_treated_as_transient() {
+        use tower::ServiceExt;
+        // Simulate a Tower-layer error that isn't a ZerobusSinkError (e.g.
+        // timeout `Elapsed`): conservatively becomes Errored, not Rejected.
+        #[derive(Debug)]
+        struct Other;
+        impl std::fmt::Display for Other {
+            fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+                write!(f, "other")
+            }
+        }
+        impl std::error::Error for Other {}
+
+        let inner = tower::service_fn(|_req: ZerobusRequest| async move {
+            let err: crate::Error = Box::new(Other);
+            Err::<ZerobusResponse, _>(err)
+        });
+        let mut svc = RetryableErrorAsErrored { inner };
+        let resp = svc
+            .ready()
+            .await
+            .unwrap()
+            .call(dummy_request())
+            .await
+            .unwrap();
+        assert_eq!(resp.status, vector_lib::event::EventStatus::Errored);
+    }
+
+    #[tokio::test]
+    async fn ok_response_passes_through() {
+        use tower::ServiceExt;
+        let inner = tower::service_fn(|_req: ZerobusRequest| async move {
+            Ok::<_, crate::Error>(ZerobusResponse::delivered(
+                GroupedCountByteSize::new_untagged(),
+            ))
+        });
+        let mut svc = RetryableErrorAsErrored { inner };
+        let resp = svc
+            .ready()
+            .await
+            .unwrap()
+            .call(dummy_request())
+            .await
+            .unwrap();
+        assert_eq!(resp.status, vector_lib::event::EventStatus::Delivered);
+    }
 }
diff --git a/src/sinks/databricks_zerobus/sink.rs b/src/sinks/databricks_zerobus/sink.rs
index 30b473c2c041b..037984fd1d4d4 100644
--- a/src/sinks/databricks_zerobus/sink.rs
+++ b/src/sinks/databricks_zerobus/sink.rs
@@ -3,25 +3,24 @@
 use std::num::NonZeroUsize;
 use std::sync::Arc;
 
+use futures::StreamExt;
 use futures::stream::BoxStream;
 
-use vector_lib::codecs::encoding::{BatchEncoder, BatchOutput};
-use vector_lib::event::EventStatus;
 use vector_lib::finalization::Finalizable;
 
 use crate::sinks::prelude::*;
 use crate::sinks::util::metadata::RequestMetadataBuilder;
-use crate::sinks::util::request_builder::default_request_builder_concurrency_limit;
 use crate::sinks::util::{RealtimeSizeBasedDefaultBatchSettings, TowerRequestSettings};
 
-use super::service::{ZerobusPayload, ZerobusRequest, ZerobusRetryLogic, ZerobusService};
+use super::service::{
+    RetryableErrorAsErroredLayer, ZerobusRequest, ZerobusRetryLogic, ZerobusService,
+};
 
 /// The main Zerobus sink.
 pub struct ZerobusSink {
     service: ZerobusService,
     request_limits: TowerRequestSettings,
     batch_settings: BatcherSettings,
-    encoder: BatchEncoder,
 }
 
 impl ZerobusSink {
@@ -29,7 +28,6 @@ impl ZerobusSink {
         service: ZerobusService,
         request_limits: TowerRequestSettings,
         batch_config: BatchConfig<RealtimeSizeBasedDefaultBatchSettings>,
-        encoder: BatchEncoder,
     ) -> Result<Self, crate::Error> {
         let batch_settings = batch_config.into_batcher_settings()?;
 
@@ -37,71 +35,30 @@ impl ZerobusSink {
             service,
             request_limits,
             batch_settings,
-            encoder,
-        })
-    }
-
-    fn encode_batch(
-        encoder: &BatchEncoder,
-        mut events: Vec<Event>,
-    ) -> Result<ZerobusRequest, String> {
-        let finalizers = events.take_finalizers();
-        let metadata_builder = RequestMetadataBuilder::from_events(&events);
-
-        let batch_output = match encoder.encode_batch(&events) {
-            Ok(output) => output,
-            Err(e) => {
-                finalizers.update_status(EventStatus::Rejected);
-                return Err(format!("Failed to encode batch: {}", e));
-            }
-        };
-
-        let (payload, byte_size) = match batch_output {
-            BatchOutput::Records(records) => {
-                let size = records.iter().map(|r| r.len()).sum::<usize>();
-                (ZerobusPayload::Records(records), size)
-            }
-            // The sink only builds a proto-batch encoder, so this arm is
-            // only reachable if the shared codec adds a new `BatchOutput`
-            // variant without a corresponding zerobus payload type.
-            #[cfg(feature = "codecs-arrow")]
-            BatchOutput::Arrow(_) => {
-                finalizers.update_status(EventStatus::Rejected);
-                return Err("The Databricks Zerobus sink only supports proto-batch output.".into());
-            }
-        };
-
-        let request_size = NonZeroUsize::new(byte_size).unwrap_or(NonZeroUsize::MIN);
-        let metadata = metadata_builder.with_request_size(request_size);
-
-        Ok(ZerobusRequest {
-            payload,
-            metadata,
-            finalizers,
         })
     }
 
     async fn run_inner(self: Box<Self>, input: BoxStream<'_, Event>) -> Result<(), ()> {
-        let encoder = Arc::new(self.encoder.clone());
-
         let result = {
             let tower_service = ServiceBuilder::new()
+                .layer(RetryableErrorAsErroredLayer)
                 .settings(self.request_limits, ZerobusRetryLogic)
                 .service(self.service.clone());
 
             input
                 .batched(self.batch_settings.as_byte_size_config())
-                .concurrent_map(default_request_builder_concurrency_limit(), move |events| {
-                    let encoder = Arc::clone(&encoder);
-                    Box::pin(async move { Self::encode_batch(&encoder, events) })
-                })
-                .filter_map(|result| async move {
-                    match result {
-                        Err(error) => {
-                            emit!(SinkRequestBuildError { error });
-                            None
-                        }
-                        Ok(req) => Some(req),
+                .map(|mut events| {
+                    let finalizers = events.take_finalizers();
+                    // The encoded request size isn't known until `Service::call`
+                    // encodes the batch, and nothing in the zerobus path reads
+                    // `RequestMetadata::request_encoded_size`, so a placeholder
+                    // is fine here.
+                    let metadata = RequestMetadataBuilder::from_events(&events)
+                        .with_request_size(NonZeroUsize::MIN);
+                    ZerobusRequest {
+                        events: Arc::new(events),
+                        metadata,
+                        finalizers,
                     }
                 })
                 .into_driver(tower_service)
diff --git a/src/sinks/databricks_zerobus/unity_catalog_schema.rs b/src/sinks/databricks_zerobus/unity_catalog_schema.rs
index 0343848f1cefe..e1871087e1dfd 100644
--- a/src/sinks/databricks_zerobus/unity_catalog_schema.rs
+++ b/src/sinks/databricks_zerobus/unity_catalog_schema.rs
@@ -6,7 +6,7 @@
 
 use bytes::Buf;
 use databricks_zerobus_ingest_sdk::schema::descriptor_from_uc_schema;
-use http::{Request, Uri};
+use http::{Request, StatusCode, Uri};
 use http_body::Body as HttpBody;
 use hyper::Body;
 use percent_encoding::{NON_ALPHANUMERIC, percent_encode};
@@ -14,9 +14,22 @@ use prost_reflect::prost_types;
 use serde::Deserialize;
 
 use super::error::ZerobusSinkError;
-use crate::config::ProxyConfig;
 use crate::http::HttpClient;
-use crate::tls::TlsSettings;
+
+/// Whether a Unity Catalog HTTP response status should be retried.
+///
+/// Delegates to the canonical Vector HTTP retry policy
+/// [`crate::sinks::util::http::RetryStrategy::Default`] so this sink stays in
+/// lock-step with other HTTP-based sinks: 5xx (except 501 Not Implemented),
+/// 408 (Request Timeout), and 429 (Too Many Requests) are transient; 4xx
+/// otherwise (404, 401, 403, ...) and 501 are permanent.
+fn status_is_retryable(status: StatusCode) -> bool {
+    use crate::sinks::util::{http::RetryStrategy, retries::RetryAction};
+    matches!(
+        RetryStrategy::Default.retry_action::<()>(status),
+        RetryAction::Retry(_) | RetryAction::RetryPartial(_)
+    )
+}
 
 // Alias the SDK types under the names the rest of the sink already uses.
 #[cfg(test)]
@@ -35,17 +48,10 @@ pub async fn fetch_table_schema(
     table_name: &str,
     client_id: &str,
     client_secret: &str,
-    proxy: &ProxyConfig,
+    http_client: &HttpClient,
 ) -> Result<UnityCatalogTableSchema, ZerobusSinkError> {
-    let http_client = HttpClient::new(TlsSettings::default(), proxy).map_err(|e| {
-        ZerobusSinkError::ConfigError {
-            message: format!("Failed to create HTTP client: {}", e),
-        }
-    })?;
-
-    // First, get OAuth token
     let token = get_oauth_token(
-        &http_client,
+        http_client,
         unity_catalog_endpoint,
         client_id,
         client_secret,
@@ -82,8 +88,9 @@ pub async fn fetch_table_schema(
     let response = http_client
         .send(request)
         .await
-        .map_err(|e| ZerobusSinkError::ConfigError {
+        .map_err(|e| ZerobusSinkError::SchemaError {
             message: format!("Failed to fetch table schema: {}", e),
+            retryable: true,
         })?;
 
     let status = response.status();
@@ -95,11 +102,12 @@ pub async fn fetch_table_schema(
             .map(|c| c.to_bytes())
             .unwrap_or_default();
         let error_text = String::from_utf8_lossy(&body_bytes);
-        return Err(ZerobusSinkError::ConfigError {
+        return Err(ZerobusSinkError::SchemaError {
             message: format!(
                 "Unity Catalog API returned error {}: {}",
                 status, error_text
             ),
+            retryable: status_is_retryable(status),
         });
     }
 
@@ -108,8 +116,9 @@ pub async fn fetch_table_schema(
         .collect()
         .await
         .map(|c| c.to_bytes())
-        .map_err(|e| ZerobusSinkError::ConfigError {
+        .map_err(|e| ZerobusSinkError::SchemaError {
             message: format!("Failed to read response body: {}", e),
+            retryable: true,
         })?;
 
     let schema: UnityCatalogTableSchema =
@@ -157,8 +166,9 @@ async fn get_oauth_token(
     let response = http_client
         .send(request)
         .await
-        .map_err(|e| ZerobusSinkError::ConfigError {
+        .map_err(|e| ZerobusSinkError::SchemaError {
             message: format!("Failed to get OAuth token: {}", e),
+            retryable: true,
         })?;
 
     let status = response.status();
@@ -170,8 +180,9 @@ async fn get_oauth_token(
             .map(|c| c.to_bytes())
             .unwrap_or_default();
         let error_text = String::from_utf8_lossy(&body_bytes);
-        return Err(ZerobusSinkError::ConfigError {
+        return Err(ZerobusSinkError::SchemaError {
             message: format!("OAuth token request failed {}: {}", status, error_text),
+            retryable: status_is_retryable(status),
         });
     }
 
@@ -180,8 +191,9 @@ async fn get_oauth_token(
         .collect()
         .await
         .map(|c| c.to_bytes())
-        .map_err(|e| ZerobusSinkError::ConfigError {
+        .map_err(|e| ZerobusSinkError::SchemaError {
             message: format!("Failed to read OAuth response body: {}", e),
+            retryable: true,
         })?;
 
     let token_response: OAuthTokenResponse =
@@ -380,6 +392,24 @@ fn sanitize_package_name(name: &str) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn status_is_retryable_matches_canonical_policy() {
+        // Transient — must retry.
+        assert!(status_is_retryable(StatusCode::INTERNAL_SERVER_ERROR));
+        assert!(status_is_retryable(StatusCode::BAD_GATEWAY));
+        assert!(status_is_retryable(StatusCode::SERVICE_UNAVAILABLE));
+        assert!(status_is_retryable(StatusCode::GATEWAY_TIMEOUT));
+        assert!(status_is_retryable(StatusCode::REQUEST_TIMEOUT));
+        assert!(status_is_retryable(StatusCode::TOO_MANY_REQUESTS));
+        // Permanent — must not retry. 501 in particular: the server doesn't
+        // support the requested functionality; retry won't change that.
+        assert!(!status_is_retryable(StatusCode::NOT_IMPLEMENTED));
+        assert!(!status_is_retryable(StatusCode::NOT_FOUND));
+        assert!(!status_is_retryable(StatusCode::UNAUTHORIZED));
+        assert!(!status_is_retryable(StatusCode::FORBIDDEN));
+        assert!(!status_is_retryable(StatusCode::BAD_REQUEST));
+    }
+
     /// Smoke test: the wrapper calls into the SDK and builds a usable
     /// `MessageDescriptor` via the descriptor pool.
     #[test]

From e5e2e15d18d85941679a6c1eacffb0f400e93422 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Josu=C3=A9=20AGBEKODO?= <josue.agbekodo@datadoghq.com>
Date: Wed, 27 May 2026 13:59:40 -0400
Subject: [PATCH 274/326] feat(http_server source): allow custom auth to enrich
 events via metadata writes (#25391)

* feat(http_server source): make custom auth type writable in metadata

* fix(http_server source): warn when auth enrichment is dropped by unsupported sources

Sources that implement HttpSource but don't override inject_auth_enrichment
(heroku_logs, prometheus pushgateway/remote_write) would silently drop any
%field metadata written in a custom auth VRL program. Emit a warning instead
so users get actionable feedback rather than silent data loss.

* update docs

* protect reserved fields

* allow metadata enrichment for metrics and traces

* dont use hard-coded list of reserved fields

* fix docs
---
 ..._custom_auth_write_metadata.enhancement.md |   6 +
 src/common/http/server_auth.rs                | 113 +++++++--
 src/sources/http_server.rs                    | 238 +++++++++++++++++-
 src/sources/util/http/prelude.rs              |  29 ++-
 .../sinks/generated/websocket_server.cue      |   2 +-
 .../sources/generated/heroku_logs.cue         |   2 +-
 .../components/sources/generated/http.cue     |  10 +-
 .../sources/generated/http_server.cue         |  10 +-
 .../generated/prometheus_pushgateway.cue      |   2 +-
 .../generated/prometheus_remote_write.cue     |   2 +-
 10 files changed, 379 insertions(+), 35 deletions(-)
 create mode 100644 changelog.d/25391_http_server_custom_auth_write_metadata.enhancement.md

diff --git a/changelog.d/25391_http_server_custom_auth_write_metadata.enhancement.md b/changelog.d/25391_http_server_custom_auth_write_metadata.enhancement.md
new file mode 100644
index 0000000000000..531afe60a4b60
--- /dev/null
+++ b/changelog.d/25391_http_server_custom_auth_write_metadata.enhancement.md
@@ -0,0 +1,6 @@
+The `custom` auth strategy for the `http_server` source now supports event enrichment via metadata
+writes. VRL programs can write `%field = value` during authentication; those values are injected
+into every successfully authenticated event. The event body (`.field`) remains read-only. Existing
+`custom` programs that do not write metadata are unaffected.
+
+authors: 20agbekodo
diff --git a/src/common/http/server_auth.rs b/src/common/http/server_auth.rs
index 7d482796f99f3..57b6ded3fbb1d 100644
--- a/src/common/http/server_auth.rs
+++ b/src/common/http/server_auth.rs
@@ -12,6 +12,7 @@ use vector_config::configurable_component;
 use vector_lib::{
     TimeZone, compile_vrl,
     event::{Event, LogEvent, VrlTarget},
+    lookup::OwnedTargetPath,
     sensitive_string::SensitiveString,
 };
 use vector_vrl_metrics::MetricsStorage;
@@ -54,7 +55,7 @@ pub enum HttpServerAuthConfig {
 
     /// Custom authentication using VRL code.
     ///
-    /// Takes in request and validates it using VRL code.
+    /// Takes in request and validates it using VRL code. The VRL program must return a boolean.
     Custom {
         /// The VRL boolean expression.
         source: String,
@@ -151,7 +152,9 @@ impl HttpServerAuthConfig {
                 let mut config = CompileConfig::default();
                 config.set_custom(enrichment_tables.clone());
                 config.set_custom(metrics_storage.clone());
-                config.set_read_only();
+                // Lock the event body (.field) as read-only, but leave metadata (%field) writable
+                // so the VRL program can enrich authenticated events via %field = value.
+                config.set_read_only_path(OwnedTargetPath::event_root(), true);
 
                 let CompilationResult {
                     program,
@@ -182,7 +185,9 @@ impl HttpServerAuthConfig {
 pub enum HttpServerAuthMatcher {
     /// Matcher for comparing exact value of Authorization header
     AuthHeader(HeaderValue, &'static str),
-    /// Matcher for running VRL script for requests, to allow for custom validation
+    /// Matcher for running VRL script for requests, to allow for custom validation.
+    /// Metadata (`%field`) writes in the program are extracted and returned to the caller
+    /// for injection into authenticated events.
     Vrl {
         /// Compiled VRL script
         program: Program,
@@ -190,18 +195,19 @@ pub enum HttpServerAuthMatcher {
 }
 
 impl HttpServerAuthMatcher {
-    /// Compares passed headers to the matcher
+    /// Validates the request. Returns `Ok(Some(enrichment))` when auth passes and the VRL program
+    /// wrote `%field` values; returns `Ok(None)` when auth passes with no metadata enrichment.
     pub fn handle_auth(
         &self,
         address: Option<&SocketAddr>,
         headers: &HeaderMap<HeaderValue>,
         path: &str,
-    ) -> Result<(), ErrorMessage> {
+    ) -> Result<Option<ObjectMap>, ErrorMessage> {
         match self {
             HttpServerAuthMatcher::AuthHeader(expected, err_message) => {
                 if let Some(header) = headers.get(AUTHORIZATION) {
                     if expected == header {
-                        Ok(())
+                        Ok(None)
                     } else {
                         Err(ErrorMessage::new(
                             StatusCode::UNAUTHORIZED,
@@ -227,7 +233,7 @@ impl HttpServerAuthMatcher {
         headers: &HeaderMap<HeaderValue>,
         path: &str,
         program: &Program,
-    ) -> Result<(), ErrorMessage> {
+    ) -> Result<Option<ObjectMap>, ErrorMessage> {
         let mut target = VrlTarget::new(
             Event::Log(LogEvent::from_map(
                 ObjectMap::from([
@@ -263,16 +269,22 @@ impl HttpServerAuthMatcher {
             warn!("Handling auth failed: {}", e);
             ErrorMessage::new(StatusCode::UNAUTHORIZED, "Auth failed".to_owned())
         })? {
-            vrl::core::Value::Boolean(result) => {
-                if result {
-                    Ok(())
+            vrl::core::Value::Boolean(true) => {
+                let enrichment = if let VrlTarget::LogEvent(_, metadata) = &target {
+                    metadata
+                        .value()
+                        .as_object()
+                        .filter(|m| !m.is_empty())
+                        .cloned()
                 } else {
-                    Err(ErrorMessage::new(
-                        StatusCode::UNAUTHORIZED,
-                        "Auth failed".to_owned(),
-                    ))
-                }
+                    None
+                };
+                Ok(enrichment)
             }
+            vrl::core::Value::Boolean(false) => Err(ErrorMessage::new(
+                StatusCode::UNAUTHORIZED,
+                "Auth failed".to_owned(),
+            )),
             _ => Err(ErrorMessage::new(
                 StatusCode::UNAUTHORIZED,
                 "Invalid return value".to_owned(),
@@ -643,4 +655,75 @@ mod tests {
         assert_eq!(401, error.code());
         assert_eq!("Auth failed", error.message());
     }
+
+    // Backward-compat: existing `custom` scripts that don't write metadata still work and return
+    // Ok(None) — no enrichment, no change in behavior.
+    #[test]
+    fn custom_auth_matcher_returns_none_enrichment_when_no_metadata_written() {
+        let custom_auth = HttpServerAuthConfig::Custom {
+            source: r#".headers.authorization == "Bearer token""#.to_string(),
+        };
+
+        let matcher = custom_auth
+            .build(&Default::default(), &Default::default())
+            .unwrap();
+
+        let mut headers = HeaderMap::new();
+        headers.insert(AUTHORIZATION, HeaderValue::from_static("Bearer token"));
+        let (_guard, addr) = next_addr();
+        let result = matcher.handle_auth(Some(&addr), &headers, "/");
+
+        assert!(result.is_ok());
+        assert_eq!(
+            None,
+            result.unwrap(),
+            "no metadata written => no enrichment"
+        );
+    }
+
+    // Existing `custom` scripts that write metadata via `%field = value` now enrich events.
+    #[test]
+    fn custom_auth_matcher_returns_enrichment_when_metadata_written() {
+        let custom_auth = HttpServerAuthConfig::Custom {
+            source: indoc! {r#"
+                %tenant_id = "acme"
+                true
+                "#}
+            .to_string(),
+        };
+
+        let matcher = custom_auth
+            .build(&Default::default(), &Default::default())
+            .unwrap();
+
+        let headers = HeaderMap::new();
+        let (_guard, addr) = next_addr();
+        let result = matcher.handle_auth(Some(&addr), &headers, "/");
+
+        assert!(result.is_ok());
+        let enrichment = result.unwrap().expect("expected enrichment map");
+        assert_eq!(
+            enrichment.get("tenant_id").cloned(),
+            Some(vrl::core::Value::from("acme")),
+        );
+    }
+
+    // Existing `custom` scripts still cannot mutate event body fields.
+    #[test]
+    fn custom_auth_build_fails_when_event_body_write_attempted() {
+        let custom_auth = HttpServerAuthConfig::Custom {
+            source: indoc! {r#"
+                .new_field = "value"
+                true
+                "#}
+            .to_string(),
+        };
+
+        assert!(
+            custom_auth
+                .build(&Default::default(), &Default::default())
+                .is_err(),
+            "writing to event body (.field) must be rejected at compile time"
+        );
+    }
 }
diff --git a/src/sources/http_server.rs b/src/sources/http_server.rs
index 7c444284adc6c..bc588fb713c0c 100644
--- a/src/sources/http_server.rs
+++ b/src/sources/http_server.rs
@@ -13,10 +13,13 @@ use vector_lib::{
     },
     config::{DataType, LegacyKey, LogNamespace},
     configurable::configurable_component,
-    lookup::{lookup_v2::OptionalValuePath, owned_value_path, path},
+    lookup::{PathPrefix, lookup_v2::OptionalValuePath, owned_value_path, path},
     schema::Definition,
 };
-use vrl::value::{Kind, kind::Collection};
+use vrl::{
+    path::ValuePath as _,
+    value::{Kind, ObjectMap, kind::Collection},
+};
 use warp::http::HeaderMap;
 
 use crate::{
@@ -114,6 +117,14 @@ pub struct SimpleHttpConfig {
     #[configurable(metadata(docs::examples = "*"))]
     query_parameters: Vec<String>,
 
+    /// HTTP authentication configuration.
+    ///
+    /// Use HTTP authentication with HTTPS only. The authentication credentials are passed as an
+    /// HTTP header without any additional encryption beyond what is provided by the transport itself.
+    ///
+    /// When using the `custom` strategy, the VRL program may write `%field = value` to enrich
+    /// authenticated events. These metadata fields are injected into the event body (legacy
+    /// namespace) or under `http_server.<field>` in event metadata (Vector namespace).
     #[configurable(derived)]
     auth: Option<HttpServerAuthConfig>,
 
@@ -217,9 +228,16 @@ impl SimpleHttpConfig {
             )
             .with_standard_vector_source_metadata();
 
-        // for metadata that is added to the events dynamically from config options
+        // For metadata that is added to the events dynamically from config options.
         if log_namespace == LogNamespace::Legacy {
-            schema_definition = schema_definition.unknown_fields(Kind::bytes());
+            // Custom auth programs can inject any VRL value, not just bytes; widen the unknown
+            // field kind accordingly so schema-aware downstream components don't reject events.
+            let unknown_kind = if matches!(self.auth, Some(HttpServerAuthConfig::Custom { .. })) {
+                Kind::any()
+            } else {
+                Kind::bytes()
+            };
+            schema_definition = schema_definition.unknown_fields(unknown_kind);
         }
 
         schema_definition
@@ -521,6 +539,42 @@ impl HttpSource for SimpleHttpSource {
     fn enable_source_ip(&self) -> bool {
         self.host_key.path.is_some()
     }
+
+    /// Injects `%field` enrichment from a `custom` auth VRL program into events.
+    /// Both namespaces use insert-if-empty semantics so auth enrichment never
+    /// overwrites built-in source metadata (`path`, `host`, `headers`, …) that
+    /// `enrich_events` already populated.
+    /// Vector namespace: inserted into event metadata under `http_server.<field>` for
+    ///   all event types (Log, Metric, Trace).
+    /// Legacy namespace: inserted into the Log event body only (Metric/Trace are skipped).
+    fn inject_auth_enrichment(&self, events: &mut [Event], enrichment: ObjectMap) {
+        for event in events.iter_mut() {
+            match self.log_namespace {
+                LogNamespace::Vector => {
+                    // metadata_mut() dispatches to Log, Metric, and Trace so every
+                    // decoded event type receives the auth enrichment fields.
+                    let meta = event.metadata_mut().value_mut();
+                    for (key, value) in &enrichment {
+                        let key_str = key.as_str();
+                        let name_part = path!(SimpleHttpConfig::NAME);
+                        let key_part = path!(key_str);
+                        let full_path = name_part.concat(key_part);
+                        if meta.get(full_path.clone()).is_none() {
+                            meta.insert(full_path, value.clone());
+                        }
+                    }
+                }
+                LogNamespace::Legacy => {
+                    // Legacy enrichment targets the event body; only Log events have one.
+                    if let Event::Log(log) = event {
+                        for (key, value) in &enrichment {
+                            log.try_insert((PathPrefix::Event, path!(key.as_str())), value.clone());
+                        }
+                    }
+                }
+            }
+        }
+    }
 }
 
 #[cfg(test)]
@@ -543,11 +597,15 @@ mod tests {
         config::LogNamespace,
         event::LogEvent,
         lookup::{
-            OwnedTargetPath, PathPrefix, event_path, lookup_v2::OptionalValuePath, owned_value_path,
+            OwnedTargetPath, PathPrefix, event_path, lookup_v2::OptionalValuePath,
+            owned_value_path, path,
         },
         schema::Definition,
     };
-    use vrl::value::{Kind, ObjectMap, kind::Collection};
+    use vrl::{
+        path::ValuePath as _,
+        value::{Kind, ObjectMap, kind::Collection},
+    };
 
     use super::{SimpleHttpConfig, remove_duplicates};
     use crate::{
@@ -1725,6 +1783,174 @@ mod tests {
         }
     }
 
+    #[test]
+    fn inject_auth_enrichment_does_not_clobber_vector_namespace_builtin_fields() {
+        use crate::{codecs::DecodingConfig, sources::util::HttpSource as _};
+        use vector_lib::codecs::BytesDeserializerConfig;
+        use vrl::value::KeyString;
+
+        let decoder = DecodingConfig::new(
+            BytesDecoderConfig::new().into(),
+            BytesDeserializerConfig::new().into(),
+            LogNamespace::Vector,
+        )
+        .build()
+        .unwrap()
+        .with_log_namespace(LogNamespace::Vector);
+
+        let source = super::SimpleHttpSource {
+            headers: vec![],
+            query_parameters: vec![],
+            path_key: OptionalValuePath::none(),
+            host_key: OptionalValuePath::none(),
+            decoder,
+            log_namespace: LogNamespace::Vector,
+        };
+
+        let mut log = LogEvent::default();
+        // Pre-populate %http_server.path as enrich_events would.
+        log.insert(
+            (
+                PathPrefix::Metadata,
+                path!(SimpleHttpConfig::NAME).concat(path!("path")),
+            ),
+            "/real/path",
+        );
+
+        let mut events = vec![Event::Log(log)];
+        let mut enrichment = ObjectMap::new();
+        // Attempt to clobber the built-in `path` field and inject a new field.
+        enrichment.insert(KeyString::from("path"), Value::from("/clobbered"));
+        enrichment.insert(KeyString::from("tenant_id"), Value::from("t-123"));
+
+        source.inject_auth_enrichment(&mut events, enrichment);
+
+        let Event::Log(log) = &events[0] else {
+            panic!("expected log event");
+        };
+        assert_eq!(
+            log.get((
+                PathPrefix::Metadata,
+                path!(SimpleHttpConfig::NAME).concat(path!("path")),
+            )),
+            Some(&Value::from("/real/path")),
+            "auth enrichment must not overwrite built-in source metadata"
+        );
+        assert_eq!(
+            log.get((
+                PathPrefix::Metadata,
+                path!(SimpleHttpConfig::NAME).concat(path!("tenant_id")),
+            )),
+            Some(&Value::from("t-123")),
+            "new auth enrichment field must be injected"
+        );
+    }
+
+    #[test]
+    fn inject_auth_enrichment_does_not_overwrite_existing_metadata_in_vector_namespace() {
+        use crate::{codecs::DecodingConfig, sources::util::HttpSource as _};
+        use vector_lib::codecs::BytesDeserializerConfig;
+        use vrl::value::KeyString;
+
+        let decoder = DecodingConfig::new(
+            BytesDecoderConfig::new().into(),
+            BytesDeserializerConfig::new().into(),
+            LogNamespace::Vector,
+        )
+        .build()
+        .unwrap()
+        .with_log_namespace(LogNamespace::Vector);
+
+        let source = super::SimpleHttpSource {
+            headers: vec![],
+            query_parameters: vec![],
+            path_key: OptionalValuePath::none(),
+            host_key: OptionalValuePath::none(),
+            decoder,
+            log_namespace: LogNamespace::Vector,
+        };
+
+        let mut log = LogEvent::default();
+        // Pre-populate a key (e.g. already written by enrich_events or the decoded event).
+        log.insert(
+            (
+                PathPrefix::Metadata,
+                path!(SimpleHttpConfig::NAME).concat(path!("tenant_id")),
+            ),
+            "existing",
+        );
+
+        let mut events = vec![Event::Log(log)];
+        let mut enrichment = ObjectMap::new();
+        enrichment.insert(KeyString::from("tenant_id"), Value::from("auth-value"));
+
+        source.inject_auth_enrichment(&mut events, enrichment);
+
+        let Event::Log(log) = &events[0] else {
+            panic!("expected log event");
+        };
+        assert_eq!(
+            log.get((
+                PathPrefix::Metadata,
+                path!(SimpleHttpConfig::NAME).concat(path!("tenant_id")),
+            )),
+            Some(&Value::from("existing")),
+            "auth enrichment must not overwrite already-present metadata keys"
+        );
+    }
+
+    #[test]
+    fn inject_auth_enrichment_applies_to_non_log_events_in_vector_namespace() {
+        use crate::{codecs::DecodingConfig, sources::util::HttpSource as _};
+        use vector_lib::{
+            codecs::BytesDeserializerConfig,
+            event::{Metric, MetricKind, MetricValue},
+        };
+        use vrl::value::KeyString;
+
+        let decoder = DecodingConfig::new(
+            BytesDecoderConfig::new().into(),
+            BytesDeserializerConfig::new().into(),
+            LogNamespace::Vector,
+        )
+        .build()
+        .unwrap()
+        .with_log_namespace(LogNamespace::Vector);
+
+        let source = super::SimpleHttpSource {
+            headers: vec![],
+            query_parameters: vec![],
+            path_key: OptionalValuePath::none(),
+            host_key: OptionalValuePath::none(),
+            decoder,
+            log_namespace: LogNamespace::Vector,
+        };
+
+        let metric = Metric::new(
+            "requests",
+            MetricKind::Incremental,
+            MetricValue::Counter { value: 1.0 },
+        );
+        let mut events = vec![Event::Metric(metric)];
+
+        let mut enrichment = ObjectMap::new();
+        enrichment.insert(KeyString::from("tenant_id"), Value::from("t-456"));
+
+        source.inject_auth_enrichment(&mut events, enrichment);
+
+        let Event::Metric(metric) = &events[0] else {
+            panic!("expected metric event");
+        };
+        assert_eq!(
+            metric
+                .metadata()
+                .value()
+                .get(path!(SimpleHttpConfig::NAME).concat(path!("tenant_id")),),
+            Some(&Value::from("t-456")),
+            "auth enrichment must be written to non-log event metadata"
+        );
+    }
+
     impl ValidatableComponent for SimpleHttpConfig {
         fn validation_configuration() -> ValidationConfiguration {
             let config = Self {
diff --git a/src/sources/util/http/prelude.rs b/src/sources/util/http/prelude.rs
index 3414ea00264b0..9645b432ad82b 100644
--- a/src/sources/util/http/prelude.rs
+++ b/src/sources/util/http/prelude.rs
@@ -11,6 +11,7 @@ use vector_lib::{
     config::SourceAcknowledgementsConfig,
     event::{BatchNotifier, BatchStatus, BatchStatusReceiver, Event},
 };
+use vrl::value::ObjectMap;
 use warp::{
     Filter,
     filters::{
@@ -56,6 +57,18 @@ pub trait HttpSource: Clone + Send + Sync + 'static {
         path: &str,
     ) -> Result<Vec<Event>, ErrorMessage>;
 
+    /// Called after `enrich_events` when `custom` auth returned metadata enrichment fields.
+    /// Sources that do not override this will emit a warning and drop the enrichment.
+    fn inject_auth_enrichment(&self, _events: &mut [Event], enrichment: ObjectMap) {
+        if !enrichment.is_empty() {
+            warn!(
+                message = "Auth metadata enrichment is not supported by this source and will be dropped. \
+                           Remove %field writes from the custom auth VRL program or switch to a source that supports enrichment.",
+                fields = ?enrichment.keys().collect::<Vec<_>>(),
+            );
+        }
+    }
+
     fn decode(&self, encoding_header: Option<&str>, body: Bytes) -> Result<Bytes, ErrorMessage> {
         decompress_body(encoding_header, body)
     }
@@ -132,23 +145,27 @@ pub trait HttpSource: Clone + Send + Sync + 'static {
                         let http_path = path.as_str();
                         let events = auth_matcher
                             .as_ref()
-                            .map_or(Ok(()), |a| {
+                            .map_or(Ok(None), |a| {
                                 a.handle_auth(
                                     addr.as_ref().map(|a| a.0).as_ref(),
                                     &headers,
                                     path.as_str(),
                                 )
                             })
-                            .and_then(|()| self.decode(encoding_header.as_deref(), body))
-                            .and_then(|body| {
+                            .and_then(|auth_enrichment| {
+                                self.decode(encoding_header.as_deref(), body)
+                                    .map(|body| (body, auth_enrichment))
+                            })
+                            .and_then(|(body, auth_enrichment)| {
                                 emit!(HttpBytesReceived {
                                     byte_size: body.len(),
                                     http_path,
                                     protocol,
                                 });
                                 self.build_events(body, &headers, &query_parameters, path.as_str())
+                                    .map(|events| (events, auth_enrichment))
                             })
-                            .map(|mut events| {
+                            .map(|(mut events, auth_enrichment)| {
                                 emit!(HttpEventsReceived {
                                     count: events.len(),
                                     byte_size: events.estimated_json_encoded_size_of(),
@@ -166,6 +183,10 @@ pub trait HttpSource: Clone + Send + Sync + 'static {
                                         .as_ref(),
                                 );
 
+                                if let Some(enrichment) = auth_enrichment {
+                                    self.inject_auth_enrichment(&mut events, enrichment);
+                                }
+
                                 events
                             });
 
diff --git a/website/cue/reference/components/sinks/generated/websocket_server.cue b/website/cue/reference/components/sinks/generated/websocket_server.cue
index 08d747b10ccaa..cb1a41a1a2f7d 100644
--- a/website/cue/reference/components/sinks/generated/websocket_server.cue
+++ b/website/cue/reference/components/sinks/generated/websocket_server.cue
@@ -71,7 +71,7 @@ generated: components: sinks: websocket_server: configuration: {
 					custom: """
 						Custom authentication using VRL code.
 
-						Takes in request and validates it using VRL code.
+						Takes in request and validates it using VRL code. The VRL program must return a boolean.
 						"""
 				}
 			}
diff --git a/website/cue/reference/components/sources/generated/heroku_logs.cue b/website/cue/reference/components/sources/generated/heroku_logs.cue
index cba1d865c3033..3153650de8890 100644
--- a/website/cue/reference/components/sources/generated/heroku_logs.cue
+++ b/website/cue/reference/components/sources/generated/heroku_logs.cue
@@ -62,7 +62,7 @@ generated: components: sources: heroku_logs: configuration: {
 					custom: """
 						Custom authentication using VRL code.
 
-						Takes in request and validates it using VRL code.
+						Takes in request and validates it using VRL code. The VRL program must return a boolean.
 						"""
 				}
 			}
diff --git a/website/cue/reference/components/sources/generated/http.cue b/website/cue/reference/components/sources/generated/http.cue
index ca96e3e7b1432..73e1f216a4d3a 100644
--- a/website/cue/reference/components/sources/generated/http.cue
+++ b/website/cue/reference/components/sources/generated/http.cue
@@ -33,10 +33,14 @@ generated: components: sources: http: configuration: {
 	}
 	auth: {
 		description: """
-			Configuration of the authentication strategy for server mode sinks and sources.
+			HTTP authentication configuration.
 
-			Use the HTTP authentication with HTTPS only. The authentication credentials are passed as an
+			Use HTTP authentication with HTTPS only. The authentication credentials are passed as an
 			HTTP header without any additional encryption beyond what is provided by the transport itself.
+
+			When using the `custom` strategy, the VRL program may write `%field = value` to enrich
+			authenticated events. These metadata fields are injected into the event body (legacy
+			namespace) or under `http_server.<field>` in event metadata (Vector namespace).
 			"""
 		required: false
 		type: object: options: {
@@ -66,7 +70,7 @@ generated: components: sources: http: configuration: {
 					custom: """
 						Custom authentication using VRL code.
 
-						Takes in request and validates it using VRL code.
+						Takes in request and validates it using VRL code. The VRL program must return a boolean.
 						"""
 				}
 			}
diff --git a/website/cue/reference/components/sources/generated/http_server.cue b/website/cue/reference/components/sources/generated/http_server.cue
index 1610fc441b56d..0a0c41a2e0739 100644
--- a/website/cue/reference/components/sources/generated/http_server.cue
+++ b/website/cue/reference/components/sources/generated/http_server.cue
@@ -33,10 +33,14 @@ generated: components: sources: http_server: configuration: {
 	}
 	auth: {
 		description: """
-			Configuration of the authentication strategy for server mode sinks and sources.
+			HTTP authentication configuration.
 
-			Use the HTTP authentication with HTTPS only. The authentication credentials are passed as an
+			Use HTTP authentication with HTTPS only. The authentication credentials are passed as an
 			HTTP header without any additional encryption beyond what is provided by the transport itself.
+
+			When using the `custom` strategy, the VRL program may write `%field = value` to enrich
+			authenticated events. These metadata fields are injected into the event body (legacy
+			namespace) or under `http_server.<field>` in event metadata (Vector namespace).
 			"""
 		required: false
 		type: object: options: {
@@ -66,7 +70,7 @@ generated: components: sources: http_server: configuration: {
 					custom: """
 						Custom authentication using VRL code.
 
-						Takes in request and validates it using VRL code.
+						Takes in request and validates it using VRL code. The VRL program must return a boolean.
 						"""
 				}
 			}
diff --git a/website/cue/reference/components/sources/generated/prometheus_pushgateway.cue b/website/cue/reference/components/sources/generated/prometheus_pushgateway.cue
index 33567c12c91d1..4cc08a4f86802 100644
--- a/website/cue/reference/components/sources/generated/prometheus_pushgateway.cue
+++ b/website/cue/reference/components/sources/generated/prometheus_pushgateway.cue
@@ -76,7 +76,7 @@ generated: components: sources: prometheus_pushgateway: configuration: {
 					custom: """
 						Custom authentication using VRL code.
 
-						Takes in request and validates it using VRL code.
+						Takes in request and validates it using VRL code. The VRL program must return a boolean.
 						"""
 				}
 			}
diff --git a/website/cue/reference/components/sources/generated/prometheus_remote_write.cue b/website/cue/reference/components/sources/generated/prometheus_remote_write.cue
index 3c71d2bd3f9ce..bef41adbf81b6 100644
--- a/website/cue/reference/components/sources/generated/prometheus_remote_write.cue
+++ b/website/cue/reference/components/sources/generated/prometheus_remote_write.cue
@@ -66,7 +66,7 @@ generated: components: sources: prometheus_remote_write: configuration: {
 					custom: """
 						Custom authentication using VRL code.
 
-						Takes in request and validates it using VRL code.
+						Takes in request and validates it using VRL code. The VRL program must return a boolean.
 						"""
 				}
 			}

From 5d6f968344ed96ef14b53f496cce7d2035c2d8d6 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 27 May 2026 15:18:29 -0400
Subject: [PATCH 275/326] chore(deps): bump rand to 0.8.6 and fix
 RUSTSEC-2026-0097 (#25505)

* chore(deps): bump rand to 0.8.6 and fix RUSTSEC-2026-0097

* Update rand to 0.8.6
---
 Cargo.lock | 32 ++++++++++++++++----------------
 deny.toml  |  1 -
 2 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3af48912136f0..b4a9b6d86ef49 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3826,7 +3826,7 @@ dependencies = [
  "log",
  "moka",
  "octseq",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "smallvec",
  "time",
@@ -7197,7 +7197,7 @@ dependencies = [
  "noisy_float",
  "num-integer",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
 ]
 
 [[package]]
@@ -7279,7 +7279,7 @@ dependencies = [
  "ed25519-dalek",
  "getrandom 0.2.15",
  "log",
- "rand 0.8.5",
+ "rand 0.8.6",
  "signatory",
 ]
 
@@ -7428,7 +7428,7 @@ dependencies = [
  "num-integer",
  "num-iter",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
  "smallvec",
  "zeroize",
 ]
@@ -7588,7 +7588,7 @@ dependencies = [
  "chrono",
  "getrandom 0.2.15",
  "http 1.3.1",
- "rand 0.8.5",
+ "rand 0.8.6",
  "reqwest 0.12.28",
  "serde",
  "serde_json",
@@ -7733,7 +7733,7 @@ dependencies = [
  "oauth2",
  "p256",
  "p384",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rsa",
  "serde",
  "serde-value",
@@ -8834,7 +8834,7 @@ dependencies = [
  "prost 0.13.5",
  "prost-build 0.13.5",
  "prost-derive 0.13.5",
- "rand 0.8.5",
+ "rand 0.8.6",
  "regex",
  "serde",
  "serde_json",
@@ -9057,9 +9057,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -9841,7 +9841,7 @@ dependencies = [
  "borsh",
  "bytes",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rkyv",
  "serde",
  "serde_json",
@@ -11004,7 +11004,7 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rand 0.8.5",
+ "rand 0.8.6",
  "rsa",
  "serde",
  "sha1",
@@ -11043,7 +11043,7 @@ dependencies = [
  "md-5",
  "memchr",
  "once_cell",
- "rand 0.8.5",
+ "rand 0.8.6",
  "serde",
  "serde_json",
  "sha2",
@@ -11754,7 +11754,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f57eb36ecbe0fc510036adff84824dd3c24bb781e21bfa67b69d556aa85214f"
 dependencies = [
  "pin-project",
- "rand 0.8.5",
+ "rand 0.8.6",
  "tokio",
 ]
 
@@ -11852,7 +11852,7 @@ dependencies = [
  "futures-sink",
  "http 1.3.1",
  "httparse",
- "rand 0.8.5",
+ "rand 0.8.6",
  "ring",
  "rustls-pki-types",
  "tokio",
@@ -12149,7 +12149,7 @@ dependencies = [
  "indexmap 1.9.3",
  "pin-project",
  "pin-project-lite",
- "rand 0.8.5",
+ "rand 0.8.6",
  "slab",
  "tokio",
  "tokio-util",
@@ -12455,7 +12455,7 @@ dependencies = [
  "http 0.2.12",
  "httparse",
  "log",
- "rand 0.8.5",
+ "rand 0.8.6",
  "sha1",
  "thiserror 1.0.68",
  "url",
diff --git a/deny.toml b/deny.toml
index 533953462810f..e6c3a90bd6e9c 100644
--- a/deny.toml
+++ b/deny.toml
@@ -47,6 +47,5 @@ ignore = [
   { id = "RUSTSEC-2026-0098", reason = "rustls-webpki 0.102/0.101 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
   { id = "RUSTSEC-2026-0099", reason = "rustls-webpki 0.102/0.101 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
   { id = "RUSTSEC-2024-0436", reason = "paste crate is unmaintained - transitive dependency via parquet v56.2.0, no safe upgrade available" },
-  { id = "RUSTSEC-2026-0097", reason = "rand 0.8.5 unsound with custom logger - transitive dependency, upstream crates have not updated to rand 0.9+" },
   { id = "RUSTSEC-2026-0104", reason = "rustls-webpki 0.102/0.101 CRL parsing panic - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179); 0.103 already patched to 0.103.13" },
 ]

From 5b82c16630641c3743c8f3aeb72795b24e097e04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ensar=20Saraj=C4=8Di=C4=87?= <dev@ensarsarajcic.com>
Date: Wed, 27 May 2026 22:24:50 +0200
Subject: [PATCH 276/326] feat(new transform): add a simple delay transform
 (#25407)

* feat(new transform): add a simple delay transform

Closes: #22146

* Add changelog entry

* Prevent polling input_rx when done = true

* Update src/transforms/delay.rs

Co-authored-by: Thomas <thomasqueirozb@gmail.com>

* Add missing docs files

* Add delay condition

* Add support for queue capacity to prevent unbounded memory growth

* Emit ComponentEventsDropped on drop newest

* Change condition to `delay_until_condition`

* Update docs

* Allow delay_until_condition to completely skip delays if passed right away

* delay_per_event => delay_milliseconds

* Change pass overflow strategy to forward

* Fix unit for `delay_milliseconds`

* Fix example for delay_milliseconds

* Handle done + empty queue case

* Fix delay tests

* Fix docs for delay_milliseconds

* Use indoc! in tests

* Set default for queue_capacity

* Fix errors caused by queue_capacity default value

* Add warning about millisecond granularity

* Update components docs

* Rename delay_milliseconds to delay_ms

* Update src/transforms/delay.rs

Co-authored-by: Thomas <thomasqueirozb@gmail.com>

* Rename delay_until_condition to condition

* bias select in delay to ensure pending delay events are completed

* Move condition check code to a method on Delay transform

* Error out on zero duration delay

* Update website/cue/reference/components/transforms/delay.cue

* fix(delay transform): use valid development status "beta"

* Regenerate docs

---------

Co-authored-by: Thomas <thomasqueirozb@gmail.com>
Co-authored-by: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.toml                                    |   3 +
 changelog.d/25407_delay_transform.feature.md  |   3 +
 src/transforms/delay.rs                       | 344 ++++++++++++++++++
 src/transforms/mod.rs                         |   2 +
 .../configuration/transforms/delay.md         |  14 +
 .../reference/components/transforms/delay.cue |  59 +++
 .../components/transforms/generated/delay.cue |  43 +++
 7 files changed, 468 insertions(+)
 create mode 100644 changelog.d/25407_delay_transform.feature.md
 create mode 100644 src/transforms/delay.rs
 create mode 100644 website/content/en/docs/reference/configuration/transforms/delay.md
 create mode 100644 website/cue/reference/components/transforms/delay.cue
 create mode 100644 website/cue/reference/components/transforms/generated/delay.cue

diff --git a/Cargo.toml b/Cargo.toml
index 48c227b62ed1e..a0baa2a76a980 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -790,6 +790,7 @@ transforms = ["transforms-logs", "transforms-metrics"]
 transforms-logs = [
   "transforms-aws_ec2_metadata",
   "transforms-dedupe",
+  "transforms-delay",
   "transforms-filter",
   "transforms-window",
   "transforms-log_to_metric",
@@ -813,11 +814,13 @@ transforms-metrics = [
   "transforms-remap",
   "transforms-tag_cardinality_limit",
   "transforms-throttle",
+  "transforms-delay",
 ]
 
 transforms-aggregate = []
 transforms-aws_ec2_metadata = ["dep:arc-swap"]
 transforms-dedupe = ["transforms-impl-dedupe"]
+transforms-delay = []
 transforms-filter = []
 transforms-incremental_to_absolute = []
 transforms-window = []
diff --git a/changelog.d/25407_delay_transform.feature.md b/changelog.d/25407_delay_transform.feature.md
new file mode 100644
index 0000000000000..a1df713c6a347
--- /dev/null
+++ b/changelog.d/25407_delay_transform.feature.md
@@ -0,0 +1,3 @@
+Added a new `delay` transform, that delays each event by a fixed duration.
+
+authors: esensar Quad9DNS
diff --git a/src/transforms/delay.rs b/src/transforms/delay.rs
new file mode 100644
index 0000000000000..3c3e8093631d5
--- /dev/null
+++ b/src/transforms/delay.rs
@@ -0,0 +1,344 @@
+use std::{num::NonZeroUsize, pin::Pin, time::Duration};
+
+use async_stream::stream;
+use futures::{Stream, StreamExt};
+use serde_with::serde_as;
+use snafu::Snafu;
+use tokio_util::time::DelayQueue;
+use vector_lib::configurable::configurable_component;
+use vector_lib::internal_event::INTENTIONAL;
+use vector_lib::{config::clone_input_definitions, internal_event::ComponentEventsDropped};
+
+use crate::{
+    conditions::{AnyCondition, Condition},
+    config::{DataType, Input, OutputId, TransformConfig, TransformContext, TransformOutput},
+    event::Event,
+    schema,
+    transforms::{TaskTransform, Transform},
+};
+
+/// Configuration for the `delay` transform.
+#[serde_as]
+#[configurable_component(transform("delay", "Slow down events passing through a topology."))]
+#[derive(Clone, Debug)]
+#[serde(deny_unknown_fields)]
+pub struct DelayConfig {
+    /// Time to delay each event, in milliseconds.
+    #[serde_as(as = "serde_with::DurationMilliSeconds<u64>")]
+    #[configurable(metadata(docs::human_name = "Delay in milliseconds", docs::example = 200))]
+    delay_ms: Duration,
+
+    /// Limit for number of items in the delay queue.
+    #[serde(default = "default_queue_capacity")]
+    queue_capacity: NonZeroUsize,
+
+    /// Strategy to handle full queue capacity.
+    #[serde(default)]
+    overflow_strategy: OverflowStrategy,
+
+    /// Delay events in provided delay periods until the condition is met.
+    condition: Option<AnyCondition>,
+}
+
+const fn default_queue_capacity() -> NonZeroUsize {
+    NonZeroUsize::new(500).expect("static non-zero number")
+}
+
+impl Default for DelayConfig {
+    fn default() -> Self {
+        Self {
+            delay_ms: Default::default(),
+            queue_capacity: default_queue_capacity(),
+            overflow_strategy: Default::default(),
+            condition: Default::default(),
+        }
+    }
+}
+
+/// Event handling behavior when delay queue is full.
+#[configurable_component]
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+#[serde(rename_all = "snake_case")]
+pub enum OverflowStrategy {
+    /// Wait for free space in the queue.
+    ///
+    /// This applies backpressure up the topology, signalling that sources should slow down
+    /// the acceptance/consumption of events. This may cause the system to degenerate if this
+    /// component blocks for too long.
+    #[default]
+    Block,
+
+    /// Drops the event instead of waiting for free space in the queue.
+    ///
+    /// The event will be intentionally dropped. This mode is typically used when performance is the
+    /// highest priority, and it is preferable to temporarily lose events rather than cause a
+    /// slowdown in the acceptance/consumption of events.
+    DropNewest,
+
+    /// Forward the event without any delay to next component.
+    Forward,
+}
+
+impl_generate_config_from_default!(DelayConfig);
+
+#[async_trait::async_trait]
+#[typetag::serde(name = "delay")]
+impl TransformConfig for DelayConfig {
+    async fn build(&self, context: &TransformContext) -> crate::Result<Transform> {
+        if self.delay_ms.as_millis() == 0 {
+            return Err(Box::new(BuildError::ZeroDelayDuration));
+        }
+        Ok(Transform::event_task(Delay::new(self, context)?))
+    }
+
+    fn input(&self) -> Input {
+        Input::all()
+    }
+
+    fn outputs(
+        &self,
+        _: &TransformContext,
+        input_definitions: &[(OutputId, schema::Definition)],
+    ) -> Vec<TransformOutput> {
+        // The event is not modified, so the definition is passed through as-is
+        vec![TransformOutput::new(
+            DataType::all_bits(),
+            clone_input_definitions(input_definitions),
+        )]
+    }
+}
+
+pub struct Delay {
+    delay: Duration,
+    queue: DelayQueue<Event>,
+    queue_capacity: NonZeroUsize,
+    overflow_strategy: OverflowStrategy,
+    condition: Option<Condition>,
+}
+
+impl Delay {
+    pub fn new(config: &DelayConfig, context: &TransformContext) -> crate::Result<Self> {
+        Ok(Self {
+            delay: config.delay_ms,
+            queue: DelayQueue::with_capacity(config.queue_capacity.get()),
+            queue_capacity: config.queue_capacity,
+            overflow_strategy: config.overflow_strategy,
+            condition: config
+                .condition
+                .as_ref()
+                .map(|c| c.build(&context.enrichment_tables, &context.metrics_storage))
+                .transpose()?,
+        })
+    }
+
+    fn check_condition(&self, event: Event, first: bool) -> (bool, Event) {
+        if let Some(condition) = self.condition.as_ref() {
+            condition.check(event)
+        } else {
+            // If this is the first check, we need to ensure at least one delay is
+            // done if no condition is configured
+            (!first, event)
+        }
+    }
+}
+
+impl TaskTransform<Event> for Delay {
+    fn transform(
+        mut self: Box<Self>,
+        mut input_rx: Pin<Box<dyn Stream<Item = Event> + Send>>,
+    ) -> Pin<Box<dyn Stream<Item = Event> + Send>>
+    where
+        Self: 'static,
+    {
+        Box::pin(stream! {
+            let mut done = false;
+            loop {
+                if done && self.queue.is_empty() {
+                    break;
+                }
+                tokio::select! {
+                    biased;
+
+                    Some(res) = self.queue.next() => {
+                        let event = res.into_inner();
+                        let (result, event) = self.check_condition(event, false);
+                        if result {
+                            yield event;
+                        } else {
+                            self.queue.insert(event, self.delay);
+                        }
+                        if done && self.queue.is_empty() {
+                            break;
+                        }
+                    },
+
+                    maybe_event = input_rx.next(), if !done => {
+                        match maybe_event {
+                            None => {
+                                done = true;
+                            }
+                            Some(event) => {
+                                let (result, event) = self.check_condition(event, true);
+                                if result {
+                                    yield event
+                                } else {
+                                    if self.queue_capacity.get() <= self.queue.len() {
+                                        match self.overflow_strategy {
+                                            OverflowStrategy::Block => {
+                                                while self.queue_capacity.get() <= self.queue.len() && let Some(next) = self.queue.next().await {
+                                                    let event = next.into_inner();
+                                                    let (result, event) = self.check_condition(event, false);
+                                                    if result {
+                                                        yield event;
+                                                    } else {
+                                                        self.queue.insert(event, self.delay);
+                                                    }
+                                                }
+                                            },
+                                            OverflowStrategy::DropNewest => {
+                                                emit!(ComponentEventsDropped::<INTENTIONAL> {
+                                                    count: 1,
+                                                    reason: "Queue is full and overflow strategy is drop_newest",
+                                                });
+                                                continue;
+                                            }
+                                            OverflowStrategy::Forward => {
+                                                yield event;
+                                                continue;
+                                            }
+                                        }
+                                    }
+                                    self.queue.insert(event, self.delay);
+                                }
+                            }
+                        }
+                    },
+                }
+            }
+        })
+    }
+}
+
+#[derive(Debug, Snafu)]
+pub enum BuildError {
+    #[snafu(display("The delay duration must not be zero"))]
+    ZeroDelayDuration,
+}
+
+#[cfg(test)]
+mod tests {
+    use indoc::indoc;
+    use std::task::Poll;
+
+    use futures::SinkExt;
+    use vector_lib::event::TraceEvent;
+
+    use super::*;
+    use crate::event::LogEvent;
+
+    #[test]
+    fn generate_config() {
+        crate::test_util::test_generate_config::<DelayConfig>();
+    }
+
+    #[tokio::test]
+    async fn delay_events() {
+        let config = toml::from_str::<DelayConfig>(indoc! {"
+            delay_ms = 200
+        "})
+        .unwrap();
+
+        let delay =
+            Transform::event_task(Delay::new(&config, &TransformContext::default()).unwrap());
+
+        let delay = delay.into_task();
+
+        let (mut tx, rx) = futures::channel::mpsc::channel(10);
+        let mut out_stream = delay.transform_events(Box::pin(rx));
+
+        tx.send(LogEvent::default().into()).await.unwrap();
+
+        // We should be pending, because we are now waiting for the delay
+        assert_eq!(Poll::Pending, futures::poll!(out_stream.next()));
+
+        // Wait long enough for delay to end
+        tokio::time::sleep(Duration::from_secs_f64(0.3)).await;
+
+        if !matches!(futures::poll!(out_stream.next()), Poll::Ready(Some(_event))) {
+            panic!("Unexpectedly received None or Pending in output stream");
+        }
+    }
+
+    #[tokio::test]
+    async fn delay_events_at_capacity_drop_newest() {
+        let config = toml::from_str::<DelayConfig>(indoc! {r#"
+            delay_ms = 200
+            queue_capacity = 1
+            overflow_strategy = "drop_newest"
+        "#})
+        .unwrap();
+
+        let delay =
+            Transform::event_task(Delay::new(&config, &TransformContext::default()).unwrap());
+
+        let delay = delay.into_task();
+
+        let (mut tx, rx) = futures::channel::mpsc::channel(10);
+        let mut out_stream = delay.transform_events(Box::pin(rx));
+
+        tx.send(LogEvent::default().into()).await.unwrap();
+        tx.send(TraceEvent::default().into()).await.unwrap();
+
+        // We should be pending, because we are now waiting for the delay
+        assert_eq!(Poll::Pending, futures::poll!(out_stream.next()));
+
+        // Wait long enough for delay to end
+        tokio::time::sleep(Duration::from_secs_f64(0.3)).await;
+
+        let Poll::Ready(Some(event)) = futures::poll!(out_stream.next()) else {
+            panic!("Unexpectedly received None or Pending in output stream");
+        };
+        assert!(event.try_into_log().is_some());
+
+        // We should be pending, because trace event should have been dropped
+        assert_eq!(Poll::Pending, futures::poll!(out_stream.next()));
+    }
+
+    #[tokio::test]
+    async fn delay_events_at_capacity_pass() {
+        let config = toml::from_str::<DelayConfig>(indoc! {r#"
+            delay_ms = 200
+            queue_capacity = 1
+            overflow_strategy = "forward"
+        "#})
+        .unwrap();
+
+        let delay =
+            Transform::event_task(Delay::new(&config, &TransformContext::default()).unwrap());
+
+        let delay = delay.into_task();
+
+        let (mut tx, rx) = futures::channel::mpsc::channel(10);
+        let mut out_stream = delay.transform_events(Box::pin(rx));
+
+        tx.send(LogEvent::default().into()).await.unwrap();
+        tx.send(TraceEvent::default().into()).await.unwrap();
+
+        // First event should be trace, because it is passed right away before delay
+        let Poll::Ready(Some(event)) = futures::poll!(out_stream.next()) else {
+            panic!("Unexpectedly received None or Pending in output stream");
+        };
+        assert!(event.try_into_trace().is_some());
+
+        // We should be pending, because we are now waiting for the delay
+        assert_eq!(Poll::Pending, futures::poll!(out_stream.next()));
+
+        // Wait long enough for delay to end
+        tokio::time::sleep(Duration::from_secs_f64(0.3)).await;
+
+        let Poll::Ready(Some(event)) = futures::poll!(out_stream.next()) else {
+            panic!("Unexpectedly received None or Pending in output stream");
+        };
+        assert!(event.try_into_log().is_some());
+    }
+}
diff --git a/src/transforms/mod.rs b/src/transforms/mod.rs
index e4f6671828807..2a9f606df3c6a 100644
--- a/src/transforms/mod.rs
+++ b/src/transforms/mod.rs
@@ -11,6 +11,8 @@ pub mod sample;
 pub mod aggregate;
 #[cfg(feature = "transforms-aws_ec2_metadata")]
 pub mod aws_ec2_metadata;
+#[cfg(feature = "transforms-delay")]
+pub mod delay;
 #[cfg(feature = "transforms-exclusive-route")]
 mod exclusive_route;
 #[cfg(feature = "transforms-filter")]
diff --git a/website/content/en/docs/reference/configuration/transforms/delay.md b/website/content/en/docs/reference/configuration/transforms/delay.md
new file mode 100644
index 0000000000000..61defbe924a97
--- /dev/null
+++ b/website/content/en/docs/reference/configuration/transforms/delay.md
@@ -0,0 +1,14 @@
+---
+title: Delay
+description: Delay events by a set duration
+component_kind: transform
+layout: component
+tags: ["delay", "component", "transform"]
+---
+
+{{/*
+This doc is generated using:
+
+1. The template in layouts/docs/component.html
+2. The relevant CUE data in cue/reference/components/...
+*/}}
diff --git a/website/cue/reference/components/transforms/delay.cue b/website/cue/reference/components/transforms/delay.cue
new file mode 100644
index 0000000000000..162325483071d
--- /dev/null
+++ b/website/cue/reference/components/transforms/delay.cue
@@ -0,0 +1,59 @@
+package metadata
+
+components: transforms: delay: {
+	title: "Delay events"
+
+	description: """
+		Delays events by a set duration.
+		"""
+
+	classes: {
+		commonly_used: false
+		development:   "beta"
+		egress_method: "stream"
+		stateful:      true
+	}
+
+	features: {
+		filter: {}
+	}
+
+	support: {
+		requirements: []
+		warnings: [
+			"""
+				Delay transform operates at millisecond granularity and when multiple events are
+				received in the same millisecond and the component doesn't preserve original ordering if
+				items are emitted in the same millisecond.
+				""",
+		]
+		notices: []
+	}
+
+	configuration: generated.components.transforms.delay.configuration
+
+	input: {
+		logs: true
+		metrics: {
+			counter:      true
+			distribution: true
+			gauge:        true
+			histogram:    true
+			set:          true
+			summary:      true
+		}
+		traces: true
+	}
+
+	output: {
+		logs: "": {
+			description: "The input `log` event."
+		}
+		metrics: "": {
+			description: "The input `metric` event."
+		}
+		traces: "": {
+			description: "The input `trace` event."
+		}
+	}
+}
diff --git a/website/cue/reference/components/transforms/generated/delay.cue b/website/cue/reference/components/transforms/generated/delay.cue
new file mode 100644
index 0000000000000..8cffcaebec3b9
--- /dev/null
+++ b/website/cue/reference/components/transforms/generated/delay.cue
@@ -0,0 +1,43 @@
+package metadata
+
+generated: components: transforms: delay: configuration: {
+	condition: {
+		description: "Delay events in provided delay periods until the condition is met."
+		required:    false
+		type: condition: {}
+	}
+	delay_ms: {
+		description: "Time to delay each event, in milliseconds."
+		required:    true
+		type: uint: unit: "milliseconds"
+	}
+	overflow_strategy: {
+		description: "Strategy to handle full queue capacity."
+		required:    false
+		type: string: {
+			default: "block"
+			enum: {
+				block: """
+					Wait for free space in the queue.
+
+					This applies backpressure up the topology, signalling that sources should slow down
+					the acceptance/consumption of events. This may cause the system to degenerate if this
+					component blocks for too long.
+					"""
+				drop_newest: """
+					Drops the event instead of waiting for free space in the queue.
+
+					The event will be intentionally dropped. This mode is typically used when performance is the
+					highest priority, and it is preferable to temporarily lose events rather than cause a
+					slowdown in the acceptance/consumption of events.
+					"""
+				forward: "Forward the event without any delay to next component."
+			}
+		}
+	}
+	queue_capacity: {
+		description: "Limit for number of items in the delay queue."
+		required:    false
+		type: uint: default: 500
+	}
+}

From cc276a6c7e0ee11bf5289d82d244bb9547b47fa2 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Wed, 27 May 2026 17:40:46 -0400
Subject: [PATCH 277/326] chore(internal docs): add AI contribution policy
 (#25511)

* docs: add AI contribution policy

Define and publish an AI contribution policy and integrate it into the contributor workflow.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: reframe AI review thread guidance

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: add documentation team as codeowner for AI_POLICY.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/CODEOWNERS                 |  2 ++
 .github/actions/spelling/allow.txt |  2 ++
 AI_POLICY.md                       | 39 ++++++++++++++++++++++++++++++
 CONTRIBUTING.md                    |  2 ++
 4 files changed, 45 insertions(+)
 create mode 100644 AI_POLICY.md

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 7534be2fb8652..dde038e8052ec 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -3,6 +3,8 @@
 .github/workflows/regression.yml @vectordotdev/vector @vectordotdev/single-machine-performance
 regression/config.yaml @vectordotdev/vector @vectordotdev/single-machine-performance
 
+AI_POLICY.md @vectordotdev/vector @vectordotdev/documentation
+
 # Keep documentation team paths in sync with .github/workflows/add_docs_review_label.yml
 docs/ @vectordotdev/vector @vectordotdev/documentation
 website/ @vectordotdev/vector
diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index 79f0d10a9a33b..7ac468f99526c 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -1,6 +1,7 @@
 acmecorp
 Acro
 addonmanager
+Agentic
 Ainol
 aiohttp
 Airis
@@ -308,6 +309,7 @@ lenovo
 levenstein
 Lexibook
 LGE
+LLMs
 Lifetab
 Lifetouch
 linkerd
diff --git a/AI_POLICY.md b/AI_POLICY.md
new file mode 100644
index 0000000000000..4f3ddfbba48ed
--- /dev/null
+++ b/AI_POLICY.md
@@ -0,0 +1,39 @@
+# AI Policy
+
+We use AI tools ourselves and encourage their use. This policy isn't about limiting how you work. It's about keeping contributions high-quality and reviews sustainable for a small team maintaining a popular open source project that receives a lot of PRs.
+
+## New to Vector?
+
+LLMs are genuinely great for onboarding into a large codebase. If you're just getting started, ask one to explain a component, trace a data flow, or summarize what a module does. It can save you a lot of time getting oriented.
+
+That said, there's still no substitute for some good old-fashioned reading. Spending time in the actual source, following the logic yourself, and running things locally is what builds the real intuition you'll need to contribute confidently. Use the LLM as a guide, as a helper.
+
+## You own what you submit
+
+When you open a PR or issue, you're vouching for it. Ideally that means you understand what the changes do, why they're correct, and how they fit Vector's architecture and conventions. If a reviewer asks you a question, please answer it in your own words rather than relaying AI output.
+
+This applies whether you wrote the code yourself, used AI as a coding assistant, or anything in between. The goal is the same: be the expert on your own contribution.
+
+## Keep conversations human
+
+GitHub discussions (issues, PR descriptions, review threads) are how our community thinks together. Honestly, if a response is thoughtful and on point, does it matter whether a human wrote every word? We don't think so. What we'd rather avoid is raw AI output forwarded into a thread without review — that's not engaging with feedback, it's delegating it.
+
+## Quality over volume
+
+AI tools can generate a lot of code quickly. Please keep PRs well-scoped and focused: one clear problem, one clear solution. Our reviewers are humans with limited time, and a focused, well-tested PR that solves a real problem will get reviewed and merged faster.
+
+Before opening a PR, it helps to make sure it addresses a real need (ideally tied to an open issue), that your changes are tested, and that you've followed the standard checks described in [CONTRIBUTING.md](CONTRIBUTING.md#running-other-checks).
+
+## AI review comments
+
+Pull requests often receive automated AI code review. Please take a moment to go through those comments before requesting a human review. If a comment doesn't apply, please include a brief note when dismissing it. Resolving comments without any explanation creates friction for human reviewers, who then have to scan each one and figure out whether a follow-up commit addressed it or it was simply closed without consideration.
+
+We'd also love if you could like or dislike each AI comment. It only takes a second and it genuinely helps us understand whether the tool is pulling its weight. So far the signal has been really good and the vast majority of comments have been valid, so your feedback helps us keep measuring that.
+
+## Agentic contributions
+
+Agentic PRs aren't a special category. They're held to exactly the same bar as any other contribution: the code should be understood by the person submitting it, covered by unit tests, and validated with integration or end-to-end tests where appropriate. If you're using an agent to help you build something, that's great. We'd just ask that you've read, understood, and tested what it produced before submitting.
+
+---
+
+That's it. If something isn't covered here, the underlying principle is: please be considerate of reviewers' time, and take ownership of the work you submit. We really appreciate your contributions.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 556958083ac69..e3191d990f41d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -39,6 +39,8 @@ Vector team member will find this document useful.
 2. **You've read Vector's [docs](https://vector.dev/docs/).**
 3. **You know about the [Vector community](https://vector.dev/community/).
    Please use this for help.**
+4. **You've read our [AI Policy](AI_POLICY.md)** if you plan to use AI tools
+   in your contribution.
 
 ## Your First Contribution
 

From 93f8054a206e5de6eb115b8ed50591248def7284 Mon Sep 17 00:00:00 2001
From: Yoenn Burban <62966490+gwenaskell@users.noreply.github.com>
Date: Thu, 28 May 2026 16:33:31 +0200
Subject: [PATCH 278/326] feat(metrics): allow downstream crates to register
 extra labels for metrics and logs (#25315)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat(metrics): allow downstream crates to register extra metric labels

`VectorLabelFilter` only preserves a fixed set of tracing-span fields on
metric keys, so embedders that own a span field of their own (e.g. a
deployment-version concept) currently cannot get it onto Vector's
internal metrics without forking. Add a generic registration hook that
extends the allowlist via the `inventory` crate so registrations are
collected at link time and the read path stays lock-free.

Downstream crates use the new `register_extra_metric_label!` macro
(re-exported as `vector_lib::register_extra_metric_label!`) at module
scope. The macro expands to an `inventory::submit!` of an
`ExtraMetricLabel`, and `VectorLabelFilter::should_include_label` now
also accepts any label key registered through that inventory.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(metrics): make register_extra_metric_label! macro self-contained

The macro previously expanded to `::inventory::submit!{ vector_lib::metrics::ExtraMetricLabel(..) }`,
which forced any caller to declare `vector-lib` (and `inventory`) as direct
dependencies — defeating the point of advertising `vector_core::register_extra_metric_label!`
as a stable entrypoint.

Re-export `inventory` from `vector-core` as a private `__inventory` alias and
have the macro expand through `$crate::__inventory::submit!` and
`$crate::metrics::ExtraMetricLabel`. `$crate` resolves to the defining crate
regardless of how the caller reached the macro, so callers only need
whichever single re-export crate they already use.

Add an integration test under `vector-lib/tests/` (which has neither
`inventory` nor `vector-core` as a direct dependency) that calls the macro
through `vector_lib::register_extra_metric_label!`. The test compiling is the
proof that the new macro path no longer leaks transitive deps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(metrics): unify built-in and extra labels under single MetricLabel registry

Previously `VectorLabelFilter::should_include_label` had two paths: a
hand-written `==` chain for the built-in global labels, and an
`inventory::iter` linear scan for downstream registrations. Collapse
the two by registering the built-ins (`component_id`, `component_type`,
`component_kind`, `buffer_type`) through the same `inventory::submit!`
calls. The entry type is renamed `ExtraMetricLabel` -> `MetricLabel` to
reflect that it now describes any allowed label, not just downstream
extras. The downstream-facing macro keeps its
`register_extra_metric_label!` name since "extra" still describes the
action from a downstream caller's perspective.

Snapshot the inventory into a `LazyLock<HashSet<&'static str>>` so the
hot path is a single set lookup against a static, instead of a
linked-list walk on every metric. `inventory` populates submissions
before `main`, so the snapshot captures every entry — built-ins and
downstream alike — by the time the first metric is filtered.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(internal_logs): allow extending the SpanFields allowlist via inventory

Until now the only way to push downstream-specific span fields onto
Vector's internal observability output was to fork either
`VectorLabelFilter` (metrics) or `SpanFields::record` (logs/traces). The
metrics side already gained an inventory hook in this PR
(`register_extra_metric_label!`); generalize it so a single registration
covers logs as well.

Add `pub struct SpanField(pub &'static str)` at the `vector-core`
top level with its own `inventory::collect!`, and have
`SpanFields::record` consult a `LazyLock<HashSet<&'static str>>`
snapshot of that registry alongside the existing `component_*` prefix
gate (kept intact: logs continue to capture every `component_*` field
without explicit registration).

Replace `register_extra_metric_label!` with `register_extra_span_field!`
that submits to *both* the `MetricLabel` and `SpanField`
inventories, so a downstream caller writes one line to extend both
channels. `MetricLabel` itself is left in place — the type was already
`pub` and removing it would be a breaking change for any in-flight
consumer of this branch.

* fix lint errors

* fix doc lints

* remove non-user-facing changelog

* move spanfield inventory to vector-core

* remove vector-lib test

* move span field logic to a separate module

* fix unit test

* apply suggestion

* add integration test

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 lib/vector-core/src/lib.rs                    |  8 ++
 lib/vector-core/src/metrics/label_filter.rs   | 85 +++++++++++++++++--
 lib/vector-core/src/metrics/mod.rs            |  1 +
 lib/vector-core/src/span_fields.rs            | 42 +++++++++
 lib/vector-lib/src/lib.rs                     |  7 +-
 .../tests/register_extra_span_field.rs        | 17 ++++
 src/sources/internal_logs.rs                  | 47 +++++++++-
 src/trace.rs                                  | 22 ++++-
 8 files changed, 216 insertions(+), 13 deletions(-)
 create mode 100644 lib/vector-core/src/span_fields.rs
 create mode 100644 lib/vector-lib/tests/register_extra_span_field.rs

diff --git a/lib/vector-core/src/lib.rs b/lib/vector-core/src/lib.rs
index ad1b36d1db516..02d202c7780bc 100644
--- a/lib/vector-core/src/lib.rs
+++ b/lib/vector-core/src/lib.rs
@@ -39,6 +39,7 @@ pub mod serde;
 pub mod sink;
 pub mod source;
 pub mod source_sender;
+pub mod span_fields;
 pub mod tcp;
 #[cfg(test)]
 mod test_util;
@@ -83,3 +84,10 @@ macro_rules! register {
         vector_lib::internal_event::register($event)
     };
 }
+
+pub use span_fields::SpanField;
+
+// Re-export `inventory` so `register_extra_span_field!` can resolve `submit!` through this
+// crate without forcing downstream callers to declare `inventory` as a direct dependency.
+#[doc(hidden)]
+pub use inventory as __inventory;
diff --git a/lib/vector-core/src/metrics/label_filter.rs b/lib/vector-core/src/metrics/label_filter.rs
index 8390620502a47..233f9e030e6ac 100644
--- a/lib/vector-core/src/metrics/label_filter.rs
+++ b/lib/vector-core/src/metrics/label_filter.rs
@@ -1,6 +1,35 @@
+use std::collections::HashSet;
+use std::sync::LazyLock;
+
 use metrics::{KeyName, Label};
 use metrics_tracing_context::LabelFilter;
 
+/// A label name that should be preserved on metric keys when present as a tracing-span field.
+///
+/// Both Vector's own built-in global labels and downstream-registered labels go through this
+/// type. Registrations are collected at link time via [`inventory`]. Downstream crates use the
+/// [`register_extra_span_field!`](crate::register_extra_span_field) macro to add one.
+#[derive(Debug)]
+pub struct MetricLabel(pub &'static str);
+
+inventory::collect!(MetricLabel);
+
+// Vector's own global labels are registered through the same mechanism so the filter only has
+// one allowlist to consult.
+inventory::submit!(MetricLabel("component_id"));
+inventory::submit!(MetricLabel("component_type"));
+inventory::submit!(MetricLabel("component_kind"));
+inventory::submit!(MetricLabel("buffer_type"));
+
+/// Snapshot of every registered [`MetricLabel`], built on first access. `inventory` populates
+/// all submissions before `main`, so the snapshot is guaranteed to capture every entry — the
+/// hot path is then a single set lookup against this static.
+pub static LABELS: LazyLock<HashSet<&'static str>> = LazyLock::new(|| {
+    inventory::iter::<MetricLabel>()
+        .map(|label| label.0)
+        .collect()
+});
+
 #[derive(Debug, Clone)]
 pub(crate) struct VectorLabelFilter;
 
@@ -19,10 +48,56 @@ impl LabelFilter for VectorLabelFilter {
         {
             return true;
         }
-        // Global labels
-        label_key == "component_id"
-            || label_key == "component_type"
-            || label_key == "component_kind"
-            || label_key == "buffer_type"
+        // Globally-registered labels: Vector's own built-ins plus any registered by downstream
+        // crates via `register_extra_span_field!`.
+        LABELS.contains(label_key)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use metrics::{KeyName, Label};
+    use metrics_tracing_context::LabelFilter;
+
+    use super::VectorLabelFilter;
+
+    // Use the macro so that removing either arm (MetricLabel or SpanField) from
+    // register_extra_span_field! would cause the tests below to fail, locking the
+    // dual-registration contract.
+    crate::register_extra_span_field!("test_extra_label");
+
+    fn key(name: &'static str) -> KeyName {
+        KeyName::from_const_str(name)
+    }
+
+    #[test]
+    fn includes_globally_registered_label() {
+        let filter = VectorLabelFilter;
+        let label = Label::new("test_extra_label", "value");
+        assert!(filter.should_include_label(&key("any_metric"), &label));
+    }
+
+    #[test]
+    fn excludes_unregistered_label() {
+        let filter = VectorLabelFilter;
+        let label = Label::new("not_registered", "value");
+        assert!(!filter.should_include_label(&key("any_metric"), &label));
+    }
+
+    #[test]
+    fn includes_built_in_global_labels() {
+        let filter = VectorLabelFilter;
+        for builtin in [
+            "component_id",
+            "component_type",
+            "component_kind",
+            "buffer_type",
+        ] {
+            let label = Label::new(builtin, "value");
+            assert!(
+                filter.should_include_label(&key("any_metric"), &label),
+                "expected built-in label `{builtin}` to remain included",
+            );
+        }
     }
 }
diff --git a/lib/vector-core/src/metrics/mod.rs b/lib/vector-core/src/metrics/mod.rs
index ea4c040163c7f..0e56d28112159 100644
--- a/lib/vector-core/src/metrics/mod.rs
+++ b/lib/vector-core/src/metrics/mod.rs
@@ -15,6 +15,7 @@ use metrics_util::layers::Layer;
 use snafu::Snafu;
 
 pub use self::ddsketch::{AgentDDSketch, BinMap, Config};
+pub use self::label_filter::{LABELS, MetricLabel};
 use self::{
     label_filter::VectorLabelFilter,
     recorder::{Registry, VectorRecorder},
diff --git a/lib/vector-core/src/span_fields.rs b/lib/vector-core/src/span_fields.rs
new file mode 100644
index 0000000000000..2193c1dc8fad2
--- /dev/null
+++ b/lib/vector-core/src/span_fields.rs
@@ -0,0 +1,42 @@
+/// Span field name that should be captured onto log events emitted by the `internal_logs`
+/// source. Vector's `SpanFields` visitor only captures fields `component_*` by default;
+/// downstream crates can extend that set through this type.
+///
+/// Use [`register_extra_span_field!`](crate::register_extra_span_field) to register one.
+#[derive(Debug)]
+pub struct SpanField(pub &'static str); // name of the span field
+
+inventory::collect!(SpanField); // collect the span field names
+
+/// Register a tracing-span field name that downstream crates want preserved on Vector's
+/// internal observability output.
+///
+/// A single registration covers both output channels:
+///
+/// * On metrics, the field is added to the allowlist consulted by
+///   [`VectorLabelFilter`](crate::metrics) (alongside Vector's built-in `component_id`,
+///   `component_type`, `component_kind`, `buffer_type`), so `metrics-tracing-context` no
+///   longer drops it before the metrics registry sees it.
+/// * On logs/traces emitted via `internal_logs`, the field is added to the allowlist
+///   consulted by `SpanFields` (alongside the existing `component_*` prefix gate), so it is
+///   captured onto the log event under `vector.<field>`.
+///
+/// Example: an embedder that owns a "deployment-version" concept of its own can write
+/// `register_extra_span_field!("deployment_version");` once at module scope and any internal
+/// metric or log emitted from inside a span carrying that field will inherit it.
+///
+/// Registrations are collected at link time via the `inventory` crate, so both read paths
+/// are lock-free. The expansion goes through this crate's re-exports of `inventory`,
+/// [`MetricLabel`](crate::metrics::MetricLabel), and [`SpanField`], so callers do not need
+/// a direct `inventory` dependency.
+#[macro_export]
+macro_rules! register_extra_span_field {
+    ($key:expr) => {
+        $crate::__inventory::submit! {
+            $crate::metrics::MetricLabel($key)
+        }
+        $crate::__inventory::submit! {
+            $crate::SpanField($key)
+        }
+    };
+}
diff --git a/lib/vector-lib/src/lib.rs b/lib/vector-lib/src/lib.rs
index 277d28df18e92..ae62fd9053438 100644
--- a/lib/vector-lib/src/lib.rs
+++ b/lib/vector-lib/src/lib.rs
@@ -20,9 +20,10 @@ pub use vector_config::impl_generate_config_from_default;
 #[cfg(feature = "vrl")]
 pub use vector_core::compile_vrl;
 pub use vector_core::{
-    EstimatedJsonEncodedSizeOf, buckets, default_data_dir, emit, event, fanout, ipallowlist,
-    latency, metric_tags, metrics, partition, quantiles, register, samples, schema, serde, sink,
-    source, source_sender, tcp, tls, transform,
+    EstimatedJsonEncodedSizeOf, SpanField, buckets, default_data_dir, emit, event, fanout,
+    ipallowlist, latency, metric_tags, metrics, partition, quantiles, register,
+    register_extra_span_field, samples, schema, serde, sink, source, source_sender, tcp, tls,
+    transform,
 };
 pub use vector_lookup as lookup;
 pub use vector_stream as stream;
diff --git a/lib/vector-lib/tests/register_extra_span_field.rs b/lib/vector-lib/tests/register_extra_span_field.rs
new file mode 100644
index 0000000000000..71a853de03fa7
--- /dev/null
+++ b/lib/vector-lib/tests/register_extra_span_field.rs
@@ -0,0 +1,17 @@
+// No `use inventory` here — the whole point is that callers of the macro must
+// not need a direct inventory dependency.
+vector_lib::register_extra_span_field!("lib_integration_label");
+
+/// Asserts that `register_extra_span_field!` registers the name as a `MetricLabel`
+/// when called from a crate that has no direct `inventory` dependency.
+///
+/// If the `MetricLabel` arm were removed from the macro, this test would fail
+/// because `lib_integration_label` would be absent from `LABELS` and
+/// `VectorLabelFilter` would drop it before the metrics registry ever sees it.
+#[test]
+fn macro_registers_metric_label_without_caller_importing_inventory() {
+    assert!(
+        vector_lib::metrics::LABELS.contains("lib_integration_label"),
+        "expected `lib_integration_label` to be in the MetricLabel allowlist",
+    );
+}
diff --git a/src/sources/internal_logs.rs b/src/sources/internal_logs.rs
index 54b8c1acf12ac..d29ce5e1bb121 100644
--- a/src/sources/internal_logs.rs
+++ b/src/sources/internal_logs.rs
@@ -210,7 +210,7 @@ async fn run(
 mod tests {
     use futures::Stream;
     use tokio::time::{Duration, sleep};
-    use vector_lib::{event::Value, lookup::OwnedTargetPath};
+    use vector_lib::{SpanField, event::Value, lookup::OwnedTargetPath};
     use vrl::value::kind::Collection;
 
     use serial_test::serial;
@@ -244,6 +244,10 @@ mod tests {
         assert_source_compliance(&SOURCE_TAGS, run_test()).await;
     }
 
+    // Register test-specific span fields so they appear in the SPAN_FIELDS allowlist.
+    inventory::submit!(SpanField("component_new_field"));
+    inventory::submit!(SpanField("component_numerical_field"));
+
     async fn run_test() {
         let test_id: u8 = rand::random();
         let start = chrono::Utc::now();
@@ -350,6 +354,47 @@ mod tests {
         rx
     }
 
+    // Register a span field through the same macro downstream crates would use, then verify
+    // that emitting a log inside a span carrying that field captures it onto the log event.
+    // This is the regression check for `register_extra_span_field!` extending the
+    // `SpanFields::record` allowlist beyond the built-in `component_*` prefix.
+    vector_lib::register_extra_span_field!("internal_logs_test_extra_field");
+
+    #[tokio::test]
+    #[serial]
+    async fn registered_extra_span_field_is_captured() {
+        trace::init(false, false, "info", 10);
+        trace::reset_early_buffer();
+
+        let test_id: u8 = rand::random();
+        let rx = start_source().await;
+
+        {
+            let span = error_span!(
+                "extras",
+                component_id = "foo",
+                internal_logs_test_extra_field = "captured",
+                some_other_field = "dropped",
+            );
+            let _enter = span.enter();
+            error!(message = "With extra field.", %test_id);
+        }
+
+        sleep(Duration::from_millis(1)).await;
+        let mut events = collect_ready(rx).await;
+        let test_id_value = Value::from(test_id.to_string());
+        events.retain(|event| event.as_log().get("test_id") == Some(&test_id_value));
+
+        assert_eq!(events.len(), 1);
+        let log = events[0].as_log();
+        assert_eq!(
+            log["vector.internal_logs_test_extra_field"],
+            "captured".into()
+        );
+        // The unregistered span field is still filtered out.
+        assert!(log.get("vector.some_other_field").is_none());
+    }
+
     // NOTE: This test requires #[serial] because it directly interacts with global tracing state.
     // This is a pre-existing limitation around tracing initialization in tests.
     #[tokio::test]
diff --git a/src/trace.rs b/src/trace.rs
index 6ecec804569ed..fe78b6f2a5aa0 100644
--- a/src/trace.rs
+++ b/src/trace.rs
@@ -1,10 +1,10 @@
 #![allow(missing_docs)]
 use std::{
-    collections::HashMap,
+    collections::{HashMap, HashSet},
     marker::PhantomData,
     str::FromStr,
     sync::{
-        Mutex, MutexGuard, OnceLock,
+        LazyLock, Mutex, MutexGuard, OnceLock,
         atomic::{AtomicBool, Ordering},
     },
 };
@@ -26,6 +26,7 @@ use tracing_subscriber::{
     util::SubscriberInitExt,
 };
 pub use tracing_tower::{InstrumentableService, InstrumentedService};
+use vector_lib::SpanField;
 use vector_lib::lookup::event_path;
 use vrl::value::Value;
 
@@ -339,6 +340,17 @@ where
 #[derive(Default, Debug)]
 struct SpanFields(HashMap<&'static str, Value>);
 
+inventory::submit!(SpanField("component_id"));
+inventory::submit!(SpanField("component_type"));
+inventory::submit!(SpanField("component_kind"));
+
+/// Snapshot of every registered [`SpanField`],
+/// materialized once on first access. `inventory` populates submissions before `main`, so the
+/// snapshot is guaranteed to capture every entry; the read path on every traced span event is
+/// then a single set lookup against this static.
+static SPAN_FIELDS: LazyLock<HashSet<&'static str>> =
+    LazyLock::new(|| inventory::iter::<SpanField>().map(|f| f.0).collect());
+
 impl SpanFields {
     fn record(&mut self, field: &tracing_core::Field, value: impl Into<Value>) {
         let name = field.name();
@@ -347,8 +359,10 @@ impl SpanFields {
         // This captures all the basic component information provided in the
         // span that each component is spawned with. We don't capture all fields
         // to avoid adding unintentional noise and to prevent accidental
-        // security/privacy issues (e.g. leaking sensitive data).
-        if name.starts_with("component_") {
+        // security/privacy issues (e.g. leaking sensitive data). Downstream
+        // crates can extend the allowlist by name through
+        // `register_extra_span_field!` (see `vector_lib::SpanField`).
+        if SPAN_FIELDS.contains(name) {
             self.0.insert(name, value.into());
         }
     }

From d898743f7021f11ffb6f09cb2cebd4fe26d094c8 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 28 May 2026 12:40:09 -0400
Subject: [PATCH 279/326] chore(internal docs): add docs team to CODEOWNERS for
 top level md files (#25515)

* chore(internal docs): use glob pattern for top-level markdown files

* chore(internal docs): sync add_docs_review_label workflow with CODEOWNERS /*.md glob

Co-Authored-By: Claude Sonnet 4.6 <noreply>

* Reorder CODEOWNERS file
---
 .github/CODEOWNERS                          | 13 ++++++-------
 .github/workflows/add_docs_review_label.yml |  1 +
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index dde038e8052ec..45bfb2b14f923 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -3,16 +3,15 @@
 .github/workflows/regression.yml @vectordotdev/vector @vectordotdev/single-machine-performance
 regression/config.yaml @vectordotdev/vector @vectordotdev/single-machine-performance
 
-AI_POLICY.md @vectordotdev/vector @vectordotdev/documentation
-
-# Keep documentation team paths in sync with .github/workflows/add_docs_review_label.yml
-docs/ @vectordotdev/vector @vectordotdev/documentation
 website/ @vectordotdev/vector
-website/content @vectordotdev/vector @vectordotdev/documentation
-website/cue/reference @vectordotdev/vector @vectordotdev/documentation
-
 website/js @vectordotdev/vector @vectordotdev/vector-website
 website/layouts @vectordotdev/vector @vectordotdev/vector-website
 website/scripts @vectordotdev/vector @vectordotdev/vector-website
 website/data @vectordotdev/vector @vectordotdev/vector-website
 website/* @vectordotdev/vector @vectordotdev/vector-website
+
+# Keep documentation team paths in sync with .github/workflows/add_docs_review_label.yml
+/*.md @vectordotdev/vector @vectordotdev/documentation
+docs/ @vectordotdev/vector @vectordotdev/documentation
+website/content @vectordotdev/vector @vectordotdev/documentation
+website/cue/reference @vectordotdev/vector @vectordotdev/documentation
diff --git a/.github/workflows/add_docs_review_label.yml b/.github/workflows/add_docs_review_label.yml
index 23f9a697397af..e8e7bc63c1b03 100644
--- a/.github/workflows/add_docs_review_label.yml
+++ b/.github/workflows/add_docs_review_label.yml
@@ -11,6 +11,7 @@ on:
     types: [opened, reopened, synchronize]
     # Keep these paths in sync with the documentation team entries in .github/CODEOWNERS
     paths:
+      - "*.md"
       - "docs/**"
       - "website/content/**"
       - "website/cue/reference/**"

From ba27e2ef2bbeb4bf81f8896c562fa74837a13cfe Mon Sep 17 00:00:00 2001
From: Flavio Cruz <87035001+flaviofcruz@users.noreply.github.com>
Date: Thu, 28 May 2026 12:53:50 -0400
Subject: [PATCH 280/326] chore(deps): update zerobus sdk to 2.0.1 (#25438)

* chore: update zerobus sdk to 2.0.0

* Use 2.0.1 as it contains important bug fixes

* Avoid a reconversion when rebuilding the stream

* Update licenses

* Regenerate Cargo.lock

---------

Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock                                    | 177 +++++++++++-------
 Cargo.toml                                    |   8 +-
 LICENSE-3rdparty.csv                          |   2 +-
 src/sinks/databricks_zerobus/service.rs       |  22 ++-
 .../unity_catalog_schema.rs                   |  34 +++-
 5 files changed, 164 insertions(+), 79 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b4a9b6d86ef49..3a187bad76ba6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3479,15 +3479,16 @@ dependencies = [
 
 [[package]]
 name = "databricks-zerobus-ingest-sdk"
-version = "1.2.0"
-source = "git+https://github.com/databricks/zerobus-sdk-rs?rev=273efe09130a7554e6b34d20b95df50289e58524#273efe09130a7554e6b34d20b95df50289e58524"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f87c99484cd20e2c9c361e2fe8884f614f35d8cde7d630cfaacbc09c4c21e9"
 dependencies = [
  "async-trait",
  "bytes",
  "hyper-http-proxy",
  "hyper-util",
- "prost 0.13.5",
- "prost-types 0.13.5",
+ "prost 0.14.3",
+ "prost-types 0.14.3",
  "protoc-bin-vendored",
  "reqwest 0.12.28",
  "serde",
@@ -3498,8 +3499,9 @@ dependencies = [
  "tokio-retry",
  "tokio-stream",
  "tokio-util",
- "tonic 0.13.1",
- "tonic-build 0.13.1",
+ "tonic 0.14.5",
+ "tonic-prost",
+ "tonic-prost-build",
  "tracing 0.1.44",
 ]
 
@@ -3747,7 +3749,7 @@ checksum = "6e39034cee21a2f5bbb66ba0e3689819c4bb5d00382a282006e802a7ffa6c41d"
 dependencies = [
  "cfg-if",
  "libc",
- "socket2 0.6.0",
+ "socket2 0.6.3",
  "windows-sys 0.60.2",
 ]
 
@@ -4307,6 +4309,12 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
 
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
 [[package]]
 name = "flatbuffers"
 version = "24.12.23"
@@ -5569,7 +5577,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.0",
+ "socket2 0.6.3",
  "tokio",
  "tower-service",
  "tracing 0.1.44",
@@ -6362,7 +6370,7 @@ dependencies = [
  "ena",
  "itertools 0.13.0",
  "lalrpop-util",
- "petgraph",
+ "petgraph 0.6.4",
  "regex",
  "regex-syntax",
  "sha3",
@@ -6980,15 +6988,14 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.0.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4569e456d394deccd22ce1c1913e6ea0e54519f577285001215d33557431afe4"
+checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
- "hermit-abi 0.3.9",
  "libc",
  "log",
  "wasi",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -7116,7 +7123,7 @@ dependencies = [
  "serde_with",
  "sha1",
  "sha2",
- "socket2 0.6.0",
+ "socket2 0.6.3",
  "stringprep",
  "strsim",
  "take_mut",
@@ -7584,7 +7591,7 @@ version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.21.7",
  "chrono",
  "getrandom 0.2.15",
  "http 1.3.1",
@@ -8078,7 +8085,18 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1d3afd2628e69da2be385eb6f2fd57c8ac7977ceeff6dc166ff1657b0e386a9"
 dependencies = [
- "fixedbitset",
+ "fixedbitset 0.4.2",
+ "indexmap 2.12.0",
+]
+
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset 0.5.7",
+ "hashbrown 0.15.2",
  "indexmap 2.12.0",
 ]
 
@@ -8591,7 +8609,7 @@ dependencies = [
  "log",
  "multimap",
  "once_cell",
- "petgraph",
+ "petgraph 0.6.4",
  "prettyplease",
  "prost 0.12.6",
  "prost-types 0.12.6",
@@ -8611,7 +8629,7 @@ dependencies = [
  "log",
  "multimap",
  "once_cell",
- "petgraph",
+ "petgraph 0.6.4",
  "prettyplease",
  "prost 0.13.5",
  "prost-types 0.13.5",
@@ -8620,6 +8638,27 @@ dependencies = [
  "tempfile",
 ]
 
+[[package]]
+name = "prost-build"
+version = "0.14.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "343d3bd7056eda839b03204e68deff7d1b13aba7af2b2fd16890697274262ee7"
+dependencies = [
+ "heck 0.5.0",
+ "itertools 0.10.5",
+ "log",
+ "multimap",
+ "petgraph 0.8.3",
+ "prettyplease",
+ "prost 0.14.3",
+ "prost-types 0.14.3",
+ "pulldown-cmark",
+ "pulldown-cmark-to-cmark",
+ "regex",
+ "syn 2.0.117",
+ "tempfile",
+]
+
 [[package]]
 name = "prost-derive"
 version = "0.12.6"
@@ -8809,6 +8848,26 @@ dependencies = [
  "psl-types",
 ]
 
+[[package]]
+name = "pulldown-cmark"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c3a14896dfa883796f1cb410461aef38810ea05f2b2c33c5aded3649095fdad"
+dependencies = [
+ "bitflags 2.10.0",
+ "memchr",
+ "unicase",
+]
+
+[[package]]
+name = "pulldown-cmark-to-cmark"
+version = "22.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50793def1b900256624a709439404384204a5dc3a6ec580281bfaac35e882e90"
+dependencies = [
+ "pulldown-cmark",
+]
+
 [[package]]
 name = "pulsar"
 version = "6.7.2"
@@ -9310,7 +9369,7 @@ dependencies = [
  "pin-project-lite",
  "rand 0.9.4",
  "ryu",
- "socket2 0.6.0",
+ "socket2 0.6.3",
  "tokio",
  "tokio-native-tls",
  "tokio-util",
@@ -10597,9 +10656,9 @@ dependencies = [
 
 [[package]]
 name = "signal-hook-mio"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34db1a06d485c9142248b7a054f034b349b212551f3dfd19c94d45a754a217cd"
+checksum = "b75a19a7a740b25bc7944bdee6172368f988763b744e3d4dfe753f6b4ece40cc"
 dependencies = [
  "libc",
  "mio",
@@ -10838,12 +10897,12 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.6.0"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
+checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.0",
 ]
 
 [[package]]
@@ -11663,9 +11722,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.50.0"
+version = "1.52.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d"
+checksum = "110a78583f19d5cdb2c5ccf321d1290344e71313c6c37d43520d386027d18386"
 dependencies = [
  "bytes",
  "libc",
@@ -11673,7 +11732,7 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.0",
+ "socket2 0.6.3",
  "tokio-macros",
  "tracing 0.1.44",
  "windows-sys 0.61.0",
@@ -11691,9 +11750,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.6.0"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.45",
@@ -11741,7 +11800,7 @@ dependencies = [
  "postgres-protocol",
  "postgres-types",
  "rand 0.9.4",
- "socket2 0.6.0",
+ "socket2 0.6.3",
  "tokio",
  "tokio-util",
  "whoami",
@@ -12011,37 +12070,6 @@ dependencies = [
  "tracing 0.1.44",
 ]
 
-[[package]]
-name = "tonic"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e581ba15a835f4d9ea06c55ab1bd4dce26fc53752c69a04aac00703bfb49ba9"
-dependencies = [
- "async-trait",
- "axum 0.8.9",
- "base64 0.22.1",
- "bytes",
- "h2 0.4.13",
- "http 1.3.1",
- "http-body 1.0.1",
- "http-body-util",
- "hyper 1.7.0",
- "hyper-timeout 0.5.1",
- "hyper-util",
- "percent-encoding",
- "pin-project",
- "prost 0.13.5",
- "rustls-native-certs 0.8.1",
- "socket2 0.5.10",
- "tokio",
- "tokio-rustls 0.26.2",
- "tokio-stream",
- "tower 0.5.3",
- "tower-layer",
- "tower-service",
- "tracing 0.1.44",
-]
-
 [[package]]
 name = "tonic"
 version = "0.14.5"
@@ -12062,7 +12090,8 @@ dependencies = [
  "hyper-util",
  "percent-encoding",
  "pin-project",
- "socket2 0.6.0",
+ "rustls-native-certs 0.8.1",
+ "socket2 0.6.3",
  "sync_wrapper 1.0.2",
  "tokio",
  "tokio-rustls 0.26.2",
@@ -12089,14 +12118,12 @@ dependencies = [
 
 [[package]]
 name = "tonic-build"
-version = "0.13.1"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac6f67be712d12f0b41328db3137e0d0757645d8904b4cb7d51cd9c2279e847"
+checksum = "c68f61875ac5293cf72e6c8cf0158086428c82c37229e98c840878f1706b0322"
 dependencies = [
  "prettyplease",
  "proc-macro2 1.0.106",
- "prost-build 0.13.5",
- "prost-types 0.13.5",
  "quote 1.0.45",
  "syn 2.0.117",
 ]
@@ -12125,6 +12152,22 @@ dependencies = [
  "tonic 0.14.5",
 ]
 
+[[package]]
+name = "tonic-prost-build"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "654e5643eff75d7f8c99197ce1440ed19a3474eada74c12bbac488b2cafdae27"
+dependencies = [
+ "prettyplease",
+ "proc-macro2 1.0.106",
+ "prost-build 0.14.3",
+ "prost-types 0.14.3",
+ "quote 1.0.45",
+ "syn 2.0.117",
+ "tempfile",
+ "tonic-build 0.14.6",
+]
+
 [[package]]
 name = "tonic-reflection"
 version = "0.11.0"
@@ -12957,9 +13000,11 @@ dependencies = [
  "proptest",
  "proptest-derive",
  "prost 0.12.6",
+ "prost 0.14.3",
  "prost-build 0.12.6",
  "prost-reflect",
  "prost-types 0.12.6",
+ "prost-types 0.14.3",
  "pulsar",
  "quick-junit",
  "quick-xml 0.31.0",
diff --git a/Cargo.toml b/Cargo.toml
index a0baa2a76a980..c389001ed9276 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -336,7 +336,11 @@ prost-reflect = { workspace = true, optional = true }
 prost-types = { workspace = true, optional = true }
 
 # Databricks Zerobus
-databricks-zerobus-ingest-sdk = { git = "https://github.com/databricks/zerobus-sdk-rs", rev = "273efe09130a7554e6b34d20b95df50289e58524", optional = true }
+databricks-zerobus-ingest-sdk = { version = "2.0.1", optional = true }
+# The SDK returns prost-types 0.14 DescriptorProto values; prost-reflect (used by the rest
+# of the sink) is on prost-types 0.13. We bridge the two via wire-format re-encoding.
+prost-014 = { package = "prost", version = "0.14", optional = true }
+prost-types-014 = { package = "prost-types", version = "0.14", optional = true }
 
 # GCP
 goauth = { version = "0.16.0", optional = true }
@@ -930,7 +934,7 @@ sinks-chronicle = []
 sinks-clickhouse = ["dep:nom", "dep:rust_decimal", "codecs-arrow"]
 sinks-console = []
 sinks-databend = ["dep:databend-client"]
-sinks-databricks-zerobus = ["dep:databricks-zerobus-ingest-sdk", "dep:prost-reflect", "dep:base64"]
+sinks-databricks-zerobus = ["dep:databricks-zerobus-ingest-sdk", "dep:prost-reflect", "dep:prost-014", "dep:prost-types-014", "dep:base64"]
 sinks-datadog_events = []
 sinks-datadog_logs = []
 sinks-datadog_metrics = ["protobuf-build", "dep:prost", "dep:prost-reflect"]
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index dec61bb1e82bd..2d00edc12d4dd 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -705,7 +705,7 @@ sha2,https://github.com/RustCrypto/hashes,MIT OR Apache-2.0,RustCrypto Developer
 sha3,https://github.com/RustCrypto/hashes,MIT OR Apache-2.0,RustCrypto Developers
 sharded-slab,https://github.com/hawkw/sharded-slab,MIT,Eliza Weisman <eliza@buoyant.io>
 signal-hook,https://github.com/vorner/signal-hook,Apache-2.0 OR MIT,"Michal 'vorner' Vaner <vorner@vorner.cz>, Thomas Himmelstoss <thimm@posteo.de>"
-signal-hook-mio,https://github.com/vorner/signal-hook,Apache-2.0 OR MIT,"Michal 'vorner' Vaner <vorner@vorner.cz>, Thomas Himmelstoss <thimm@posteo.de>"
+signal-hook-mio,https://github.com/vorner/signal-hook,MIT OR Apache-2.0,"Michal 'vorner' Vaner <vorner@vorner.cz>, Thomas Himmelstoss <thimm@posteo.de>"
 signal-hook-registry,https://github.com/vorner/signal-hook,Apache-2.0 OR MIT,"Michal 'vorner' Vaner <vorner@vorner.cz>, Masaki Hara <ackie.h.gmai@gmail.com>"
 signatory,https://github.com/iqlusioninc/crates/tree/main/signatory,Apache-2.0 OR MIT,Tony Arcieri <tony@iqlusion.io>
 signature,https://github.com/RustCrypto/traits/tree/master/signature,Apache-2.0 OR MIT,RustCrypto Developers
diff --git a/src/sinks/databricks_zerobus/service.rs b/src/sinks/databricks_zerobus/service.rs
index 028d03e7a154a..076488e55bf49 100644
--- a/src/sinks/databricks_zerobus/service.rs
+++ b/src/sinks/databricks_zerobus/service.rs
@@ -277,7 +277,9 @@ impl MockStream {
 /// Schema and encoding state derived from the Unity Catalog table.
 pub(super) struct ResolvedSchema {
     encoder: BatchEncoder,
-    descriptor_proto: Arc<prost_reflect::prost_types::DescriptorProto>,
+    /// SDK-typed (prost-types 0.14) descriptor — held in this form so each
+    /// stream rebuild avoids re-encoding from the prost-reflect 0.13 form.
+    descriptor_proto: Arc<prost_types_014::DescriptorProto>,
 }
 
 /// Service for handling Zerobus requests.
@@ -318,10 +320,21 @@ impl ZerobusService {
     }
 
     /// Resolve the protobuf message descriptor from Unity Catalog.
+    ///
+    /// Returns both the prost-reflect `MessageDescriptor` (used by the proto
+    /// batch encoder) and the SDK-typed `DescriptorProto` (used to construct
+    /// Zerobus streams). Returning both avoids re-encoding the descriptor
+    /// every time a stream is rebuilt after a retryable failure.
     async fn resolve_descriptor(
         config: &ZerobusSinkConfig,
         http_client: &HttpClient,
-    ) -> Result<prost_reflect::MessageDescriptor, ZerobusSinkError> {
+    ) -> Result<
+        (
+            prost_reflect::MessageDescriptor,
+            prost_types_014::DescriptorProto,
+        ),
+        ZerobusSinkError,
+    > {
         let (client_id, client_secret) = config.auth.credentials();
 
         let table_schema = unity_catalog_schema::fetch_table_schema(
@@ -340,8 +353,9 @@ impl ZerobusService {
     pub(super) async fn ensure_schema(&self) -> Result<&ResolvedSchema, ZerobusSinkError> {
         self.schema
             .get_or_try_init(|| async {
-                let descriptor = Self::resolve_descriptor(&self.config, &self.http_client).await?;
-                let descriptor_proto = Arc::new(descriptor.descriptor_proto().clone());
+                let (descriptor, sdk_descriptor_proto) =
+                    Self::resolve_descriptor(&self.config, &self.http_client).await?;
+                let descriptor_proto = Arc::new(sdk_descriptor_proto);
 
                 let batch_serializer =
                     BatchSerializerConfig::ProtoBatch(ProtoBatchSerializerConfig {
diff --git a/src/sinks/databricks_zerobus/unity_catalog_schema.rs b/src/sinks/databricks_zerobus/unity_catalog_schema.rs
index e1871087e1dfd..343604512242d 100644
--- a/src/sinks/databricks_zerobus/unity_catalog_schema.rs
+++ b/src/sinks/databricks_zerobus/unity_catalog_schema.rs
@@ -313,15 +313,37 @@ fn format_kind_type(kind: &prost_reflect::Kind) -> String {
 /// wrapper adds the `FileDescriptorProto` / `DescriptorPool` plumbing that
 /// Vector needs to get a `prost_reflect::MessageDescriptor` usable for
 /// dynamic message encoding.
+///
+/// Returns both the `MessageDescriptor` (for dynamic encoding via prost-reflect)
+/// and the SDK-typed `DescriptorProto` (prost-types 0.14, used when constructing
+/// the Zerobus stream). Returning both lets us avoid re-encoding the descriptor
+/// on every stream rebuild.
 pub fn generate_descriptor_from_schema(
     schema: &UnityCatalogTableSchema,
-) -> Result<prost_reflect::MessageDescriptor, ZerobusSinkError> {
-    let message_proto =
+) -> Result<
+    (
+        prost_reflect::MessageDescriptor,
+        prost_types_014::DescriptorProto,
+    ),
+    ZerobusSinkError,
+> {
+    let sdk_message_proto =
         descriptor_from_uc_schema(schema).map_err(|e| ZerobusSinkError::ConfigError {
             message: format!("Failed to convert Unity Catalog schema to protobuf: {}", e),
         })?;
 
-    let message_name = message_proto.name().to_string();
+    // The SDK returns a prost-types 0.14 DescriptorProto, but prost-reflect (used
+    // below to build the descriptor pool) is on prost-types 0.13. Re-encode through
+    // the protobuf wire format to bridge the two versions.
+    let message_name = sdk_message_proto.name().to_string();
+    let encoded = prost_014::Message::encode_to_vec(&sdk_message_proto);
+    let message_proto =
+        <prost_reflect::prost_types::DescriptorProto as prost_reflect::prost::Message>::decode(
+            encoded.as_slice(),
+        )
+        .map_err(|e| ZerobusSinkError::ConfigError {
+            message: format!("Failed to re-decode SDK DescriptorProto: {}", e),
+        })?;
     let package_name = sanitize_package_name(&schema.catalog_name);
 
     let file_proto = prost_types::FileDescriptorProto {
@@ -355,7 +377,7 @@ pub fn generate_descriptor_from_schema(
         );
     }
 
-    Ok(message_descriptor)
+    Ok((message_descriptor, sdk_message_proto))
 }
 
 /// Default prefix for package name segments that start with a non-letter.
@@ -438,7 +460,7 @@ mod tests {
             ],
         };
 
-        let descriptor =
+        let (descriptor, _sdk_proto) =
             generate_descriptor_from_schema(&schema).expect("descriptor should be generated");
         assert_eq!(descriptor.fields().len(), 2);
         assert!(descriptor.get_field_by_name("id").is_some());
@@ -454,7 +476,7 @@ mod tests {
         let schema: UnityCatalogTableSchema =
             serde_json::from_str(json).expect("Failed to parse nested_structs_complete schema");
 
-        let descriptor =
+        let (descriptor, _sdk_proto) =
             generate_descriptor_from_schema(&schema).expect("Failed to generate descriptor");
 
         let proto_text = format_descriptor_as_proto(&descriptor);

From b7aae737cef5dd37d1445915443a1eb97b584f85 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Thu, 28 May 2026 14:33:49 -0400
Subject: [PATCH 281/326] fix(observability): redact sink-specific API key
 headers in debug logs (#25516)

* fix(observability): redact sink-specific API key headers in debug logs

Expand the sensitive header list in `remove_sensitive()` to cover
`DD-API-KEY`, `X-Honeycomb-Team`, `x-api-key`, and `Api-Key`, which
are injected by Vector's own sinks and were previously logged in
plaintext when debug logging was enabled.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(observability): mark all duplicate sensitive header values in debug logs

`HeaderMap::get_mut` only returned the first value for a header name,
leaving any duplicates (added via `append` or injected by a proxy)
unredacted. Switch to `iter_mut` so every entry matching a sensitive
name is marked.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: apply rustfmt to http_client tests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(observability): add case-insensitive header name test

HeaderName normalizes to lowercase, confirming that mixed-case variants
like X-Api-Key are redacted by the same path as x-api-key.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(observability): add Proxy-Authenticate, WWW-Authenticate, and Cookie2 to sensitive headers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: update changelog to include newly redacted headers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../redact-sink-api-key-headers.security.md   |  3 +
 src/internal_events/http_client.rs            | 91 ++++++++++++++++++-
 2 files changed, 90 insertions(+), 4 deletions(-)
 create mode 100644 changelog.d/redact-sink-api-key-headers.security.md

diff --git a/changelog.d/redact-sink-api-key-headers.security.md b/changelog.d/redact-sink-api-key-headers.security.md
new file mode 100644
index 0000000000000..1922656445ffd
--- /dev/null
+++ b/changelog.d/redact-sink-api-key-headers.security.md
@@ -0,0 +1,3 @@
+Redact sink-specific API key headers (`DD-API-KEY`, `X-Honeycomb-Team`, `x-api-key`, `Api-Key`) in debug-level HTTP request and response logs, alongside the existing standard headers (`Authorization`, `Proxy-Authorization`, `Proxy-Authenticate`, `WWW-Authenticate`, `Cookie`, `Set-Cookie`, `Cookie2`).
+
+authors: pront
diff --git a/src/internal_events/http_client.rs b/src/internal_events/http_client.rs
index 346192dfca141..38e6fe94f8d7e 100644
--- a/src/internal_events/http_client.rs
+++ b/src/internal_events/http_client.rs
@@ -2,7 +2,7 @@ use std::time::Duration;
 
 use http::{
     Request, Response,
-    header::{self, HeaderMap, HeaderValue},
+    header::{self, HeaderMap, HeaderName, HeaderValue},
 };
 use hyper::{Error, body::HttpBody};
 use vector_lib::{
@@ -17,13 +17,21 @@ pub struct AboutToSendHttpRequest<'a, T> {
 
 fn remove_sensitive(headers: &HeaderMap<HeaderValue>) -> HeaderMap<HeaderValue> {
     let mut headers = headers.clone();
-    for name in &[
+    let sensitive: &[HeaderName] = &[
         header::AUTHORIZATION,
         header::PROXY_AUTHORIZATION,
+        header::PROXY_AUTHENTICATE,
+        header::WWW_AUTHENTICATE,
         header::COOKIE,
         header::SET_COOKIE,
-    ] {
-        if let Some(value) = headers.get_mut(name) {
+        HeaderName::from_static("cookie2"),
+        HeaderName::from_static("dd-api-key"),
+        HeaderName::from_static("x-honeycomb-team"),
+        HeaderName::from_static("x-api-key"),
+        HeaderName::from_static("api-key"),
+    ];
+    for (name, value) in headers.iter_mut() {
+        if sensitive.contains(name) {
             value.set_sensitive(true);
         }
     }
@@ -114,3 +122,78 @@ impl<B: HttpBody> std::fmt::Display for FormatBody<'_, B> {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use http::header::{self, HeaderMap, HeaderName, HeaderValue};
+
+    use super::remove_sensitive;
+
+    fn is_sensitive(map: &HeaderMap, name: &HeaderName) -> Vec<bool> {
+        map.get_all(name)
+            .iter()
+            .map(HeaderValue::is_sensitive)
+            .collect()
+    }
+
+    #[test]
+    fn marks_single_sensitive_header() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::AUTHORIZATION,
+            HeaderValue::from_static("Bearer token"),
+        );
+        let result = remove_sensitive(&headers);
+        assert!(
+            is_sensitive(&result, &header::AUTHORIZATION)
+                .iter()
+                .all(|&s| s)
+        );
+    }
+
+    #[test]
+    fn marks_all_duplicate_sensitive_headers() {
+        let x_api_key: HeaderName = HeaderName::from_static("x-api-key");
+        let mut headers = HeaderMap::new();
+        headers.insert(x_api_key.clone(), HeaderValue::from_static("key-one"));
+        headers.append(x_api_key.clone(), HeaderValue::from_static("key-two"));
+        headers.append(x_api_key.clone(), HeaderValue::from_static("key-three"));
+
+        let result = remove_sensitive(&headers);
+        let sensitive_flags = is_sensitive(&result, &x_api_key);
+        assert_eq!(sensitive_flags.len(), 3);
+        assert!(
+            sensitive_flags.iter().all(|&s| s),
+            "not all duplicate x-api-key values were marked sensitive: {sensitive_flags:?}"
+        );
+    }
+
+    #[test]
+    fn header_name_matching_is_case_insensitive() {
+        // HeaderName normalizes to lowercase, so mixed-case variants are identical.
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            HeaderName::from_static("x-api-key"),
+            HeaderValue::from_static("secret"),
+        );
+        let result = remove_sensitive(&headers);
+        // Lookup with the mixed-case form resolves to the same normalized name.
+        let mixed_case = HeaderName::from_bytes(b"X-Api-Key").unwrap();
+        assert!(is_sensitive(&result, &mixed_case).iter().all(|&s| s));
+    }
+
+    #[test]
+    fn does_not_mark_non_sensitive_headers() {
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("application/json"),
+        );
+        let result = remove_sensitive(&headers);
+        assert!(
+            is_sensitive(&result, &header::CONTENT_TYPE)
+                .iter()
+                .all(|&s| !s)
+        );
+    }
+}

From 08b6975fc7c0384ecb72e94bceedb7622a5340db Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 28 May 2026 23:31:05 -0400
Subject: [PATCH 282/326] fix(metrics): restore IndexMap for unbounded
 MetricSet to fix CPU regression (#25493)

* perf(metrics): restore IndexMap for unbounded MetricSet to fix CPU regression

* refactor(metrics): remove pop_lru from MetricSetInner, check Bounded in enforce_capacity_policy

* chore(changelog): add context on when the perf regression is noticeable

* refactor(metrics): add debug_assert for impossible Bounded state in enforce_capacity_policy

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 ...058_metric_set_indexmap_performance.fix.md |   5 +
 src/sinks/util/buffer/metrics/normalize.rs    | 196 ++++++++++++++++--
 2 files changed, 180 insertions(+), 21 deletions(-)
 create mode 100644 changelog.d/24058_metric_set_indexmap_performance.fix.md

diff --git a/changelog.d/24058_metric_set_indexmap_performance.fix.md b/changelog.d/24058_metric_set_indexmap_performance.fix.md
new file mode 100644
index 0000000000000..beae01365f164
--- /dev/null
+++ b/changelog.d/24058_metric_set_indexmap_performance.fix.md
@@ -0,0 +1,5 @@
+Fixed a CPU regression introduced in 0.50.0 affecting all sinks that use metric normalization such as `prometheus_remote_write`, `aws_cloudwatch_metrics`, `statsd` and others.
+
+The only exception is the `incremental_to_absolute` transform when `max_bytes` or `max_events` are configured, where the overhead is expected and necessary for eviction to work correctly.
+
+authors: thomasqueirozb
diff --git a/src/sinks/util/buffer/metrics/normalize.rs b/src/sinks/util/buffer/metrics/normalize.rs
index c244506508f18..45026c0cc5e81 100644
--- a/src/sinks/util/buffer/metrics/normalize.rs
+++ b/src/sinks/util/buffer/metrics/normalize.rs
@@ -3,6 +3,7 @@ use std::{
     time::{Duration, Instant},
 };
 
+use indexmap::IndexMap;
 use lru::LruCache;
 use serde_with::serde_as;
 use snafu::Snafu;
@@ -375,14 +376,96 @@ pub struct MetricSetSettings {
     pub time_to_live: Option<u64>,
 }
 
-/// Dual-limit cache using standard LRU with optional capacity and TTL policies.
+/// Inner storage for `MetricSet`.
 ///
-/// This implementation uses the standard LRU crate with optional enforcement of both
-/// memory and entry count limits via CapacityPolicy, plus optional TTL via TtlPolicy.
+/// Uses `IndexMap` when no capacity eviction policy is configured — avoiding the
+/// per-access LRU bookkeeping (pointer chasing in a doubly-linked list) that
+/// `LruCache::get_mut` performs unconditionally.  `LruCache` is used only when a
+/// capacity policy is set, so that LRU eviction order is maintained correctly.
+#[derive(Clone, Debug)]
+enum MetricSetInner {
+    /// Unbounded storage with no eviction.  Hash-map lookup only, no LRU overhead.
+    Unbounded(IndexMap<MetricSeries, MetricEntry>),
+    /// Bounded storage with LRU eviction semantics.
+    Bounded(LruCache<MetricSeries, MetricEntry>),
+}
+
+impl MetricSetInner {
+    fn len(&self) -> usize {
+        match self {
+            Self::Unbounded(m) => m.len(),
+            Self::Bounded(m) => m.len(),
+        }
+    }
+
+    fn is_empty(&self) -> bool {
+        match self {
+            Self::Unbounded(m) => m.is_empty(),
+            Self::Bounded(m) => m.is_empty(),
+        }
+    }
+
+    /// Returns a mutable reference to the entry.
+    ///
+    /// For `Unbounded` this is a plain hash-map lookup.
+    /// For `Bounded` this also promotes the entry to the MRU end of the LRU list.
+    fn get_mut(&mut self, key: &MetricSeries) -> Option<&mut MetricEntry> {
+        match self {
+            Self::Unbounded(m) => m.get_mut(key),
+            Self::Bounded(m) => m.get_mut(key),
+        }
+    }
+
+    /// Inserts or replaces an entry, returning the previous value if any.
+    fn put(&mut self, key: MetricSeries, value: MetricEntry) -> Option<MetricEntry> {
+        match self {
+            Self::Unbounded(m) => m.insert(key, value),
+            Self::Bounded(m) => m.put(key, value),
+        }
+    }
+
+    /// Removes an entry by key, returning it if present.
+    fn pop(&mut self, key: &MetricSeries) -> Option<MetricEntry> {
+        match self {
+            // swap_remove is O(1) vs shift_remove's O(n); insertion order is not required here.
+            Self::Unbounded(m) => m.swap_remove(key),
+            Self::Bounded(m) => m.pop(key),
+        }
+    }
+
+    fn iter(&self) -> MetricSetIter<'_> {
+        match self {
+            Self::Unbounded(m) => MetricSetIter::Unbounded(m.iter()),
+            Self::Bounded(m) => MetricSetIter::Bounded(m.iter()),
+        }
+    }
+}
+
+enum MetricSetIter<'a> {
+    Unbounded(indexmap::map::Iter<'a, MetricSeries, MetricEntry>),
+    Bounded(lru::Iter<'a, MetricSeries, MetricEntry>),
+}
+
+impl<'a> Iterator for MetricSetIter<'a> {
+    type Item = (&'a MetricSeries, &'a MetricEntry);
+
+    fn next(&mut self) -> Option<Self::Item> {
+        match self {
+            Self::Unbounded(it) => it.next(),
+            Self::Bounded(it) => it.next(),
+        }
+    }
+}
+
+/// Dual-limit cache for metric normalization with optional capacity and TTL policies.
+///
+/// Uses `IndexMap` internally when no capacity eviction policy is configured, avoiding
+/// the per-access LRU pointer-manipulation overhead of `LruCache`. Switches to
+/// `LruCache` only when a `max_bytes` or `max_events` capacity policy is set, so that
+/// LRU eviction ordering is preserved for those cases.
 #[derive(Clone, Debug)]
 pub struct MetricSet {
-    /// LRU cache for storing metric entries
-    inner: LruCache<MetricSeries, MetricEntry>,
+    inner: MetricSetInner,
     /// Optional capacity policy for memory and/or entry count limits
     capacity_policy: Option<CapacityPolicy>,
     /// Optional TTL policy for time-based expiration
@@ -411,10 +494,15 @@ impl MetricSet {
         capacity_policy: Option<CapacityPolicy>,
         ttl_policy: Option<TtlPolicy>,
     ) -> Self {
-        // Always use an unbounded cache since we manually track limits
-        // This ensures our capacity policy can properly track memory for all evicted entries
+        // Use LruCache only when a capacity policy requires LRU eviction ordering.
+        // Without a capacity policy, IndexMap avoids the per-access LRU overhead.
+        let inner = if capacity_policy.is_some() {
+            MetricSetInner::Bounded(LruCache::unbounded())
+        } else {
+            MetricSetInner::Unbounded(IndexMap::default())
+        };
         Self {
-            inner: LruCache::unbounded(),
+            inner,
             capacity_policy,
             ttl_policy,
         }
@@ -463,9 +551,15 @@ impl MetricSet {
             return; // No capacity limits configured
         };
 
+        // A capacity policy is only set when inner is Bounded; this should always be true.
+        let MetricSetInner::Bounded(ref mut lru) = self.inner else {
+            debug_assert!(false, "capacity policy set but inner is not Bounded");
+            return;
+        };
+
         // Keep evicting until we're within limits
-        while capacity_policy.needs_eviction(self.inner.len()) {
-            if let Some((series, entry)) = self.inner.pop_lru() {
+        while capacity_policy.needs_eviction(lru.len()) {
+            if let Some((series, entry)) = lru.pop_lru() {
                 capacity_policy.free_item(&series, &entry);
             } else {
                 break; // No more entries to evict
@@ -497,14 +591,13 @@ impl MetricSet {
             return; // No TTL policy, nothing to do
         };
 
-        let mut expired_keys = Vec::new();
-
         // Collect expired keys using the provided timestamp
-        for (series, entry) in self.inner.iter() {
-            if entry.is_expired(ttl, now) {
-                expired_keys.push(series.clone());
-            }
-        }
+        let expired_keys: Vec<MetricSeries> = self
+            .inner
+            .iter()
+            .filter(|(_, e)| e.is_expired(ttl, now))
+            .map(|(s, _)| s.clone())
+            .collect();
 
         // Remove expired entries and update memory tracking (if max_bytes is set)
         for series in expired_keys {
@@ -549,11 +642,19 @@ impl MetricSet {
     pub fn into_metrics(mut self) -> Vec<Metric> {
         // Clean up expired entries first (using current time)
         self.cleanup_expired(Instant::now());
-        let mut metrics = Vec::new();
-        while let Some((series, entry)) = self.inner.pop_lru() {
-            metrics.push(entry.into_metric(series));
+        match self.inner {
+            MetricSetInner::Unbounded(m) => m
+                .into_iter()
+                .map(|(series, entry)| entry.into_metric(series))
+                .collect(),
+            MetricSetInner::Bounded(mut m) => {
+                let mut metrics = Vec::with_capacity(m.len());
+                while let Some((series, entry)) = m.pop_lru() {
+                    metrics.push(entry.into_metric(series));
+                }
+                metrics
+            }
         }
-        metrics
     }
 
     /// Either pass the metric through as-is if absolute, or convert it
@@ -705,3 +806,56 @@ impl Default for MetricSet {
         Self::new(MetricSetSettings::default())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use vector_lib::event::metric::{MetricKind, MetricValue};
+
+    use super::*;
+
+    fn counter(name: &str, value: f64, kind: MetricKind) -> Metric {
+        Metric::new(name, kind, MetricValue::Counter { value })
+    }
+
+    // Verifies that the default (no capacity policy) path uses IndexMap and that
+    // make_absolute / into_metrics behave correctly across multiple updates.
+    #[test]
+    fn unbounded_incremental_to_absolute_accumulates() {
+        let mut set = MetricSet::default();
+        assert!(matches!(set.inner, MetricSetInner::Unbounded(_)));
+
+        // First incremental: stored as reference, emitted as absolute 1.0
+        let out = set.make_absolute(counter("hits", 1.0, MetricKind::Incremental));
+        assert_eq!(out.unwrap().value(), &MetricValue::Counter { value: 1.0 });
+
+        // Second incremental: accumulated with previous, emitted as absolute 3.0
+        let out = set.make_absolute(counter("hits", 2.0, MetricKind::Incremental));
+        assert_eq!(out.unwrap().value(), &MetricValue::Counter { value: 3.0 });
+
+        // into_metrics drains the set and returns all tracked series
+        let metrics = set.into_metrics();
+        assert_eq!(metrics.len(), 1);
+        assert_eq!(metrics[0].name(), "hits");
+    }
+
+    #[test]
+    fn unbounded_absolute_passes_through() {
+        let mut set = MetricSet::default();
+
+        let out = set.make_absolute(counter("rps", 42.0, MetricKind::Absolute));
+        assert_eq!(out.unwrap().value(), &MetricValue::Counter { value: 42.0 });
+
+        // Absolute metrics are not stored in the set
+        assert!(set.is_empty());
+    }
+
+    // Verifies that capacity policy switches to the LruCache (Bounded) path.
+    #[test]
+    fn bounded_path_selected_when_capacity_policy_set() {
+        let set = MetricSet::new(MetricSetSettings {
+            max_events: Some(10),
+            ..Default::default()
+        });
+        assert!(matches!(set.inner, MetricSetInner::Bounded(_)));
+    }
+}

From 27497d0bda63e9c8af9da91ef66116b221e6a35f Mon Sep 17 00:00:00 2001
From: taylorchandleryoung <taylor.c.young@datadoghq.com>
Date: Fri, 29 May 2026 15:55:44 +0200
Subject: [PATCH 283/326] fix(shutdown): Update known lifecycle flow to warn
 not error (#25458)

* Update known lifecycle flow to warn not error

* Adding changelog

* Refactor the stat so its done on every shutdown regardless of cause

* Adding tests

* fix issue found by codex

* update comment on new behavior

* More doc updates

* fmt update

* Rename and move logic to call site

* Move function to shared helper file

* fmt pass
---
 .../tcp_ack_graceful_tls_shutdown.fix.md      |   5 +
 src/internal_events/tcp.rs                    | 107 +++++++++++++++
 src/net.rs                                    | 126 ++++++++++++++++++
 src/sources/util/net/tcp/mod.rs               |  23 +++-
 4 files changed, 259 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/tcp_ack_graceful_tls_shutdown.fix.md

diff --git a/changelog.d/tcp_ack_graceful_tls_shutdown.fix.md b/changelog.d/tcp_ack_graceful_tls_shutdown.fix.md
new file mode 100644
index 0000000000000..79ccda1ecf422
--- /dev/null
+++ b/changelog.d/tcp_ack_graceful_tls_shutdown.fix.md
@@ -0,0 +1,5 @@
+TCP-based sources that emit acknowledgements (`fluent`, `logstash`) no longer log a spurious `Error writing acknowledgement, dropping connection.` at ERROR level when the ack write fails because the peer cleanly closed its TLS session (for example, during a rolling pod restart). These graceful shutdowns now log at WARN and no longer increment `component_errors_total{error_code="ack_failed", ...}`, preventing operator dashboards/alerts from firing on routine peer disconnects. Genuine ack write failures are still logged at ERROR and continue to increment `component_errors_total`.
+
+The `connection_shutdown_total{mode="tcp"}` counter is now incremented exactly once per accepted source connection when its per-connection task exits, pairing with `ConnectionOpen` — regardless of cause (TLS handshake failure, shutdown signal during handshake, graceful peer EOF, decoder failure, downstream closed, ack write failure, tripwire, max connection duration). Previously it was not emitted by TCP sources at all.
+
+authors: taylorchandleryoung
diff --git a/src/internal_events/tcp.rs b/src/internal_events/tcp.rs
index 1ec0cfb6322e5..698c0dfab525e 100644
--- a/src/internal_events/tcp.rs
+++ b/src/internal_events/tcp.rs
@@ -46,6 +46,22 @@ impl InternalEvent for TcpSocketConnectionShutdown {
     }
 }
 
+/// Emitted once per accepted TCP source connection, after the per-connection
+/// task exits — regardless of cause. This includes pre-loop exits (TLS
+/// handshake failure, shutdown signal arriving during handshake) as well as
+/// every read/ack loop exit (graceful peer EOF, decoder failure, downstream
+/// closed, ack write failure, shutdown signal, tripwire, max connection
+/// duration). Pairs exactly with `ConnectionOpen`.
+#[derive(Debug, NamedInternalEvent)]
+pub struct TcpSourceConnectionClosed;
+
+impl InternalEvent for TcpSourceConnectionClosed {
+    fn emit(self) {
+        debug!(message = "Connection closed.");
+        counter!(CounterName::ConnectionShutdownTotal, "mode" => "tcp").increment(1);
+    }
+}
+
 #[cfg(all(unix, feature = "sources-dnstap"))]
 #[derive(Debug, NamedInternalEvent)]
 pub struct TcpSocketError<'a, E> {
@@ -158,3 +174,94 @@ impl InternalEvent for TcpBytesReceived {
         .increment(self.byte_size as u64);
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::io;
+
+    use serial_test::serial;
+    use vector_lib::event::MetricValue;
+    use vector_lib::internal_event::InternalEvent;
+    use vector_lib::metrics::Controller;
+
+    use super::{TcpSendAckError, TcpSourceConnectionClosed};
+
+    /// Returns the current value of a counter matching `name` and all `tags`.
+    /// Counters that have not yet been touched aren't in the snapshot and
+    /// register as 0.0 here.
+    fn counter_value(name: &str, tags: &[(&str, &str)]) -> f64 {
+        Controller::get()
+            .expect("metrics controller initialized")
+            .capture_metrics()
+            .into_iter()
+            .find(|m| {
+                m.name() == name
+                    && tags
+                        .iter()
+                        .all(|(k, v)| m.tags().is_some_and(|t| t.get(k) == Some(*v)))
+            })
+            .map(|m| match m.value() {
+                MetricValue::Counter { value } => *value,
+                other => panic!("expected counter for {name}, got {other:?}"),
+            })
+            .unwrap_or(0.0)
+    }
+
+    /// `TcpSourceConnectionClosed` MUST bump `connection_shutdown_total{mode="tcp"}`
+    /// once per emit. Pins the contract that this event is the sole owner of the
+    /// connection-close counter on the source side.
+    #[test]
+    #[serial]
+    fn tcp_source_connection_closed_increments_shutdown_total() {
+        crate::test_util::trace_init();
+        let before = counter_value("connection_shutdown_total", &[("mode", "tcp")]);
+
+        TcpSourceConnectionClosed.emit();
+
+        let after = counter_value("connection_shutdown_total", &[("mode", "tcp")]);
+        assert_eq!(after - before, 1.0);
+    }
+
+    /// `TcpSendAckError` is an `*Error` event and per the instrumentation spec MUST
+    /// only emit on real errors — bumping `component_errors_total` with the
+    /// `ack_failed` error_code.
+    #[test]
+    #[serial]
+    fn tcp_send_ack_error_emit_always_increments_component_errors_total() {
+        crate::test_util::trace_init();
+        let errors_before = counter_value(
+            "component_errors_total",
+            &[
+                ("error_code", "ack_failed"),
+                ("error_type", "writer_failed"),
+                ("stage", "sending"),
+                ("mode", "tcp"),
+            ],
+        );
+        let shutdown_before = counter_value("connection_shutdown_total", &[("mode", "tcp")]);
+
+        TcpSendAckError {
+            error: io::Error::from(io::ErrorKind::ConnectionReset),
+        }
+        .emit();
+
+        assert_eq!(
+            counter_value(
+                "component_errors_total",
+                &[
+                    ("error_code", "ack_failed"),
+                    ("error_type", "writer_failed"),
+                    ("stage", "sending"),
+                    ("mode", "tcp"),
+                ],
+            ) - errors_before,
+            1.0,
+        );
+        assert_eq!(
+            counter_value("connection_shutdown_total", &[("mode", "tcp")]),
+            shutdown_before,
+            "TcpSendAckError must not bump the connection-close counter — \
+             that is TcpSourceConnectionClosed's responsibility.",
+        );
+    }
+}
diff --git a/src/net.rs b/src/net.rs
index f62abfa32974a..ed6e46d8bfb95 100644
--- a/src/net.rs
+++ b/src/net.rs
@@ -50,3 +50,129 @@ where
 pub fn set_keepalive(socket: &TcpStream, ttl: Duration) -> io::Result<()> {
     SockRef::from(socket).set_tcp_keepalive(&TcpKeepalive::new().with_time(ttl))
 }
+
+// SSL_R_PROTOCOL_IS_SHUTDOWN from openssl/include/openssl/sslerr.h. Stable across
+// OpenSSL 1.1.1 and 3.x. Not re-exported by the `openssl-sys` crate so we pin it here.
+const SSL_R_PROTOCOL_IS_SHUTDOWN: std::ffi::c_int = 207;
+
+/// Returns true when an `io::Error` represents a peer-initiated, graceful TLS
+/// shutdown (close_notify), rather than a real I/O failure.
+///
+/// Two cases are recognized:
+/// - `SSL_ERROR_ZERO_RETURN`: the peer sent `close_notify` and we observed it
+///   during this I/O call.
+/// - `SSL_R_PROTOCOL_IS_SHUTDOWN`: a subsequent write after the session was
+///   already shut down ("ssl session has been shut down").
+pub fn is_graceful_tls_shutdown(err: &io::Error) -> bool {
+    let Some(ssl) = err
+        .get_ref()
+        .and_then(|inner| inner.downcast_ref::<openssl::ssl::Error>())
+    else {
+        return false;
+    };
+    if ssl.code() == openssl::ssl::ErrorCode::ZERO_RETURN {
+        return true;
+    }
+    ssl.ssl_error().is_some_and(|stack| {
+        stack
+            .errors()
+            .iter()
+            .any(|e| e.reason_code() == SSL_R_PROTOCOL_IS_SHUTDOWN)
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use std::pin::Pin;
+
+    use openssl::ssl::{SslAcceptor, SslConnector, SslFiletype, SslMethod, SslVerifyMode};
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    use tokio::net::TcpListener;
+    use tokio_openssl::SslStream;
+
+    use crate::tls::{TEST_PEM_CA_PATH, TEST_PEM_CRT_PATH, TEST_PEM_KEY_PATH};
+
+    use super::{TcpStream, io, is_graceful_tls_shutdown};
+
+    #[test]
+    fn plain_io_errors_are_not_graceful() {
+        for err in [
+            io::Error::from(io::ErrorKind::BrokenPipe),
+            io::Error::from(io::ErrorKind::ConnectionReset),
+            io::Error::from(io::ErrorKind::UnexpectedEof),
+            io::Error::other("not an ssl error"),
+        ] {
+            assert!(
+                !is_graceful_tls_shutdown(&err),
+                "expected non-graceful, got graceful for {err:?}",
+            );
+        }
+    }
+
+    // Drives a real TLS handshake between two local sockets and completes a
+    // bidirectional SSL shutdown. A subsequent write surfaces a `std::io::Error`
+    // wrapping an `openssl::ssl::Error` from the same code path production hits,
+    // validating that the helper correctly identifies it as a graceful shutdown
+    // — without having to synthesize an `openssl::ssl::Error` (whose fields are
+    // crate-private). Bidirectional shutdown is what reliably elicits
+    // SSL_R_PROTOCOL_IS_SHUTDOWN; a half-closed session would still permit
+    // writes per RFC 5246.
+    #[tokio::test]
+    async fn detects_graceful_shutdown_from_real_ssl_stream() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+
+        let server = tokio::spawn(async move {
+            let (stream, _) = listener.accept().await.unwrap();
+            let mut acceptor = SslAcceptor::mozilla_intermediate(SslMethod::tls()).unwrap();
+            acceptor
+                .set_private_key_file(TEST_PEM_KEY_PATH, SslFiletype::PEM)
+                .unwrap();
+            acceptor
+                .set_certificate_chain_file(TEST_PEM_CRT_PATH)
+                .unwrap();
+            let acceptor = acceptor.build();
+            let ssl = openssl::ssl::Ssl::new(acceptor.context()).unwrap();
+            let mut tls = SslStream::new(ssl, stream).unwrap();
+            Pin::new(&mut tls).accept().await.unwrap();
+            // Cleanly close the SSL session — sends close_notify and waits for the peer's.
+            Pin::new(&mut tls).shutdown().await.unwrap();
+        });
+
+        let mut connector = SslConnector::builder(SslMethod::tls()).unwrap();
+        connector.set_ca_file(TEST_PEM_CA_PATH).unwrap();
+        connector.set_verify(SslVerifyMode::NONE);
+        let ssl = connector
+            .build()
+            .configure()
+            .unwrap()
+            .into_ssl("localhost")
+            .unwrap();
+        let stream = TcpStream::connect(addr).await.unwrap();
+        let mut tls = SslStream::new(ssl, stream).unwrap();
+        Pin::new(&mut tls).connect().await.unwrap();
+
+        // Drain the server's close_notify so our SSL state observes the peer shutdown.
+        let mut buf = [0u8; 1];
+        let n = tls.read(&mut buf).await.unwrap();
+        assert_eq!(n, 0, "expected EOF from peer's close_notify");
+
+        // Complete the bidirectional SSL shutdown locally. Once both sides are
+        // shut down, OpenSSL marks the session as SHUTDOWN and any further write
+        // returns SSL_R_PROTOCOL_IS_SHUTDOWN ("ssl session has been shut down").
+        Pin::new(&mut tls).shutdown().await.unwrap();
+
+        let err = tls
+            .write_all(b"too late")
+            .await
+            .expect_err("write after bidirectional shutdown should fail");
+
+        assert!(
+            is_graceful_tls_shutdown(&err),
+            "expected graceful shutdown detection, got: {err:?} (inner: {:?})",
+            err.get_ref(),
+        );
+
+        server.await.unwrap();
+    }
+}
diff --git a/src/sources/util/net/tcp/mod.rs b/src/sources/util/net/tcp/mod.rs
index 079f22d84b34c..c1bf2d8600879 100644
--- a/src/sources/util/net/tcp/mod.rs
+++ b/src/sources/util/net/tcp/mod.rs
@@ -37,8 +37,9 @@ use crate::{
     internal_events::{
         ConnectionOpen, OpenGauge, SocketBindError, SocketEventsReceived, SocketMode,
         SocketReceiveError, StreamClosedError, TcpBytesReceived, TcpSendAckError,
-        TcpSocketTlsConnectionError,
+        TcpSocketTlsConnectionError, TcpSourceConnectionClosed,
     },
+    net::is_graceful_tls_shutdown,
     sources::util::{AfterReadExt, LenientFramedRead},
 };
 
@@ -220,6 +221,12 @@ where
                             tokio::spawn(
                                 fut.map(move |()| {
                                     drop(open_token);
+                                    // Paired with the ConnectionOpen emit above:
+                                    // fires exactly once per accepted connection,
+                                    // including paths that return early from
+                                    // handle_stream (TLS handshake failure,
+                                    // shutdown during handshake).
+                                    emit!(TcpSourceConnectionClosed);
                                     drop(tcp_connection_permit);
                                 })
                                 .instrument(span.or_current()),
@@ -401,7 +408,19 @@ async fn handle_stream<T>(
                                 if let Some(ack_bytes) = acker.build_ack(ack){
                                     let stream = reader.get_mut().get_mut();
                                     if let Err(error) = stream.write_all(&ack_bytes).await {
-                                        emit!(TcpSendAckError{ error });
+                                        // Per spec, `*Error` events MUST only be
+                                        // emitted on real errors. A peer-initiated
+                                        // graceful TLS shutdown during the ack
+                                        // write is a lifecycle event, not an error
+                                        // — log at warn and skip the emit.
+                                        if is_graceful_tls_shutdown(&error) {
+                                            warn!(
+                                                message = "Connection closed by peer before acknowledgement could be sent.",
+                                                error = %error,
+                                            );
+                                        } else {
+                                            emit!(TcpSendAckError { error });
+                                        }
                                         break;
                                     }
                                 }

From ddf5c74514fa690cdf8c14e71050acf2db915f19 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 29 May 2026 11:08:50 -0400
Subject: [PATCH 284/326] chore(deps): bump futures to 0.3.32 (#25522)

* chore(deps): bump futures to 0.3.32, fix try_recv breaking change

Co-Authored-By: Claude <claude-sonnet-4-6>

* fmt
---
 Cargo.lock                        | 37 +++++++++++++++----------------
 Cargo.toml                        |  2 +-
 src/sinks/datadog/events/tests.rs |  8 ++-----
 src/sinks/datadog/logs/tests.rs   | 13 +++++------
 src/sinks/mezmo.rs                |  2 +-
 5 files changed, 27 insertions(+), 35 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3a187bad76ba6..a98455d5e64a0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4464,9 +4464,9 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "futures"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -4479,9 +4479,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -4489,15 +4489,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -4517,9 +4517,9 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
 
 [[package]]
 name = "futures-lite"
@@ -4536,9 +4536,9 @@ dependencies = [
 
 [[package]]
 name = "futures-macro"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.45",
@@ -4547,15 +4547,15 @@ dependencies = [
 
 [[package]]
 name = "futures-sink"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
 
 [[package]]
 name = "futures-task"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
 [[package]]
 name = "futures-timer"
@@ -4565,9 +4565,9 @@ checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
 
 [[package]]
 name = "futures-util"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -4577,7 +4577,6 @@ dependencies = [
  "futures-task",
  "memchr",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index c389001ed9276..0ca1aca2ff4ac 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -157,7 +157,7 @@ dashmap = { version = "6.1.0", default-features = false }
 derivative = { version = "2.2.0", default-features = false }
 exitcode = { version = "1.1.2", default-features = false }
 flate2 = { version = "1.1.2", default-features = false, features = ["zlib-rs"] }
-futures = { version = "0.3.31", default-features = false, features = ["std"] }
+futures = { version = "0.3.32", default-features = false, features = ["std"] }
 futures-util = { version = "0.3.29", default-features = false }
 glob = { version = "0.3.3", default-features = false }
 hickory-proto = { version = "0.26.1", default-features = false, features = ["dnssec-ring"] }
diff --git a/src/sinks/datadog/events/tests.rs b/src/sinks/datadog/events/tests.rs
index a363307f6c4e7..c800d09b562f9 100644
--- a/src/sinks/datadog/events/tests.rs
+++ b/src/sinks/datadog/events/tests.rs
@@ -1,11 +1,7 @@
 use std::sync::Arc;
 
 use bytes::Bytes;
-use futures::{
-    StreamExt,
-    channel::mpsc::{Receiver, TryRecvError},
-    stream::Stream,
-};
+use futures::{StreamExt, channel::mpsc::Receiver, stream::Stream};
 use hyper::StatusCode;
 use indoc::indoc;
 use similar_asserts::assert_eq;
@@ -105,7 +101,7 @@ async fn smoke() {
 async fn handles_failure() {
     let (_expected, mut rx) = start_test(StatusCode::FORBIDDEN, BatchStatus::Rejected).await;
 
-    assert!(matches!(rx.try_next(), Err(TryRecvError { .. })));
+    assert!(rx.try_recv().is_err());
 }
 
 #[tokio::test]
diff --git a/src/sinks/datadog/logs/tests.rs b/src/sinks/datadog/logs/tests.rs
index 3867ababb48c5..d394a71e0b3b6 100644
--- a/src/sinks/datadog/logs/tests.rs
+++ b/src/sinks/datadog/logs/tests.rs
@@ -4,10 +4,7 @@ use std::sync::Arc;
 
 use bytes::Bytes;
 use chrono::Utc;
-use futures::{
-    StreamExt,
-    channel::mpsc::{Receiver, TryRecvError},
-};
+use futures::{StreamExt, channel::mpsc::Receiver};
 use http::request::Parts;
 use indoc::indoc;
 use vector_lib::{
@@ -195,9 +192,9 @@ async fn telemetry() {
 async fn handles_failure_v1() {
     let (_expected, mut rx) =
         start_test_error(ApiStatus::BadRequestv1, BatchStatus::Rejected).await;
-    let res = rx.try_next();
+    let res = rx.try_recv();
 
-    assert!(matches!(res, Err(TryRecvError { .. })));
+    assert!(res.is_err());
 }
 
 #[tokio::test]
@@ -209,9 +206,9 @@ async fn handles_failure_v1() {
 async fn handles_failure_v2() {
     let (_expected, mut rx) =
         start_test_error(ApiStatus::BadRequestv2, BatchStatus::Rejected).await;
-    let res = rx.try_next();
+    let res = rx.try_recv();
 
-    assert!(matches!(res, Err(TryRecvError { .. })));
+    assert!(res.is_err());
 }
 
 #[tokio::test]
diff --git a/src/sinks/mezmo.rs b/src/sinks/mezmo.rs
index d24142993623b..e83c2ab949b7f 100644
--- a/src/sinks/mezmo.rs
+++ b/src/sinks/mezmo.rs
@@ -524,7 +524,7 @@ mod tests {
     async fn smoke_fails() {
         let (_hosts, _partitions, mut rx) =
             smoke_start(StatusCode::FORBIDDEN, BatchStatus::Rejected).await;
-        assert!(matches!(rx.try_next(), Err(mpsc::TryRecvError { .. })));
+        assert!(rx.try_recv().is_err());
     }
 
     #[tokio::test]

From 12101a7bed47c57b78352c5ec0418f025be27712 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Fri, 29 May 2026 11:16:47 -0400
Subject: [PATCH 285/326] chore(dev): use lazy variable for CONTAINER_TOOL
 detection (#25523)

* chore(dev): use lazy variable for CONTAINER_TOOL detection

* Remove export from CONTAINER_TOOL
---
 Makefile | 18 +-----------------
 1 file changed, 1 insertion(+), 17 deletions(-)

diff --git a/Makefile b/Makefile
index 67aac49ffb60a..bbe578ea375df 100644
--- a/Makefile
+++ b/Makefile
@@ -46,16 +46,7 @@ export AUTOINSTALL ?= false
 # Override to true for a bit more log output in your environment building (more coming!)
 export VERBOSE ?= false
 # Override the container tool. Tries docker first and then tries podman.
-export CONTAINER_TOOL ?= auto
-ifeq ($(CONTAINER_TOOL),auto)
-	ifeq ($(shell docker version >/dev/null 2>&1 && echo docker), docker)
-		override CONTAINER_TOOL = docker
-	else ifeq ($(shell podman version >/dev/null 2>&1 && echo podman), podman)
-		override CONTAINER_TOOL = podman
-	else
-		override CONTAINER_TOOL = unknown
-	endif
-endif
+CONTAINER_TOOL ?= $(shell docker version >/dev/null 2>&1 && echo docker || (podman version >/dev/null 2>&1 && echo podman) || echo unknown)
 # If we're using podman create pods else if we're using docker create networks.
 export CURRENT_DIR = $(shell pwd)
 
@@ -94,13 +85,6 @@ help:
 	@printf -- "\n"
 	@awk 'BEGIN {FS = ":.*##"; printf "Usage: make ${FORMATTING_BEGIN_BLUE}<target>${FORMATTING_END}\n"} /^[a-zA-Z0-9_-]+:.*?##/ { printf "  ${FORMATTING_BEGIN_BLUE}%-46s${FORMATTING_END} %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
 
-##@ Environment
-
-.PHONY: check-container-tool
-check-container-tool: ## Checks what container tool is installed
-	@echo -n "Checking if $(CONTAINER_TOOL) is available..." && \
-	$(CONTAINER_TOOL) version 1>/dev/null && echo "yes"
-
 ##@ Building
 .PHONY: build
 build: check-build-tools

From 708569f7db8ca444084e12a439fd15933e2b9011 Mon Sep 17 00:00:00 2001
From: Jakub Onderka <ahoj@jakubonderka.cz>
Date: Fri, 29 May 2026 18:34:04 +0200
Subject: [PATCH 286/326] chore(deps): Bump tikv-jemallocator from 0.7.0
 (#25520)

---
 Cargo.lock                      | 12 ++++++------
 Cargo.toml                      |  2 +-
 lib/vector-vrl/tests/Cargo.toml |  2 +-
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a98455d5e64a0..58bdcf5228501 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7590,7 +7590,7 @@ version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "chrono",
  "getrandom 0.2.15",
  "http 1.3.1",
@@ -8644,7 +8644,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "343d3bd7056eda839b03204e68deff7d1b13aba7af2b2fd16890697274262ee7"
 dependencies = [
  "heck 0.5.0",
- "itertools 0.10.5",
+ "itertools 0.14.0",
  "log",
  "multimap",
  "petgraph 0.8.3",
@@ -11624,9 +11624,9 @@ dependencies = [
 
 [[package]]
 name = "tikv-jemalloc-sys"
-version = "0.6.1+5.3.0-1-ge13ca993e8ccb9ba9847cc330696e02839f328f7"
+version = "0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd8aa5b2ab86a2cefa406d889139c162cbb230092f7d1d7cbc1716405d852a3b"
+checksum = "1a2825c78386b4ae0314074867860ba9577875de945f05992c38815cbec327f0"
 dependencies = [
  "cc",
  "libc",
@@ -11634,9 +11634,9 @@ dependencies = [
 
 [[package]]
 name = "tikv-jemallocator"
-version = "0.6.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0359b4327f954e0567e69fb191cf1436617748813819c94b8cd4a431422d053a"
+checksum = "249f09e49ab1609436f34c776e84231bead18d6a955f119f939bdc1d847561bd"
 dependencies = [
  "libc",
  "tikv-jemalloc-sys",
diff --git a/Cargo.toml b/Cargo.toml
index 0ca1aca2ff4ac..bb892ed263d31 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -475,7 +475,7 @@ rdkafka = { workspace = true, features = ["cmake_build"], optional = true }
 
 [target.'cfg(unix)'.dependencies]
 nix = { version = "0.31", default-features = false, features = ["socket", "signal", "fs"] }
-tikv-jemallocator = { version = "0.6.0", default-features = false, features = ["unprefixed_malloc_on_supported_platforms"], optional = true }
+tikv-jemallocator = { version = "0.7.0", default-features = false, features = ["unprefixed_malloc_on_supported_platforms"], optional = true }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 procfs = { version = "0.18.0", default-features = false }
diff --git a/lib/vector-vrl/tests/Cargo.toml b/lib/vector-vrl/tests/Cargo.toml
index ca477616e3b43..791c51f24c77e 100644
--- a/lib/vector-vrl/tests/Cargo.toml
+++ b/lib/vector-vrl/tests/Cargo.toml
@@ -20,7 +20,7 @@ serde_json.workspace = true
 tracing-subscriber = { workspace = true, features = ["fmt"] }
 
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
-tikv-jemallocator = { version = "0.6.1" }
+tikv-jemallocator = { version = "0.7.0" }
 
 [features]
 default = []

From cf51ef7cf024f5fc5d1dd85593abd35e8812f636 Mon Sep 17 00:00:00 2001
From: Jed Laundry <jlaundry@jlaundry.com>
Date: Sat, 30 May 2026 05:25:01 +1200
Subject: [PATCH 287/326] chore(deps): Update Azure crates (May 2026 release)
 (#25492)

* update Azure crates to 1.0

* sdk changes

* futures related changes

* Change TryRecvError::Closed to ::Empty

---------

Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock                                | 35 +++++++++++------------
 Cargo.toml                                |  8 +++---
 src/sinks/azure_blob/integration_tests.rs |  2 +-
 src/sinks/azure_common/config.rs          |  4 +--
 src/sinks/azure_common/service.rs         |  2 +-
 5 files changed, 24 insertions(+), 27 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 58bdcf5228501..47c93ae2b79e7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1884,9 +1884,9 @@ dependencies = [
 
 [[package]]
 name = "azure_core"
-version = "0.33.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd0160068f7a3021b5e749dc552374e82360463e9fb51e1127631a69fdde641f"
+checksum = "fe6a26a7d374b440015cbbcbf2d9d8be5a133aa940599f5e5dc569504baa262e"
 dependencies = [
  "async-lock 3.4.0",
  "async-trait",
@@ -1905,9 +1905,9 @@ dependencies = [
 
 [[package]]
 name = "azure_core_macros"
-version = "0.7.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bd69a8e70ec6be32ebf7e947cf9a58f6c7255e4cd9c48e640532ef3e37adc6d"
+checksum = "b9b52dba6a345f3ad2d42ff8d0d63df9d0994cfa29657bf18ffdbf149f78a4f5"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.45",
@@ -1917,9 +1917,9 @@ dependencies = [
 
 [[package]]
 name = "azure_identity"
-version = "0.33.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c89484f1ce8b81471c897150ec748b02beef8870bd0d43693bc5ef42365b8f"
+checksum = "32edf96b356ca7c51d7590c4925cc36efc3947a5da4468e8e0b25c56ecbb3de5"
 dependencies = [
  "async-lock 3.4.0",
  "async-trait",
@@ -1936,10 +1936,11 @@ dependencies = [
 
 [[package]]
 name = "azure_storage_blob"
-version = "0.10.1"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72693fc24f79adee4b3df7469b29724aa7ea25b908ea0e23f62b93f01f098283"
+checksum = "1756febbcca86c862ef718b983b505d08bd65a9bc984a915b0a16af4a4c3fe5b"
 dependencies = [
+ "async-stream",
  "async-trait",
  "azure_core",
  "bytes",
@@ -12247,20 +12248,15 @@ version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
 dependencies = [
- "async-compression",
  "base64 0.22.1",
  "bitflags 2.10.0",
  "bytes",
- "futures-core",
  "futures-util",
  "http 1.3.1",
  "http-body 1.0.1",
- "http-body-util",
  "iri-string",
  "mime",
  "pin-project-lite",
- "tokio",
- "tokio-util",
  "tower 0.5.3",
  "tower-layer",
  "tower-service",
@@ -12538,9 +12534,9 @@ checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
 name = "typespec"
-version = "0.13.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b63559a2aab9c7694fa8d2658a828d6b36f1e3904b1860d820c7cc6a2ead61c7"
+checksum = "21666a31293beab8f41d38c2849ddbc342cd9c7cb4d71a9818868287a8934e53"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -12553,12 +12549,13 @@ dependencies = [
 
 [[package]]
 name = "typespec_client_core"
-version = "0.12.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de81ecf3a175da5a10ed60344caa8b53fe6d8ce28c6c978a7e3e09ca1e1b4131"
+checksum = "924f0c734e0ac3b881ab99d032bd28fcc969d2bb73ef1b8dd4772fd8e518a382"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
+ "bytes",
  "dyn-clone",
  "futures",
  "pin-project",
@@ -12576,9 +12573,9 @@ dependencies = [
 
 [[package]]
 name = "typespec_macros"
-version = "0.12.0"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07108c5d18e00ec7bb09d2e48df95ebfab6b7179112d1e4216e9968ac2a0a429"
+checksum = "2c608f4427943f8adb211abc95c87672b1b98847152783507d54e3246e502f60"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.45",
diff --git a/Cargo.toml b/Cargo.toml
index bb892ed263d31..5af6296d39720 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -226,7 +226,7 @@ strum = { version = "0.28", features = ["derive"] }
 [dependencies]
 cfg-if.workspace = true
 reqwest.workspace = true
-reqwest_13 = { package = "reqwest", version = "0.13", default-features = false, features = ["json", "rustls-no-provider"] }
+reqwest_13 = { package = "reqwest", version = "0.13", default-features = false, features = ["json", "native-tls", "rustls-no-provider"] }
 clap.workspace = true
 clap_complete.workspace = true
 indoc.workspace = true
@@ -306,11 +306,11 @@ aws-smithy-runtime-api = { version = "1.7.3", default-features = false, optional
 aws-smithy-types = { version = "1.2.11", default-features = false, features = ["rt-tokio"], optional = true }
 
 # Azure
-azure_core = { version = "0.33", features = ["reqwest", "hmac_openssl"], optional = true }
-azure_identity = { version = "0.33", features = ["client_certificate"], optional = true }
+azure_core = { version = "1.0", default-features = false, features = ["reqwest", "hmac_openssl"], optional = true }
+azure_identity = { version = "1.0", default-features = false, features = ["client_certificate"], optional = true }
 
 # Azure Storage
-azure_storage_blob = { version = "0.10.1", optional = true }
+azure_storage_blob = { version = "1.0", default-features = false, optional = true }
 
 # OpenDAL
 opendal = { version = "0.54", default-features = false, features = ["services-webhdfs"], optional = true }
diff --git a/src/sinks/azure_blob/integration_tests.rs b/src/sinks/azure_blob/integration_tests.rs
index f7cd38970a847..9703db841a062 100644
--- a/src/sinks/azure_blob/integration_tests.rs
+++ b/src/sinks/azure_blob/integration_tests.rs
@@ -379,7 +379,7 @@ impl AzureBlobSinkConfig {
             .await
             .expect("Failed to download blob");
         let body_bytes = downloaded
-            .into_body()
+            .body
             .collect()
             .await
             .expect("Failed to read blob body");
diff --git a/src/sinks/azure_common/config.rs b/src/sinks/azure_common/config.rs
index 357c66f1ce5e8..245517d89170b 100644
--- a/src/sinks/azure_common/config.rs
+++ b/src/sinks/azure_common/config.rs
@@ -637,8 +637,8 @@ pub async fn build_client(
             .build()
             .map_err(|e| format!("Failed to build reqwest client: {e}"))?,
     )));
-    let client = BlobContainerClient::from_url(url, credential, Some(options))
-        .map_err(|e| format!("{e}"))?;
+    let client =
+        BlobContainerClient::new(url, credential, Some(options)).map_err(|e| format!("{e}"))?;
     Ok(Arc::new(client))
 }
 
diff --git a/src/sinks/azure_common/service.rs b/src/sinks/azure_common/service.rs
index 68f75d9afe8f0..31668ab85ba70 100644
--- a/src/sinks/azure_common/service.rs
+++ b/src/sinks/azure_common/service.rs
@@ -48,7 +48,7 @@ impl Service<AzureBlobRequest> for AzureBlobService {
                 blob_content_encoding: request.content_encoding.map(|e| e.to_string()),
                 ..Default::default()
             }
-            .with_if_not_exists();
+            .if_not_exists();
 
             let result = blob_client
                 .upload(

From a9b45c2c7ab6f469b042900d552279d0ae2d42e6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 29 May 2026 18:16:57 +0000
Subject: [PATCH 288/326] chore(deps): bump openssl-src from 300.5.5+3.5.5 to
 300.6.0+3.6.2 (#25299)

Bumps [openssl-src](https://github.com/alexcrichton/openssl-src-rs) from 300.5.5+3.5.5 to 300.6.0+3.6.2.
- [Release notes](https://github.com/alexcrichton/openssl-src-rs/releases)
- [Commits](https://github.com/alexcrichton/openssl-src-rs/commits)

---
updated-dependencies:
- dependency-name: openssl-src
  dependency-version: 300.6.0+3.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <thomas.schneider@datadoghq.com>
---
 Cargo.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 47c93ae2b79e7..318b68b102e57 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7787,9 +7787,9 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
 
 [[package]]
 name = "openssl-src"
-version = "300.5.5+3.5.5"
+version = "300.6.0+3.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f1787d533e03597a7934fd0a765f0d28e94ecc5fb7789f8053b1e699a56f709"
+checksum = "a8e8cbfd3a4a8c8f089147fd7aaa33cf8c7450c4d09f8f80698a0cf093abeff4"
 dependencies = [
  "cc",
 ]

From 9e15fc1c3a38af6f8728ebdd4ea8c0d427a14ff5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 29 May 2026 18:23:14 +0000
Subject: [PATCH 289/326] chore(deps): bump openssl from 0.10.79 to 0.10.80 in
 the cargo-security group across 1 directory (#25475)

chore(deps): bump openssl in the cargo-security group across 1 directory

Bumps the cargo-security group with 1 update in the / directory: [openssl](https://github.com/rust-openssl/rust-openssl).


Updates `openssl` from 0.10.79 to 0.10.80
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](https://github.com/rust-openssl/rust-openssl/compare/openssl-v0.10.79...openssl-v0.10.80)

---
updated-dependencies:
- dependency-name: openssl
  dependency-version: 0.10.80
  dependency-type: direct:production
  dependency-group: cargo-security
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock                 | 8 ++++----
 lib/vector-core/Cargo.toml | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 318b68b102e57..d7705d2cbe09e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7756,9 +7756,9 @@ dependencies = [
 
 [[package]]
 name = "openssl"
-version = "0.10.79"
+version = "0.10.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf0b434746ee2832f4f0baf10137e1cabb18cbe6912c69e2e33263c45250f542"
+checksum = "a45fa2aa886c42762255da344f0a0d313e254066c46aad76f300c3d3da62d967"
 dependencies = [
  "bitflags 2.10.0",
  "cfg-if",
@@ -7796,9 +7796,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.115"
+version = "0.9.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "158fe5b292746440aa6e7a7e690e55aeb72d41505e2804c23c6973ad0e9c9781"
+checksum = "f28a22dc7140cda5f096e5e7724a6962ca81a7f8bfd2979f9b18c11af56318c4"
 dependencies = [
  "cc",
  "libc",
diff --git a/lib/vector-core/Cargo.toml b/lib/vector-core/Cargo.toml
index caf2735d45166..1ec303bbb272b 100644
--- a/lib/vector-core/Cargo.toml
+++ b/lib/vector-core/Cargo.toml
@@ -34,7 +34,7 @@ metrics-util.workspace = true
 mlua = { version = "0.10.5", default-features = false, features = ["lua54", "send", "vendored"], optional = true }
 no-proxy = { version = "0.3.6", default-features = false, features = ["serialize"] }
 ordered-float.workspace = true
-openssl = { version = "0.10.79", default-features = false, features = ["vendored"] }
+openssl = { version = "0.10.80", default-features = false, features = ["vendored"] }
 parking_lot = { version = "0.12.5", default-features = false }
 pin-project.workspace = true
 proptest = { workspace = true, optional = true }

From f7e394f4f33ad10caad81e12ff8534c26fb6e385 Mon Sep 17 00:00:00 2001
From: ArunPiduguDD <arun.pidugu@datadoghq.com>
Date: Fri, 29 May 2026 14:58:12 -0400
Subject: [PATCH 290/326] fix(aggregate transform): Fix incorrectly dropped
 events bug in metrics aggregate transform (#25486)

* fix(aggregate): Fix incorrectly dropped events bug in metrics aggregate processor

* Refactor to remove ignore metric pre-check

Originally wanted to avoid deconstructing and reconstructing the Metric
Event for ignored metrics, but the other solution was not ideal

* fix(aggregate transform): Fix rustfmt formatting for long match arm

Environment: Datadog workspace

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* address suggested changes - tweak record function + update changelog

* undo changes to docstrings

* Revert "undo changes to docstrings"

This reverts commit 42e3f3f205cb65e0b0840e3ccaa4809e068ac79b.

* generate docs

* Use aggregate return value in tests

* update changelog

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../aggregate_passthrough_ignored_kind.fix.md |  14 +
 src/transforms/aggregate.rs                   | 317 ++++++++++--------
 .../transforms/generated/aggregate.cue        |  14 +-
 3 files changed, 204 insertions(+), 141 deletions(-)
 create mode 100644 changelog.d/aggregate_passthrough_ignored_kind.fix.md

diff --git a/changelog.d/aggregate_passthrough_ignored_kind.fix.md b/changelog.d/aggregate_passthrough_ignored_kind.fix.md
new file mode 100644
index 0000000000000..9f47154224beb
--- /dev/null
+++ b/changelog.d/aggregate_passthrough_ignored_kind.fix.md
@@ -0,0 +1,14 @@
+The `aggregate` transform now correctly passes through/ignores metrics whose kind is not supported
+by the configured mode. Prior to this change these metrics would be silently dropped, contrary to
+the officially documented behavior. For example, `absolute` metrics flowing through a `sum`-mode aggregate
+transform are now forwarded to the next step in the pipeline unchanged rather than being dropped:
+
+```text
+{kind: incremental, type: counter, name: "http.requests", value: 10}  → summed into aggregate
+{kind: absolute,    type: gauge,   name: "cpu.usage",     value: 0.83} → previously dropped, now passes through unchanged
+{kind: incremental, type: counter, name: "http.requests", value: 5}   → summed into aggregate
+```
+
+If you want to preserve the previous drop behavior, add a `filter` transform before the aggregate transform to discard the unwanted metric kind.
+
+authors: ArunPiduguDD
diff --git a/src/transforms/aggregate.rs b/src/transforms/aggregate.rs
index 67de0815c6d29..acc0438c5a5f7 100644
--- a/src/transforms/aggregate.rs
+++ b/src/transforms/aggregate.rs
@@ -49,28 +49,28 @@ pub enum AggregationMode {
     #[default]
     Auto,
 
-    /// Sums incremental metrics, ignores absolute
+    /// Sums incremental metrics; absolute metrics pass through unchanged.
     Sum,
 
-    /// Returns the latest value for absolute metrics, ignores incremental
+    /// Returns the latest value for absolute metrics; incremental metrics pass through unchanged.
     Latest,
 
     /// Counts metrics for incremental and absolute metrics
     Count,
 
-    /// Returns difference between latest value for absolute, ignores incremental
+    /// Returns difference between latest value for absolute; incremental metrics pass through unchanged.
     Diff,
 
-    /// Max value of absolute metric, ignores incremental
+    /// Max value of absolute metric; incremental metrics pass through unchanged.
     Max,
 
-    /// Min value of absolute metric, ignores incremental
+    /// Min value of absolute metric; incremental metrics pass through unchanged.
     Min,
 
-    /// Mean value of absolute metric, ignores incremental
+    /// Mean value of absolute metric; incremental metrics pass through unchanged.
     Mean,
 
-    /// Stdev value of absolute metric, ignores incremental
+    /// Stdev value of absolute metric; incremental metrics pass through unchanged.
     Stdev,
 }
 
@@ -80,32 +80,32 @@ enum InnerMode {
     #[default]
     Auto,
 
-    /// Sums incremental metrics, ignores absolute
+    /// Sums incremental metrics; absolute metrics pass through unchanged.
     Sum,
 
-    /// Returns the latest value for absolute metrics, ignores incremental
+    /// Returns the latest value for absolute metrics; incremental metrics pass through unchanged.
     Latest,
 
     /// Counts metrics for incremental and absolute metrics
     Count,
 
-    /// Returns difference between latest value for absolute, ignores incremental
+    /// Returns difference between latest value for absolute; incremental metrics pass through unchanged.
     Diff {
         prev_map: HashMap<MetricSeries, MetricEntry>,
     },
 
-    /// Max value of absolute metric, ignores incremental
+    /// Max value of absolute metric; incremental metrics pass through unchanged.
     Max,
 
-    /// Min value of absolute metric, ignores incremental
+    /// Min value of absolute metric; incremental metrics pass through unchanged.
     Min,
 
-    /// Mean value of absolute metric, ignores incremental
+    /// Mean value of absolute metric; incremental metrics pass through unchanged.
     Mean {
         multi_map: HashMap<MetricSeries, Vec<MetricEntry>>,
     },
 
-    /// Stdev value of absolute metric, ignores incremental
+    /// Stdev value of absolute metric; incremental metrics pass through unchanged.
     Stdev {
         multi_map: HashMap<MetricSeries, Vec<MetricEntry>>,
     },
@@ -181,44 +181,45 @@ impl Aggregate {
         })
     }
 
-    pub fn record(&mut self, event: Event) {
+    pub fn record(&mut self, event: Event) -> Option<Event> {
         let (series, data, metadata) = event.into_metric().into_parts();
 
-        match &mut self.mode {
-            InnerMode::Auto => match data.kind {
-                MetricKind::Incremental => self.record_sum(series, data, metadata),
-                MetricKind::Absolute => {
-                    self.map.insert(series, (data, metadata));
-                }
-            },
-            InnerMode::Sum => self.record_sum(series, data, metadata),
-            InnerMode::Latest | InnerMode::Diff { .. } => match data.kind {
-                MetricKind::Incremental => (),
-                MetricKind::Absolute => {
-                    self.map.insert(series, (data, metadata));
-                }
-            },
-            InnerMode::Count => self.record_count(series, data, metadata),
-            InnerMode::Max | InnerMode::Min => self.record_comparison(series, data, metadata),
-            InnerMode::Mean { multi_map } | InnerMode::Stdev { multi_map } => match data.kind {
-                MetricKind::Incremental => (),
-                MetricKind::Absolute => {
-                    if matches!(data.value, MetricValue::Gauge { value: _ }) {
-                        match multi_map.entry(series) {
-                            Entry::Occupied(mut entry) => {
-                                let existing = entry.get_mut();
-                                existing.push((data, metadata));
-                            }
-                            Entry::Vacant(entry) => {
-                                entry.insert(vec![(data, metadata)]);
-                            }
+        match (&mut self.mode, data.kind) {
+            (InnerMode::Sum, MetricKind::Absolute)
+            | (InnerMode::Latest | InnerMode::Diff { .. }, MetricKind::Incremental)
+            | (InnerMode::Max | InnerMode::Min, MetricKind::Incremental)
+            | (InnerMode::Mean { .. } | InnerMode::Stdev { .. }, MetricKind::Incremental) => {
+                return Some(Event::Metric(Metric::from_parts(series, data, metadata)));
+            }
+            (InnerMode::Auto | InnerMode::Sum, MetricKind::Incremental) => {
+                self.record_sum(series, data, metadata);
+            }
+            (InnerMode::Auto, MetricKind::Absolute)
+            | (InnerMode::Latest | InnerMode::Diff { .. }, MetricKind::Absolute) => {
+                self.map.insert(series, (data, metadata));
+            }
+            (InnerMode::Count, _) => {
+                self.record_count(series, data, metadata);
+            }
+            (InnerMode::Max | InnerMode::Min, MetricKind::Absolute) => {
+                self.record_comparison(series, data, metadata);
+            }
+            (
+                InnerMode::Mean { multi_map } | InnerMode::Stdev { multi_map },
+                MetricKind::Absolute,
+            ) => {
+                if matches!(data.value, MetricValue::Gauge { value: _ }) {
+                    match multi_map.entry(series) {
+                        Entry::Occupied(mut entry) => entry.get_mut().push((data, metadata)),
+                        Entry::Vacant(entry) => {
+                            entry.insert(vec![(data, metadata)]);
                         }
                     }
                 }
-            },
+            }
         }
-
         emit!(AggregateEventRecorded);
+        None
     }
 
     fn record_count(
@@ -241,23 +242,20 @@ impl Aggregate {
     }
 
     fn record_sum(&mut self, series: MetricSeries, data: MetricData, metadata: EventMetadata) {
-        match data.kind {
-            MetricKind::Incremental => match self.map.entry(series) {
-                Entry::Occupied(mut entry) => {
-                    let existing = entry.get_mut();
-                    // In order to update (add) the new and old kind's must match
-                    if existing.0.kind == data.kind && existing.0.update(&data) {
-                        existing.1.merge(metadata);
-                    } else {
-                        emit!(AggregateUpdateFailed);
-                        *existing = (data, metadata);
-                    }
-                }
-                Entry::Vacant(entry) => {
-                    entry.insert((data, metadata));
+        match self.map.entry(series) {
+            Entry::Occupied(mut entry) => {
+                let existing = entry.get_mut();
+                // In order to update (add) the new and old kind's must match
+                if existing.0.kind == data.kind && existing.0.update(&data) {
+                    existing.1.merge(metadata);
+                } else {
+                    emit!(AggregateUpdateFailed);
+                    *existing = (data, metadata);
                 }
-            },
-            MetricKind::Absolute => {}
+            }
+            Entry::Vacant(entry) => {
+                entry.insert((data, metadata));
+            }
         }
     }
 
@@ -267,36 +265,33 @@ impl Aggregate {
         data: MetricData,
         metadata: EventMetadata,
     ) {
-        match data.kind {
-            MetricKind::Incremental => (),
-            MetricKind::Absolute => match self.map.entry(series) {
-                Entry::Occupied(mut entry) => {
-                    let existing = entry.get_mut();
-                    // In order to update (add) the new and old kind's must match
-                    if existing.0.kind == data.kind {
-                        if let MetricValue::Gauge {
-                            value: existing_value,
-                        } = existing.0.value()
-                            && let MetricValue::Gauge { value: new_value } = data.value()
-                        {
-                            let should_update = match self.mode {
-                                InnerMode::Max => new_value > existing_value,
-                                InnerMode::Min => new_value < existing_value,
-                                _ => false,
-                            };
-                            if should_update {
-                                *existing = (data, metadata);
-                            }
+        match self.map.entry(series) {
+            Entry::Occupied(mut entry) => {
+                let existing = entry.get_mut();
+                // In order to update (add) the new and old kind's must match
+                if existing.0.kind == data.kind {
+                    if let MetricValue::Gauge {
+                        value: existing_value,
+                    } = existing.0.value()
+                        && let MetricValue::Gauge { value: new_value } = data.value()
+                    {
+                        let should_update = match self.mode {
+                            InnerMode::Max => new_value > existing_value,
+                            InnerMode::Min => new_value < existing_value,
+                            _ => false,
+                        };
+                        if should_update {
+                            *existing = (data, metadata);
                         }
-                    } else {
-                        emit!(AggregateUpdateFailed);
-                        *existing = (data, metadata);
                     }
+                } else {
+                    emit!(AggregateUpdateFailed);
+                    *existing = (data, metadata);
                 }
-                Entry::Vacant(entry) => {
-                    entry.insert((data, metadata));
-                }
-            },
+            }
+            Entry::Vacant(entry) => {
+                entry.insert((data, metadata));
+            }
         }
     }
 
@@ -405,7 +400,11 @@ impl TaskTransform<Event> for Aggregate {
                                 self.flush_into(&mut output);
                                 done = true;
                             }
-                            Some(event) => self.record(event),
+                            Some(event) => {
+                                if let Some(passthrough) = self.record(event) {
+                                    output.push(passthrough);
+                                }
+                            }
                         }
                     }
                 };
@@ -481,7 +480,7 @@ mod tests {
         );
 
         // Single item, just stored regardless of kind
-        agg.record(counter_a_1.clone());
+        assert_eq!(agg.record(counter_a_1.clone()), None);
         let mut out = vec![];
         // We should flush 1 item counter_a_1
         agg.flush_into(&mut out);
@@ -499,8 +498,8 @@ mod tests {
         assert_eq!(0, out.len());
 
         // Two increments with the same series, should sum into 1
-        agg.record(counter_a_1.clone());
-        agg.record(counter_a_2);
+        assert_eq!(agg.record(counter_a_1.clone()), None);
+        assert_eq!(agg.record(counter_a_2), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(1, out.len());
@@ -512,8 +511,8 @@ mod tests {
             MetricValue::Counter { value: 44.0 },
         );
         // Two increments with the different series, should get each back as-is
-        agg.record(counter_a_1.clone());
-        agg.record(counter_b_1.clone());
+        assert_eq!(agg.record(counter_a_1.clone()), None);
+        assert_eq!(agg.record(counter_b_1.clone()), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(2, out.len());
@@ -547,7 +546,7 @@ mod tests {
         );
 
         // Single item, just stored regardless of kind
-        agg.record(gauge_a_1.clone());
+        assert_eq!(agg.record(gauge_a_1.clone()), None);
         let mut out = vec![];
         // We should flush 1 item gauge_a_1
         agg.flush_into(&mut out);
@@ -565,8 +564,8 @@ mod tests {
         assert_eq!(0, out.len());
 
         // Two absolutes with the same series, should get the 2nd (last) back.
-        agg.record(gauge_a_1.clone());
-        agg.record(gauge_a_2.clone());
+        assert_eq!(agg.record(gauge_a_1.clone()), None);
+        assert_eq!(agg.record(gauge_a_2.clone()), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(1, out.len());
@@ -578,8 +577,8 @@ mod tests {
             MetricValue::Gauge { value: 44.0 },
         );
         // Two increments with the different series, should get each back as-is
-        agg.record(gauge_a_1.clone());
-        agg.record(gauge_b_1.clone());
+        assert_eq!(agg.record(gauge_a_1.clone()), None);
+        assert_eq!(agg.record(gauge_b_1.clone()), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(2, out.len());
@@ -623,7 +622,7 @@ mod tests {
         );
 
         // Single item, counter should be 1
-        agg.record(gauge_a_1.clone());
+        assert_eq!(agg.record(gauge_a_1.clone()), None);
         let mut out = vec![];
         // We should flush 1 item gauge_a_1
         agg.flush_into(&mut out);
@@ -641,8 +640,8 @@ mod tests {
         assert_eq!(0, out.len());
 
         // Two absolutes with the same series, counter should be 2
-        agg.record(gauge_a_1.clone());
-        agg.record(gauge_a_2.clone());
+        assert_eq!(agg.record(gauge_a_1.clone()), None);
+        assert_eq!(agg.record(gauge_a_2.clone()), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(1, out.len());
@@ -669,7 +668,7 @@ mod tests {
         );
 
         // Single item, it should be returned as is
-        agg.record(gauge_a_2.clone());
+        assert_eq!(agg.record(gauge_a_2.clone()), None);
         let mut out = vec![];
         // We should flush 1 item gauge_a_2
         agg.flush_into(&mut out);
@@ -687,8 +686,8 @@ mod tests {
         assert_eq!(0, out.len());
 
         // Two absolutes, result should be higher of the 2
-        agg.record(gauge_a_1.clone());
-        agg.record(gauge_a_2.clone());
+        assert_eq!(agg.record(gauge_a_1.clone()), None);
+        assert_eq!(agg.record(gauge_a_2.clone()), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(1, out.len());
@@ -715,7 +714,7 @@ mod tests {
         );
 
         // Single item, it should be returned as is
-        agg.record(gauge_a_2.clone());
+        assert_eq!(agg.record(gauge_a_2.clone()), None);
         let mut out = vec![];
         // We should flush 1 item gauge_a_2
         agg.flush_into(&mut out);
@@ -733,8 +732,8 @@ mod tests {
         assert_eq!(0, out.len());
 
         // Two absolutes, result should be lower of the 2
-        agg.record(gauge_a_1.clone());
-        agg.record(gauge_a_2.clone());
+        assert_eq!(agg.record(gauge_a_1.clone()), None);
+        assert_eq!(agg.record(gauge_a_2.clone()), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(1, out.len());
@@ -766,7 +765,7 @@ mod tests {
         );
 
         // Single item, it should be returned as is
-        agg.record(gauge_a_2.clone());
+        assert_eq!(agg.record(gauge_a_2.clone()), None);
         let mut out = vec![];
         // We should flush 1 item gauge_a_2
         agg.flush_into(&mut out);
@@ -784,13 +783,13 @@ mod tests {
         assert_eq!(0, out.len());
 
         // Two absolutes in 2 separate flushes, result should be diff between the 2
-        agg.record(gauge_a_1.clone());
+        assert_eq!(agg.record(gauge_a_1.clone()), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(1, out.len());
         assert_eq!(&gauge_a_1, &out[0]);
 
-        agg.record(gauge_a_2.clone());
+        assert_eq!(agg.record(gauge_a_2.clone()), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(1, out.len());
@@ -818,13 +817,13 @@ mod tests {
 
         let mut out = vec![];
         // Two absolutes in 2 separate flushes, result should be second one due to different types
-        agg.record(gauge_a_1.clone());
+        assert_eq!(agg.record(gauge_a_1.clone()), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(1, out.len());
         assert_eq!(&gauge_a_1, &out[0]);
 
-        agg.record(gauge_a_2.clone());
+        assert_eq!(agg.record(gauge_a_2.clone()), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(1, out.len());
@@ -862,7 +861,7 @@ mod tests {
         );
 
         // Single item, it should be returned as is
-        agg.record(gauge_a_2.clone());
+        assert_eq!(agg.record(gauge_a_2.clone()), None);
         let mut out = vec![];
         // We should flush 1 item gauge_a_2
         agg.flush_into(&mut out);
@@ -880,9 +879,9 @@ mod tests {
         assert_eq!(0, out.len());
 
         // Three absolutes, result should be mean
-        agg.record(gauge_a_1.clone());
-        agg.record(gauge_a_2.clone());
-        agg.record(gauge_a_3.clone());
+        assert_eq!(agg.record(gauge_a_1.clone()), None);
+        assert_eq!(agg.record(gauge_a_2.clone()), None);
+        assert_eq!(agg.record(gauge_a_3.clone()), None);
         out.clear();
         agg.flush_into(&mut out);
         assert_eq!(1, out.len());
@@ -941,7 +940,7 @@ mod tests {
         );
 
         for gauge in gauges {
-            agg.record(gauge);
+            assert_eq!(agg.record(gauge), None);
         }
         let mut out = vec![];
         agg.flush_into(&mut out);
@@ -949,6 +948,56 @@ mod tests {
         assert_eq!(&stdev_result, &out[0]);
     }
 
+    #[test]
+    fn passes_through_ignored_kind() {
+        // Sum mode aggregates incremental, passes through absolute without collapsing.
+        let mut agg = Aggregate::new(&AggregateConfig {
+            interval_ms: 1000_u64,
+            mode: AggregationMode::Sum,
+        })
+        .unwrap();
+
+        let counter_1 = make_metric(
+            "counter_a",
+            MetricKind::Incremental,
+            MetricValue::Counter { value: 10.0 },
+        );
+        let counter_2 = make_metric(
+            "counter_a",
+            MetricKind::Incremental,
+            MetricValue::Counter { value: 5.0 },
+        );
+        let counter_summed = make_metric(
+            "counter_a",
+            MetricKind::Incremental,
+            MetricValue::Counter { value: 15.0 },
+        );
+        let gauge_1 = make_metric(
+            "gauge_a",
+            MetricKind::Absolute,
+            MetricValue::Gauge { value: 42.0 },
+        );
+        let gauge_2 = make_metric(
+            "gauge_a",
+            MetricKind::Absolute,
+            MetricValue::Gauge { value: 99.0 },
+        );
+
+        // Absolute metrics pass through immediately (not held until flush).
+        assert_eq!(agg.record(gauge_1.clone()), Some(gauge_1));
+        assert_eq!(agg.record(gauge_2.clone()), Some(gauge_2));
+
+        // Each is returned individually — no collapsing to latest.
+        assert_eq!(agg.record(counter_1), None);
+        assert_eq!(agg.record(counter_2), None);
+
+        let mut out = vec![];
+        agg.flush_into(&mut out);
+        // Only the summed incremental counter appears at flush; the gauges already passed through.
+        assert_eq!(1, out.len());
+        assert_eq!(&counter_summed, &out[0]);
+    }
+
     #[test]
     fn conflicting_value_type() {
         let mut agg = Aggregate::new(&AggregateConfig {
@@ -979,13 +1028,13 @@ mod tests {
         // when types conflict the new values replaces whatever is there
 
         // Start with an counter
-        agg.record(counter.clone());
+        assert_eq!(agg.record(counter.clone()), None);
         // Another will "add" to it
-        agg.record(counter.clone());
+        assert_eq!(agg.record(counter.clone()), None);
         // Then an set will replace it due to a failed update
-        agg.record(set.clone());
+        assert_eq!(agg.record(set.clone()), None);
         // Then a set union would be a noop
-        agg.record(set.clone());
+        assert_eq!(agg.record(set.clone()), None);
         let mut out = vec![];
         // We should flush 1 item counter
         agg.flush_into(&mut out);
@@ -993,13 +1042,13 @@ mod tests {
         assert_eq!(&set, &out[0]);
 
         // Start out with an set
-        agg.record(set.clone());
+        assert_eq!(agg.record(set.clone()), None);
         // Union with itself, a noop
-        agg.record(set);
+        assert_eq!(agg.record(set), None);
         // Send an counter with the same name, will replace due to a failed update
-        agg.record(counter.clone());
+        assert_eq!(agg.record(counter.clone()), None);
         // Send another counter will "add"
-        agg.record(counter);
+        assert_eq!(agg.record(counter), None);
         let mut out = vec![];
         // We should flush 1 item counter
         agg.flush_into(&mut out);
@@ -1034,13 +1083,13 @@ mod tests {
         // when types conflict the new values replaces whatever is there
 
         // Start with an incremental
-        agg.record(incremental.clone());
+        assert_eq!(agg.record(incremental.clone()), None);
         // Another will "add" to it
-        agg.record(incremental.clone());
+        assert_eq!(agg.record(incremental.clone()), None);
         // Then an absolute will replace it with a failed update
-        agg.record(absolute.clone());
+        assert_eq!(agg.record(absolute.clone()), None);
         // Then another absolute will replace it normally
-        agg.record(absolute.clone());
+        assert_eq!(agg.record(absolute.clone()), None);
         let mut out = vec![];
         // We should flush 1 item incremental
         agg.flush_into(&mut out);
@@ -1048,13 +1097,13 @@ mod tests {
         assert_eq!(&absolute, &out[0]);
 
         // Start out with an absolute
-        agg.record(absolute.clone());
+        assert_eq!(agg.record(absolute.clone()), None);
         // Replace it normally
-        agg.record(absolute);
+        assert_eq!(agg.record(absolute), None);
         // Send an incremental with the same name, will replace due to a failed update
-        agg.record(incremental.clone());
+        assert_eq!(agg.record(incremental.clone()), None);
         // Send another incremental will "add"
-        agg.record(incremental);
+        assert_eq!(agg.record(incremental), None);
         let mut out = vec![];
         // We should flush 1 item incremental
         agg.flush_into(&mut out);
diff --git a/website/cue/reference/components/transforms/generated/aggregate.cue b/website/cue/reference/components/transforms/generated/aggregate.cue
index 725285a35281b..8b4f796100cbb 100644
--- a/website/cue/reference/components/transforms/generated/aggregate.cue
+++ b/website/cue/reference/components/transforms/generated/aggregate.cue
@@ -22,13 +22,13 @@ generated: components: transforms: aggregate: configuration: {
 			enum: {
 				Auto:   "Default mode. Sums incremental metrics and uses the latest value for absolute metrics."
 				Count:  "Counts metrics for incremental and absolute metrics"
-				Diff:   "Returns difference between latest value for absolute, ignores incremental"
-				Latest: "Returns the latest value for absolute metrics, ignores incremental"
-				Max:    "Max value of absolute metric, ignores incremental"
-				Mean:   "Mean value of absolute metric, ignores incremental"
-				Min:    "Min value of absolute metric, ignores incremental"
-				Stdev:  "Stdev value of absolute metric, ignores incremental"
-				Sum:    "Sums incremental metrics, ignores absolute"
+				Diff:   "Returns difference between latest value for absolute; incremental metrics pass through unchanged."
+				Latest: "Returns the latest value for absolute metrics; incremental metrics pass through unchanged."
+				Max:    "Max value of absolute metric; incremental metrics pass through unchanged."
+				Mean:   "Mean value of absolute metric; incremental metrics pass through unchanged."
+				Min:    "Min value of absolute metric; incremental metrics pass through unchanged."
+				Stdev:  "Stdev value of absolute metric; incremental metrics pass through unchanged."
+				Sum:    "Sums incremental metrics; absolute metrics pass through unchanged."
 			}
 		}
 	}

From 91fd215e4a06174820eaa4ee5aa8a9d31100ce86 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 1 Jun 2026 10:01:13 -0400
Subject: [PATCH 291/326] chore(dev): upload merged-lcov artifact from coverage
 workflow (#25548)

* chore(dev): upload merged-lcov artifact from coverage workflow

Saves merged-lcov.info as a GitHub Actions artifact (90-day retention)
so it can be downloaded locally for debugging and for the maturity eval
skill to compute per-file line coverage without Datadog API access.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(dev): use more descriptive artifact name for merged lcov report

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/coverage.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index a07ec850373a4..3aaa3f526b176 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -97,6 +97,13 @@ jobs:
 
       - uses: ./.github/actions/dd-token
 
+      - name: Upload merged coverage artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-lcov-merged-report
+          path: merged-lcov.info
+          retention-days: 90
+
       - name: Upload to Datadog
         env:
           DD_SITE: datadoghq.com

From 0833531578ab4356fa6b854c5e5bcd948040f8f6 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 1 Jun 2026 10:53:28 -0400
Subject: [PATCH 292/326] chore(dev): harden merged-lcov artifact upload step
 (#25549)

* chore(dev): harden merged-lcov artifact upload step

- Move upload before dd-token so it does not inherit DD credentials
- Add overwrite: true so rerun-failed-jobs does not error on duplicate
- Add continue-on-error: true so artifact service failures cannot block
  the Datadog coverage upload

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(dev): rename merged artifact to avoid coverage-* download pattern

The coverage-upload job downloads pattern coverage-* to collect source
reports. Naming the merged artifact coverage-lcov-merged-report caused
reruns to pull it back in, feeding merged-lcov.info into the merge step
alongside the original reports and inflating hit counts. Renaming to
merged-lcov-report keeps it outside the download pattern.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(dev): rename artifact to archive-merged-lcov-report

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/coverage.yml | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 3aaa3f526b176..9cc8e3d22d590 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -90,6 +90,15 @@ jobs:
           done
           lcov "${ARGS[@]}" --output-file merged-lcov.info
 
+      - name: Upload merged coverage artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        continue-on-error: true
+        with:
+          name: archive-merged-lcov-report
+          path: merged-lcov.info
+          retention-days: 90
+          overwrite: true
+
       - uses: ./.github/actions/setup
         with:
           vdev: false
@@ -97,13 +106,6 @@ jobs:
 
       - uses: ./.github/actions/dd-token
 
-      - name: Upload merged coverage artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: coverage-lcov-merged-report
-          path: merged-lcov.info
-          retention-days: 90
-
       - name: Upload to Datadog
         env:
           DD_SITE: datadoghq.com

From 42fa63be5898df2f63ed4edd8c31c69f88a41a4a Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 1 Jun 2026 11:10:43 -0400
Subject: [PATCH 293/326] chore(website): remove commonly_used field from
 component definitions (#25551)

* chore(website): remove commonly_used field from component definitions

* cue fmt
---
 website/cue/reference/components.cue                         | 5 -----
 website/cue/reference/components/sinks/amqp.cue              | 1 -
 website/cue/reference/components/sinks/appsignal.cue         | 1 -
 .../cue/reference/components/sinks/aws_cloudwatch_logs.cue   | 1 -
 .../reference/components/sinks/aws_cloudwatch_metrics.cue    | 1 -
 .../cue/reference/components/sinks/aws_kinesis_firehose.cue  | 1 -
 .../cue/reference/components/sinks/aws_kinesis_streams.cue   | 1 -
 website/cue/reference/components/sinks/aws_s3.cue            | 1 -
 website/cue/reference/components/sinks/aws_sns.cue           | 1 -
 website/cue/reference/components/sinks/aws_sqs.cue           | 1 -
 website/cue/reference/components/sinks/axiom.cue             | 1 -
 website/cue/reference/components/sinks/azure_blob.cue        | 1 -
 .../cue/reference/components/sinks/azure_logs_ingestion.cue  | 1 -
 .../cue/reference/components/sinks/azure_monitor_logs.cue    | 1 -
 website/cue/reference/components/sinks/blackhole.cue         | 1 -
 website/cue/reference/components/sinks/clickhouse.cue        | 1 -
 website/cue/reference/components/sinks/console.cue           | 1 -
 website/cue/reference/components/sinks/databend.cue          | 1 -
 .../cue/reference/components/sinks/databricks_zerobus.cue    | 1 -
 website/cue/reference/components/sinks/datadog.cue           | 1 -
 website/cue/reference/components/sinks/doris.cue             | 1 -
 website/cue/reference/components/sinks/elasticsearch.cue     | 1 -
 website/cue/reference/components/sinks/file.cue              | 3 +--
 .../components/sinks/gcp_chronicle_unstructured.cue          | 1 -
 website/cue/reference/components/sinks/gcp_cloud_storage.cue | 1 -
 website/cue/reference/components/sinks/gcp_pubsub.cue        | 1 -
 .../cue/reference/components/sinks/gcp_stackdriver_logs.cue  | 1 -
 .../reference/components/sinks/gcp_stackdriver_metrics.cue   | 1 -
 website/cue/reference/components/sinks/greptimedb_logs.cue   | 1 -
 .../cue/reference/components/sinks/greptimedb_metrics.cue    | 1 -
 website/cue/reference/components/sinks/honeycomb.cue         | 1 -
 website/cue/reference/components/sinks/http.cue              | 1 -
 website/cue/reference/components/sinks/humio.cue             | 1 -
 website/cue/reference/components/sinks/influxdb_logs.cue     | 1 -
 website/cue/reference/components/sinks/influxdb_metrics.cue  | 1 -
 website/cue/reference/components/sinks/kafka.cue             | 1 -
 website/cue/reference/components/sinks/keep.cue              | 1 -
 website/cue/reference/components/sinks/loki.cue              | 1 -
 website/cue/reference/components/sinks/mezmo.cue             | 1 -
 website/cue/reference/components/sinks/mqtt.cue              | 1 -
 website/cue/reference/components/sinks/nats.cue              | 1 -
 website/cue/reference/components/sinks/new_relic.cue         | 1 -
 website/cue/reference/components/sinks/opentelemetry.cue     | 1 -
 website/cue/reference/components/sinks/papertrail.cue        | 1 -
 website/cue/reference/components/sinks/postgres.cue          | 1 -
 .../cue/reference/components/sinks/prometheus_exporter.cue   | 1 -
 .../reference/components/sinks/prometheus_remote_write.cue   | 1 -
 website/cue/reference/components/sinks/pulsar.cue            | 1 -
 website/cue/reference/components/sinks/redis.cue             | 1 -
 website/cue/reference/components/sinks/sematext_logs.cue     | 1 -
 website/cue/reference/components/sinks/sematext_metrics.cue  | 5 ++---
 website/cue/reference/components/sinks/socket.cue            | 1 -
 website/cue/reference/components/sinks/splunk_hec_logs.cue   | 1 -
 .../cue/reference/components/sinks/splunk_hec_metrics.cue    | 1 -
 website/cue/reference/components/sinks/vector.cue            | 1 -
 website/cue/reference/components/sinks/webhdfs.cue           | 3 +--
 website/cue/reference/components/sinks/websocket.cue         | 1 -
 website/cue/reference/components/sinks/websocket_server.cue  | 1 -
 website/cue/reference/components/sources/amqp.cue            | 1 -
 website/cue/reference/components/sources/apache_metrics.cue  | 3 +--
 website/cue/reference/components/sources/aws_ecs_metrics.cue | 3 +--
 .../reference/components/sources/aws_kinesis_firehose.cue    | 3 +--
 website/cue/reference/components/sources/aws_s3.cue          | 1 -
 website/cue/reference/components/sources/aws_sqs.cue         | 1 -
 website/cue/reference/components/sources/datadog_agent.cue   | 3 +--
 website/cue/reference/components/sources/demo_logs.cue       | 3 +--
 website/cue/reference/components/sources/dnstap.cue          | 3 +--
 website/cue/reference/components/sources/docker_logs.cue     | 3 +--
 .../reference/components/sources/eventstoredb_metrics.cue    | 3 +--
 website/cue/reference/components/sources/exec.cue            | 3 +--
 website/cue/reference/components/sources/file.cue            | 3 +--
 website/cue/reference/components/sources/file_descriptor.cue | 3 +--
 website/cue/reference/components/sources/fluent.cue          | 3 +--
 website/cue/reference/components/sources/gcp_pubsub.cue      | 1 -
 website/cue/reference/components/sources/heroku_logs.cue     | 3 +--
 website/cue/reference/components/sources/host_metrics.cue    | 3 +--
 website/cue/reference/components/sources/http_client.cue     | 3 +--
 website/cue/reference/components/sources/http_server.cue     | 3 +--
 website/cue/reference/components/sources/internal_logs.cue   | 3 +--
 .../cue/reference/components/sources/internal_metrics.cue    | 3 +--
 website/cue/reference/components/sources/journald.cue        | 3 +--
 website/cue/reference/components/sources/kafka.cue           | 1 -
 website/cue/reference/components/sources/kubernetes_logs.cue | 3 +--
 website/cue/reference/components/sources/logstash.cue        | 3 +--
 website/cue/reference/components/sources/mongodb_metrics.cue | 3 +--
 website/cue/reference/components/sources/mqtt.cue            | 1 -
 website/cue/reference/components/sources/nats.cue            | 1 -
 website/cue/reference/components/sources/nginx_metrics.cue   | 3 +--
 website/cue/reference/components/sources/okta.cue            | 3 +--
 website/cue/reference/components/sources/opentelemetry.cue   | 3 +--
 .../cue/reference/components/sources/postgresql_metrics.cue  | 3 +--
 .../reference/components/sources/prometheus_pushgateway.cue  | 3 +--
 .../reference/components/sources/prometheus_remote_write.cue | 3 +--
 .../cue/reference/components/sources/prometheus_scrape.cue   | 3 +--
 website/cue/reference/components/sources/pulsar.cue          | 3 +--
 website/cue/reference/components/sources/redis.cue           | 3 +--
 website/cue/reference/components/sources/socket.cue          | 3 +--
 website/cue/reference/components/sources/splunk_hec.cue      | 3 +--
 website/cue/reference/components/sources/static_metrics.cue  | 3 +--
 website/cue/reference/components/sources/statsd.cue          | 3 +--
 website/cue/reference/components/sources/stdin.cue           | 3 +--
 website/cue/reference/components/sources/vector.cue          | 3 +--
 website/cue/reference/components/sources/websocket.cue       | 3 +--
 .../cue/reference/components/sources/windows_event_log.cue   | 3 +--
 website/cue/reference/components/transforms/aggregate.cue    | 1 -
 .../cue/reference/components/transforms/aws_ec2_metadata.cue | 1 -
 website/cue/reference/components/transforms/dedupe.cue       | 1 -
 website/cue/reference/components/transforms/delay.cue        | 1 -
 .../cue/reference/components/transforms/exclusive_route.cue  | 1 -
 website/cue/reference/components/transforms/filter.cue       | 1 -
 .../components/transforms/incremental_to_absolute.cue        | 1 -
 .../cue/reference/components/transforms/log_to_metric.cue    | 1 -
 website/cue/reference/components/transforms/lua.cue          | 1 -
 .../cue/reference/components/transforms/metric_to_log.cue    | 1 -
 website/cue/reference/components/transforms/reduce.cue       | 1 -
 website/cue/reference/components/transforms/remap.cue        | 1 -
 website/cue/reference/components/transforms/route.cue        | 1 -
 website/cue/reference/components/transforms/sample.cue       | 1 -
 .../components/transforms/tag_cardinality_limit.cue          | 1 -
 website/cue/reference/components/transforms/throttle.cue     | 1 -
 website/cue/reference/components/transforms/trace_to_log.cue | 1 -
 website/cue/reference/components/transforms/window.cue       | 1 -
 122 files changed, 43 insertions(+), 169 deletions(-)

diff --git a/website/cue/reference/components.cue b/website/cue/reference/components.cue
index 2ce873c95501e..4e6bb70a01963 100644
--- a/website/cue/reference/components.cue
+++ b/website/cue/reference/components.cue
@@ -6,11 +6,6 @@ components: {
 		_args: kind: string
 		let Args = _args
 
-		// `commonly_used` specifies if the component is commonly used or not.
-		// Setting this to `true` will surface the component from other,
-		// less commonly used, components.
-		commonly_used: bool
-
 		if Args.kind == "source" || Args.kind == "sink" {
 			delivery: #DeliveryStatus
 		}
diff --git a/website/cue/reference/components/sinks/amqp.cue b/website/cue/reference/components/sinks/amqp.cue
index 9a8f90a2a356f..b568618c39c0e 100644
--- a/website/cue/reference/components/sinks/amqp.cue
+++ b/website/cue/reference/components/sinks/amqp.cue
@@ -4,7 +4,6 @@ components: sinks: amqp: {
 	title: "AMQP"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "dynamic"
diff --git a/website/cue/reference/components/sinks/appsignal.cue b/website/cue/reference/components/sinks/appsignal.cue
index 7dc65b6fd7d33..36d76c9814ea3 100644
--- a/website/cue/reference/components/sinks/appsignal.cue
+++ b/website/cue/reference/components/sinks/appsignal.cue
@@ -4,7 +4,6 @@ components: sinks: appsignal: {
 	title: "AppSignal"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/aws_cloudwatch_logs.cue b/website/cue/reference/components/sinks/aws_cloudwatch_logs.cue
index 01ee0b130760a..19c0adf14cd90 100644
--- a/website/cue/reference/components/sinks/aws_cloudwatch_logs.cue
+++ b/website/cue/reference/components/sinks/aws_cloudwatch_logs.cue
@@ -4,7 +4,6 @@ components: sinks: aws_cloudwatch_logs: components._aws & {
 	title: "AWS Cloudwatch Logs"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/aws_cloudwatch_metrics.cue b/website/cue/reference/components/sinks/aws_cloudwatch_metrics.cue
index fac63b4891421..e05077efac58e 100644
--- a/website/cue/reference/components/sinks/aws_cloudwatch_metrics.cue
+++ b/website/cue/reference/components/sinks/aws_cloudwatch_metrics.cue
@@ -4,7 +4,6 @@ components: sinks: aws_cloudwatch_metrics: components._aws & {
 	title: "AWS Cloudwatch Metrics"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/aws_kinesis_firehose.cue b/website/cue/reference/components/sinks/aws_kinesis_firehose.cue
index 2246c48d2a5b7..0f983f15d72d8 100644
--- a/website/cue/reference/components/sinks/aws_kinesis_firehose.cue
+++ b/website/cue/reference/components/sinks/aws_kinesis_firehose.cue
@@ -4,7 +4,6 @@ components: sinks: aws_kinesis_firehose: components._aws & {
 	title: "AWS Kinesis Firehose"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/aws_kinesis_streams.cue b/website/cue/reference/components/sinks/aws_kinesis_streams.cue
index 53a7a1b4ae670..5d868d662b313 100644
--- a/website/cue/reference/components/sinks/aws_kinesis_streams.cue
+++ b/website/cue/reference/components/sinks/aws_kinesis_streams.cue
@@ -4,7 +4,6 @@ components: sinks: aws_kinesis_streams: components._aws & {
 	title: "AWS Kinesis Data Streams"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/aws_s3.cue b/website/cue/reference/components/sinks/aws_s3.cue
index 6f42d082959ba..11ecb0fa18e87 100644
--- a/website/cue/reference/components/sinks/aws_s3.cue
+++ b/website/cue/reference/components/sinks/aws_s3.cue
@@ -4,7 +4,6 @@ components: sinks: aws_s3: components._aws & {
 	title: "AWS S3"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/aws_sns.cue b/website/cue/reference/components/sinks/aws_sns.cue
index feca5c0980ea8..899b535222aa8 100644
--- a/website/cue/reference/components/sinks/aws_sns.cue
+++ b/website/cue/reference/components/sinks/aws_sns.cue
@@ -4,7 +4,6 @@ components: sinks: aws_sns: components._aws & {
 	title: "Amazon Simple Notification Service (SNS)"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/aws_sqs.cue b/website/cue/reference/components/sinks/aws_sqs.cue
index 2e875455ed8fd..4ea3957973b36 100644
--- a/website/cue/reference/components/sinks/aws_sqs.cue
+++ b/website/cue/reference/components/sinks/aws_sqs.cue
@@ -4,7 +4,6 @@ components: sinks: aws_sqs: components._aws & {
 	title: "Amazon Simple Queue Service (SQS)"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/axiom.cue b/website/cue/reference/components/sinks/axiom.cue
index 97fb56974342b..0ab5277b32694 100644
--- a/website/cue/reference/components/sinks/axiom.cue
+++ b/website/cue/reference/components/sinks/axiom.cue
@@ -4,7 +4,6 @@ components: sinks: axiom: {
 	title: "Axiom"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/azure_blob.cue b/website/cue/reference/components/sinks/azure_blob.cue
index 7786fc65d8253..2c4f3051b8ecf 100644
--- a/website/cue/reference/components/sinks/azure_blob.cue
+++ b/website/cue/reference/components/sinks/azure_blob.cue
@@ -4,7 +4,6 @@ components: sinks: azure_blob: {
 	title: "Azure Blob Storage"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/azure_logs_ingestion.cue b/website/cue/reference/components/sinks/azure_logs_ingestion.cue
index 0b3fec1187eb0..07a407d536cc9 100644
--- a/website/cue/reference/components/sinks/azure_logs_ingestion.cue
+++ b/website/cue/reference/components/sinks/azure_logs_ingestion.cue
@@ -14,7 +14,6 @@ components: sinks: azure_logs_ingestion: {
 		"""
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/azure_monitor_logs.cue b/website/cue/reference/components/sinks/azure_monitor_logs.cue
index e764495d9304b..0f6b0b228e7ce 100644
--- a/website/cue/reference/components/sinks/azure_monitor_logs.cue
+++ b/website/cue/reference/components/sinks/azure_monitor_logs.cue
@@ -4,7 +4,6 @@ components: sinks: azure_monitor_logs: {
 	title: "Azure Monitor Logs"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "deprecated"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/blackhole.cue b/website/cue/reference/components/sinks/blackhole.cue
index 1927915881873..dc4941e996452 100644
--- a/website/cue/reference/components/sinks/blackhole.cue
+++ b/website/cue/reference/components/sinks/blackhole.cue
@@ -4,7 +4,6 @@ components: sinks: blackhole: {
 	title: "Blackhole"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/clickhouse.cue b/website/cue/reference/components/sinks/clickhouse.cue
index 320608e26858d..71360422abe35 100644
--- a/website/cue/reference/components/sinks/clickhouse.cue
+++ b/website/cue/reference/components/sinks/clickhouse.cue
@@ -4,7 +4,6 @@ components: sinks: clickhouse: {
 	title: "ClickHouse"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/console.cue b/website/cue/reference/components/sinks/console.cue
index 027acc4dfad25..ca37db7f3cec8 100644
--- a/website/cue/reference/components/sinks/console.cue
+++ b/website/cue/reference/components/sinks/console.cue
@@ -4,7 +4,6 @@ components: sinks: console: {
 	title: "Console"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/databend.cue b/website/cue/reference/components/sinks/databend.cue
index 1e04cb818899a..c332afd1d969a 100644
--- a/website/cue/reference/components/sinks/databend.cue
+++ b/website/cue/reference/components/sinks/databend.cue
@@ -4,7 +4,6 @@ components: sinks: databend: {
 	title: "Databend"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/databricks_zerobus.cue b/website/cue/reference/components/sinks/databricks_zerobus.cue
index f9510774dfe16..2412a5237cf4b 100644
--- a/website/cue/reference/components/sinks/databricks_zerobus.cue
+++ b/website/cue/reference/components/sinks/databricks_zerobus.cue
@@ -4,7 +4,6 @@ components: sinks: databricks_zerobus: {
 	title: "Databricks Zerobus"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/datadog.cue b/website/cue/reference/components/sinks/datadog.cue
index 63128c5373a92..1ec91c3dc6ee1 100644
--- a/website/cue/reference/components/sinks/datadog.cue
+++ b/website/cue/reference/components/sinks/datadog.cue
@@ -2,7 +2,6 @@ package metadata
 
 components: sinks: _datadog: {
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   string | *"stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/doris.cue b/website/cue/reference/components/sinks/doris.cue
index 820f6a7d61682..1d05e2b1956f4 100644
--- a/website/cue/reference/components/sinks/doris.cue
+++ b/website/cue/reference/components/sinks/doris.cue
@@ -4,7 +4,6 @@ components: sinks: doris: {
 	title: "Doris"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/elasticsearch.cue b/website/cue/reference/components/sinks/elasticsearch.cue
index aa3bba6d53617..c565a42703575 100644
--- a/website/cue/reference/components/sinks/elasticsearch.cue
+++ b/website/cue/reference/components/sinks/elasticsearch.cue
@@ -4,7 +4,6 @@ components: sinks: elasticsearch: {
 	title: "Elasticsearch"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/file.cue b/website/cue/reference/components/sinks/file.cue
index 3f4344c36ff33..4636e4969a157 100644
--- a/website/cue/reference/components/sinks/file.cue
+++ b/website/cue/reference/components/sinks/file.cue
@@ -4,8 +4,7 @@ components: sinks: file: {
 	title: "File"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/gcp_chronicle_unstructured.cue b/website/cue/reference/components/sinks/gcp_chronicle_unstructured.cue
index 4de4475cb4d07..15c8f18c88008 100644
--- a/website/cue/reference/components/sinks/gcp_chronicle_unstructured.cue
+++ b/website/cue/reference/components/sinks/gcp_chronicle_unstructured.cue
@@ -4,7 +4,6 @@ components: sinks: gcp_chronicle_unstructured: {
 	title: "GCP Chronicle Unstructured"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/gcp_cloud_storage.cue b/website/cue/reference/components/sinks/gcp_cloud_storage.cue
index a17fa3ec59066..97fd36bf83c31 100644
--- a/website/cue/reference/components/sinks/gcp_cloud_storage.cue
+++ b/website/cue/reference/components/sinks/gcp_cloud_storage.cue
@@ -4,7 +4,6 @@ components: sinks: gcp_cloud_storage: {
 	title: "GCP Cloud Storage (GCS)"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/gcp_pubsub.cue b/website/cue/reference/components/sinks/gcp_pubsub.cue
index da57d140d5364..39d48249ad97b 100644
--- a/website/cue/reference/components/sinks/gcp_pubsub.cue
+++ b/website/cue/reference/components/sinks/gcp_pubsub.cue
@@ -4,7 +4,6 @@ components: sinks: gcp_pubsub: {
 	title: "GCP PubSub"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/gcp_stackdriver_logs.cue b/website/cue/reference/components/sinks/gcp_stackdriver_logs.cue
index 84c31f5de30dd..4bb88a571cda5 100644
--- a/website/cue/reference/components/sinks/gcp_stackdriver_logs.cue
+++ b/website/cue/reference/components/sinks/gcp_stackdriver_logs.cue
@@ -4,7 +4,6 @@ components: sinks: gcp_stackdriver_logs: {
 	title: "GCP Operations (formerly Stackdriver) Logs"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/gcp_stackdriver_metrics.cue b/website/cue/reference/components/sinks/gcp_stackdriver_metrics.cue
index 6d1bec6b6cf18..8838d5d279d39 100644
--- a/website/cue/reference/components/sinks/gcp_stackdriver_metrics.cue
+++ b/website/cue/reference/components/sinks/gcp_stackdriver_metrics.cue
@@ -4,7 +4,6 @@ components: sinks: gcp_stackdriver_metrics: {
 	title: "GCP Cloud Monitoring (formerly Stackdriver) Metrics"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/greptimedb_logs.cue b/website/cue/reference/components/sinks/greptimedb_logs.cue
index 565f0ef3b801d..5e23f17f41d18 100644
--- a/website/cue/reference/components/sinks/greptimedb_logs.cue
+++ b/website/cue/reference/components/sinks/greptimedb_logs.cue
@@ -4,7 +4,6 @@ components: sinks: greptimedb_logs: {
 	title: "GreptimeDB Logs"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/greptimedb_metrics.cue b/website/cue/reference/components/sinks/greptimedb_metrics.cue
index 7bad56a28ca8d..a3bd6bc5f8614 100644
--- a/website/cue/reference/components/sinks/greptimedb_metrics.cue
+++ b/website/cue/reference/components/sinks/greptimedb_metrics.cue
@@ -5,7 +5,6 @@ components: sinks: greptimedb_metrics: {
 	alias: "greptimedb"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/honeycomb.cue b/website/cue/reference/components/sinks/honeycomb.cue
index a0ec0d5d2185f..9d3f596bdd4cb 100644
--- a/website/cue/reference/components/sinks/honeycomb.cue
+++ b/website/cue/reference/components/sinks/honeycomb.cue
@@ -4,7 +4,6 @@ components: sinks: honeycomb: {
 	title: "Honeycomb"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/http.cue b/website/cue/reference/components/sinks/http.cue
index 4cd8e352a88dc..bd8f00d90a470 100644
--- a/website/cue/reference/components/sinks/http.cue
+++ b/website/cue/reference/components/sinks/http.cue
@@ -4,7 +4,6 @@ components: sinks: http: {
 	title: "HTTP"
 
 	classes: {
-		commonly_used: true
 		service_providers: []
 		delivery:      "at_least_once"
 		development:   "stable"
diff --git a/website/cue/reference/components/sinks/humio.cue b/website/cue/reference/components/sinks/humio.cue
index 137d357175976..c5861a4415e58 100644
--- a/website/cue/reference/components/sinks/humio.cue
+++ b/website/cue/reference/components/sinks/humio.cue
@@ -4,7 +4,6 @@ components: sinks: _humio: {
 	_humio_encoding: enabled: false
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/influxdb_logs.cue b/website/cue/reference/components/sinks/influxdb_logs.cue
index 86084a4c8d01c..c2544a956367a 100644
--- a/website/cue/reference/components/sinks/influxdb_logs.cue
+++ b/website/cue/reference/components/sinks/influxdb_logs.cue
@@ -4,7 +4,6 @@ components: sinks: influxdb_logs: {
 	title: "InfluxDB Logs"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/influxdb_metrics.cue b/website/cue/reference/components/sinks/influxdb_metrics.cue
index 4a0453519e08e..51f250584871a 100644
--- a/website/cue/reference/components/sinks/influxdb_metrics.cue
+++ b/website/cue/reference/components/sinks/influxdb_metrics.cue
@@ -4,7 +4,6 @@ components: sinks: influxdb_metrics: {
 	title: "InfluxDB Metrics"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/kafka.cue b/website/cue/reference/components/sinks/kafka.cue
index d464d80826e79..b4946c45cd00a 100644
--- a/website/cue/reference/components/sinks/kafka.cue
+++ b/website/cue/reference/components/sinks/kafka.cue
@@ -4,7 +4,6 @@ components: sinks: kafka: {
 	title: "Kafka"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "dynamic"
diff --git a/website/cue/reference/components/sinks/keep.cue b/website/cue/reference/components/sinks/keep.cue
index 0bc963337215b..b965b5ccd6972 100644
--- a/website/cue/reference/components/sinks/keep.cue
+++ b/website/cue/reference/components/sinks/keep.cue
@@ -4,7 +4,6 @@ components: sinks: keep: {
 	title: "Keep"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/loki.cue b/website/cue/reference/components/sinks/loki.cue
index a1d245016178b..2e6cccc93489b 100644
--- a/website/cue/reference/components/sinks/loki.cue
+++ b/website/cue/reference/components/sinks/loki.cue
@@ -4,7 +4,6 @@ components: sinks: loki: {
 	title: "Loki"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/mezmo.cue b/website/cue/reference/components/sinks/mezmo.cue
index 540274a358576..a7cf5466bda8b 100644
--- a/website/cue/reference/components/sinks/mezmo.cue
+++ b/website/cue/reference/components/sinks/mezmo.cue
@@ -5,7 +5,6 @@ components: sinks: mezmo: {
 	alias: "logdna"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/mqtt.cue b/website/cue/reference/components/sinks/mqtt.cue
index 5794db48e740e..0de5a5fb33772 100644
--- a/website/cue/reference/components/sinks/mqtt.cue
+++ b/website/cue/reference/components/sinks/mqtt.cue
@@ -4,7 +4,6 @@ components: sinks: mqtt: {
 	title: "MQTT"
 
 	classes: {
-		commonly_used: false
 		delivery:      "best_effort"
 		development:   "beta"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/nats.cue b/website/cue/reference/components/sinks/nats.cue
index 99c101d5d8665..6649b606c41cf 100644
--- a/website/cue/reference/components/sinks/nats.cue
+++ b/website/cue/reference/components/sinks/nats.cue
@@ -4,7 +4,6 @@ components: sinks: nats: {
 	title: "NATS"
 
 	classes: {
-		commonly_used: false
 		delivery:      "best_effort"
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/new_relic.cue b/website/cue/reference/components/sinks/new_relic.cue
index 9dc3a7cff8034..7262f4eca913d 100644
--- a/website/cue/reference/components/sinks/new_relic.cue
+++ b/website/cue/reference/components/sinks/new_relic.cue
@@ -4,7 +4,6 @@ components: sinks: new_relic: {
 	title: "New Relic"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/opentelemetry.cue b/website/cue/reference/components/sinks/opentelemetry.cue
index b5fa8855bcea2..c6b2907fd05d8 100644
--- a/website/cue/reference/components/sinks/opentelemetry.cue
+++ b/website/cue/reference/components/sinks/opentelemetry.cue
@@ -4,7 +4,6 @@ components: sinks: opentelemetry: {
 	title: "Open Telemetry"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/papertrail.cue b/website/cue/reference/components/sinks/papertrail.cue
index e2a7cc1800545..5142872eaa92a 100644
--- a/website/cue/reference/components/sinks/papertrail.cue
+++ b/website/cue/reference/components/sinks/papertrail.cue
@@ -4,7 +4,6 @@ components: sinks: papertrail: {
 	title: "Papertrail"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/postgres.cue b/website/cue/reference/components/sinks/postgres.cue
index e2c4c68fd719d..8d02b72200200 100644
--- a/website/cue/reference/components/sinks/postgres.cue
+++ b/website/cue/reference/components/sinks/postgres.cue
@@ -4,7 +4,6 @@ components: sinks: postgres: {
 	title: "PostgreSQL"
 
 	classes: {
-		commonly_used: false
 		delivery:      "exactly_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/prometheus_exporter.cue b/website/cue/reference/components/sinks/prometheus_exporter.cue
index c23a9b77771f5..1fdb0d95a819d 100644
--- a/website/cue/reference/components/sinks/prometheus_exporter.cue
+++ b/website/cue/reference/components/sinks/prometheus_exporter.cue
@@ -7,7 +7,6 @@ components: sinks: prometheus_exporter: {
 	alias: "prometheus"
 
 	classes: {
-		commonly_used: true
 		delivery:      "best_effort"
 		development:   "stable"
 		egress_method: "expose"
diff --git a/website/cue/reference/components/sinks/prometheus_remote_write.cue b/website/cue/reference/components/sinks/prometheus_remote_write.cue
index 1a1a1ed8c20be..bcbf5404ba466 100644
--- a/website/cue/reference/components/sinks/prometheus_remote_write.cue
+++ b/website/cue/reference/components/sinks/prometheus_remote_write.cue
@@ -4,7 +4,6 @@ components: sinks: prometheus_remote_write: {
 	title: "Prometheus Remote Write"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/pulsar.cue b/website/cue/reference/components/sinks/pulsar.cue
index 3bc31ede308c9..2b021f7a8d1e1 100644
--- a/website/cue/reference/components/sinks/pulsar.cue
+++ b/website/cue/reference/components/sinks/pulsar.cue
@@ -4,7 +4,6 @@ components: sinks: pulsar: {
 	title: "Apache Pulsar"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/redis.cue b/website/cue/reference/components/sinks/redis.cue
index 0ba92f88e56ea..753be721284e1 100644
--- a/website/cue/reference/components/sinks/redis.cue
+++ b/website/cue/reference/components/sinks/redis.cue
@@ -3,7 +3,6 @@ package metadata
 components: sinks: redis: {
 	title: "Redis"
 	classes: {
-		commonly_used: false
 		delivery:      "best_effort"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/sematext_logs.cue b/website/cue/reference/components/sinks/sematext_logs.cue
index 52ec8da456cfb..25ecec4cdaa49 100644
--- a/website/cue/reference/components/sinks/sematext_logs.cue
+++ b/website/cue/reference/components/sinks/sematext_logs.cue
@@ -4,7 +4,6 @@ components: sinks: sematext_logs: {
 	title: "Sematext Logs"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/sematext_metrics.cue b/website/cue/reference/components/sinks/sematext_metrics.cue
index a4e6ab8826ef5..ded787f29d636 100644
--- a/website/cue/reference/components/sinks/sematext_metrics.cue
+++ b/website/cue/reference/components/sinks/sematext_metrics.cue
@@ -4,9 +4,8 @@ components: sinks: sematext_metrics: {
 	title: "Sematext Metrics"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
-		development:   "stable"
+		delivery:    "at_least_once"
+		development: "stable"
 		service_providers: ["Sematext"]
 		egress_method: "batch"
 		stateful:      true
diff --git a/website/cue/reference/components/sinks/socket.cue b/website/cue/reference/components/sinks/socket.cue
index 7bd59d45c6037..63a383ad6c9a7 100644
--- a/website/cue/reference/components/sinks/socket.cue
+++ b/website/cue/reference/components/sinks/socket.cue
@@ -4,7 +4,6 @@ components: sinks: socket: {
 	title: "Socket"
 
 	classes: {
-		commonly_used: true
 		delivery:      "best_effort"
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/splunk_hec_logs.cue b/website/cue/reference/components/sinks/splunk_hec_logs.cue
index 9a824eb7bcea3..d88eb821cb238 100644
--- a/website/cue/reference/components/sinks/splunk_hec_logs.cue
+++ b/website/cue/reference/components/sinks/splunk_hec_logs.cue
@@ -5,7 +5,6 @@ components: sinks: splunk_hec_logs: {
 	alias: "splunk_hec"
 
 	classes: {
-		commonly_used: true
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/splunk_hec_metrics.cue b/website/cue/reference/components/sinks/splunk_hec_metrics.cue
index 700775703b28f..16fe4cd0c34d6 100644
--- a/website/cue/reference/components/sinks/splunk_hec_metrics.cue
+++ b/website/cue/reference/components/sinks/splunk_hec_metrics.cue
@@ -4,7 +4,6 @@ components: sinks: splunk_hec_metrics: {
 	title: "Splunk HEC metrics"
 
 	classes: {
-		commonly_used: false
 		delivery:      "at_least_once"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/vector.cue b/website/cue/reference/components/sinks/vector.cue
index bcffbf3ba0114..f18f515b312ce 100644
--- a/website/cue/reference/components/sinks/vector.cue
+++ b/website/cue/reference/components/sinks/vector.cue
@@ -10,7 +10,6 @@ components: sinks: vector: {
 		"""
 
 	classes: {
-		commonly_used: false
 		delivery:      "best_effort"
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sinks/webhdfs.cue b/website/cue/reference/components/sinks/webhdfs.cue
index 2eaebd6986131..2254e743e747b 100644
--- a/website/cue/reference/components/sinks/webhdfs.cue
+++ b/website/cue/reference/components/sinks/webhdfs.cue
@@ -4,8 +4,7 @@ components: sinks: webhdfs: {
 	title: "WebHDFS"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 
 		development:   "beta"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/websocket.cue b/website/cue/reference/components/sinks/websocket.cue
index 0e6d12188b68f..25c41ed638ed8 100644
--- a/website/cue/reference/components/sinks/websocket.cue
+++ b/website/cue/reference/components/sinks/websocket.cue
@@ -4,7 +4,6 @@ components: sinks: websocket: {
 	title: "WebSocket"
 
 	classes: {
-		commonly_used: false
 		delivery:      "best_effort"
 		development:   "beta"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sinks/websocket_server.cue b/website/cue/reference/components/sinks/websocket_server.cue
index ac4426f05802c..4b5a0ee3b8d42 100644
--- a/website/cue/reference/components/sinks/websocket_server.cue
+++ b/website/cue/reference/components/sinks/websocket_server.cue
@@ -5,7 +5,6 @@ components: sinks: websocket_server: {
 	title: "WebSocket server"
 
 	classes: {
-		commonly_used: false
 		delivery:      "best_effort"
 		development:   "beta"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/amqp.cue b/website/cue/reference/components/sources/amqp.cue
index ac63a1961089c..531a29c56d168 100644
--- a/website/cue/reference/components/sources/amqp.cue
+++ b/website/cue/reference/components/sources/amqp.cue
@@ -28,7 +28,6 @@ components: sources: amqp: {
 	}
 
 	classes: {
-		commonly_used: true
 		deployment_roles: ["aggregator"]
 		delivery:      "at_least_once"
 		development:   "beta"
diff --git a/website/cue/reference/components/sources/apache_metrics.cue b/website/cue/reference/components/sources/apache_metrics.cue
index ba8c79ca8b5aa..717efb1474f22 100644
--- a/website/cue/reference/components/sources/apache_metrics.cue
+++ b/website/cue/reference/components/sources/apache_metrics.cue
@@ -4,8 +4,7 @@ components: sources: apache_metrics: {
 	title: "Apache HTTP Server (HTTPD) Metrics"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon", "sidecar"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/aws_ecs_metrics.cue b/website/cue/reference/components/sources/aws_ecs_metrics.cue
index 4bd4cac53efda..30690ee4eafb9 100644
--- a/website/cue/reference/components/sources/aws_ecs_metrics.cue
+++ b/website/cue/reference/components/sources/aws_ecs_metrics.cue
@@ -9,8 +9,7 @@ components: sources: aws_ecs_metrics: {
 		"""
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["sidecar"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/aws_kinesis_firehose.cue b/website/cue/reference/components/sources/aws_kinesis_firehose.cue
index 17c3fcf337478..1a4d16ddeae9a 100644
--- a/website/cue/reference/components/sources/aws_kinesis_firehose.cue
+++ b/website/cue/reference/components/sources/aws_kinesis_firehose.cue
@@ -6,8 +6,7 @@ components: sources: aws_kinesis_firehose: {
 	title: "AWS Kinesis Firehose"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["aggregator"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/aws_s3.cue b/website/cue/reference/components/sources/aws_s3.cue
index 5c6253cf636ab..f84fde778cb48 100644
--- a/website/cue/reference/components/sources/aws_s3.cue
+++ b/website/cue/reference/components/sources/aws_s3.cue
@@ -22,7 +22,6 @@ components: sources: aws_s3: components._aws & {
 	}
 
 	classes: {
-		commonly_used: true
 		deployment_roles: ["aggregator"]
 		delivery:      "at_least_once"
 		development:   "stable"
diff --git a/website/cue/reference/components/sources/aws_sqs.cue b/website/cue/reference/components/sources/aws_sqs.cue
index 5e9886a4288a9..1b10b9f232a56 100644
--- a/website/cue/reference/components/sources/aws_sqs.cue
+++ b/website/cue/reference/components/sources/aws_sqs.cue
@@ -26,7 +26,6 @@ components: sources: aws_sqs: components._aws & {
 	}
 
 	classes: {
-		commonly_used: true
 		deployment_roles: ["aggregator"]
 		delivery:      "at_least_once"
 		development:   "stable"
diff --git a/website/cue/reference/components/sources/datadog_agent.cue b/website/cue/reference/components/sources/datadog_agent.cue
index 52ac91a375bce..5bb26bb89823c 100644
--- a/website/cue/reference/components/sources/datadog_agent.cue
+++ b/website/cue/reference/components/sources/datadog_agent.cue
@@ -10,8 +10,7 @@ components: sources: datadog_agent: {
 		"""
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["aggregator", "sidecar"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/demo_logs.cue b/website/cue/reference/components/sources/demo_logs.cue
index d58723b1782b6..a06cf8d519ef2 100644
--- a/website/cue/reference/components/sources/demo_logs.cue
+++ b/website/cue/reference/components/sources/demo_logs.cue
@@ -10,8 +10,7 @@ components: sources: demo_logs: {
 		"""
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon", "sidecar"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/dnstap.cue b/website/cue/reference/components/sources/dnstap.cue
index 1854973c15ee6..17f4af41de550 100644
--- a/website/cue/reference/components/sources/dnstap.cue
+++ b/website/cue/reference/components/sources/dnstap.cue
@@ -4,8 +4,7 @@ components: sources: dnstap: {
 	title: "Dnstap"
 
 	classes: {
-		commonly_used: false
-		delivery:      "best_effort"
+		delivery: "best_effort"
 		deployment_roles: ["daemon"]
 		development:   "beta"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/docker_logs.cue b/website/cue/reference/components/sources/docker_logs.cue
index 3331b3cdb254d..f6d7bfcc205c4 100644
--- a/website/cue/reference/components/sources/docker_logs.cue
+++ b/website/cue/reference/components/sources/docker_logs.cue
@@ -5,8 +5,7 @@ components: sources: docker_logs: {
 	alias: "docker"
 
 	classes: {
-		commonly_used: false
-		delivery:      "best_effort"
+		delivery: "best_effort"
 		deployment_roles: ["daemon"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/eventstoredb_metrics.cue b/website/cue/reference/components/sources/eventstoredb_metrics.cue
index 2df38e0f69115..b4002180a2a80 100644
--- a/website/cue/reference/components/sources/eventstoredb_metrics.cue
+++ b/website/cue/reference/components/sources/eventstoredb_metrics.cue
@@ -4,8 +4,7 @@ components: sources: eventstoredb_metrics: {
 	title: "EventStoreDB Metrics"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon", "sidecar"]
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/exec.cue b/website/cue/reference/components/sources/exec.cue
index 8941d45e57cdf..257400b93525f 100644
--- a/website/cue/reference/components/sources/exec.cue
+++ b/website/cue/reference/components/sources/exec.cue
@@ -4,8 +4,7 @@ components: sources: exec: {
 	title: "Exec"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["sidecar"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/file.cue b/website/cue/reference/components/sources/file.cue
index ae6d8ba7c49b4..0a95bdfd4c8d3 100644
--- a/website/cue/reference/components/sources/file.cue
+++ b/website/cue/reference/components/sources/file.cue
@@ -6,8 +6,7 @@ components: sources: file: {
 	title: "File"
 
 	classes: {
-		commonly_used: true
-		delivery:      "best_effort"
+		delivery: "best_effort"
 		deployment_roles: ["daemon", "sidecar"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/file_descriptor.cue b/website/cue/reference/components/sources/file_descriptor.cue
index 3a79105042828..0bde6fb2520cc 100644
--- a/website/cue/reference/components/sources/file_descriptor.cue
+++ b/website/cue/reference/components/sources/file_descriptor.cue
@@ -4,8 +4,7 @@ components: sources: file_descriptor: {
 	title: "File Descriptor"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["sidecar"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/fluent.cue b/website/cue/reference/components/sources/fluent.cue
index 07c2ad5bfad3f..96f3e868fe7f4 100644
--- a/website/cue/reference/components/sources/fluent.cue
+++ b/website/cue/reference/components/sources/fluent.cue
@@ -6,8 +6,7 @@ components: sources: fluent: {
 	title: "Fluent"
 
 	classes: {
-		commonly_used: true
-		delivery:      "best_effort"
+		delivery: "best_effort"
 		deployment_roles: ["sidecar", "aggregator"]
 		development:   "beta"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/gcp_pubsub.cue b/website/cue/reference/components/sources/gcp_pubsub.cue
index 7611f4b11ddba..39bc69a9145a5 100644
--- a/website/cue/reference/components/sources/gcp_pubsub.cue
+++ b/website/cue/reference/components/sources/gcp_pubsub.cue
@@ -26,7 +26,6 @@ components: sources: gcp_pubsub: {
 	}
 
 	classes: {
-		commonly_used: true
 		deployment_roles: ["aggregator"]
 		delivery:      "at_least_once"
 		development:   "beta"
diff --git a/website/cue/reference/components/sources/heroku_logs.cue b/website/cue/reference/components/sources/heroku_logs.cue
index 0321436a98da2..199b6b275cfac 100644
--- a/website/cue/reference/components/sources/heroku_logs.cue
+++ b/website/cue/reference/components/sources/heroku_logs.cue
@@ -12,8 +12,7 @@ components: sources: heroku_logs: {
 	alias: "logplex"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["aggregator"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/host_metrics.cue b/website/cue/reference/components/sources/host_metrics.cue
index 377d02b3d0ba9..967088c9e24d2 100644
--- a/website/cue/reference/components/sources/host_metrics.cue
+++ b/website/cue/reference/components/sources/host_metrics.cue
@@ -10,8 +10,7 @@ components: sources: host_metrics: {
 		"""
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/http_client.cue b/website/cue/reference/components/sources/http_client.cue
index ed3b1937fe629..c999cc27e96d3 100644
--- a/website/cue/reference/components/sources/http_client.cue
+++ b/website/cue/reference/components/sources/http_client.cue
@@ -4,8 +4,7 @@ components: sources: http_client: {
 	title: "HTTP Client"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon", "sidecar", "aggregator"]
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/http_server.cue b/website/cue/reference/components/sources/http_server.cue
index 11103ead72390..5ea6609e14eba 100644
--- a/website/cue/reference/components/sources/http_server.cue
+++ b/website/cue/reference/components/sources/http_server.cue
@@ -7,8 +7,7 @@ components: sources: http_server: {
 	alias: "http"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["aggregator", "sidecar"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/internal_logs.cue b/website/cue/reference/components/sources/internal_logs.cue
index 24369f81cfe47..f477bbbbf6d4c 100644
--- a/website/cue/reference/components/sources/internal_logs.cue
+++ b/website/cue/reference/components/sources/internal_logs.cue
@@ -5,8 +5,7 @@ components: sources: internal_logs: {
 	description: "The internal logs source exposes all log and trace messages emitted by the running Vector instance."
 
 	classes: {
-		commonly_used: true
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["aggregator", "daemon", "sidecar"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/internal_metrics.cue b/website/cue/reference/components/sources/internal_metrics.cue
index 1e990965638c6..1361148420fe5 100644
--- a/website/cue/reference/components/sources/internal_metrics.cue
+++ b/website/cue/reference/components/sources/internal_metrics.cue
@@ -9,8 +9,7 @@ components: sources: internal_metrics: {
 		"""
 
 	classes: {
-		commonly_used: true
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["aggregator", "daemon", "sidecar"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/journald.cue b/website/cue/reference/components/sources/journald.cue
index 9c0a44748ec61..e7404f10e0a31 100644
--- a/website/cue/reference/components/sources/journald.cue
+++ b/website/cue/reference/components/sources/journald.cue
@@ -4,8 +4,7 @@ components: sources: journald: {
 	title: "Journald"
 
 	classes: {
-		commonly_used: true
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/kafka.cue b/website/cue/reference/components/sources/kafka.cue
index 3b2d792a62de4..2181703f68e2c 100644
--- a/website/cue/reference/components/sources/kafka.cue
+++ b/website/cue/reference/components/sources/kafka.cue
@@ -25,7 +25,6 @@ components: sources: kafka: {
 	}
 
 	classes: {
-		commonly_used: true
 		deployment_roles: ["aggregator"]
 		delivery:      "at_least_once"
 		development:   "stable"
diff --git a/website/cue/reference/components/sources/kubernetes_logs.cue b/website/cue/reference/components/sources/kubernetes_logs.cue
index 3ff55a8790bc9..76b7ff5d248c5 100644
--- a/website/cue/reference/components/sources/kubernetes_logs.cue
+++ b/website/cue/reference/components/sources/kubernetes_logs.cue
@@ -11,8 +11,7 @@ components: sources: kubernetes_logs: {
 		"""
 
 	classes: {
-		commonly_used: true
-		delivery:      "best_effort"
+		delivery: "best_effort"
 		deployment_roles: ["daemon"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/logstash.cue b/website/cue/reference/components/sources/logstash.cue
index 3be43a264cca8..c77fac935da83 100644
--- a/website/cue/reference/components/sources/logstash.cue
+++ b/website/cue/reference/components/sources/logstash.cue
@@ -6,8 +6,7 @@ components: sources: logstash: {
 	title: "Logstash"
 
 	classes: {
-		commonly_used: true
-		delivery:      "best_effort"
+		delivery: "best_effort"
 		deployment_roles: ["sidecar", "aggregator"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/mongodb_metrics.cue b/website/cue/reference/components/sources/mongodb_metrics.cue
index 40c9e10218b35..3c1b0ae391aa0 100644
--- a/website/cue/reference/components/sources/mongodb_metrics.cue
+++ b/website/cue/reference/components/sources/mongodb_metrics.cue
@@ -4,8 +4,7 @@ components: sources: mongodb_metrics: {
 	title: "MongoDB Metrics"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon", "sidecar"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/mqtt.cue b/website/cue/reference/components/sources/mqtt.cue
index 4530c36984b4e..8ddddf5d2dffd 100644
--- a/website/cue/reference/components/sources/mqtt.cue
+++ b/website/cue/reference/components/sources/mqtt.cue
@@ -28,7 +28,6 @@ components: sources: mqtt: {
 	}
 
 	classes: {
-		commonly_used: false
 		deployment_roles: ["aggregator"]
 		delivery:      "best_effort"
 		development:   "beta"
diff --git a/website/cue/reference/components/sources/nats.cue b/website/cue/reference/components/sources/nats.cue
index 0e367e6cc0e0d..3f33f0c9963c1 100644
--- a/website/cue/reference/components/sources/nats.cue
+++ b/website/cue/reference/components/sources/nats.cue
@@ -25,7 +25,6 @@ components: sources: nats: {
 	}
 
 	classes: {
-		commonly_used: true
 		deployment_roles: ["aggregator"]
 		delivery:      "best_effort"
 		development:   "stable"
diff --git a/website/cue/reference/components/sources/nginx_metrics.cue b/website/cue/reference/components/sources/nginx_metrics.cue
index bcfbc2e70a4fc..f769d3ffdff6f 100644
--- a/website/cue/reference/components/sources/nginx_metrics.cue
+++ b/website/cue/reference/components/sources/nginx_metrics.cue
@@ -4,8 +4,7 @@ components: sources: nginx_metrics: {
 	title: "Nginx Metrics"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon", "sidecar"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/okta.cue b/website/cue/reference/components/sources/okta.cue
index d5848a32b60be..fa49a7672eb79 100644
--- a/website/cue/reference/components/sources/okta.cue
+++ b/website/cue/reference/components/sources/okta.cue
@@ -5,8 +5,7 @@ components: sources: okta: {
 	title: "Okta"
 
 	classes: {
-		commonly_used: true
-		delivery:      "best_effort"
+		delivery: "best_effort"
 		deployment_roles: ["aggregator"]
 		development:   "beta"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/opentelemetry.cue b/website/cue/reference/components/sources/opentelemetry.cue
index cfbbd8009306f..de13860e01ff9 100644
--- a/website/cue/reference/components/sources/opentelemetry.cue
+++ b/website/cue/reference/components/sources/opentelemetry.cue
@@ -7,8 +7,7 @@ components: sources: opentelemetry: {
 	title: "OpenTelemetry"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon", "aggregator"]
 		development:   "beta"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/postgresql_metrics.cue b/website/cue/reference/components/sources/postgresql_metrics.cue
index 5b392c909b9a9..123ae2130833e 100644
--- a/website/cue/reference/components/sources/postgresql_metrics.cue
+++ b/website/cue/reference/components/sources/postgresql_metrics.cue
@@ -9,8 +9,7 @@ components: sources: postgresql_metrics: {
 		"""
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon", "sidecar"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/prometheus_pushgateway.cue b/website/cue/reference/components/sources/prometheus_pushgateway.cue
index 62ddb8c8faf17..67a19b2515430 100644
--- a/website/cue/reference/components/sources/prometheus_pushgateway.cue
+++ b/website/cue/reference/components/sources/prometheus_pushgateway.cue
@@ -4,8 +4,7 @@ components: sources: prometheus_pushgateway: {
 	title: "Prometheus Pushgateway"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon", "sidecar"]
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/prometheus_remote_write.cue b/website/cue/reference/components/sources/prometheus_remote_write.cue
index c7dd80b82153a..faf469a9881c7 100644
--- a/website/cue/reference/components/sources/prometheus_remote_write.cue
+++ b/website/cue/reference/components/sources/prometheus_remote_write.cue
@@ -4,8 +4,7 @@ components: sources: prometheus_remote_write: {
 	title: "Prometheus Remote Write"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon", "sidecar"]
 		development:   "beta"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/prometheus_scrape.cue b/website/cue/reference/components/sources/prometheus_scrape.cue
index f5087c28b3c63..04b5247a72ba7 100644
--- a/website/cue/reference/components/sources/prometheus_scrape.cue
+++ b/website/cue/reference/components/sources/prometheus_scrape.cue
@@ -5,8 +5,7 @@ components: sources: prometheus_scrape: {
 	alias: "prometheus"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon", "sidecar"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/pulsar.cue b/website/cue/reference/components/sources/pulsar.cue
index e1fd70d70e776..90d1a81288c2c 100644
--- a/website/cue/reference/components/sources/pulsar.cue
+++ b/website/cue/reference/components/sources/pulsar.cue
@@ -4,8 +4,7 @@ components: sources: pulsar: {
 	title: "Apache Pulsar"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["aggregator"]
 		development:   "beta"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/redis.cue b/website/cue/reference/components/sources/redis.cue
index 72d0d18bf3f3a..77dce10edd3b8 100644
--- a/website/cue/reference/components/sources/redis.cue
+++ b/website/cue/reference/components/sources/redis.cue
@@ -29,8 +29,7 @@ components: sources: redis: {
 	}
 
 	classes: {
-		commonly_used: false
-		delivery:      "best_effort"
+		delivery: "best_effort"
 		deployment_roles: ["aggregator"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/socket.cue b/website/cue/reference/components/sources/socket.cue
index 2a9cd052657ad..42f3b6e0e800c 100644
--- a/website/cue/reference/components/sources/socket.cue
+++ b/website/cue/reference/components/sources/socket.cue
@@ -6,8 +6,7 @@ components: sources: socket: {
 	title: "Socket"
 
 	classes: {
-		commonly_used: true
-		delivery:      "best_effort"
+		delivery: "best_effort"
 		deployment_roles: ["aggregator", "sidecar"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/splunk_hec.cue b/website/cue/reference/components/sources/splunk_hec.cue
index ef6ba5f8cfcf2..1338d776c699d 100644
--- a/website/cue/reference/components/sources/splunk_hec.cue
+++ b/website/cue/reference/components/sources/splunk_hec.cue
@@ -10,8 +10,7 @@ components: sources: splunk_hec: {
 		"""
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["aggregator"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/static_metrics.cue b/website/cue/reference/components/sources/static_metrics.cue
index 24e7f1186f8df..9715577eafff8 100644
--- a/website/cue/reference/components/sources/static_metrics.cue
+++ b/website/cue/reference/components/sources/static_metrics.cue
@@ -9,8 +9,7 @@ components: sources: static_metrics: {
 		"""
 
 	classes: {
-		commonly_used: true
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["aggregator", "daemon", "sidecar"]
 		development:   "stable"
 		egress_method: "batch"
diff --git a/website/cue/reference/components/sources/statsd.cue b/website/cue/reference/components/sources/statsd.cue
index 0eddb9f274020..425a9479b4aa8 100644
--- a/website/cue/reference/components/sources/statsd.cue
+++ b/website/cue/reference/components/sources/statsd.cue
@@ -6,8 +6,7 @@ components: sources: statsd: {
 	title: "StatsD"
 
 	classes: {
-		commonly_used: false
-		delivery:      "best_effort"
+		delivery: "best_effort"
 		deployment_roles: ["aggregator"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/stdin.cue b/website/cue/reference/components/sources/stdin.cue
index 262289538aac7..32b69131a2767 100644
--- a/website/cue/reference/components/sources/stdin.cue
+++ b/website/cue/reference/components/sources/stdin.cue
@@ -4,8 +4,7 @@ components: sources: stdin: {
 	title: "STDIN"
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["sidecar"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/vector.cue b/website/cue/reference/components/sources/vector.cue
index 3f7c18cef245b..aa9b4db6fe34e 100644
--- a/website/cue/reference/components/sources/vector.cue
+++ b/website/cue/reference/components/sources/vector.cue
@@ -10,8 +10,7 @@ components: sources: vector: {
 		"""
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["aggregator"]
 		development:   "stable"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/websocket.cue b/website/cue/reference/components/sources/websocket.cue
index 34489bc2c0946..3d3bb209ba663 100644
--- a/website/cue/reference/components/sources/websocket.cue
+++ b/website/cue/reference/components/sources/websocket.cue
@@ -4,8 +4,7 @@ components: sources: websocket: {
 	title: "WebSocket"
 
 	classes: {
-		commonly_used: false
-		delivery:      "best_effort"
+		delivery: "best_effort"
 		deployment_roles: ["aggregator"]
 		development:   "beta"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/sources/windows_event_log.cue b/website/cue/reference/components/sources/windows_event_log.cue
index 0bf1c424daea6..bb71871f1007b 100644
--- a/website/cue/reference/components/sources/windows_event_log.cue
+++ b/website/cue/reference/components/sources/windows_event_log.cue
@@ -9,8 +9,7 @@ components: sources: windows_event_log: {
 		"""
 
 	classes: {
-		commonly_used: false
-		delivery:      "at_least_once"
+		delivery: "at_least_once"
 		deployment_roles: ["daemon"]
 		development:   "beta"
 		egress_method: "stream"
diff --git a/website/cue/reference/components/transforms/aggregate.cue b/website/cue/reference/components/transforms/aggregate.cue
index 37980aa252e23..e680f29580886 100644
--- a/website/cue/reference/components/transforms/aggregate.cue
+++ b/website/cue/reference/components/transforms/aggregate.cue
@@ -10,7 +10,6 @@ components: transforms: aggregate: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "stable"
 		egress_method: "stream"
 		stateful:      true
diff --git a/website/cue/reference/components/transforms/aws_ec2_metadata.cue b/website/cue/reference/components/transforms/aws_ec2_metadata.cue
index ed5bff826033a..b11ba10961c2e 100644
--- a/website/cue/reference/components/transforms/aws_ec2_metadata.cue
+++ b/website/cue/reference/components/transforms/aws_ec2_metadata.cue
@@ -8,7 +8,6 @@ components: transforms: aws_ec2_metadata: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "stable"
 		egress_method: "stream"
 		stateful:      false
diff --git a/website/cue/reference/components/transforms/dedupe.cue b/website/cue/reference/components/transforms/dedupe.cue
index 322186bd8b777..2919cf77d6f06 100644
--- a/website/cue/reference/components/transforms/dedupe.cue
+++ b/website/cue/reference/components/transforms/dedupe.cue
@@ -8,7 +8,6 @@ components: transforms: dedupe: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "stable"
 		egress_method: "stream"
 		stateful:      true
diff --git a/website/cue/reference/components/transforms/delay.cue b/website/cue/reference/components/transforms/delay.cue
index 162325483071d..dc145811bd928 100644
--- a/website/cue/reference/components/transforms/delay.cue
+++ b/website/cue/reference/components/transforms/delay.cue
@@ -8,7 +8,6 @@ components: transforms: delay: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "beta"
 		egress_method: "stream"
 		stateful:      true
diff --git a/website/cue/reference/components/transforms/exclusive_route.cue b/website/cue/reference/components/transforms/exclusive_route.cue
index b02c9db834b11..20ee559d28b47 100644
--- a/website/cue/reference/components/transforms/exclusive_route.cue
+++ b/website/cue/reference/components/transforms/exclusive_route.cue
@@ -12,7 +12,6 @@ components: transforms: exclusive_route: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "beta"
 		egress_method: "stream"
 		stateful:      false
diff --git a/website/cue/reference/components/transforms/filter.cue b/website/cue/reference/components/transforms/filter.cue
index 13a68d8097383..92c746e191517 100644
--- a/website/cue/reference/components/transforms/filter.cue
+++ b/website/cue/reference/components/transforms/filter.cue
@@ -8,7 +8,6 @@ components: transforms: filter: {
 		"""
 
 	classes: {
-		commonly_used: true
 		development:   "stable"
 		egress_method: "stream"
 		stateful:      false
diff --git a/website/cue/reference/components/transforms/incremental_to_absolute.cue b/website/cue/reference/components/transforms/incremental_to_absolute.cue
index 0c3e655ed2938..ad3094ef8375d 100644
--- a/website/cue/reference/components/transforms/incremental_to_absolute.cue
+++ b/website/cue/reference/components/transforms/incremental_to_absolute.cue
@@ -8,7 +8,6 @@ components: transforms: incremental_to_absolute: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "beta"
 		egress_method: "stream"
 		stateful:      true
diff --git a/website/cue/reference/components/transforms/log_to_metric.cue b/website/cue/reference/components/transforms/log_to_metric.cue
index c580e4c9ef545..9f1cb35b2bdd7 100644
--- a/website/cue/reference/components/transforms/log_to_metric.cue
+++ b/website/cue/reference/components/transforms/log_to_metric.cue
@@ -8,7 +8,6 @@ components: transforms: log_to_metric: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "stable"
 		egress_method: "batch"
 		stateful:      false
diff --git a/website/cue/reference/components/transforms/lua.cue b/website/cue/reference/components/transforms/lua.cue
index c962249e9b685..7d425f9ec1bf5 100644
--- a/website/cue/reference/components/transforms/lua.cue
+++ b/website/cue/reference/components/transforms/lua.cue
@@ -8,7 +8,6 @@ components: transforms: lua: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "stable"
 		egress_method: "stream"
 		stateful:      true
diff --git a/website/cue/reference/components/transforms/metric_to_log.cue b/website/cue/reference/components/transforms/metric_to_log.cue
index db684299c218b..4721c4381bf62 100644
--- a/website/cue/reference/components/transforms/metric_to_log.cue
+++ b/website/cue/reference/components/transforms/metric_to_log.cue
@@ -9,7 +9,6 @@ components: transforms: metric_to_log: {
 		"""
 
 	classes: {
-		commonly_used: true
 		development:   "stable"
 		egress_method: "stream"
 		stateful:      false
diff --git a/website/cue/reference/components/transforms/reduce.cue b/website/cue/reference/components/transforms/reduce.cue
index 49fa0184df561..586d511536c6a 100644
--- a/website/cue/reference/components/transforms/reduce.cue
+++ b/website/cue/reference/components/transforms/reduce.cue
@@ -9,7 +9,6 @@ components: transforms: reduce: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "stable"
 		egress_method: "stream"
 		stateful:      true
diff --git a/website/cue/reference/components/transforms/remap.cue b/website/cue/reference/components/transforms/remap.cue
index c27de5b1c6fee..dd2a016fd6ffd 100644
--- a/website/cue/reference/components/transforms/remap.cue
+++ b/website/cue/reference/components/transforms/remap.cue
@@ -12,7 +12,6 @@ components: transforms: "remap": {
 		"""
 
 	classes: {
-		commonly_used: true
 		development:   "stable"
 		egress_method: "stream"
 		stateful:      false
diff --git a/website/cue/reference/components/transforms/route.cue b/website/cue/reference/components/transforms/route.cue
index 82f0750528701..acde90223f816 100644
--- a/website/cue/reference/components/transforms/route.cue
+++ b/website/cue/reference/components/transforms/route.cue
@@ -12,7 +12,6 @@ components: transforms: route: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "stable"
 		egress_method: "stream"
 		stateful:      false
diff --git a/website/cue/reference/components/transforms/sample.cue b/website/cue/reference/components/transforms/sample.cue
index 3f589f9248fb1..f3c1828cc9c37 100644
--- a/website/cue/reference/components/transforms/sample.cue
+++ b/website/cue/reference/components/transforms/sample.cue
@@ -8,7 +8,6 @@ components: transforms: sample: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "stable"
 		egress_method: "stream"
 		stateful:      false
diff --git a/website/cue/reference/components/transforms/tag_cardinality_limit.cue b/website/cue/reference/components/transforms/tag_cardinality_limit.cue
index 91cf2962185b4..5aad8656d8eff 100644
--- a/website/cue/reference/components/transforms/tag_cardinality_limit.cue
+++ b/website/cue/reference/components/transforms/tag_cardinality_limit.cue
@@ -16,7 +16,6 @@ components: transforms: tag_cardinality_limit: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "beta"
 		egress_method: "stream"
 		stateful:      true
diff --git a/website/cue/reference/components/transforms/throttle.cue b/website/cue/reference/components/transforms/throttle.cue
index 4c68f5f99f7a2..068bbee53acb3 100644
--- a/website/cue/reference/components/transforms/throttle.cue
+++ b/website/cue/reference/components/transforms/throttle.cue
@@ -8,7 +8,6 @@ components: transforms: throttle: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "stable"
 		egress_method: "stream"
 		stateful:      true
diff --git a/website/cue/reference/components/transforms/trace_to_log.cue b/website/cue/reference/components/transforms/trace_to_log.cue
index a6780673dcc8f..bb8b35b479056 100644
--- a/website/cue/reference/components/transforms/trace_to_log.cue
+++ b/website/cue/reference/components/transforms/trace_to_log.cue
@@ -11,7 +11,6 @@ components: transforms: trace_to_log: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "beta"
 		egress_method: "stream"
 		stateful:      false
diff --git a/website/cue/reference/components/transforms/window.cue b/website/cue/reference/components/transforms/window.cue
index f0f7541d3658e..71db55d13f9a6 100644
--- a/website/cue/reference/components/transforms/window.cue
+++ b/website/cue/reference/components/transforms/window.cue
@@ -9,7 +9,6 @@ components: transforms: window: {
 		"""
 
 	classes: {
-		commonly_used: false
 		development:   "beta"
 		egress_method: "stream"
 		stateful:      true

From 030c6ba433a0c9aff94e411f33d8b13373603b7f Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Mon, 1 Jun 2026 12:06:00 -0400
Subject: [PATCH 294/326] chore(internal docs): AI policy follow-ups (#25550)

docs(ai policy): improve keep-conversations-human and agentic sections

- Rewrote "Keep conversations human" as community guidance: shorter,
  warmer tone, explicitly permits AI for grammar/conciseness while
  keeping the core-ideas-should-be-yours framing.
- Added model-disclosure note to "Agentic contributions": prefer the
  commit message, PR description as a fallback.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 AI_POLICY.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/AI_POLICY.md b/AI_POLICY.md
index 4f3ddfbba48ed..44694aaee91d0 100644
--- a/AI_POLICY.md
+++ b/AI_POLICY.md
@@ -16,7 +16,7 @@ This applies whether you wrote the code yourself, used AI as a coding assistant,
 
 ## Keep conversations human
 
-GitHub discussions (issues, PR descriptions, review threads) are how our community thinks together. Honestly, if a response is thoughtful and on point, does it matter whether a human wrote every word? We don't think so. What we'd rather avoid is raw AI output forwarded into a thread without review — that's not engaging with feedback, it's delegating it.
+For discussions under issues, PR descriptions, and review threads, it works best when real people are behind the messages. Feel free to use AI to polish grammar or tighten a response, but the core ideas should be yours.
 
 ## Quality over volume
 
@@ -34,6 +34,8 @@ We'd also love if you could like or dislike each AI comment. It only takes a sec
 
 Agentic PRs aren't a special category. They're held to exactly the same bar as any other contribution: the code should be understood by the person submitting it, covered by unit tests, and validated with integration or end-to-end tests where appropriate. If you're using an agent to help you build something, that's great. We'd just ask that you've read, understood, and tested what it produced before submitting.
 
+If your PR was substantially or fully generated by an agent, please mention the model used (e.g., "Generated with Claude Sonnet 4.6") in the commit message — or at minimum the PR description. It's not a requirement for mixed workflows where AI was just a coding assistant, but it's useful context for reviewers when the model did most of the heavy lifting.
+
 ---
 
 That's it. If something isn't covered here, the underlying principle is: please be considerate of reviewers' time, and take ownership of the work you submit. We really appreciate your contributions.

From 2a3c5d89de23ee9b65d97fd038c2eb8bdbf98578 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 1 Jun 2026 13:10:39 -0400
Subject: [PATCH 295/326] fix(vdev): use CUE raw string for VRL changelog in
 release prepare (#25553)

---
 vdev/src/commands/release/prepare.rs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/vdev/src/commands/release/prepare.rs b/vdev/src/commands/release/prepare.rs
index 9fc317869cf6e..eaab1a482c1d5 100644
--- a/vdev/src/commands/release/prepare.rs
+++ b/vdev/src/commands/release/prepare.rs
@@ -433,8 +433,8 @@ fn format_vrl_changelog_block(changelog: &str) -> String {
         .collect::<Vec<_>>()
         .join("\n");
 
-    let opening = "\tvrl_changelog: \"\"\"";
-    let closing = format!("{double_tab}\"\"\"");
+    let opening = "\tvrl_changelog: #\"\"\"";
+    let closing = format!("{double_tab}\"\"\"#");
 
     format!("{opening}\n{body}\n{closing}")
 }
@@ -547,11 +547,11 @@ mod tests {
         let vrl_changelog_block = format_vrl_changelog_block(vrl_changelog);
 
         let expected = concat!(
-            "\tvrl_changelog: \"\"\"\n",
+            "\tvrl_changelog: #\"\"\"\n",
             "\t\t#### [0.2.0]\n",
             "\t\t- Feature\n",
             "\t\t- Fix\n",
-            "\t\t\"\"\""
+            "\t\t\"\"\"#"
         );
 
         assert_eq!(vrl_changelog_block, expected);

From b017893944effcc9c2904c1d5e4cdfb871c8f41b Mon Sep 17 00:00:00 2001
From: Bruce Guenter <bruce.guenter@datadoghq.com>
Date: Mon, 1 Jun 2026 11:34:03 -0600
Subject: [PATCH 296/326] fix(logstash source): preserve writer windows when
 generating ACKs (#25531)

* fix(logstash source): preserve writer windows when generating ACKs

Filebeat expects ACKs to remain within the current Lumberjack writer window.
The logstash source decoder was ignoring WindowSize frames and the receiver
could later batch frames from multiple windows together before building an ACK.
When that happened, Vector could ACK the highest sequence in the merged batch
instead of the last sequence in the current window.

That behavior could surface as "invalid sequence number received" on the sender
side and could contribute to reconnects and duplicate retransmits under load.

Fix this by preserving writer window boundaries during decode, tracking which
decoded frames close a window, and emitting one ACK frame per completed window
when a batched read contains multiple windows. This keeps the existing batching
behavior in the generic TCP path while making the logstash receiver respect the
expected ACK semantics.

Also add unit tests that demonstrate the bug with both sequence resets and
monotonic sequences across adjacent windows.

* Revert incomplete window handling regression

* Simplify logic in LogstashAcker::new

* Add unit test for acking a partial window and assert all decoded sequence numbers

* Use a SmallVec for the acknowledgements
---
 changelog.d/25531_logstash_ack_windows.fix.md |   3 +
 src/sources/logstash.rs                       | 375 ++++++++++++++++--
 2 files changed, 340 insertions(+), 38 deletions(-)
 create mode 100644 changelog.d/25531_logstash_ack_windows.fix.md

diff --git a/changelog.d/25531_logstash_ack_windows.fix.md b/changelog.d/25531_logstash_ack_windows.fix.md
new file mode 100644
index 0000000000000..786406ab211a4
--- /dev/null
+++ b/changelog.d/25531_logstash_ack_windows.fix.md
@@ -0,0 +1,3 @@
+Fixed the `logstash` source to preserve writer window boundaries when generating ACKs. This prevents batched reads from producing ACK sequences that advance past the current window, which could lead to "invalid sequence number received" errors and duplicate retransmits under load.
+
+authors: bruceg
diff --git a/src/sources/logstash.rs b/src/sources/logstash.rs
index a643ce0af73ba..a8b6c6b389e28 100644
--- a/src/sources/logstash.rs
+++ b/src/sources/logstash.rs
@@ -3,6 +3,7 @@ use std::{
     convert::TryFrom,
     io::{self, Read},
     net::SocketAddr,
+    num::NonZeroUsize,
     time::Duration,
 };
 
@@ -264,39 +265,47 @@ impl TcpSource for LogstashSource {
 }
 
 struct LogstashAcker {
-    sequence_number: u32,
-    protocol_version: Option<LogstashProtocolVersion>,
+    // Batched reads can contain multiple writer windows. Preserve a separate
+    // ACK point for each completed window so Filebeat never sees an ACK that
+    // advances past the current window it is waiting on. If the batch ends in
+    // the middle of a window, ACK the last received event in that final ACK
+    // domain so clients are not forced to wait for the advertised window size.
+    // Lumberjack defines WindowSize as a maximum unacked count, so a sender can
+    // legitimately advertise a fresh window after a previously ACKed partial
+    // tail. Within a single ReadyFrames batch, the only incomplete ACK domain
+    // we can represent independently is the final tail we have actually seen.
+    // We expect most batches to need only one ACK point, either for a single
+    // completed window or for one partial tail. Multiple ACKs are only needed
+    // when ReadyFrames coalesces multiple logical windows into one batch.
+    acknowledgements: SmallVec<[(LogstashProtocolVersion, u32); 1]>,
 }
 
 impl LogstashAcker {
     fn new(frames: &[LogstashEventFrame]) -> Self {
-        let mut sequence_number = 0;
-        let mut protocol_version = None;
-
-        for frame in frames {
-            sequence_number = std::cmp::max(sequence_number, frame.sequence_number);
-            // We assume that it's valid to ack via any of the protocol versions that we've seen in
-            // a set of frames from a single stream, so here we just take the last. In reality, we
-            // do not expect stream with multiple protocol versions to occur.
-            protocol_version = Some(frame.protocol);
-        }
-
-        Self {
-            sequence_number,
-            protocol_version,
-        }
+        let acknowledgements = frames
+            .iter()
+            .enumerate()
+            // ACK each completed writer window and the last frame in a partial batch if ReadyFrames
+            // flushes before the current window is complete.
+            .filter(|(index, frame)| frame.window_end || index + 1 == frames.len())
+            .map(|(_, frame)| (frame.protocol, frame.sequence_number))
+            .collect();
+
+        Self { acknowledgements }
     }
 }
 
 impl TcpSourceAcker for LogstashAcker {
     // https://github.com/logstash-plugins/logstash-input-beats/blob/master/PROTOCOL.md#ack-frame-type
     fn build_ack(self, ack: TcpSourceAck) -> Option<Bytes> {
-        match (ack, self.protocol_version) {
-            (TcpSourceAck::Ack, Some(protocol_version)) => {
-                let mut bytes: Vec<u8> = Vec::with_capacity(6);
-                bytes.push(protocol_version.into());
-                bytes.push(LogstashFrameType::Ack.into());
-                bytes.extend(self.sequence_number.to_be_bytes().iter());
+        match ack {
+            TcpSourceAck::Ack if !self.acknowledgements.is_empty() => {
+                let mut bytes: Vec<u8> = Vec::with_capacity(self.acknowledgements.len() * 6);
+                for (protocol_version, sequence_number) in self.acknowledgements {
+                    bytes.push(protocol_version.into());
+                    bytes.push(LogstashFrameType::Ack.into());
+                    bytes.extend(sequence_number.to_be_bytes().iter());
+                }
                 Some(Bytes::from(bytes))
             }
             _ => None,
@@ -315,12 +324,51 @@ enum LogstashDecoderReadState {
 #[derive(Debug)]
 struct LogstashDecoder {
     state: LogstashDecoderReadState,
+    // Tracks how many events remain in the current writer window. This lets us
+    // preserve sender window boundaries even if ReadyFrames later batches
+    // multiple decoded windows together before ACKing.
+    window_events_remaining: Option<NonZeroUsize>,
 }
 
 impl LogstashDecoder {
     const fn new() -> Self {
+        Self::new_with_window_events_remaining(None)
+    }
+
+    const fn new_with_window_events_remaining(
+        window_events_remaining: Option<NonZeroUsize>,
+    ) -> Self {
         Self {
             state: LogstashDecoderReadState::ReadProtocol,
+            window_events_remaining,
+        }
+    }
+
+    /// Marks whether a decoded frame closes the current writer window.
+    ///
+    /// Filebeat expects ACKs to stay within the current window announced by the
+    /// most recent `WindowSize` frame. The generic TCP batching layer can merge
+    /// frames from multiple windows before we build an ACK, so we record the
+    /// per-frame window boundary here and let the acker emit one ACK frame per
+    /// completed window later.
+    ///
+    /// If a sender omits `WindowSize`, we keep the previous behavior and treat
+    /// each standalone frame as ACKable on its own.
+    const fn annotate_frame(&mut self, frame: &mut LogstashEventFrame) {
+        match self.window_events_remaining {
+            Some(remaining) if remaining.get() == 1 => {
+                frame.window_end = true;
+                self.window_events_remaining = None;
+            }
+            Some(remaining) => {
+                frame.window_end = false;
+                self.window_events_remaining = NonZeroUsize::new(remaining.get() - 1); // safe because we know remaining is greater than 1
+            }
+            None => {
+                // Preserve existing behavior for inputs that send standalone data frames
+                // without an explicit WindowSize frame.
+                frame.window_end = true;
+            }
         }
     }
 }
@@ -440,6 +488,12 @@ struct LogstashEventFrame {
     protocol: LogstashProtocolVersion,
     sequence_number: u32,
     fields: BTreeMap<KeyString, serde_json::Value>,
+    window_end: bool,
+}
+
+struct DecodedCompressedFrames {
+    frames: VecDeque<(LogstashEventFrame, usize)>,
+    window_events_remaining: Option<NonZeroUsize>,
 }
 
 // Based on spec at: https://github.com/logstash-plugins/logstash-input-beats/blob/master/PROTOCOL.md
@@ -492,8 +546,15 @@ impl Decoder for LogstashDecoder {
                     }
                 }
                 // The window size indicates how many events the writer will send before waiting
-                // for acks. As we forward events as we get them, and ack as they are received, we
-                // do not need to keep track of this.
+                // for acks. We preserve this boundary so the acker can emit one ACK per
+                // completed window, even if multiple windows are batched together later.
+                // Filebeat accepts cumulative ACKs, but not ACKs that advance past the
+                // current writer window it is waiting on. WindowSize is a maximum unacked
+                // count, not necessarily an exact count of immediately following frames, so a
+                // sender can legitimately advertise a new window after a previously ACKed
+                // partial tail. If a malformed sender does this before that earlier tail has
+                // actually been ACKed, we tolerate the reset here even though it can collapse
+                // the older incomplete domain into the new one.
                 //
                 // https://github.com/logstash-plugins/logstash-input-beats/blob/master/PROTOCOL.md#window-size-frame-type
                 LogstashDecoderReadState::ReadFrame(_protocol, LogstashFrameType::WindowSize) => {
@@ -501,7 +562,8 @@ impl Decoder for LogstashDecoder {
                         return Ok(None);
                     }
 
-                    let _window_size = src.get_u32();
+                    let window_size = src.get_u32() as usize;
+                    self.window_events_remaining = NonZeroUsize::new(window_size);
 
                     LogstashDecoderReadState::ReadProtocol
                 }
@@ -519,27 +581,37 @@ impl Decoder for LogstashDecoder {
                 }
                 // https://github.com/logstash-plugins/logstash-input-beats/blob/master/PROTOCOL.md#data-frame-type
                 LogstashDecoderReadState::ReadFrame(protocol, LogstashFrameType::Data) => {
-                    let Some(frame) = decode_data_frame(protocol, src) else {
+                    let Some((mut frame, byte_size)) = decode_data_frame(protocol, src) else {
                         return Ok(None);
                     };
+                    self.annotate_frame(&mut frame);
 
-                    LogstashDecoderReadState::PendingFrames([frame].into())
+                    LogstashDecoderReadState::PendingFrames([(frame, byte_size)].into())
                 }
                 // https://github.com/logstash-plugins/logstash-input-beats/blob/master/PROTOCOL.md#json-frame-type
                 LogstashDecoderReadState::ReadFrame(protocol, LogstashFrameType::Json) => {
-                    let Some(frame) = decode_json_frame(protocol, src)? else {
+                    let Some((mut frame, byte_size)) = decode_json_frame(protocol, src)? else {
                         return Ok(None);
                     };
+                    self.annotate_frame(&mut frame);
 
-                    LogstashDecoderReadState::PendingFrames([frame].into())
+                    LogstashDecoderReadState::PendingFrames([(frame, byte_size)].into())
                 }
                 // https://github.com/logstash-plugins/logstash-input-beats/blob/master/PROTOCOL.md#compressed-frame-type
+                //
+                // The compressed payload is still part of the same logical Lumberjack stream, so
+                // the nested decoder must inherit the current window state and return the updated
+                // state after expanding the payload. Re-annotating the emitted frames here would
+                // overwrite any WindowSize boundaries that were established inside the compressed
+                // payload and can also lose progress from a partially consumed outer window.
                 LogstashDecoderReadState::ReadFrame(_protocol, LogstashFrameType::Compressed) => {
-                    let Some(frames) = decode_compressed_frame(src)? else {
+                    let Some(decoded) = decode_compressed_frame(src, self.window_events_remaining)?
+                    else {
                         return Ok(None);
                     };
+                    self.window_events_remaining = decoded.window_events_remaining;
 
-                    LogstashDecoderReadState::PendingFrames(frames)
+                    LogstashDecoderReadState::PendingFrames(decoded.frames)
                 }
             };
         }
@@ -581,6 +653,7 @@ fn decode_data_frame(
             protocol,
             sequence_number,
             fields,
+            window_end: false,
         },
         byte_size,
     ))
@@ -639,6 +712,7 @@ fn decode_json_frame(
             protocol,
             sequence_number,
             fields,
+            window_end: false,
         },
         byte_size,
     )))
@@ -646,7 +720,8 @@ fn decode_json_frame(
 
 fn decode_compressed_frame(
     src: &mut BytesMut,
-) -> Result<Option<VecDeque<(LogstashEventFrame, usize)>>, DecodeError> {
+    window_events_remaining: Option<NonZeroUsize>,
+) -> Result<Option<DecodedCompressedFrames>, DecodeError> {
     let mut rest = src.as_ref();
 
     if rest.remaining() < 4 {
@@ -674,14 +749,17 @@ fn decode_compressed_frame(
 
     let mut buf = res?;
 
-    let mut decoder = LogstashDecoder::new();
+    let mut decoder = LogstashDecoder::new_with_window_events_remaining(window_events_remaining);
 
     let mut frames = VecDeque::new();
 
     while let Some(s) = decoder.decode(&mut buf)? {
         frames.push_back(s);
     }
-    Ok(Some(frames))
+    Ok(Some(DecodedCompressedFrames {
+        frames,
+        window_events_remaining: decoder.window_events_remaining,
+    }))
 }
 
 fn bytes_remaining(src: &BytesMut, rest: &[u8]) -> usize {
@@ -709,10 +787,14 @@ impl From<LogstashEventFrame> for SmallVec<[Event; 1]> {
 
 #[cfg(test)]
 mod test {
+    use std::io::Write;
+
     use bytes::BufMut;
-    use futures::Stream;
+    use flate2::{Compression, write::ZlibEncoder};
+    use futures::{Stream, StreamExt, stream};
     use rand::{Rng, rng};
     use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    use vector_lib::codecs::ReadyFrames;
     use vector_lib::lookup::OwnedTargetPath;
     use vrl::value::kind::Collection;
 
@@ -791,8 +873,7 @@ mod test {
         assert!(log.get("timestamp").is_some());
     }
 
-    fn encode_req(seq: u32, pairs: &[(&str, &str)]) -> Bytes {
-        let mut req = BytesMut::new();
+    fn push_req(req: &mut BytesMut, seq: u32, pairs: &[(&str, &str)]) {
         req.put_u8(b'2');
         req.put_u8(b'D');
         req.put_u32(seq);
@@ -803,9 +884,127 @@ mod test {
             req.put_u32(value.len() as u32);
             req.put(value.as_bytes());
         }
+    }
+
+    fn encode_req(seq: u32, pairs: &[(&str, &str)]) -> Bytes {
+        let mut req = BytesMut::new();
+        push_req(&mut req, seq, pairs);
         req.into()
     }
 
+    fn push_window_size(req: &mut BytesMut, size: u32) {
+        req.put_u8(b'2');
+        req.put_u8(b'W');
+        req.put_u32(size);
+    }
+
+    fn push_compressed(req: &mut BytesMut, inner: &[u8]) {
+        let mut encoder = ZlibEncoder::new(Vec::new(), Compression::default());
+        encoder.write_all(inner).unwrap();
+        let compressed = encoder.finish().unwrap();
+
+        req.put_u8(b'2');
+        req.put_u8(b'C');
+        req.put_u32(compressed.len() as u32);
+        req.put(compressed.as_slice());
+    }
+
+    fn decode_frames(mut src: BytesMut) -> Vec<(LogstashEventFrame, usize)> {
+        let mut decoder = LogstashDecoder::new();
+        let mut frames = Vec::new();
+
+        while let Some(frame) = decoder.decode(&mut src).unwrap() {
+            frames.push(frame);
+        }
+
+        assert_eq!(src.len(), 0);
+        frames
+    }
+
+    fn decode_acknowledgements(mut ack: Bytes) -> Vec<u32> {
+        let mut acknowledgements = Vec::new();
+
+        while !ack.is_empty() {
+            assert!(
+                ack.len() >= 6,
+                "ack stream ended with {} trailing bytes",
+                ack.len()
+            );
+            assert_eq!(ack.get_u8(), b'2');
+            assert_eq!(ack.get_u8(), b'A');
+            acknowledgements.push(ack.get_u32());
+        }
+
+        acknowledgements
+    }
+
+    fn decoded_sequence_numbers(decoded: &[(LogstashEventFrame, usize)]) -> Vec<u32> {
+        decoded
+            .iter()
+            .map(|(frame, _)| frame.sequence_number)
+            .collect::<Vec<_>>()
+    }
+
+    fn assert_decoded_sequences(
+        decoded: &[(LogstashEventFrame, usize)],
+        expected_sequences: &[u32],
+    ) {
+        assert_eq!(decoded_sequence_numbers(decoded), expected_sequences);
+    }
+
+    async fn assert_acknowledgements_for_ready_frames(
+        decoded: Vec<(LogstashEventFrame, usize)>,
+        expected_sequences: &[u32],
+        expected_acknowledgements: &[u32],
+    ) {
+        assert_decoded_sequences(&decoded, expected_sequences);
+
+        let stream = stream::iter(decoded.into_iter().map(Ok::<_, DecodeError>));
+        let mut ready = ReadyFrames::with_capacity(stream, 16);
+        let (frames, _) = ready.next().await.unwrap().unwrap();
+
+        let ack = LogstashAcker::new(&frames)
+            .build_ack(TcpSourceAck::Ack)
+            .unwrap();
+        let acknowledgements = decode_acknowledgements(ack);
+
+        assert!(ready.next().await.is_none());
+        assert_eq!(acknowledgements, expected_acknowledgements);
+    }
+
+    fn decode_frames_and_assert_sequences(
+        src: BytesMut,
+        expected_sequences: &[u32],
+    ) -> Vec<(LogstashEventFrame, usize)> {
+        let decoded = decode_frames(src);
+        assert_decoded_sequences(&decoded, expected_sequences);
+        decoded
+    }
+
+    fn decode_frames_with_decoder(
+        decoder: &mut LogstashDecoder,
+        mut src: BytesMut,
+    ) -> Vec<(LogstashEventFrame, usize)> {
+        let mut frames = Vec::new();
+
+        while let Some(frame) = decoder.decode(&mut src).unwrap() {
+            frames.push(frame);
+        }
+
+        assert_eq!(src.len(), 0);
+        frames
+    }
+
+    fn decode_frames_with_decoder_and_assert_sequences(
+        decoder: &mut LogstashDecoder,
+        src: BytesMut,
+        expected_sequences: &[u32],
+    ) -> Vec<(LogstashEventFrame, usize)> {
+        let decoded = decode_frames_with_decoder(decoder, src);
+        assert_decoded_sequences(&decoded, expected_sequences);
+        decoded
+    }
+
     #[test]
     fn v1_decoder_does_not_panic() {
         let seq = rng().random_range(1..u32::MAX);
@@ -818,6 +1017,106 @@ mod test {
         }
     }
 
+    #[tokio::test]
+    async fn distinct_windows_do_not_share_an_ack_domain() {
+        let mut req = BytesMut::new();
+        push_window_size(&mut req, 1);
+        push_req(&mut req, 1, &[("message", "first window")]);
+        push_window_size(&mut req, 2);
+        push_req(&mut req, 1, &[("message", "second window first")]);
+        push_req(&mut req, 2, &[("message", "second window second")]);
+
+        let decoded = decode_frames_and_assert_sequences(req, &[1, 1, 2]);
+        assert_acknowledgements_for_ready_frames(decoded, &[1, 1, 2], &[1, 2]).await;
+    }
+
+    #[tokio::test]
+    async fn distinct_windows_with_monotonic_sequences_ack_the_first_window() {
+        let mut req = BytesMut::new();
+        push_window_size(&mut req, 2);
+        push_req(&mut req, 1, &[("message", "first window first")]);
+        push_req(&mut req, 2, &[("message", "first window second")]);
+        push_window_size(&mut req, 2);
+        push_req(&mut req, 3, &[("message", "second window first")]);
+        push_req(&mut req, 4, &[("message", "second window second")]);
+
+        let decoded = decode_frames_and_assert_sequences(req, &[1, 2, 3, 4]);
+        assert_acknowledgements_for_ready_frames(decoded, &[1, 2, 3, 4], &[2, 4]).await;
+    }
+
+    #[tokio::test]
+    async fn incomplete_final_window_is_acked_to_the_last_received_event() {
+        let mut req = BytesMut::new();
+        push_window_size(&mut req, 4);
+        push_req(&mut req, 1, &[("message", "only event in partial window")]);
+
+        let decoded = decode_frames_and_assert_sequences(req, &[1]);
+        assert_acknowledgements_for_ready_frames(decoded, &[1], &[1]).await;
+    }
+
+    #[tokio::test]
+    async fn compressed_frames_preserve_inner_window_boundaries() {
+        let mut inner = BytesMut::new();
+        push_window_size(&mut inner, 2);
+        push_req(&mut inner, 1, &[("message", "compressed first")]);
+        push_req(&mut inner, 2, &[("message", "compressed second")]);
+
+        let mut req = BytesMut::new();
+        push_compressed(&mut req, &inner);
+
+        let decoded = decode_frames_and_assert_sequences(req, &[1, 2]);
+        assert_acknowledgements_for_ready_frames(decoded, &[1, 2], &[2]).await;
+    }
+
+    #[tokio::test]
+    async fn single_window_split_across_ready_frames_keeps_progressive_acks() {
+        let mut req = BytesMut::new();
+        push_window_size(&mut req, 4);
+        push_req(&mut req, 1, &[("message", "first")]);
+        push_req(&mut req, 2, &[("message", "second")]);
+        push_req(&mut req, 3, &[("message", "third")]);
+        push_req(&mut req, 4, &[("message", "fourth")]);
+
+        let decoded = decode_frames_and_assert_sequences(req, &[1, 2, 3, 4]);
+
+        let stream = stream::iter(decoded.into_iter().map(Ok::<_, DecodeError>));
+        let mut ready = ReadyFrames::with_capacity(stream, 2);
+        let mut acknowledgements = Vec::new();
+
+        while let Some(result) = ready.next().await {
+            let (frames, _byte_size) = result.unwrap();
+            let ack = LogstashAcker::new(&frames)
+                .build_ack(TcpSourceAck::Ack)
+                .unwrap();
+            acknowledgements.push(decode_acknowledgements(ack));
+        }
+
+        assert_eq!(acknowledgements, vec![vec![2], vec![4]]);
+    }
+
+    #[tokio::test]
+    async fn fresh_window_after_acked_partial_tail_is_accepted() {
+        let mut decoder = LogstashDecoder::new();
+
+        let mut first_batch = BytesMut::new();
+        push_window_size(&mut first_batch, 2);
+        push_req(&mut first_batch, 1, &[("message", "first partial tail")]);
+        let decoded =
+            decode_frames_with_decoder_and_assert_sequences(&mut decoder, first_batch, &[1]);
+        assert_acknowledgements_for_ready_frames(decoded, &[1], &[1]).await;
+
+        let mut second_batch = BytesMut::new();
+        push_window_size(&mut second_batch, 1);
+        push_req(
+            &mut second_batch,
+            1,
+            &[("message", "fresh window after ack")],
+        );
+        let decoded =
+            decode_frames_with_decoder_and_assert_sequences(&mut decoder, second_batch, &[1]);
+        assert_acknowledgements_for_ready_frames(decoded, &[1], &[1]).await;
+    }
+
     async fn send_req(address: SocketAddr, pairs: &[(&str, &str)], sends_ack: bool) {
         let seq = rng().random_range(1..u32::MAX);
         let mut socket = tokio::net::TcpStream::connect(address).await.unwrap();

From 067ef75e6474e885203885826f0d1f8ca2f93897 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 1 Jun 2026 14:45:28 -0400
Subject: [PATCH 297/326] fix(vdev): emit breaking: true for .breaking.md
 changelog fragments (#25556)

---
 vdev/src/commands/release/generate_cue.rs | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/vdev/src/commands/release/generate_cue.rs b/vdev/src/commands/release/generate_cue.rs
index 5ac95237029eb..64f3d98b483d4 100644
--- a/vdev/src/commands/release/generate_cue.rs
+++ b/vdev/src/commands/release/generate_cue.rs
@@ -416,6 +416,7 @@ impl ConventionalParts {
 struct ChangelogEntry {
     /// Mapped CUE type ("chore" | "fix" | "feat" | "enhancement").
     cue_type: String,
+    breaking: bool,
     description: String,
     contributors: Vec<String>,
 }
@@ -451,6 +452,7 @@ fn parse_changelog_fragment(path: &Path) -> Result<ChangelogEntry> {
         );
     }
     let fragment_type = parts[1];
+    let breaking = fragment_type == "breaking";
     let cue_type = match fragment_type {
         "breaking" | "deprecation" => "chore",
         "security" | "fix" => "fix",
@@ -478,6 +480,7 @@ fn parse_changelog_fragment(path: &Path) -> Result<ChangelogEntry> {
 
     Ok(ChangelogEntry {
         cue_type: cue_type.to_string(),
+        breaking,
         description,
         contributors,
     })
@@ -542,6 +545,9 @@ fn render_changelog(entries: &[ChangelogEntry]) -> String {
             let mut s = String::new();
             s.push_str("\t\t{\n");
             writeln!(s, "\t\t\ttype: {}", json!(e.cue_type)).unwrap();
+            if e.breaking {
+                s.push_str("\t\t\tbreaking: true\n");
+            }
             s.push_str("\t\t\tdescription: #\"\"\"\n");
             for line in e.description.lines() {
                 writeln!(s, "\t\t\t\t{line}").unwrap();
@@ -666,6 +672,9 @@ mod tests {
 
         // No-author entries get empty contributor list.
         assert!(entries[1].contributors.is_empty());
+        // Breaking fragments must be marked as such.
+        assert!(entries[1].breaking);
+        assert!(!entries[0].breaking);
     }
 
     #[test]
@@ -680,11 +689,13 @@ mod tests {
         let entries = vec![
             ChangelogEntry {
                 cue_type: "feat".into(),
+                breaking: false,
                 description: "Adds a thing.\nMulti-line.".into(),
                 contributors: vec!["alice".into()],
             },
             ChangelogEntry {
                 cue_type: "fix".into(),
+                breaking: false,
                 description: "Fixed it.".into(),
                 contributors: vec![],
             },

From 29b089daf44056173bf3f4467df257217fdbfb2a Mon Sep 17 00:00:00 2001
From: Yoenn Burban <62966490+gwenaskell@users.noreply.github.com>
Date: Tue, 2 Jun 2026 19:30:11 +0200
Subject: [PATCH 298/326] fix(observability): propagate component span into
 spawned tasks (#25521)

* fix(observability): propagate component span into spawned tasks

Several components spawn background `tokio` tasks without carrying the
current tracing span, so internal metrics/logs emitted from that work
lost their component tags (component_id, component_kind, component_type).

Wrap spawned futures with `in_current_span()` (or, for the Datadog logs
and metrics sinks driving `concurrent_map`, instrument the mapped future
inside the closure) so the owning component's span is preserved.

`ConcurrentMap` itself no longer instruments the spawned future; that is
now the caller's responsibility, documented inline. The fanout detached
send is intentionally left un-instrumented (it drains a sink unrelated to
the upstream component that owns the fanout), with a comment explaining
why.

Signed-off-by: Yoenn Burban <yoenn.burban@datadoghq.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

* cargo fmt

* add a helper function

* fix fmt

* move helper to vector_common

* added rt feature to vector_common cargo file

* add a regression test

* apply limit to test shutdown duration

* fix clippy

---------

Signed-off-by: Yoenn Burban <yoenn.burban@datadoghq.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 Cargo.toml                                    |  1 +
 .../spawned_task_component_tags.fix.md        |  3 +
 lib/file-source/src/file_server.rs            |  2 +-
 .../src/variants/disk_v2/ledger.rs            |  2 +-
 lib/vector-common/Cargo.toml                  |  2 +-
 lib/vector-common/src/lib.rs                  | 16 +++++
 lib/vector-core/src/fanout.rs                 |  4 ++
 lib/vector-lib/src/lib.rs                     |  3 +-
 lib/vector-stream/src/concurrent_map.rs       |  5 ++
 lib/vector-tap/src/controller.rs              |  4 +-
 src/api/grpc/service.rs                       |  2 +-
 src/api/grpc_server.rs                        |  2 +-
 src/gcp.rs                                    |  2 +-
 src/lib.rs                                    |  2 +
 src/secrets/exec.rs                           |  2 +-
 src/sinks/blackhole/sink.rs                   |  2 +-
 src/sinks/datadog/logs/sink.rs                | 18 +++--
 src/sinks/datadog/metrics/sink.rs             | 18 +++--
 src/sinks/datadog/traces/config.rs            |  2 +-
 src/sinks/mqtt/sink.rs                        |  2 +-
 src/sinks/prometheus/exporter.rs              |  2 +-
 src/sinks/redis/sink.rs                       |  2 +-
 src/sinks/splunk_hec/common/service.rs        |  2 +-
 src/sinks/util/sink.rs                        |  2 +-
 src/sinks/websocket_server/sink.rs            | 49 ++++++-------
 src/sources/aws_s3/sqs.rs                     |  3 +-
 src/sources/aws_sqs/source.rs                 | 33 ++++-----
 src/sources/docker_logs/mod.rs                | 56 +++++++--------
 src/sources/exec/mod.rs                       |  2 +-
 src/sources/file.rs                           |  2 +-
 src/sources/gcp_pubsub.rs                     |  2 +-
 src/sources/journald.rs                       |  4 +-
 src/sources/kafka.rs                          |  2 +-
 src/sources/kubernetes_logs/mod.rs            |  6 +-
 src/sources/postgresql_metrics.rs             |  4 +-
 src/sources/splunk_hec/acknowledgements.rs    |  4 +-
 src/sources/util/framestream.rs               |  2 +-
 src/sources/windows_event_log/mod.rs          |  4 +-
 src/topology/builder.rs                       |  4 +-
 src/transforms/throttle/rate_limiter.rs       |  2 +-
 tests/vector_api/harness.rs                   |  5 +-
 tests/vector_api/top.rs                       | 69 +++++++++++++++++++
 42 files changed, 228 insertions(+), 127 deletions(-)
 create mode 100644 changelog.d/spawned_task_component_tags.fix.md

diff --git a/Cargo.toml b/Cargo.toml
index 5af6296d39720..6d9ac547423bd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1125,6 +1125,7 @@ vector-api-tests = [
   "api",
   "api-client-minimal",
   "sources-demo_logs",
+  "sources-gcp_pubsub",
   "transforms-log_to_metric",
   "transforms-remap",
   "transforms-route",
diff --git a/changelog.d/spawned_task_component_tags.fix.md b/changelog.d/spawned_task_component_tags.fix.md
new file mode 100644
index 0000000000000..d2f5c2bb068a1
--- /dev/null
+++ b/changelog.d/spawned_task_component_tags.fix.md
@@ -0,0 +1,3 @@
+Internal telemetry (metrics and logs) emitted from work that Vector runs on spawned `tokio` tasks now correctly inherits the owning component's tags (`component_id`, `component_kind`, `component_type`). Previously, several components spawned background tasks without propagating the tracing span, so some internal events emitted from those tasks were missing their component tags. Affected emissions include the `datadog_logs` sink's `component_discarded_events_total` (events too large to encode), the `gcp_pubsub` source's `component_errors_total`/`component_discarded_events_total` from its per-stream tasks, and the `splunk_hec` sinks' acknowledgement-handling `component_errors_total`.
+
+authors: gwenaskell
diff --git a/lib/file-source/src/file_server.rs b/lib/file-source/src/file_server.rs
index 87a436298ca16..17d80cf1586a4 100644
--- a/lib/file-source/src/file_server.rs
+++ b/lib/file-source/src/file_server.rs
@@ -148,7 +148,7 @@ where
         let mut stats = TimingStats::default();
 
         // Spawn the checkpoint writer task
-        let checkpoint_task_handle = tokio::spawn(checkpoint_writer(
+        let checkpoint_task_handle = vector_common::spawn_in_current_span(checkpoint_writer(
             checkpointer,
             self.glob_minimum_cooldown,
             shutdown_checkpointer,
diff --git a/lib/vector-buffers/src/variants/disk_v2/ledger.rs b/lib/vector-buffers/src/variants/disk_v2/ledger.rs
index e63fc5fb16973..a2d1c68f8d8e5 100644
--- a/lib/vector-buffers/src/variants/disk_v2/ledger.rs
+++ b/lib/vector-buffers/src/variants/disk_v2/ledger.rs
@@ -700,7 +700,7 @@ where
     #[must_use]
     pub(super) fn spawn_finalizer(self: Arc<Self>) -> OrderedFinalizer<u64> {
         let (finalizer, mut stream) = OrderedFinalizer::new(None);
-        tokio::spawn(async move {
+        vector_common::spawn_in_current_span(async move {
             while let Some((_status, amount)) = stream.next().await {
                 self.increment_pending_acks(amount);
                 self.notify_writer_waiters();
diff --git a/lib/vector-common/Cargo.toml b/lib/vector-common/Cargo.toml
index a583641c68cec..b329b981aa64c 100644
--- a/lib/vector-common/Cargo.toml
+++ b/lib/vector-common/Cargo.toml
@@ -50,7 +50,7 @@ serde_json.workspace = true
 smallvec = { version = "1", default-features = false }
 strum.workspace = true
 stream-cancel = { version = "0.8.2", default-features = false }
-tokio = { workspace = true, features = ["macros", "time"] }
+tokio = { workspace = true, features = ["macros", "rt", "time"] }
 tracing.workspace = true
 vrl.workspace = true
 vector-config.workspace = true
diff --git a/lib/vector-common/src/lib.rs b/lib/vector-common/src/lib.rs
index 75849aac75884..cda7e4b921242 100644
--- a/lib/vector-common/src/lib.rs
+++ b/lib/vector-common/src/lib.rs
@@ -130,3 +130,19 @@ pub type Error = Box<dyn std::error::Error + Send + Sync + 'static>;
 /// Vector's basic result type, defined in terms of [`Error`] and generic over
 /// `T`.
 pub type Result<T> = std::result::Result<T, Error>;
+
+/// Spawn a future on the current tokio runtime, propagating the current tracing span into the
+/// spawned task.  This ensures that any logs or internal metrics emitted by the task retain the
+/// component tags (`component_id`, `component_kind`, `component_type`) of the caller.
+///
+/// Prefer this over `tokio::spawn(future.in_current_span())` to keep call sites concise.
+#[track_caller]
+pub fn spawn_in_current_span<T>(
+    task: impl std::future::Future<Output = T> + Send + 'static,
+) -> tokio::task::JoinHandle<T>
+where
+    T: Send + 'static,
+{
+    use tracing::Instrument as _;
+    tokio::spawn(task.in_current_span())
+}
diff --git a/lib/vector-core/src/fanout.rs b/lib/vector-core/src/fanout.rs
index 33ff30ae3e72a..500b6b8583c51 100644
--- a/lib/vector-core/src/fanout.rs
+++ b/lib/vector-core/src/fanout.rs
@@ -358,6 +358,10 @@ impl<'a> SendGroup<'a> {
 
     fn try_detach_send(&mut self, id: &ComponentKey) -> bool {
         if let Some(send) = self.sends.remove(id) {
+            // Deliberately not instrumented with the current span: this drains a send to a sink
+            // that has just been detached from the topology, so it is unrelated to the upstream
+            // component that owns this fanout. Attaching the current span would mis-tag this
+            // task's logs with the upstream component's identity rather than the detached sink's.
             tokio::spawn(async move {
                 if let Err(e) = send.await {
                     warn!(
diff --git a/lib/vector-lib/src/lib.rs b/lib/vector-lib/src/lib.rs
index ae62fd9053438..1247085a058a3 100644
--- a/lib/vector-lib/src/lib.rs
+++ b/lib/vector-lib/src/lib.rs
@@ -13,7 +13,8 @@ pub use vector_common::{
     Error, NamedInternalEvent, Result, TimeZone, assert_event_data_eq, atomic, btreemap,
     byte_size_of, byte_size_of::ByteSizeOf, conversion, counter, encode_logfmt, finalization,
     finalizer, gauge, histogram, id, impl_event_data_eq, internal_event, json_size,
-    registered_event, request_metadata, sensitive_string, shutdown, stats, trigger,
+    registered_event, request_metadata, sensitive_string, shutdown, spawn_in_current_span, stats,
+    trigger,
 };
 pub use vector_config as configurable;
 pub use vector_config::impl_generate_config_from_default;
diff --git a/lib/vector-stream/src/concurrent_map.rs b/lib/vector-stream/src/concurrent_map.rs
index 6b2920db1cc68..6dde7a31f7bbe 100644
--- a/lib/vector-stream/src/concurrent_map.rs
+++ b/lib/vector-stream/src/concurrent_map.rs
@@ -72,6 +72,11 @@ where
                     Poll::Pending | Poll::Ready(None) => break,
                     Poll::Ready(Some(item)) => {
                         let fut = (this.f)(item);
+                        // `ConcurrentMap` does not instrument the spawned future itself: the
+                        // mapping closure runs on a detached task, so the current span at poll
+                        // time is not necessarily meaningful for the work being performed. It is
+                        // the caller's responsibility to propagate any span (e.g. the owning
+                        // component's span for internal metric/log tagging) into `fut`.
                         let handle = tokio::spawn(fut);
                         this.in_flight.push_back(handle);
                     }
diff --git a/lib/vector-tap/src/controller.rs b/lib/vector-tap/src/controller.rs
index 2a8208179f3e8..f0b19ecde5a72 100644
--- a/lib/vector-tap/src/controller.rs
+++ b/lib/vector-tap/src/controller.rs
@@ -214,7 +214,7 @@ impl TapController {
 fn shutdown_trigger(control_tx: fanout::ControlChannel, sink_id: ComponentKey) -> ShutdownTx {
     let (shutdown_tx, shutdown_rx) = oneshot::channel();
 
-    tokio::spawn(async move {
+    vector_common::spawn_in_current_span(async move {
         _ = shutdown_rx.await;
         if control_tx
             .send(fanout::ControlMessage::Remove(sink_id.clone()))
@@ -366,7 +366,7 @@ async fn tap_handler(
                             );
                             let mut tap_transformer = TapTransformer::new(tx.clone(), output.clone());
 
-                            tokio::spawn(async move {
+                            vector_common::spawn_in_current_span(async move {
                                 while let Some(events) = tap_buffer_rx.next().await {
                                     tap_transformer.try_send(events);
                                 }
diff --git a/src/api/grpc/service.rs b/src/api/grpc/service.rs
index 110ef9d5ba441..e1e0808619db9 100644
--- a/src/api/grpc/service.rs
+++ b/src/api/grpc/service.rs
@@ -676,7 +676,7 @@ impl observability::Service for ObservabilityService {
 
         let watch_rx = self.watch_rx.clone();
 
-        tokio::spawn(async move {
+        crate::spawn_in_current_span(async move {
             let _tap_controller = TapController::new(watch_rx, tap_tx, patterns);
             let mut tap_rx = ReceiverStream::new(tap_rx);
             let mut interval = time::interval(time::Duration::from_millis(interval_ms));
diff --git a/src/api/grpc_server.rs b/src/api/grpc_server.rs
index 715aeecad2b8e..f582b2f82981c 100644
--- a/src/api/grpc_server.rs
+++ b/src/api/grpc_server.rs
@@ -80,7 +80,7 @@ impl GrpcServer {
         let router_serving = Arc::clone(&serving);
 
         // Spawn the server with the already-bound listener
-        tokio::spawn(async move {
+        crate::spawn_in_current_span(async move {
             // Build reflection service for tools like grpcurl
             let reflection_service = tonic_reflection::server::Builder::configure()
                 .register_encoded_file_descriptor_set(
diff --git a/src/gcp.rs b/src/gcp.rs
index 9a0ff365a69ee..89fec86770e0b 100644
--- a/src/gcp.rs
+++ b/src/gcp.rs
@@ -194,7 +194,7 @@ impl GcpAuthenticator {
 
     pub fn spawn_regenerate_token(&self) -> watch::Receiver<()> {
         let (sender, receiver) = watch::channel(());
-        tokio::spawn(self.clone().token_regenerator(sender));
+        crate::spawn_in_current_span(self.clone().token_regenerator(sender));
         receiver
     }
 
diff --git a/src/lib.rs b/src/lib.rs
index 8d26a3b080ecf..fc05f14cc92eb 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -241,6 +241,8 @@ pub fn get_hostname() -> std::io::Result<String> {
     })
 }
 
+pub(crate) use vector_lib::spawn_in_current_span;
+
 /// Spawn a task with the given name. The name is only used if
 /// built with [`tokio_unstable`][tokio_unstable].
 ///
diff --git a/src/secrets/exec.rs b/src/secrets/exec.rs
index 081c752c2b36a..2a6e8c464065f 100644
--- a/src/secrets/exec.rs
+++ b/src/secrets/exec.rs
@@ -179,7 +179,7 @@ async fn query_backend(
         .ok_or("unable to acquire stdout")?;
 
     let query = serde_json::to_vec(&query)?;
-    tokio::spawn(async move { stdin.write_all(&query).await });
+    crate::spawn_in_current_span(async move { stdin.write_all(&query).await });
 
     let timeout = time::sleep(time::Duration::from_secs(timeout));
     tokio::pin!(timeout);
diff --git a/src/sinks/blackhole/sink.rs b/src/sinks/blackhole/sink.rs
index ff0744913cc8b..8796c7425f691 100644
--- a/src/sinks/blackhole/sink.rs
+++ b/src/sinks/blackhole/sink.rs
@@ -57,7 +57,7 @@ impl StreamSink<EventArray> for BlackholeSink {
 
         if self.config.print_interval_secs.as_secs() > 0 {
             let interval_dur = self.config.print_interval_secs;
-            tokio::spawn(async move {
+            crate::spawn_in_current_span(async move {
                 let mut print_interval = interval(interval_dur);
                 loop {
                     select! {
diff --git a/src/sinks/datadog/logs/sink.rs b/src/sinks/datadog/logs/sink.rs
index 0abf4bed1ade5..5fb5e2189fa10 100644
--- a/src/sinks/datadog/logs/sink.rs
+++ b/src/sinks/datadog/logs/sink.rs
@@ -2,6 +2,7 @@ use std::{collections::VecDeque, fmt::Debug, io, sync::Arc};
 
 use itertools::Itertools;
 use snafu::Snafu;
+use tracing::Instrument;
 use vector_lib::{
     event::{ObjectMap, Value},
     internal_event::{ComponentEventsDropped, UNINTENTIONAL},
@@ -393,12 +394,19 @@ where
             .concurrent_map(default_request_builder_concurrency_limit(), move |input| {
                 let builder = Arc::clone(&builder);
 
-                Box::pin(async move {
-                    let (api_key, events) = input;
-                    let api_key = api_key.unwrap_or_else(|| Arc::clone(&builder.default_api_key));
+                // `concurrent_map` spawns this future on a detached task. The closure itself runs
+                // within `run_inner`'s span, so `in_current_span` captures the sink span here and
+                // re-enters it on the spawned task to preserve the sink's automatic component tags.
+                Box::pin(
+                    async move {
+                        let (api_key, events) = input;
+                        let api_key =
+                            api_key.unwrap_or_else(|| Arc::clone(&builder.default_api_key));
 
-                    builder.build_request(events, api_key)
-                })
+                        builder.build_request(events, api_key)
+                    }
+                    .in_current_span(),
+                )
             })
             .filter_map(|request| async move {
                 match request {
diff --git a/src/sinks/datadog/metrics/sink.rs b/src/sinks/datadog/metrics/sink.rs
index 1cd075a831d9c..a366cc81150c8 100644
--- a/src/sinks/datadog/metrics/sink.rs
+++ b/src/sinks/datadog/metrics/sink.rs
@@ -8,6 +8,7 @@ use futures_util::{
     stream::{self, BoxStream},
 };
 use tower::Service;
+use tracing::Instrument;
 use vector_lib::{
     event::{Event, Metric, MetricValue},
     partition::Partitioner,
@@ -136,11 +137,18 @@ where
             .concurrent_map(
                 default_request_builder_concurrency_limit(),
                 |((api_key, endpoint), metrics)| {
-                    Box::pin(async move {
-                        let collapsed_metrics =
-                            sort_and_collapse_counters_by_series_and_timestamp(metrics);
-                        ((api_key, endpoint), collapsed_metrics)
-                    })
+                    // `concurrent_map` spawns this future on a detached task. The closure itself
+                    // runs within `run_inner`'s span, so `in_current_span` captures the sink span
+                    // here and re-enters it on the spawned task to preserve the sink's automatic
+                    // component tags on any internal metrics/logs emitted during aggregation.
+                    Box::pin(
+                        async move {
+                            let collapsed_metrics =
+                                sort_and_collapse_counters_by_series_and_timestamp(metrics);
+                            ((api_key, endpoint), collapsed_metrics)
+                        }
+                        .in_current_span(),
+                    )
                 },
             )
             // We build our requests "incrementally", which means that for a single batch of metrics, we might generate
diff --git a/src/sinks/datadog/traces/config.rs b/src/sinks/datadog/traces/config.rs
index 7ace1b75f9817..00682514dadc1 100644
--- a/src/sinks/datadog/traces/config.rs
+++ b/src/sinks/datadog/traces/config.rs
@@ -178,7 +178,7 @@ impl DatadogTracesConfig {
         // Send the APM stats payloads independently of the sink framework.
         // This is necessary to comply with what the APM stats backend of Datadog expects with
         // respect to receiving stats payloads.
-        tokio::spawn(flush_apm_stats_thread(
+        crate::spawn_in_current_span(flush_apm_stats_thread(
             tripwire,
             client,
             compression,
diff --git a/src/sinks/mqtt/sink.rs b/src/sinks/mqtt/sink.rs
index cc69c8d6b9ff8..e9feb7bb0144e 100644
--- a/src/sinks/mqtt/sink.rs
+++ b/src/sinks/mqtt/sink.rs
@@ -60,7 +60,7 @@ impl MqttSink {
         let (client, mut connection) = self.connector.connect();
 
         // This is necessary to keep the mqtt event loop moving forward.
-        tokio::spawn(async move {
+        crate::spawn_in_current_span(async move {
             loop {
                 // If an error is returned here there is currently no way to tie this back
                 // to the event that was posted which means we can't accurately provide
diff --git a/src/sinks/prometheus/exporter.rs b/src/sinks/prometheus/exporter.rs
index 6072bc8274ea0..8ed514b638fa0 100644
--- a/src/sinks/prometheus/exporter.rs
+++ b/src/sinks/prometheus/exporter.rs
@@ -466,7 +466,7 @@ impl PrometheusExporter {
         let tls = MaybeTlsSettings::from_config(tls.as_ref(), true)?;
         let listener = tls.bind(&address).await?;
 
-        tokio::spawn(async move {
+        crate::spawn_in_current_span(async move {
             info!(message = "Building HTTP server.", address = %address);
 
             Server::builder(hyper::server::accept::from_stream(listener.accept_stream()))
diff --git a/src/sinks/redis/sink.rs b/src/sinks/redis/sink.rs
index 274d2b103cf86..b3719d01e514a 100644
--- a/src/sinks/redis/sink.rs
+++ b/src/sinks/redis/sink.rs
@@ -139,7 +139,7 @@ impl RedisConnection {
         Ok(Self::Sentinel {
             connection_send: conn_tx,
             connection_recv: conn_rx,
-            repair_task: Arc::new(tokio::spawn(async move {
+            repair_task: Arc::new(crate::spawn_in_current_span(async move {
                 Self::repair_connection_manager_task(
                     sentinel,
                     service_name,
diff --git a/src/sinks/splunk_hec/common/service.rs b/src/sinks/splunk_hec/common/service.rs
index 095da254d832b..3b1c68c876561 100644
--- a/src/sinks/splunk_hec/common/service.rs
+++ b/src/sinks/splunk_hec/common/service.rs
@@ -58,7 +58,7 @@ where
         let max_pending_acks = indexer_acknowledgements.max_pending_acks.get();
         let tx = if let Some(ack_client) = ack_client {
             let (tx, rx) = mpsc::channel(128);
-            tokio::spawn(run_acknowledgements(
+            crate::spawn_in_current_span(run_acknowledgements(
                 rx,
                 ack_client,
                 Arc::clone(&http_request_builder),
diff --git a/src/sinks/util/sink.rs b/src/sinks/util/sink.rs
index f8dd31c67f129..e9c35c94f3e70 100644
--- a/src/sinks/util/sink.rs
+++ b/src/sinks/util/sink.rs
@@ -323,7 +323,7 @@ where
                     this.lingers.remove(partition);
 
                     let batch = batch.finish();
-                    let future = tokio::spawn(this.service.call(batch));
+                    let future = crate::spawn_in_current_span(this.service.call(batch));
 
                     if let Some(map) = this.in_flight.as_mut() {
                         map.insert(partition.clone(), future.map(|_| ()).fuse().boxed());
diff --git a/src/sinks/websocket_server/sink.rs b/src/sinks/websocket_server/sink.rs
index 77da730fbbdda..ea38d88fdac7f 100644
--- a/src/sinks/websocket_server/sink.rs
+++ b/src/sinks/websocket_server/sink.rs
@@ -37,7 +37,6 @@ use tokio_tungstenite::tungstenite::{
     handshake::server::{ErrorResponse, Request, Response},
 };
 use tokio_util::codec::Encoder as _;
-use tracing::Instrument;
 use url::Url;
 use uuid::Uuid;
 use vector_lib::{
@@ -129,20 +128,17 @@ impl WebSocketListenerSink {
         let open_gauge = OpenGauge::new();
 
         while let Ok(stream) = listener.accept().await {
-            tokio::spawn(
-                Self::handle_connection(
-                    auth.clone(),
-                    message_buffering.clone(),
-                    subprotocol.clone(),
-                    Arc::clone(&peers),
-                    Arc::clone(&client_checkpoints),
-                    Arc::clone(&buffer),
-                    stream,
-                    extra_tags_config.clone(),
-                    open_gauge.clone(),
-                )
-                .in_current_span(),
-            );
+            crate::spawn_in_current_span(Self::handle_connection(
+                auth.clone(),
+                message_buffering.clone(),
+                subprotocol.clone(),
+                Arc::clone(&peers),
+                Arc::clone(&client_checkpoints),
+                Arc::clone(&buffer),
+                stream,
+                extra_tags_config.clone(),
+                open_gauge.clone(),
+            ));
         }
     }
 
@@ -360,19 +356,16 @@ impl StreamSink<Event> for WebSocketListenerSink {
         )));
         let client_checkpoints = Arc::new(Mutex::new(HashMap::default()));
 
-        tokio::spawn(
-            Self::handle_connections(
-                self.auth,
-                self.message_buffering.clone(),
-                self.subprotocol.clone(),
-                Arc::clone(&peers),
-                self.extra_tags_config,
-                Arc::clone(&client_checkpoints),
-                Arc::clone(&message_buffer),
-                listener,
-            )
-            .in_current_span(),
-        );
+        crate::spawn_in_current_span(Self::handle_connections(
+            self.auth,
+            self.message_buffering.clone(),
+            self.subprotocol.clone(),
+            Arc::clone(&peers),
+            self.extra_tags_config,
+            Arc::clone(&client_checkpoints),
+            Arc::clone(&message_buffer),
+            listener,
+        ));
 
         while input.as_mut().peek().await.is_some() {
             let mut event = input.next().await.unwrap();
diff --git a/src/sources/aws_s3/sqs.rs b/src/sources/aws_s3/sqs.rs
index 9ad5b47be61cc..802bdf5d38f0e 100644
--- a/src/sources/aws_s3/sqs.rs
+++ b/src/sources/aws_s3/sqs.rs
@@ -28,7 +28,6 @@ use smallvec::SmallVec;
 use snafu::{ResultExt, Snafu};
 use tokio::{pin, select};
 use tokio_util::codec::FramedRead;
-use tracing::Instrument;
 use vector_lib::{
     codecs::decoding::FramingError,
     config::{LegacyKey, LogNamespace, log_schema},
@@ -358,7 +357,7 @@ impl Ingestor {
                 acknowledgements,
             );
             let fut = process.run();
-            let handle = tokio::spawn(fut.in_current_span());
+            let handle = crate::spawn_in_current_span(fut);
             handles.push(handle);
         }
 
diff --git a/src/sources/aws_sqs/source.rs b/src/sources/aws_sqs/source.rs
index f8afdb9365ca9..7dc7c01e735e0 100644
--- a/src/sources/aws_sqs/source.rs
+++ b/src/sources/aws_sqs/source.rs
@@ -7,7 +7,6 @@ use aws_sdk_sqs::{
 use chrono::{DateTime, TimeZone, Utc};
 use futures::{FutureExt, StreamExt};
 use tokio::{pin, select};
-use tracing_futures::Instrument;
 use vector_lib::{
     config::LogNamespace,
     finalizer::UnorderedFinalizer,
@@ -50,16 +49,13 @@ impl SqsSource {
             let (finalizer, mut ack_stream) = Finalizer::new(Some(shutdown.clone()));
             let client = self.client.clone();
             let queue_url = self.queue_url.clone();
-            tokio::spawn(
-                async move {
-                    while let Some((status, receipts)) = ack_stream.next().await {
-                        if status == BatchStatus::Delivered {
-                            delete_messages(client.clone(), receipts, queue_url.clone()).await;
-                        }
+            crate::spawn_in_current_span(async move {
+                while let Some((status, receipts)) = ack_stream.next().await {
+                    if status == BatchStatus::Delivered {
+                        delete_messages(client.clone(), receipts, queue_url.clone()).await;
                     }
                 }
-                .in_current_span(),
-            );
+            });
             Arc::new(finalizer)
         });
         let events_received = register!(EventsReceived);
@@ -70,19 +66,16 @@ impl SqsSource {
             let mut out = out.clone();
             let finalizer = finalizer.clone();
             let events_received = events_received.clone();
-            task_handles.push(tokio::spawn(
-                async move {
-                    let finalizer = finalizer.as_ref();
-                    pin!(shutdown);
-                    loop {
-                        select! {
-                            _ = &mut shutdown => break,
-                            _ = source.run_once(&mut out, finalizer, events_received.clone()) => {},
-                        }
+            task_handles.push(crate::spawn_in_current_span(async move {
+                let finalizer = finalizer.as_ref();
+                pin!(shutdown);
+                loop {
+                    select! {
+                        _ = &mut shutdown => break,
+                        _ = source.run_once(&mut out, finalizer, events_received.clone()) => {},
                     }
                 }
-                .in_current_span(),
-            ));
+            }));
         }
 
         // Wait for all of the processes to finish.  If any one of them panics, we resume
diff --git a/src/sources/docker_logs/mod.rs b/src/sources/docker_logs/mod.rs
index 45268788d45cc..8c3ef9bac102f 100644
--- a/src/sources/docker_logs/mod.rs
+++ b/src/sources/docker_logs/mod.rs
@@ -22,7 +22,6 @@ use chrono::{DateTime, FixedOffset, Local, ParseError, Utc};
 use futures::{Stream, StreamExt};
 use serde_with::serde_as;
 use tokio::sync::mpsc;
-use tracing_futures::Instrument;
 use vector_lib::{
     codecs::{BytesDeserializer, BytesDeserializerConfig},
     config::{LegacyKey, LogNamespace},
@@ -740,39 +739,36 @@ impl EventStreamBuilder {
     /// Spawn a task to runs event stream until shutdown.
     fn start(&self, id: ContainerId, backoff: Option<Duration>) -> ContainerState {
         let this = self.clone();
-        tokio::spawn(
-            async move {
-                if let Some(duration) = backoff {
-                    tokio::time::sleep(duration).await;
-                }
+        crate::spawn_in_current_span(async move {
+            if let Some(duration) = backoff {
+                tokio::time::sleep(duration).await;
+            }
 
-                match this
-                    .core
-                    .docker
-                    .inspect_container(id.as_str(), None::<InspectContainerOptions>)
-                    .await
-                {
-                    Ok(details) => match ContainerMetadata::from_details(details) {
-                        Ok(metadata) => {
-                            let info = ContainerLogInfo::new(id, metadata, this.core.now_timestamp);
-                            this.run_event_stream(info).await;
-                            return;
-                        }
-                        Err(error) => emit!(DockerLogsTimestampParseError {
-                            error,
-                            container_id: id.as_str()
-                        }),
-                    },
-                    Err(error) => emit!(DockerLogsContainerMetadataFetchError {
+            match this
+                .core
+                .docker
+                .inspect_container(id.as_str(), None::<InspectContainerOptions>)
+                .await
+            {
+                Ok(details) => match ContainerMetadata::from_details(details) {
+                    Ok(metadata) => {
+                        let info = ContainerLogInfo::new(id, metadata, this.core.now_timestamp);
+                        this.run_event_stream(info).await;
+                        return;
+                    }
+                    Err(error) => emit!(DockerLogsTimestampParseError {
                         error,
                         container_id: id.as_str()
                     }),
-                }
-
-                this.finish(Err((id, ErrorPersistence::Transient)));
+                },
+                Err(error) => emit!(DockerLogsContainerMetadataFetchError {
+                    error,
+                    container_id: id.as_str()
+                }),
             }
-            .in_current_span(),
-        );
+
+            this.finish(Err((id, ErrorPersistence::Transient)));
+        });
 
         ContainerState::new_running()
     }
@@ -781,7 +777,7 @@ impl EventStreamBuilder {
     fn restart(&self, container: &mut ContainerState) {
         if let Some(info) = container.take_info() {
             let this = self.clone();
-            tokio::spawn(this.run_event_stream(info).in_current_span());
+            crate::spawn_in_current_span(this.run_event_stream(info));
         }
     }
 
diff --git a/src/sources/exec/mod.rs b/src/sources/exec/mod.rs
index b87452ef107d1..48e3c14454d11 100644
--- a/src/sources/exec/mod.rs
+++ b/src/sources/exec/mod.rs
@@ -724,7 +724,7 @@ fn spawn_reader_thread<R: 'static + AsyncRead + Unpin + std::marker::Send>(
     sender: Sender<((SmallVec<[Event; 1]>, usize), &'static str)>,
 ) {
     // Start the green background thread for collecting
-    drop(tokio::spawn(async move {
+    drop(crate::spawn_in_current_span(async move {
         debug!("Start capturing {} command output.", origin);
 
         let mut stream = DecoderFramedRead::new(reader, decoder);
diff --git a/src/sources/file.rs b/src/sources/file.rs
index 93f4e188be97a..d485c6ad6b4b6 100644
--- a/src/sources/file.rs
+++ b/src/sources/file.rs
@@ -580,7 +580,7 @@ pub fn file_source(
         // checkpoints until all the acks have come in.
         let (send_shutdown, shutdown2) = oneshot::channel::<()>();
         let checkpoints = checkpointer.view();
-        tokio::spawn(async move {
+        crate::spawn_in_current_span(async move {
             while let Some((status, entry)) = ack_stream.next().await {
                 if status == BatchStatus::Delivered {
                     checkpoints.update(entry.file_id, entry.offset);
diff --git a/src/sources/gcp_pubsub.rs b/src/sources/gcp_pubsub.rs
index b01664b7ade63..ddf96d19acf70 100644
--- a/src/sources/gcp_pubsub.rs
+++ b/src/sources/gcp_pubsub.rs
@@ -453,7 +453,7 @@ impl PubsubSource {
         // when it has an idle interval it will mark itself as not
         // busy.
         let busy_flag = Arc::new(AtomicBool::new(false));
-        let task = tokio::spawn(self.clone().run(Arc::clone(&busy_flag)));
+        let task = crate::spawn_in_current_span(self.clone().run(Arc::clone(&busy_flag)));
         tasks.push(Task { task, busy_flag });
     }
 
diff --git a/src/sources/journald.rs b/src/sources/journald.rs
index c6177fba1eb6c..177ee5e91663c 100644
--- a/src/sources/journald.rs
+++ b/src/sources/journald.rs
@@ -519,7 +519,7 @@ impl JournaldSource {
         let events_received = register!(EventsReceived);
 
         // Spawn stderr handler task
-        let stderr_handler = tokio::spawn(Self::handle_stderr(stderr_stream));
+        let stderr_handler = crate::spawn_in_current_span(Self::handle_stderr(stderr_stream));
 
         let batch_size = self.batch_size;
         let result = loop {
@@ -1056,7 +1056,7 @@ impl Finalizer {
     ) -> Self {
         if acknowledgements {
             let (finalizer, mut ack_stream) = OrderedFinalizer::new(Some(shutdown));
-            tokio::spawn(async move {
+            crate::spawn_in_current_span(async move {
                 while let Some((status, cursor)) = ack_stream.next().await {
                     if status == BatchStatus::Delivered {
                         checkpointer.lock().await.set(cursor).await;
diff --git a/src/sources/kafka.rs b/src/sources/kafka.rs
index cae76d8e02059..f5927b365157b 100644
--- a/src/sources/kafka.rs
+++ b/src/sources/kafka.rs
@@ -455,7 +455,7 @@ async fn kafka_source(
             .map_or(config.session_timeout_ms / 2, Duration::from_millis);
         let consumer_state =
             ConsumerStateInner::<Consuming>::new(config, decoder, out, log_namespace, span);
-        tokio::spawn(async move {
+        crate::spawn_in_current_span(async move {
             coordinate_kafka_callbacks(
                 consumer,
                 callback_rx,
diff --git a/src/sources/kubernetes_logs/mod.rs b/src/sources/kubernetes_logs/mod.rs
index fa001972a59d7..04b26b4aa7c09 100644
--- a/src/sources/kubernetes_logs/mod.rs
+++ b/src/sources/kubernetes_logs/mod.rs
@@ -738,7 +738,7 @@ impl Source {
         let pod_state = pod_store_w.as_reader();
         let pod_cacher = MetaCache::new();
 
-        reflectors.push(tokio::spawn(custom_reflector(
+        reflectors.push(crate::spawn_in_current_span(custom_reflector(
             pod_store_w,
             pod_cacher,
             pod_watcher,
@@ -762,7 +762,7 @@ impl Source {
             )
             .backoff(watcher::DefaultBackoff::default());
 
-            reflectors.push(tokio::spawn(custom_reflector(
+            reflectors.push(crate::spawn_in_current_span(custom_reflector(
                 ns_store_w,
                 MetaCache::new(),
                 ns_watcher,
@@ -787,7 +787,7 @@ impl Source {
         let node_state = node_store_w.as_reader();
         let node_cacher = MetaCache::new();
 
-        reflectors.push(tokio::spawn(custom_reflector(
+        reflectors.push(crate::spawn_in_current_span(custom_reflector(
             node_store_w,
             node_cacher,
             node_watcher,
diff --git a/src/sources/postgresql_metrics.rs b/src/sources/postgresql_metrics.rs
index 96ae1ab3a1263..2854c50496174 100644
--- a/src/sources/postgresql_metrics.rs
+++ b/src/sources/postgresql_metrics.rs
@@ -295,7 +295,7 @@ impl PostgresqlClient {
                             endpoint: &self.endpoint,
                         }
                     })?;
-                tokio::spawn(connection);
+                crate::spawn_in_current_span(connection);
                 client
             }
             None => {
@@ -306,7 +306,7 @@ impl PostgresqlClient {
                         .with_context(|_| ConnectionFailedSnafu {
                             endpoint: &self.endpoint,
                         })?;
-                tokio::spawn(connection);
+                crate::spawn_in_current_span(connection);
                 client
             }
         };
diff --git a/src/sources/splunk_hec/acknowledgements.rs b/src/sources/splunk_hec/acknowledgements.rs
index 3f65b7d115f95..c1688acb9945d 100644
--- a/src/sources/splunk_hec/acknowledgements.rs
+++ b/src/sources/splunk_hec/acknowledgements.rs
@@ -106,7 +106,7 @@ impl IndexerAcknowledgement {
         let idle_task_channels = Arc::clone(&channels);
 
         if config.ack_idle_cleanup {
-            tokio::spawn(async move {
+            crate::spawn_in_current_span(async move {
                 let mut interval = interval(Duration::from_secs(max_idle_time));
                 loop {
                     interval.tick().await;
@@ -206,7 +206,7 @@ impl Channel {
         let ack_ids_status = Arc::new(Mutex::new(RoaringTreemap::new()));
         let finalizer_ack_ids_status = Arc::clone(&ack_ids_status);
         let (ack_event_finalizer, mut ack_stream) = UnorderedFinalizer::new(Some(shutdown));
-        tokio::spawn(async move {
+        crate::spawn_in_current_span(async move {
             while let Some((status, ack_id)) = ack_stream.next().await {
                 if status == BatchStatus::Delivered {
                     let mut ack_ids_status = finalizer_ack_ids_status.lock().unwrap();
diff --git a/src/sources/util/framestream.rs b/src/sources/util/framestream.rs
index a42bae5815322..9c96b2f3fc4ef 100644
--- a/src/sources/util/framestream.rs
+++ b/src/sources/util/framestream.rs
@@ -908,7 +908,7 @@ async fn spawn_event_handling_tasks(
 ) -> JoinHandle<()> {
     wait_for_task_quota(&active_task_nums, max_frame_handling_tasks).await;
 
-    tokio::spawn(async move {
+    crate::spawn_in_current_span(async move {
         future::ready({
             if let Some(evt) = event_handler.handle_event(received_from, event_data)
                 && event_sink.send_event(evt).await.is_err()
diff --git a/src/sources/windows_event_log/mod.rs b/src/sources/windows_event_log/mod.rs
index 9fb2cff142ee6..945bc99b54fd9 100644
--- a/src/sources/windows_event_log/mod.rs
+++ b/src/sources/windows_event_log/mod.rs
@@ -101,7 +101,7 @@ impl Finalizer {
                 OrderedFinalizer::<FinalizerEntry>::new(Some(shutdown.clone()));
 
             // Spawn background task to process acknowledgments and update checkpoints
-            tokio::spawn(async move {
+            crate::spawn_in_current_span(async move {
                 while let Some((status, entry)) = ack_stream.next().await {
                     if status == BatchStatus::Delivered {
                         if let Err(e) = checkpointer.set_batch(entry.bookmarks.clone()).await {
@@ -361,7 +361,7 @@ impl WindowsEventLogSource {
             }
         };
         let shutdown_watcher = shutdown.clone();
-        tokio::spawn(async move {
+        crate::spawn_in_current_span(async move {
             shutdown_watcher.await;
             unsafe {
                 let handle =
diff --git a/src/topology/builder.rs b/src/topology/builder.rs
index 6ed0206446597..9caa9e2f11378 100644
--- a/src/topology/builder.rs
+++ b/src/topology/builder.rs
@@ -1280,12 +1280,12 @@ impl Runner {
 
                             let mut t = self.transform.clone();
                             let mut outputs_buf = self.outputs.new_buf_with_capacity(len);
-                            let task = tokio::spawn(async move {
+                            let task = crate::spawn_in_current_span(async move {
                                 for events in input_arrays {
                                     t.transform_all(events, &mut outputs_buf);
                                 }
                                 outputs_buf
-                            }.in_current_span());
+                            });
                             in_flight.push_back(task);
                         }
                         None => {
diff --git a/src/transforms/throttle/rate_limiter.rs b/src/transforms/throttle/rate_limiter.rs
index 83f1b8de5384b..39a9cb63a4a63 100644
--- a/src/transforms/throttle/rate_limiter.rs
+++ b/src/transforms/throttle/rate_limiter.rs
@@ -25,7 +25,7 @@ where
         let rate_limiter = Arc::new(RateLimiter::dashmap_with_clock(quota, clock));
 
         let rate_limiter_clone = Arc::clone(&rate_limiter);
-        let flush_handle = tokio::spawn(async move {
+        let flush_handle = crate::spawn_in_current_span(async move {
             let mut interval = tokio::time::interval(flush_keys_interval);
             loop {
                 interval.tick().await;
diff --git a/tests/vector_api/harness.rs b/tests/vector_api/harness.rs
index ba79b521bba22..e9fc94daa562f 100644
--- a/tests/vector_api/harness.rs
+++ b/tests/vector_api/harness.rs
@@ -97,7 +97,10 @@ impl TestHarness {
         let mut cmd =
             Command::cargo_bin("vector").map_err(|e| format!("Failed to get cargo bin: {e}"))?;
 
-        cmd.arg("-c").arg(&config_path);
+        cmd.arg("-c")
+            .arg(&config_path)
+            .arg("--graceful-shutdown-limit-secs")
+            .arg("1");
 
         if watch_mode {
             cmd.arg("-w");
diff --git a/tests/vector_api/top.rs b/tests/vector_api/top.rs
index 79e94a094785c..931ccf10162c8 100644
--- a/tests/vector_api/top.rs
+++ b/tests/vector_api/top.rs
@@ -410,3 +410,72 @@ async fn multi_output_transform_reports_per_output_sent_events() {
         "Never received non-empty output_totals for splitter transform within timeout"
     );
 }
+
+/// Regression test: `component_errors_total` emitted from a spawned task must carry
+/// the component's tracing span so that the metric is labelled with `component_id`.
+///
+/// The gcp_pubsub source immediately tries to connect to a non-existent endpoint from
+/// inside a `tokio::spawn`-ed per-stream task.  Before the `spawn_in_current_span` fix
+/// the task ran without the component span, so the counter had no `component_id` tag
+/// and never appeared in the API's `ErrorsTotal` stream.  With the fix the tag is
+/// present and the stream delivers an entry for `component_id = "gcp"`.
+#[tokio::test]
+async fn gcp_pubsub_spawned_task_errors_carry_component_span() {
+    // Point the source at an unreachable local endpoint so the per-stream task
+    // immediately gets ECONNREFUSED, emitting GcpPubsubConnectError
+    // (component_errors_total) on every retry.
+    let mut runner = TestHarness::new(indoc! {"
+        sources:
+          gcp:
+            type: gcp_pubsub
+            project: test-project
+            subscription: test-subscription
+            endpoint: http://127.0.0.1:1
+            skip_authentication: true
+
+        sinks:
+          blackhole:
+            type: blackhole
+            inputs: ['gcp']
+    "})
+    .await
+    .expect("Failed to start Vector");
+
+    // Stream ErrorsTotal every 200 ms; look for a non-zero entry attributed to "gcp".
+    let mut stream = runner
+        .api_client()
+        .stream_component_metrics(MetricName::ErrorsTotal, 200)
+        .await
+        .expect("Failed to open errors_total stream");
+
+    let deadline = tokio::time::Instant::now() + EVENT_PROCESSING_TIMEOUT;
+    let mut found = false;
+
+    while tokio::time::Instant::now() < deadline {
+        match tokio::time::timeout(std::time::Duration::from_millis(500), stream.next()).await {
+            Ok(Some(Ok(msg))) => {
+                if msg.component_id == "gcp"
+                    && let Some(Value::Total(total)) = msg.value
+                {
+                    assert!(
+                        total.value > 0,
+                        "Expected a positive component_errors_total for 'gcp', got {}",
+                        total.value
+                    );
+                    found = true;
+                    break;
+                }
+            }
+            Ok(Some(Err(e))) => panic!("Stream error: {e}"),
+            Ok(None) => panic!("Stream ended unexpectedly"),
+            Err(_) => continue, // poll timeout, keep looping
+        }
+    }
+
+    assert!(
+        found,
+        "component_errors_total was never attributed to component_id='gcp' within the timeout. \
+         This means the spawned per-stream task ran without the component's tracing span, \
+         so its metrics counters had no component_id tag and were invisible to the API."
+    );
+}

From 5072d8b86de09962c1ef1aed9cd36db3ae9c5dd4 Mon Sep 17 00:00:00 2001
From: Pavlos Rontidis <pavlos.rontidis@gmail.com>
Date: Tue, 2 Jun 2026 15:31:35 -0400
Subject: [PATCH 299/326] docs(schemas): improve log_namespace docs and warn on
 log_schema (#25560)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 lib/vector-core/src/config/global_options.rs        | 6 +++++-
 src/config/schema.rs                                | 3 +++
 website/content/en/guides/level-up/log_namespace.md | 6 ++++++
 website/cue/reference/generated/configuration.cue   | 5 ++++-
 4 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/lib/vector-core/src/config/global_options.rs b/lib/vector-core/src/config/global_options.rs
index d86df49803552..2eb5fd3cdbda4 100644
--- a/lib/vector-core/src/config/global_options.rs
+++ b/lib/vector-core/src/config/global_options.rs
@@ -84,7 +84,11 @@ pub struct GlobalOptions {
     /// This is used if a component does not have its own specific log schema. All events use a log
     /// schema, whether or not the default is used, to assign event fields on incoming events.
     #[serde(default, skip_serializing_if = "crate::serde::is_default")]
-    #[configurable(metadata(docs::common = false, docs::required = false))]
+    #[configurable(metadata(
+        docs::common = false,
+        docs::required = false,
+        docs::warnings = "These settings are ignored when `schema.log_namespace` is set to `true`."
+    ))]
     pub log_schema: LogSchema,
 
     /// Telemetry options.
diff --git a/src/config/schema.rs b/src/config/schema.rs
index 6c7b6e52dae4d..a5b48945ce401 100644
--- a/src/config/schema.rs
+++ b/src/config/schema.rs
@@ -30,6 +30,8 @@ pub struct Options {
 
     /// Controls how metadata is stored in log events.
     ///
+    /// This feature is in beta and behavior may change.
+    ///
     /// When set to `false` (legacy mode), metadata fields like `host`, `timestamp`, and `source_type`
     /// are stored as top-level fields alongside your log data.
     ///
@@ -39,6 +41,7 @@ pub struct Options {
     /// See the [Log Namespacing guide](/guides/level-up/log_namespace/) for detailed information
     /// about when to use Vector namespace mode and how to migrate from legacy mode.
     #[configurable(metadata(
+        status = "beta",
         docs::warnings = "Enabling log namespacing currently does not work when disk buffers are used. Avoid combining `schema.log_namespace = true` with disk buffers until [#18574](https://github.com/vectordotdev/vector/issues/18574) is resolved."
     ))]
     pub log_namespace: Option<bool>,
diff --git a/website/content/en/guides/level-up/log_namespace.md b/website/content/en/guides/level-up/log_namespace.md
index 0782d91aac23c..8d86d585afb7e 100644
--- a/website/content/en/guides/level-up/log_namespace.md
+++ b/website/content/en/guides/level-up/log_namespace.md
@@ -23,6 +23,12 @@ If you encounter any issues please [report them here](https://github.com/vectord
 
 {{< /requirement >}}
 
+{{< warning >}}
+Enabling log namespacing does not work when disk buffers are used. Avoid combining
+`schema.log_namespace: true` with disk buffers until
+[#18574](https://github.com/vectordotdev/vector/issues/18574) is resolved.
+{{< /warning >}}
+
 ## Background
 
 Vector traditionally stored metadata (like `host`, `timestamp`, and `source_type`) as top-level
diff --git a/website/cue/reference/generated/configuration.cue b/website/cue/reference/generated/configuration.cue
index 198275e76e9b9..bafae5ee4fdce 100644
--- a/website/cue/reference/generated/configuration.cue
+++ b/website/cue/reference/generated/configuration.cue
@@ -433,6 +433,8 @@ generated: configuration: {
 					description: """
 						Controls how metadata is stored in log events.
 
+						This feature is in beta and behavior may change.
+
 						When set to `false` (legacy mode), metadata fields like `host`, `timestamp`, and `source_type`
 						are stored as top-level fields alongside your log data.
 
@@ -1498,7 +1500,8 @@ generated: configuration: {
 				"""
 			common:   false
 			required: false
-			group:    "schema"
+			warnings: ["These settings are ignored when `schema.log_namespace` is set to `true`."]
+			group: "schema"
 		}
 		metrics_storage_refresh_period: {
 			type: float: {}

From c0806d3b31323b1419ae39242b341ff008e0ac87 Mon Sep 17 00:00:00 2001
From: Yoenn Burban <62966490+gwenaskell@users.noreply.github.com>
Date: Wed, 3 Jun 2026 16:24:14 +0200
Subject: [PATCH 300/326] fix(metrics): correct CUE metric catalog
 discrepancies (#25559)

* fix(docs): correct buffer byte metric names in CUE documentation

The buffer byte metrics were documented under the old names
`buffer_received_event_bytes_total` and `buffer_sent_event_bytes_total`,
but the code emits `buffer_received_bytes_total` and
`buffer_sent_bytes_total` as defined in
`lib/vector-common/src/internal_event/metric_name.rs`
(BufferReceivedBytesTotal / BufferSentBytesTotal).

Users querying the documented names would find no data.

Fixes the HIGH-severity discrepancy identified in the telemetry
correctness report (section F1).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(docs): remove stale metrics from CUE documentation

The following metrics are documented in the CUE catalog but no longer
emitted by the code (absent from CounterName/GaugeName enums in
lib/vector-common/src/internal_event/metric_name.rs and from all
emit!() / counter!() / gauge!() call sites):

- connection_read_errors_total (syslog.cue)
- utf8_convert_errors_total (syslog.cue)
- stdin_reads_failed_total (sources/stdin.cue, internal_metrics.cue)
- protobuf_decode_errors_total (sources/vector.cue, sinks/vector.cue,
    internal_metrics.cue); replaced by component_errors_total
- send_errors_total (sinks/nats.cue, sinks/redis.cue,
    internal_metrics.cue); replaced by component_errors_total
- streams_total (sinks/loki.cue, internal_metrics.cue)
- invalid_record_total (internal_metrics.cue); replaced by
    component_errors_total
- timestamp_parse_errors_total (internal_metrics.cue); replaced by
    component_errors_total
- config_reload_rejected (internal_metrics.cue); replaced by
    component_errors_total with error_code="reload"
- config_reloaded (internal_metrics.cue); replaced by reloaded_total

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(docs): add missing metrics to CUE documentation

These metrics are emitted by the code (registered in
lib/vector-common/src/internal_event/metric_name.rs) but were absent
from the CUE catalog:

Buffer metrics (lib/vector-buffers/src/internal_events.rs):
- buffer_discarded_bytes_total
- buffer_errors_total

Adaptive concurrency metrics (src/internal_events/adaptive_concurrency.rs):
- adaptive_concurrency_back_pressure
- adaptive_concurrency_past_rtt_mean
- adaptive_concurrency_reached_limit

HTTP client metrics (src/internal_events/http_client.rs):
- http_client_errors_total
- http_client_error_rtt_seconds

Infrastructure metrics:
- active_endpoints (src/internal_events/open.rs)
- sqs_message_defer_succeeded_total (src/internal_events/aws_sqs.rs)
- k8s_event_namespace_annotation_failures_total
    (src/internal_events/kubernetes_logs.rs)
- k8s_event_node_annotation_failures_total
    (src/internal_events/kubernetes_logs.rs)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(docs): correct open_files type and remove phantom output tag from transform_buffer_*

open_files: documented as type "counter" but the code emits it as a
gauge via gauge!(GaugeName::OpenFiles) in
src/internal_events/file.rs. GaugeName is defined in
lib/vector-common/src/internal_event/metric_name.rs.

transform_buffer_*: all seven transform buffer metrics were documented
with an "output" tag. In production, the topology builder always
creates transform channel metrics with output=None
(src/topology/builder.rs: ChannelMetricMetadata::new(Transform, None)),
so the "output" label is never present. The tag has been removed from
all seven transform_buffer_* entries.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(docs): document buffer metric tags in CUE

Add the missing buffer_id, stage, and intentional labels to the internal metrics CUE schema so the documented buffer telemetry matches the runtime emitters.

Co-authored-by: Cursor <cursoragent@cursor.com>

* group all buffer tags in a helper

* add missing error type per codex suggestion

* use proper tags per codex review comment

* fmt

* document _buffer_error_code

* fmt

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 website/cue/reference/components/sinks.cue    |   4 +-
 .../cue/reference/components/sinks/loki.cue   |   4 +-
 .../cue/reference/components/sinks/nats.cue   |   4 +-
 .../cue/reference/components/sinks/redis.cue  |   4 +-
 .../cue/reference/components/sinks/vector.cue |   4 +-
 .../components/sources/internal_metrics.cue   | 262 ++++++++++--------
 .../reference/components/sources/stdin.cue    |   4 +-
 .../reference/components/sources/syslog.cue   |   4 +-
 .../reference/components/sources/vector.cue   |   1 -
 9 files changed, 150 insertions(+), 141 deletions(-)

diff --git a/website/cue/reference/components/sinks.cue b/website/cue/reference/components/sinks.cue
index 416df6cdb280d..b136783a31720 100644
--- a/website/cue/reference/components/sinks.cue
+++ b/website/cue/reference/components/sinks.cue
@@ -667,9 +667,9 @@ components: sinks: [Name=string]: {
 		buffer_size_events:                   components.sources.internal_metrics.output.metrics.buffer_size_events
 		buffer_events:                        components.sources.internal_metrics.output.metrics.buffer_events
 		buffer_received_events_total:         components.sources.internal_metrics.output.metrics.buffer_received_events_total
-		buffer_received_event_bytes_total:    components.sources.internal_metrics.output.metrics.buffer_received_event_bytes_total
+		buffer_received_bytes_total:          components.sources.internal_metrics.output.metrics.buffer_received_bytes_total
 		buffer_sent_events_total:             components.sources.internal_metrics.output.metrics.buffer_sent_events_total
-		buffer_sent_event_bytes_total:        components.sources.internal_metrics.output.metrics.buffer_sent_event_bytes_total
+		buffer_sent_bytes_total:              components.sources.internal_metrics.output.metrics.buffer_sent_bytes_total
 		component_discarded_events_total:     components.sources.internal_metrics.output.metrics.component_discarded_events_total
 		component_errors_total:               components.sources.internal_metrics.output.metrics.component_errors_total
 		component_received_events_count:      components.sources.internal_metrics.output.metrics.component_received_events_count
diff --git a/website/cue/reference/components/sinks/loki.cue b/website/cue/reference/components/sinks/loki.cue
index 2e6cccc93489b..442c96b8aff48 100644
--- a/website/cue/reference/components/sinks/loki.cue
+++ b/website/cue/reference/components/sinks/loki.cue
@@ -157,7 +157,5 @@ components: sinks: loki: {
 		}
 	}
 
-	telemetry: metrics: {
-		streams_total: components.sources.internal_metrics.output.metrics.streams_total
-	}
+	telemetry: metrics: {}
 }
diff --git a/website/cue/reference/components/sinks/nats.cue b/website/cue/reference/components/sinks/nats.cue
index 6649b606c41cf..c1fa9901e4199 100644
--- a/website/cue/reference/components/sinks/nats.cue
+++ b/website/cue/reference/components/sinks/nats.cue
@@ -62,7 +62,5 @@ components: sinks: nats: {
 
 	how_it_works: components._nats.how_it_works
 
-	telemetry: metrics: {
-		send_errors_total: components.sources.internal_metrics.output.metrics.send_errors_total
-	}
+	telemetry: metrics: {}
 }
diff --git a/website/cue/reference/components/sinks/redis.cue b/website/cue/reference/components/sinks/redis.cue
index 753be721284e1..b023a363a2c2c 100644
--- a/website/cue/reference/components/sinks/redis.cue
+++ b/website/cue/reference/components/sinks/redis.cue
@@ -80,7 +80,5 @@ components: sinks: redis: {
 		}
 	}
 
-	telemetry: metrics: {
-		send_errors_total: components.sources.internal_metrics.output.metrics.send_errors_total
-	}
+	telemetry: metrics: {}
 }
diff --git a/website/cue/reference/components/sinks/vector.cue b/website/cue/reference/components/sinks/vector.cue
index f18f515b312ce..396bbd1adb92b 100644
--- a/website/cue/reference/components/sinks/vector.cue
+++ b/website/cue/reference/components/sinks/vector.cue
@@ -79,7 +79,5 @@ components: sinks: vector: {
 
 	how_it_works: components.sinks.vector.how_it_works
 
-	telemetry: metrics: {
-		protobuf_decode_errors_total: components.sources.internal_metrics.output.metrics.protobuf_decode_errors_total
-	}
+	telemetry: metrics: {}
 }
diff --git a/website/cue/reference/components/sources/internal_metrics.cue b/website/cue/reference/components/sources/internal_metrics.cue
index 1361148420fe5..d7a33596df37a 100644
--- a/website/cue/reference/components/sources/internal_metrics.cue
+++ b/website/cue/reference/components/sources/internal_metrics.cue
@@ -53,6 +53,12 @@ components: sources: internal_metrics: {
 		}
 
 		// Instance-level "process" metrics
+		active_endpoints: {
+			description:       "The number of active endpoints this component is sending data to."
+			type:              "gauge"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
 		active_clients: {
 			description:       "Number of clients attached to a component."
 			type:              "gauge"
@@ -164,6 +170,24 @@ components: sources: internal_metrics: {
 			default_namespace: "vector"
 			tags:              _component_tags
 		}
+		adaptive_concurrency_back_pressure: {
+			description:       "A histogram of whether back-pressure was applied during the current window."
+			type:              "histogram"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
+		adaptive_concurrency_past_rtt_mean: {
+			description:       "The mean round-trip time (RTT) from the past window."
+			type:              "histogram"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
+		adaptive_concurrency_reached_limit: {
+			description:       "A histogram of whether the concurrency limit was reached during the current window."
+			type:              "histogram"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
 		checkpoints_total: {
 			description:       "The total number of files checkpointed."
 			type:              "counter"
@@ -202,20 +226,6 @@ components: sources: internal_metrics: {
 			default_namespace: "vector"
 			tags:              _component_tags
 		}
-		connection_read_errors_total: {
-			description:       "The total number of errors reading datagram."
-			type:              "counter"
-			default_namespace: "vector"
-			tags: _component_tags & {
-				mode: {
-					description: ""
-					required:    true
-					enum: {
-						udp: "User Datagram Protocol"
-					}
-				}
-			}
-		}
 		container_processed_events_total: {
 			description:       "The total number of container events processed."
 			type:              "counter"
@@ -264,6 +274,18 @@ components: sources: internal_metrics: {
 			default_namespace: "vector"
 			tags:              _component_tags
 		}
+		k8s_event_namespace_annotation_failures_total: {
+			description:       "The total number of failures to annotate a Kubernetes event with namespace metadata."
+			type:              "counter"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
+		k8s_event_node_annotation_failures_total: {
+			description:       "The total number of failures to annotate a Kubernetes event with node metadata."
+			type:              "counter"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
 		events_discarded_total: {
 			description:       "The total number of events discarded by this component."
 			type:              "counter"
@@ -298,7 +320,7 @@ components: sources: internal_metrics: {
 			description:        "The number of bytes currently in the buffer."
 			type:               "gauge"
 			default_namespace:  "vector"
-			tags:               _component_tags
+			tags:               _buffer_tags
 			deprecated:         true
 			deprecated_message: "This metric has been deprecated in favor of [`buffer_size_bytes`](#buffer_size_bytes)."
 		}
@@ -306,7 +328,7 @@ components: sources: internal_metrics: {
 			description:        "The number of events currently in the buffer."
 			type:               "gauge"
 			default_namespace:  "vector"
-			tags:               _component_tags
+			tags:               _buffer_tags
 			deprecated:         true
 			deprecated_message: "This metric has been deprecated in favor of [`buffer_size_events`](#buffer_size_events)."
 		}
@@ -314,49 +336,77 @@ components: sources: internal_metrics: {
 			description:       "The number of bytes currently in the buffer."
 			type:              "gauge"
 			default_namespace: "vector"
-			tags:              _component_tags
+			tags:              _buffer_tags
 		}
 		buffer_size_events: {
 			description:       "The number of events currently in the buffer."
 			type:              "gauge"
 			default_namespace: "vector"
-			tags:              _component_tags
+			tags:              _buffer_tags
 		}
 		buffer_discarded_events_total: {
 			description:       "The number of events dropped by this non-blocking buffer."
 			type:              "counter"
 			default_namespace: "vector"
-			tags:              _component_tags
+			tags: _buffer_tags & {
+				intentional: {
+					description: "True if the events were discarded intentionally, like a `filter` transform, or false if due to an error."
+					required:    true
+				}
+			}
+		}
+		buffer_discarded_bytes_total: {
+			description:       "The number of bytes dropped by this non-blocking buffer."
+			type:              "counter"
+			default_namespace: "vector"
+			tags: _buffer_tags & {
+				intentional: {
+					description: "True if the events were discarded intentionally, like a `filter` transform, or false if due to an error."
+					required:    true
+				}
+			}
+		}
+		buffer_errors_total: {
+			description:       "The total number of errors encountered by this buffer."
+			type:              "counter"
+			default_namespace: "vector"
+			tags: _component_tags & {
+				error_code: _buffer_error_code
+				error_type: _error_type
+				stage:      _stage
+			}
 		}
-		buffer_received_event_bytes_total: {
+		buffer_received_bytes_total: {
 			description:       "The number of bytes received by this buffer."
 			type:              "counter"
 			default_namespace: "vector"
-			tags:              _component_tags
+			tags:              _buffer_tags
 		}
 		buffer_received_events_total: {
 			description:       "The number of events received by this buffer."
 			type:              "counter"
 			default_namespace: "vector"
-			tags:              _component_tags
+			tags:              _buffer_tags
 		}
 		buffer_send_duration_seconds: {
 			description:       "The duration spent sending a payload to this buffer."
 			type:              "histogram"
 			default_namespace: "vector"
-			tags:              _component_tags
+			tags: _component_tags & {
+				stage: _buffer_stage
+			}
 		}
-		buffer_sent_event_bytes_total: {
+		buffer_sent_bytes_total: {
 			description:       "The number of bytes sent by this buffer."
 			type:              "counter"
 			default_namespace: "vector"
-			tags:              _component_tags
+			tags:              _buffer_tags
 		}
 		buffer_sent_events_total: {
 			description:       "The number of events sent by this buffer."
 			type:              "counter"
 			default_namespace: "vector"
-			tags:              _component_tags
+			tags:              _buffer_tags
 		}
 		component_discarded_events_total: {
 			description:       "The number of events dropped by this component."
@@ -627,7 +677,7 @@ components: sources: internal_metrics: {
 		}
 		open_files: {
 			description:       "The total number of open files."
-			type:              "counter"
+			type:              "gauge"
 			default_namespace: "vector"
 			tags:              _component_tags
 		}
@@ -690,6 +740,28 @@ components: sources: internal_metrics: {
 			default_namespace: "vector"
 			tags:              _component_tags
 		}
+		http_client_errors_total: {
+			description:       "The total number of HTTP request errors."
+			type:              "counter"
+			default_namespace: "vector"
+			tags: _component_tags & {
+				error_kind: {
+					description: "The type of error returned by the HTTP client."
+					required:    true
+				}
+			}
+		}
+		http_client_error_rtt_seconds: {
+			description:       "The round-trip time (RTT) of failed HTTP requests."
+			type:              "histogram"
+			default_namespace: "vector"
+			tags: _component_tags & {
+				error_kind: {
+					description: "The type of error returned by the HTTP client."
+					required:    true
+				}
+			}
+		}
 		http_requests_total: {
 			description:       "The total number of HTTP requests issued by this component."
 			type:              "counter"
@@ -725,12 +797,6 @@ components: sources: internal_metrics: {
 				status: _status
 			}
 		}
-		invalid_record_total: {
-			description:       "The total number of invalid records that have been discarded."
-			type:              "counter"
-			default_namespace: "vector"
-			tags:              _component_tags
-		}
 		lua_memory_used_bytes: {
 			description:       "The total memory currently being used by the Lua runtime."
 			type:              "gauge"
@@ -755,18 +821,6 @@ components: sources: internal_metrics: {
 			default_namespace: "vector"
 			tags:              _internal_metrics_tags
 		}
-		protobuf_decode_errors_total: {
-			description:       "The total number of [Protocol Buffers](\(urls.protobuf)) errors thrown during communication between Vector instances."
-			type:              "counter"
-			default_namespace: "vector"
-			tags:              _component_tags
-		}
-		send_errors_total: {
-			description:       "The total number of errors sending messages."
-			type:              "counter"
-			default_namespace: "vector"
-			tags:              _component_tags
-		}
 		source_lag_time_seconds: {
 			description:       "The difference between the timestamp recorded in each event and the time when it was ingested, expressed as fractional seconds."
 			type:              "histogram"
@@ -851,12 +905,6 @@ components: sources: internal_metrics: {
 			default_namespace: "vector"
 			tags:              _component_tags
 		}
-		streams_total: {
-			description:       "The total number of streams."
-			type:              "counter"
-			default_namespace: "vector"
-			tags:              _component_tags
-		}
 		s3_object_processing_failed_duration_seconds: {
 			description:       "The time taken to process an S3 object that failed, in seconds."
 			type:              "histogram"
@@ -879,6 +927,12 @@ components: sources: internal_metrics: {
 				}
 			}
 		}
+		sqs_message_defer_succeeded_total: {
+			description:       "The total number of SQS messages successfully deferred."
+			type:              "counter"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
 		sqs_message_delete_succeeded_total: {
 			description:       "The total number of successful deletions of SQS messages."
 			type:              "counter"
@@ -924,12 +978,6 @@ components: sources: internal_metrics: {
 			default_namespace: "vector"
 			tags:              _component_tags
 		}
-		stdin_reads_failed_total: {
-			description:       "The total number of errors reading from stdin."
-			type:              "counter"
-			default_namespace: "vector"
-			tags:              _component_tags
-		}
 		tag_value_limit_exceeded_total: {
 			description: """
 				The total number of events discarded because the tag has been rejected after
@@ -957,29 +1005,19 @@ components: sources: internal_metrics: {
 				}
 			}
 		}
-		timestamp_parse_errors_total: {
-			description:       "The total number of errors encountered parsing [RFC 3339](\(urls.rfc_3339)) timestamps."
-			type:              "counter"
-			default_namespace: "vector"
-			tags:              _component_tags
-		}
 		transform_buffer_max_byte_size: {
-			description:       "The maximum number of bytes the buffer that feeds into a transform can hold."
-			type:              "gauge"
-			default_namespace: "vector"
-			tags: _component_tags & {
-				output: _output
-			}
+			description:        "The maximum number of bytes the buffer that feeds into a transform can hold."
+			type:               "gauge"
+			default_namespace:  "vector"
+			tags:               _component_tags
 			deprecated:         true
 			deprecated_message: "This metric has been deprecated in favor of [`transform_buffer_max_size_bytes`](#transform_buffer_max_size_bytes)."
 		}
 		transform_buffer_max_event_size: {
-			description:       "The maximum number of events the buffer that feeds into a transform can hold."
-			type:              "gauge"
-			default_namespace: "vector"
-			tags: _component_tags & {
-				output: _output
-			}
+			description:        "The maximum number of events the buffer that feeds into a transform can hold."
+			type:               "gauge"
+			default_namespace:  "vector"
+			tags:               _component_tags
 			deprecated:         true
 			deprecated_message: "This metric has been deprecated in favor of [`transform_buffer_max_size_events`](#transform_buffer_max_size_events)."
 		}
@@ -987,41 +1025,31 @@ components: sources: internal_metrics: {
 			description:       "The maximum number of bytes the buffer that feeds into a transform can hold."
 			type:              "gauge"
 			default_namespace: "vector"
-			tags: _component_tags & {
-				output: _output
-			}
+			tags:              _component_tags
 		}
 		transform_buffer_max_size_events: {
 			description:       "The maximum number of events the buffer that feeds into a transform can hold."
 			type:              "gauge"
 			default_namespace: "vector"
-			tags: _component_tags & {
-				output: _output
-			}
+			tags:              _component_tags
 		}
 		transform_buffer_utilization: {
 			description:       "The utilization level of the buffer that feeds into a transform."
 			type:              "histogram"
 			default_namespace: "vector"
-			tags: _component_tags & {
-				output: _output
-			}
+			tags:              _component_tags
 		}
 		transform_buffer_utilization_level: {
 			description:       "The current utilization level of the buffer that feeds into a transform."
 			type:              "gauge"
 			default_namespace: "vector"
-			tags: _component_tags & {
-				output: _output
-			}
+			tags:              _component_tags
 		}
 		transform_buffer_utilization_mean: {
 			description:       "The mean utilization level of the buffer that feeds into a transform. This value is smoothed over time using an exponentially weighted moving average (EWMA)."
 			type:              "gauge"
 			default_namespace: "vector"
-			tags: _component_tags & {
-				output: _output
-			}
+			tags:              _component_tags
 		}
 		uptime_seconds: {
 			description:       "The total number of seconds the Vector instance has been up."
@@ -1029,20 +1057,6 @@ components: sources: internal_metrics: {
 			default_namespace: "vector"
 			tags:              _internal_metrics_tags
 		}
-		utf8_convert_errors_total: {
-			description:       "The total number of errors converting bytes to a UTF-8 string in UDP mode."
-			type:              "counter"
-			default_namespace: "vector"
-			tags: _component_tags & {
-				mode: {
-					description: "The connection mode used by the component."
-					required:    true
-					enum: {
-						udp: "User Datagram Protocol"
-					}
-				}
-			}
-		}
 		utilization: {
 			description:       "A ratio from 0 to 1 of the load on a component. A value of 0 would indicate a completely idle component that is simply waiting for input. A value of 1 would indicate a that is never idle. This value is updated every 5 seconds."
 			type:              "gauge"
@@ -1128,22 +1142,6 @@ components: sources: internal_metrics: {
 			tags:              _internal_metrics_tags
 		}
 
-		// config metrics
-		config_reload_rejected: {
-			description:       "Number of configuration reload attempts that were rejected."
-			type:              "counter"
-			default_namespace: "vector"
-			tags: _internal_metrics_tags & {
-				reason: _reason
-			}
-		}
-		config_reloaded: {
-			description:       "Number of times a new configuration was loaded successfully."
-			type:              "counter"
-			default_namespace: "vector"
-			tags:              _internal_metrics_tags
-		}
-
 		// Helpful tag groupings
 		_component_tags: _internal_metrics_tags & {
 			component_kind: _component_kind
@@ -1175,6 +1173,29 @@ components: sources: internal_metrics: {
 			required:    true
 			examples: ["file", "http", "honeycomb", "splunk_hec"]
 		}
+		_buffer_tags: _component_tags & {
+			buffer_id: _buffer_id
+			stage:     _buffer_stage
+		}
+		_buffer_id: {
+			description: "The unique identifier of the buffer."
+			required:    true
+		}
+		_buffer_error_code: {
+			description: "The specific error code emitted for a buffer read failure."
+			required:    true
+			enum: {
+				"deser_failed":                "The buffer record could not be deserialized."
+				"checksum_mismatch":           "The buffer record checksum did not match the expected value."
+				"decode_failed":               "The buffer record could not be decoded."
+				"incompatible_record_version": "The buffer record version is incompatible with this reader."
+				"partial_write":               "The buffer contained a partially written record."
+			}
+		}
+		_buffer_stage: {
+			description: "The numbered stage within the buffer pipeline."
+			required:    true
+		}
 		_endpoint: {
 			description: "The absolute path of originating file."
 			required:    true
@@ -1197,6 +1218,7 @@ components: sources: internal_metrics: {
 				"match_failed":                "The match operation failed."
 				"out_of_order":                "The event was out of order."
 				"parse_failed":                "The parsing operation failed."
+				"reader_failed":               "The buffer reader failed."
 				"read_failed":                 "The file read operation failed."
 				"render_error":                "The rendering operation failed."
 				"stream_closed":               "The downstream was closed, forwarding the event(s) failed."
diff --git a/website/cue/reference/components/sources/stdin.cue b/website/cue/reference/components/sources/stdin.cue
index 32b69131a2767..8d7d62baf1134 100644
--- a/website/cue/reference/components/sources/stdin.cue
+++ b/website/cue/reference/components/sources/stdin.cue
@@ -91,7 +91,5 @@ components: sources: stdin: {
 		}
 	}
 
-	telemetry: metrics: {
-		stdin_reads_failed_total: components.sources.internal_metrics.output.metrics.stdin_reads_failed_total
-	}
+	telemetry: metrics: {}
 }
diff --git a/website/cue/reference/components/sources/syslog.cue b/website/cue/reference/components/sources/syslog.cue
index ba27f8762718b..e53039742c734 100644
--- a/website/cue/reference/components/sources/syslog.cue
+++ b/website/cue/reference/components/sources/syslog.cue
@@ -211,8 +211,6 @@ components: sources: syslog: {
 	}
 
 	telemetry: metrics: {
-		connection_read_errors_total: components.sources.internal_metrics.output.metrics.connection_read_errors_total
-		utf8_convert_errors_total:    components.sources.internal_metrics.output.metrics.utf8_convert_errors_total
-		component_received_bytes:     components.sources.internal_metrics.output.metrics.component_received_bytes
+		component_received_bytes: components.sources.internal_metrics.output.metrics.component_received_bytes
 	}
 }
diff --git a/website/cue/reference/components/sources/vector.cue b/website/cue/reference/components/sources/vector.cue
index aa9b4db6fe34e..3b74992eb3dae 100644
--- a/website/cue/reference/components/sources/vector.cue
+++ b/website/cue/reference/components/sources/vector.cue
@@ -105,6 +105,5 @@ components: sources: vector: {
 		grpc_server_handler_duration_seconds: components.sources.internal_metrics.output.metrics.grpc_server_handler_duration_seconds
 		grpc_server_messages_received_total:  components.sources.internal_metrics.output.metrics.grpc_server_messages_received_total
 		grpc_server_messages_sent_total:      components.sources.internal_metrics.output.metrics.grpc_server_messages_sent_total
-		protobuf_decode_errors_total:         components.sources.internal_metrics.output.metrics.protobuf_decode_errors_total
 	}
 }

From 06af024431c44fdb3c55b09bd4deb1a3bcd70dd1 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Wed, 3 Jun 2026 16:01:49 -0400
Subject: [PATCH 301/326] chore(releasing): v0.56.0 release (#25568)

* chore(releasing): prepare v0.56.0 release (#25555)

* chore(releasing): Pinned VRL version to 0.33.0

* chore(releasing): Generated release CUE file

* chore(releasing): Updated website/cue/reference/administration/interfaces/kubectl.cue vector version to 0.56.0

* chore(releasing): Updated distribution/install.sh vector version to 0.56.0

* chore(releasing): Add 0.56.0 to versions.cue

* chore(releasing): Created release md file

* Format + fix changelogs

* Update LICENSE-3rdparty.csv

* Add Release highlights

* Add unit test entry

* Add breaking: true to greptimedb entry

* chore(releasing): address PR review on release highlights

Co-Authored-By: Claude Sonnet 4.6

* cue fmt

* Apply docs suggestions

Co-authored-by: domalessi <111786334+domalessi@users.noreply.github.com>

* Upgrade VRL to 0.33.1

* Bump release date

* Add 0.33.1 VRL changelog alongside 0.33.0 updated changelog

* Fix VRL changelog strikethrough formatting in 0.56.0

Co-Authored-By: Claude Sonnet 4.6

---------

Co-authored-by: domalessi <111786334+domalessi@users.noreply.github.com>

* chore(releasing): bump version to 0.57.0 and revert VRL to git main

Co-Authored-By: Claude Sonnet 4.6

* chore(releasing): update Kubernetes manifests for v0.56.0

Co-Authored-By: Claude Sonnet 4.6

---------

Co-authored-by: domalessi <111786334+domalessi@users.noreply.github.com>
---
 Cargo.lock                                    |  39 +-
 Cargo.toml                                    |   2 +-
 LICENSE-3rdparty.csv                          |   3 +-
 .../10870_http_retry_strategy.feature.md      |   7 -
 ...http_retry_transport_errors.enhancement.md |   9 -
 ...13_remove_default_os_package_config.fix.md |   7 -
 .../20278_expected_event_count.feature.md     |   3 -
 ...ector_sink_zstd_compression.enhancement.md |  33 -
 ...058_metric_set_indexmap_performance.fix.md |   5 -
 .../24840_databricks_zerobus_sink.feature.md  |   3 -
 ...c_decompression_reject_unnegotiated.fix.md |   6 -
 .../24917_otel_source_zstd.enhancement.md     |   7 -
 .../24929_fix_stall_on_disk_shutdown.fix.md   |   6 -
 ...25194_windows_event_log_lost_wakeup.fix.md |   3 -
 ...25199_batch_encoding_events_dropped.fix.md |   3 -
 ...plunk_hec_source_specify_wrong_auth.fix.md |   3 -
 changelog.d/25253_el8_glibc_floor.fix.md      |   3 -
 .../25267_vrl_get_env_var_playground.fix.md   |   2 -
 ...3_enable_codecs_parquet_in_releases.fix.md |   3 -
 ...2_windows_event_log_source_metadata.fix.md |   3 -
 ..._custom_auth_write_metadata.enhancement.md |   6 -
 changelog.d/25407_delay_transform.feature.md  |   3 -
 ...x_file_source_checkpoint_write_race.fix.md |   3 -
 .../aggregate_passthrough_ignored_kind.fix.md |  14 -
 ...use_aws_s3_dedicated_batch_encoding.fix.md |   3 -
 changelog.d/drop_empty_batches_fanout.fix.md  |   4 -
 changelog.d/drop_fakedata_generator.fix.md    |   9 -
 changelog.d/fix_topology_build_spans.fix.md   |   7 -
 .../greptimedb_ingester_crate.breaking.md     |   3 -
 changelog.d/mqtt_source_mutual_TLS.fix.md     |   3 -
 .../redact-sink-api-key-headers.security.md   |   3 -
 .../sample_dynamic_ratio_field.feature.md     |   3 -
 changelog.d/serde_group_bump.enhancement.md   |   3 -
 .../splunk_hec_source_codec.enhancement.md    |  20 -
 ...nality_limit_global_per_tag.enhancement.md |   6 -
 ..._limit_improve_memory_usage.enhancement.md |   3 -
 ...y_limit_per_tag_and_exclude.enhancement.md |   6 -
 ...nality_limit_tracking_scope.enhancement.md |   6 -
 .../tcp_ack_graceful_tls_shutdown.fix.md      |   5 -
 distribution/install.sh                       |   2 +-
 .../kubernetes/vector-agent/README.md         |   2 +-
 .../kubernetes/vector-agent/configmap.yaml    |   2 +-
 .../kubernetes/vector-agent/daemonset.yaml    |   4 +-
 .../kubernetes/vector-agent/rbac.yaml         |   4 +-
 .../vector-agent/service-headless.yaml        |   2 +-
 .../vector-agent/serviceaccount.yaml          |   2 +-
 .../kubernetes/vector-aggregator/README.md    |   2 +-
 .../vector-aggregator/configmap.yaml          |   2 +-
 .../vector-aggregator/service-headless.yaml   |   2 +-
 .../kubernetes/vector-aggregator/service.yaml |   2 +-
 .../vector-aggregator/serviceaccount.yaml     |   2 +-
 .../vector-aggregator/statefulset.yaml        |   4 +-
 .../vector-stateless-aggregator/README.md     |   2 +-
 .../configmap.yaml                            |   2 +-
 .../deployment.yaml                           |   4 +-
 .../service-headless.yaml                     |   2 +-
 .../vector-stateless-aggregator/service.yaml  |   2 +-
 .../serviceaccount.yaml                       |   2 +-
 website/content/en/releases/0.56.0.md         |   4 +
 .../administration/interfaces/kubectl.cue     |   2 +-
 website/cue/reference/releases/0.56.0.cue     | 646 ++++++++++++++++++
 website/cue/reference/versions.cue            |   1 +
 62 files changed, 699 insertions(+), 260 deletions(-)
 delete mode 100644 changelog.d/10870_http_retry_strategy.feature.md
 delete mode 100644 changelog.d/10870_http_retry_transport_errors.enhancement.md
 delete mode 100644 changelog.d/15513_remove_default_os_package_config.fix.md
 delete mode 100644 changelog.d/20278_expected_event_count.feature.md
 delete mode 100644 changelog.d/23030_vector_sink_zstd_compression.enhancement.md
 delete mode 100644 changelog.d/24058_metric_set_indexmap_performance.fix.md
 delete mode 100644 changelog.d/24840_databricks_zerobus_sink.feature.md
 delete mode 100644 changelog.d/24917_grpc_decompression_reject_unnegotiated.fix.md
 delete mode 100644 changelog.d/24917_otel_source_zstd.enhancement.md
 delete mode 100644 changelog.d/24929_fix_stall_on_disk_shutdown.fix.md
 delete mode 100644 changelog.d/25194_windows_event_log_lost_wakeup.fix.md
 delete mode 100644 changelog.d/25199_batch_encoding_events_dropped.fix.md
 delete mode 100644 changelog.d/25230_splunk_hec_source_specify_wrong_auth.fix.md
 delete mode 100644 changelog.d/25253_el8_glibc_floor.fix.md
 delete mode 100644 changelog.d/25267_vrl_get_env_var_playground.fix.md
 delete mode 100644 changelog.d/25313_enable_codecs_parquet_in_releases.fix.md
 delete mode 100644 changelog.d/25332_windows_event_log_source_metadata.fix.md
 delete mode 100644 changelog.d/25391_http_server_custom_auth_write_metadata.enhancement.md
 delete mode 100644 changelog.d/25407_delay_transform.feature.md
 delete mode 100644 changelog.d/25447_fix_file_source_checkpoint_write_race.fix.md
 delete mode 100644 changelog.d/aggregate_passthrough_ignored_kind.fix.md
 delete mode 100644 changelog.d/clickhouse_aws_s3_dedicated_batch_encoding.fix.md
 delete mode 100644 changelog.d/drop_empty_batches_fanout.fix.md
 delete mode 100644 changelog.d/drop_fakedata_generator.fix.md
 delete mode 100644 changelog.d/fix_topology_build_spans.fix.md
 delete mode 100644 changelog.d/greptimedb_ingester_crate.breaking.md
 delete mode 100644 changelog.d/mqtt_source_mutual_TLS.fix.md
 delete mode 100644 changelog.d/redact-sink-api-key-headers.security.md
 delete mode 100644 changelog.d/sample_dynamic_ratio_field.feature.md
 delete mode 100644 changelog.d/serde_group_bump.enhancement.md
 delete mode 100644 changelog.d/splunk_hec_source_codec.enhancement.md
 delete mode 100644 changelog.d/tag_cardinality_limit_global_per_tag.enhancement.md
 delete mode 100644 changelog.d/tag_cardinality_limit_improve_memory_usage.enhancement.md
 delete mode 100644 changelog.d/tag_cardinality_limit_per_tag_and_exclude.enhancement.md
 delete mode 100644 changelog.d/tag_cardinality_limit_tracking_scope.enhancement.md
 delete mode 100644 changelog.d/tcp_ack_graceful_tls_shutdown.fix.md
 create mode 100644 website/content/en/releases/0.56.0.md
 create mode 100644 website/cue/reference/releases/0.56.0.cue

diff --git a/Cargo.lock b/Cargo.lock
index d7705d2cbe09e..e7155549e5b48 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3817,31 +3817,30 @@ dependencies = [
 
 [[package]]
 name = "domain"
-version = "0.11.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a11dd7f04a6a6d2aea0153c6e31f5ea7af8b2efdf52cdaeea7a9a592c7fefef9"
+checksum = "8c469892dddfeff64ecfdbc64cf059c77fb0decaeccd4d5d484394bdd6312bac"
 dependencies = [
  "bumpalo",
  "bytes",
  "domain-macros",
  "futures-util",
- "hashbrown 0.14.5",
+ "hashbrown 0.17.1",
+ "jiff",
  "log",
- "moka",
  "octseq",
- "rand 0.8.6",
+ "rand 0.10.1",
  "serde",
  "smallvec",
- "time",
  "tokio",
  "tracing 0.1.44",
 ]
 
 [[package]]
 name = "domain-macros"
-version = "0.11.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e197fdfd2cdb5fdeb7f8ddcf3aed5d5d04ecde2890d448b14ffb716f7376b70"
+checksum = "6fef7ef74e413e36d5364db163ca577ccb56f2f74377705d5f920ee3e1544127"
 dependencies = [
  "proc-macro2 1.0.106",
  "quote 1.0.45",
@@ -4873,7 +4872,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 dependencies = [
  "ahash 0.8.11",
- "allocator-api2",
 ]
 
 [[package]]
@@ -4898,6 +4896,15 @@ dependencies = [
  "foldhash 0.2.0",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "allocator-api2",
+]
+
 [[package]]
 name = "hashlink"
 version = "0.10.0"
@@ -7054,13 +7061,9 @@ version = "0.12.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e0d88686dc561d743b40de8269b26eaf0dc58781bde087b0984646602021d08"
 dependencies = [
- "async-lock 3.4.0",
- "async-trait",
  "crossbeam-channel",
  "crossbeam-epoch",
  "crossbeam-utils",
- "event-listener 5.3.1",
- "futures-util",
  "once_cell",
  "parking_lot",
  "quanta",
@@ -7635,9 +7638,9 @@ dependencies = [
 
 [[package]]
 name = "octseq"
-version = "0.5.2"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "126c3ca37c9c44cec575247f43a3e4374d8927684f129d2beeb0d2cef262fe12"
+checksum = "182eab3e1cd9cdc0ecf1ce3342d9844f3dc7d098f0694569bfdf327b612d69fd"
 dependencies = [
  "bytes",
  "serde",
@@ -12869,7 +12872,7 @@ dependencies = [
 
 [[package]]
 name = "vector"
-version = "0.56.0"
+version = "0.57.0"
 dependencies = [
  "approx",
  "arc-swap",
@@ -13511,8 +13514,8 @@ checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
 [[package]]
 name = "vrl"
-version = "0.32.0"
-source = "git+https://github.com/vectordotdev/vrl.git?branch=main#704351cc3fdec4415bbf89653b9ca2cd0dc20212"
+version = "0.33.1"
+source = "git+https://github.com/vectordotdev/vrl.git?branch=main#1f1e215ca3364fb4db6fa4d55351d1c681ab982e"
 dependencies = [
  "aes",
  "aes-siv",
diff --git a/Cargo.toml b/Cargo.toml
index 6d9ac547423bd..f5ad7c2d25d13 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "vector"
-version = "0.56.0"
+version = "0.57.0"
 authors = ["Vector Contributors <vector@datadoghq.com>"]
 edition = "2024"
 description = "A lightweight and ultra-fast tool for building observability pipelines"
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 2d00edc12d4dd..d152c4cb4358f 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -316,6 +316,7 @@ half,https://github.com/starkat99/half-rs,MIT OR Apache-2.0,Kathryn Long <squees
 hash_hasher,https://github.com/Fraser999/Hash-Hasher,Apache-2.0 OR MIT,Fraser Hutchison <fraser@astria.org>
 hashbag,https://github.com/jonhoo/hashbag,MIT OR Apache-2.0,Jon Gjengset <jon@thesquareplanet.com>
 hashbrown,https://github.com/rust-lang/hashbrown,MIT OR Apache-2.0,Amanieu d'Antras <amanieu@gmail.com>
+hashbrown,https://github.com/rust-lang/hashbrown,MIT OR Apache-2.0,The hashbrown Authors
 hashlink,https://github.com/kyren/hashlink,MIT OR Apache-2.0,kyren <kerriganw@gmail.com>
 hdrhistogram,https://github.com/HdrHistogram/HdrHistogram_rust,MIT OR Apache-2.0,"Jon Gjengset <jon@thesquareplanet.com>, Marshall Pierce <marshall@mpierce.org>"
 headers,https://github.com/hyperium/headers,MIT,Sean McArthur <sean@seanmonstar.com>
@@ -514,7 +515,7 @@ oauth2,https://github.com/ramosbugs/oauth2-rs,MIT OR Apache-2.0,"Alex Crichton <
 objc,http://github.com/SSheldon/rust-objc,MIT,Steven Sheldon
 objc2-core-foundation,https://github.com/madsmtm/objc2,Zlib OR Apache-2.0 OR MIT,The objc2-core-foundation Authors
 objc2-io-kit,https://github.com/madsmtm/objc2,Zlib OR Apache-2.0 OR MIT,The objc2-io-kit Authors
-octseq,https://github.com/NLnetLabs/octets/,BSD-3-Clause,NLnet Labs <rust-team@nlnetlabs.nl>
+octseq,https://github.com/NLnetLabs/octets,BSD-3-Clause,NLnet Labs <rust-team@nlnetlabs.nl>
 ofb,https://github.com/RustCrypto/block-modes,MIT OR Apache-2.0,RustCrypto Developers
 once_cell,https://github.com/matklad/once_cell,MIT OR Apache-2.0,Aleksey Kladov <aleksey.kladov@gmail.com>
 onig,https://github.com/iwillspeak/rust-onig,MIT,"Will Speak <will@willspeak.me>, Ivan Ivashchenko <defuz@me.com>"
diff --git a/changelog.d/10870_http_retry_strategy.feature.md b/changelog.d/10870_http_retry_strategy.feature.md
deleted file mode 100644
index 09afba2eddd40..0000000000000
--- a/changelog.d/10870_http_retry_strategy.feature.md
+++ /dev/null
@@ -1,7 +0,0 @@
-HTTP-based sinks that use the shared retry helpers now support a `retry_strategy` configuration
-option to control which HTTP response codes are retried. The `http` sink also includes a new
-example showing how to retry only specific transient status codes.
-
-Issue: https://github.com/vectordotdev/vector/issues/10870
-
-authors: ndrsg
diff --git a/changelog.d/10870_http_retry_transport_errors.enhancement.md b/changelog.d/10870_http_retry_transport_errors.enhancement.md
deleted file mode 100644
index f06f63b2f0e07..0000000000000
--- a/changelog.d/10870_http_retry_transport_errors.enhancement.md
+++ /dev/null
@@ -1,9 +0,0 @@
-HTTP-based sinks using the shared retry logic now classify transport-layer failures with
-`HttpError::is_retriable`: connection and TLS connector issues may be retried, while failures
-such as invalid HTTP request construction or an invalid proxy URI are not. Setting
-`retry_strategy` to `none` disables retries for these transport errors and for request
-timeouts, in addition to status-code-based retries.
-
-Issue: https://github.com/vectordotdev/vector/issues/10870
-
-authors: ndrsg
diff --git a/changelog.d/15513_remove_default_os_package_config.fix.md b/changelog.d/15513_remove_default_os_package_config.fix.md
deleted file mode 100644
index e509742ff2564..0000000000000
--- a/changelog.d/15513_remove_default_os_package_config.fix.md
+++ /dev/null
@@ -1,7 +0,0 @@
-The default `/etc/vector/vector.yaml` config file is no longer installed by the Debian, RPM, Alpine, and distroless-static Docker packages. The previous default ran a `demo_logs` source and printed synthesized syslog lines to stdout, which then surfaced in journald or `/var/log/` on hosts running Vector as a service and was a common source of confusion.
-
-New installs will now have no active config on disk. Provide your own configuration at `/etc/vector/vector.yaml` (or pass `--config <path>`) before starting Vector. A reference example is shipped at `/usr/share/vector/examples/vector.yaml`, and more sample configs remain at `/etc/vector/examples/`.
-
-Existing installs are unaffected on upgrade: package managers preserve the on-disk `/etc/vector/vector.yaml` if you already had one.
-
-authors: pront
diff --git a/changelog.d/20278_expected_event_count.feature.md b/changelog.d/20278_expected_event_count.feature.md
deleted file mode 100644
index 23dac198ecdea..0000000000000
--- a/changelog.d/20278_expected_event_count.feature.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Unit tests now support an optional `expected_event_count` field on test outputs, allowing assertions on the number of events emitted by a transform.
-
-authors: pront
diff --git a/changelog.d/23030_vector_sink_zstd_compression.enhancement.md b/changelog.d/23030_vector_sink_zstd_compression.enhancement.md
deleted file mode 100644
index 5c1b8408d3248..0000000000000
--- a/changelog.d/23030_vector_sink_zstd_compression.enhancement.md
+++ /dev/null
@@ -1,33 +0,0 @@
-The `vector` sink now supports `zstd` compression in addition to `gzip`. This provides better
-compression ratios and performance for Vector-to-Vector communication.
-
-The compression configuration has been enhanced to support multiple algorithms while maintaining
-full backward compatibility:
-
-## Legacy boolean syntax (still supported)
-
-```yaml
-sinks:
-  my_vector:
-    type: vector
-    address: "localhost:6000"
-    compression: true   # Uses gzip (default)
-    # or
-    compression: false  # No compression
-```
-
-## New string syntax
-
-```yaml
-sinks:
-  my_vector:
-    type: vector
-    address: "localhost:6000"
-    compression: "zstd"  # Use zstd compression
-    # Supported values: "none", "gzip", "zstd"
-```
-
-The Vector source automatically accepts both gzip and zstd compressed data, enabling seamless
-communication between Vector instances using different compression algorithms.
-
-authors: jpds
diff --git a/changelog.d/24058_metric_set_indexmap_performance.fix.md b/changelog.d/24058_metric_set_indexmap_performance.fix.md
deleted file mode 100644
index beae01365f164..0000000000000
--- a/changelog.d/24058_metric_set_indexmap_performance.fix.md
+++ /dev/null
@@ -1,5 +0,0 @@
-Fixed a CPU regression introduced in 0.50.0 affecting all sinks that use metric normalization such as `prometheus_remote_write`, `aws_cloudwatch_metrics`, `statsd` and others.
-
-The only exception is the `incremental_to_absolute` transform when `max_bytes` or `max_events` are configured, where the overhead is expected and necessary for eviction to work correctly.
-
-authors: thomasqueirozb
diff --git a/changelog.d/24840_databricks_zerobus_sink.feature.md b/changelog.d/24840_databricks_zerobus_sink.feature.md
deleted file mode 100644
index 34a8ecb1c9224..0000000000000
--- a/changelog.d/24840_databricks_zerobus_sink.feature.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Add a new `databricks_zerobus` sink that streams log data to Databricks Unity Catalog tables via the Zerobus ingestion service. Supports OAuth 2.0 authentication, automatic schema fetching from Unity Catalog, and protobuf batch encoding.
-
-authors: flaviocruz
diff --git a/changelog.d/24917_grpc_decompression_reject_unnegotiated.fix.md b/changelog.d/24917_grpc_decompression_reject_unnegotiated.fix.md
deleted file mode 100644
index ef1e4a90cc53a..0000000000000
--- a/changelog.d/24917_grpc_decompression_reject_unnegotiated.fix.md
+++ /dev/null
@@ -1,6 +0,0 @@
-The shared gRPC decompression layer now rejects request frames that set the
-compressed flag without a negotiated `grpc-encoding` (e.g. `identity` or a
-missing header). Previously such malformed frames were silently decoded as
-gzip, which could mask client/server compression-negotiation bugs.
-
-authors: jpds
diff --git a/changelog.d/24917_otel_source_zstd.enhancement.md b/changelog.d/24917_otel_source_zstd.enhancement.md
deleted file mode 100644
index 1a35e5257e968..0000000000000
--- a/changelog.d/24917_otel_source_zstd.enhancement.md
+++ /dev/null
@@ -1,7 +0,0 @@
-The `opentelemetry` source's gRPC OTLP receiver now accepts `zstd`-compressed
-requests in addition to `gzip`, matching the compression schemes advertised via
-the `grpc-accept-encoding` response header. No configuration change is required;
-clients can send OTLP payloads with `grpc-encoding: zstd` and they will be
-transparently decompressed.
-
-authors: jpds
diff --git a/changelog.d/24929_fix_stall_on_disk_shutdown.fix.md b/changelog.d/24929_fix_stall_on_disk_shutdown.fix.md
deleted file mode 100644
index 2c7633caef857..0000000000000
--- a/changelog.d/24929_fix_stall_on_disk_shutdown.fix.md
+++ /dev/null
@@ -1,6 +0,0 @@
-Fixed issue during in place reload of a sink with a disk buffer configured, where
-the component would stall for batch.timeout_sec before gracefully reloading.
-This fix also resolves issues Vector had where it would ignore SIGINT during
-cases where the pipeline stall had occurred.
-
-authors: graphcareful
diff --git a/changelog.d/25194_windows_event_log_lost_wakeup.fix.md b/changelog.d/25194_windows_event_log_lost_wakeup.fix.md
deleted file mode 100644
index cb6f67987d67c..0000000000000
--- a/changelog.d/25194_windows_event_log_lost_wakeup.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-The `windows_event_log` source no longer freezes after periods of inactivity.
-
-authors: tot19
diff --git a/changelog.d/25199_batch_encoding_events_dropped.fix.md b/changelog.d/25199_batch_encoding_events_dropped.fix.md
deleted file mode 100644
index 214aad79a528c..0000000000000
--- a/changelog.d/25199_batch_encoding_events_dropped.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Sinks using batch encoding (Parquet, Arrow IPC) now consistently emit `ComponentEventsDropped` for every encode failure path. Previously some `build_record_batch` failures (notably type mismatches) dropped events silently. A new `EncoderRecordBatchError` internal event also reports `component_errors_total` with `error_code="arrow_json_decode"` or `"arrow_record_batch_creation"` at `stage="sending"` for granular alerting.
-
-authors: pront
diff --git a/changelog.d/25230_splunk_hec_source_specify_wrong_auth.fix.md b/changelog.d/25230_splunk_hec_source_specify_wrong_auth.fix.md
deleted file mode 100644
index 8c2af5dd212e4..0000000000000
--- a/changelog.d/25230_splunk_hec_source_specify_wrong_auth.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-The error log + metric that `splunk_hec` source emit on missing/invalid auth header now specifies "authentication_failed" as error_type.
-
-authors: 20agbekodo
diff --git a/changelog.d/25253_el8_glibc_floor.fix.md b/changelog.d/25253_el8_glibc_floor.fix.md
deleted file mode 100644
index 8c638782e339a..0000000000000
--- a/changelog.d/25253_el8_glibc_floor.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Restored support for installing Vector on RHEL 8, Rocky Linux 8, AlmaLinux 8, and CentOS Stream 8, which had been broken since v0.55.0 due to an inadvertent glibc requirement bump.
-
-authors: pront
diff --git a/changelog.d/25267_vrl_get_env_var_playground.fix.md b/changelog.d/25267_vrl_get_env_var_playground.fix.md
deleted file mode 100644
index 29de5d36fe6a5..0000000000000
--- a/changelog.d/25267_vrl_get_env_var_playground.fix.md
+++ /dev/null
@@ -1,2 +0,0 @@
-Restored the full VRL stdlib, including `get_env_var`, in the standalone VRL CLI and web playground by default.
-authors: pront
diff --git a/changelog.d/25313_enable_codecs_parquet_in_releases.fix.md b/changelog.d/25313_enable_codecs_parquet_in_releases.fix.md
deleted file mode 100644
index fe3baaf110d5e..0000000000000
--- a/changelog.d/25313_enable_codecs_parquet_in_releases.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Parquet encoding in the `aws_s3` sink (`batch_encoding`) now works out of the box in the official release binaries. Previously it required compiling Vector from source with the `codecs-parquet` feature.
-
-authors: pront
diff --git a/changelog.d/25332_windows_event_log_source_metadata.fix.md b/changelog.d/25332_windows_event_log_source_metadata.fix.md
deleted file mode 100644
index 936e773cc8588..0000000000000
--- a/changelog.d/25332_windows_event_log_source_metadata.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-The `windows_event_log` source now adds standard source metadata, including `source_type`, to emitted log events.
-
-authors: tot19
diff --git a/changelog.d/25391_http_server_custom_auth_write_metadata.enhancement.md b/changelog.d/25391_http_server_custom_auth_write_metadata.enhancement.md
deleted file mode 100644
index 531afe60a4b60..0000000000000
--- a/changelog.d/25391_http_server_custom_auth_write_metadata.enhancement.md
+++ /dev/null
@@ -1,6 +0,0 @@
-The `custom` auth strategy for the `http_server` source now supports event enrichment via metadata
-writes. VRL programs can write `%field = value` during authentication; those values are injected
-into every successfully authenticated event. The event body (`.field`) remains read-only. Existing
-`custom` programs that do not write metadata are unaffected.
-
-authors: 20agbekodo
diff --git a/changelog.d/25407_delay_transform.feature.md b/changelog.d/25407_delay_transform.feature.md
deleted file mode 100644
index a1df713c6a347..0000000000000
--- a/changelog.d/25407_delay_transform.feature.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Added a new `delay` transform, that delays each event by a fixed duration.
-
-authors: esensar Quad9DNS
diff --git a/changelog.d/25447_fix_file_source_checkpoint_write_race.fix.md b/changelog.d/25447_fix_file_source_checkpoint_write_race.fix.md
deleted file mode 100644
index 305d64109712a..0000000000000
--- a/changelog.d/25447_fix_file_source_checkpoint_write_race.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed a bug in the `file` source where checkpoints recording the last-read file position were not always fully written before Vector shut down. On the next startup, the `file` source could start reading from an earlier position, causing events to be re-processed.
-
-authors: thomasqueirozb
diff --git a/changelog.d/aggregate_passthrough_ignored_kind.fix.md b/changelog.d/aggregate_passthrough_ignored_kind.fix.md
deleted file mode 100644
index 9f47154224beb..0000000000000
--- a/changelog.d/aggregate_passthrough_ignored_kind.fix.md
+++ /dev/null
@@ -1,14 +0,0 @@
-The `aggregate` transform now correctly passes through/ignores metrics whose kind is not supported
-by the configured mode. Prior to this change these metrics would be silently dropped, contrary to
-the officially documented behavior. For example, `absolute` metrics flowing through a `sum`-mode aggregate
-transform are now forwarded to the next step in the pipeline unchanged rather than being dropped:
-
-```text
-{kind: incremental, type: counter, name: "http.requests", value: 10}  → summed into aggregate
-{kind: absolute,    type: gauge,   name: "cpu.usage",     value: 0.83} → previously dropped, now passes through unchanged
-{kind: incremental, type: counter, name: "http.requests", value: 5}   → summed into aggregate
-```
-
-If you want to preserve the previous drop behavior, add a `filter` transform before the aggregate transform to discard the unwanted metric kind.
-
-authors: ArunPiduguDD
diff --git a/changelog.d/clickhouse_aws_s3_dedicated_batch_encoding.fix.md b/changelog.d/clickhouse_aws_s3_dedicated_batch_encoding.fix.md
deleted file mode 100644
index f39347d4c47bd..0000000000000
--- a/changelog.d/clickhouse_aws_s3_dedicated_batch_encoding.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-The `aws_s3` and `clickhouse` sinks now correctly advertise only the `batch_encoding.codec` values they actually support: `parquet` for `aws_s3` and `arrow_stream` for `clickhouse`. Previously the documentation and configuration schema listed both codecs for both sinks, even though picking the wrong one produced a startup error.
-
-authors: flaviofcruz
diff --git a/changelog.d/drop_empty_batches_fanout.fix.md b/changelog.d/drop_empty_batches_fanout.fix.md
deleted file mode 100644
index 12ebfcd682555..0000000000000
--- a/changelog.d/drop_empty_batches_fanout.fix.md
+++ /dev/null
@@ -1,4 +0,0 @@
-Fixed a crash that could occur when a source or transform emitted an empty event batch into a topology with downstream buffers. Vector now
-drops empty batches before they reach those buffers and logs a warning identifying the upstream component.
-
-authors: graphcareful
diff --git a/changelog.d/drop_fakedata_generator.fix.md b/changelog.d/drop_fakedata_generator.fix.md
deleted file mode 100644
index 500e826bc3239..0000000000000
--- a/changelog.d/drop_fakedata_generator.fix.md
+++ /dev/null
@@ -1,9 +0,0 @@
-The text content generated by the `demo_logs` source has changed: the
-pool of fake usernames and the pool of fake domain TLDs are now both
-defined inside Vector rather than pulled from an external crate. The
-line formats (`apache_common`, `apache_error`, `json`, `syslog`,
-`bsd_syslog`) are unchanged. If any of your tests or downstream
-pipelines assert on specific generated usernames or TLDs, please
-update those expectations.
-
-authors: pront
diff --git a/changelog.d/fix_topology_build_spans.fix.md b/changelog.d/fix_topology_build_spans.fix.md
deleted file mode 100644
index 9ea5d755bbd04..0000000000000
--- a/changelog.d/fix_topology_build_spans.fix.md
+++ /dev/null
@@ -1,7 +0,0 @@
-Fixed a bug in the topology builder causing component metrics registered at build
-time to miss the component tags if the component build function awaits non-trivially.
-
-This notably affected sinks using a disk buffer, and source or sinks performing
-IO work in the build function.
-
-authors: gwenaskell
diff --git a/changelog.d/greptimedb_ingester_crate.breaking.md b/changelog.d/greptimedb_ingester_crate.breaking.md
deleted file mode 100644
index 79984693ef8e1..0000000000000
--- a/changelog.d/greptimedb_ingester_crate.breaking.md
+++ /dev/null
@@ -1,3 +0,0 @@
-The `greptimedb_metrics` and `greptimedb_logs` sinks now require GreptimeDB v1.x. Users running GreptimeDB v0.x must upgrade their GreptimeDB instance before upgrading Vector.
-
-authors: thomasqueirozb
diff --git a/changelog.d/mqtt_source_mutual_TLS.fix.md b/changelog.d/mqtt_source_mutual_TLS.fix.md
deleted file mode 100644
index 9d1c52d65c370..0000000000000
--- a/changelog.d/mqtt_source_mutual_TLS.fix.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Fixed a bug in the `mqtt` source where user-provided TLS client certificates (`crt_file` / `key_file`) were being silently ignored, breaking mTLS connections to strict brokers like AWS IoT Core.
-
-authors: mr-
diff --git a/changelog.d/redact-sink-api-key-headers.security.md b/changelog.d/redact-sink-api-key-headers.security.md
deleted file mode 100644
index 1922656445ffd..0000000000000
--- a/changelog.d/redact-sink-api-key-headers.security.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Redact sink-specific API key headers (`DD-API-KEY`, `X-Honeycomb-Team`, `x-api-key`, `Api-Key`) in debug-level HTTP request and response logs, alongside the existing standard headers (`Authorization`, `Proxy-Authorization`, `Proxy-Authenticate`, `WWW-Authenticate`, `Cookie`, `Set-Cookie`, `Cookie2`).
-
-authors: pront
diff --git a/changelog.d/sample_dynamic_ratio_field.feature.md b/changelog.d/sample_dynamic_ratio_field.feature.md
deleted file mode 100644
index d2e3c04839c19..0000000000000
--- a/changelog.d/sample_dynamic_ratio_field.feature.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Added `ratio_field` and `rate_field` options to the `sample` transform to support dynamic per-event sampling, while requiring static `rate` or `ratio` fallback configuration and disallowing `ratio_field` and `rate_field` together.
-
-authors: jhammer
diff --git a/changelog.d/serde_group_bump.enhancement.md b/changelog.d/serde_group_bump.enhancement.md
deleted file mode 100644
index 3c9ea910c6601..0000000000000
--- a/changelog.d/serde_group_bump.enhancement.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Bumped `serde_json` to `1.0.149` and `serde_with` to `3.18.0`. `serde_json` switched its float-to-string formatter from Ryū to Żmij in `1.0.147`, so floats serialized via the `native_json` codec may render with slightly different textual form (for example `1e+16` instead of `1e16`). The change is purely cosmetic: parsed `f32`/`f64` values round-trip identically, and Vector-to-Vector communication between old and new versions is unaffected.
-
-authors: pront
diff --git a/changelog.d/splunk_hec_source_codec.enhancement.md b/changelog.d/splunk_hec_source_codec.enhancement.md
deleted file mode 100644
index 93c3bfe86f522..0000000000000
--- a/changelog.d/splunk_hec_source_codec.enhancement.md
+++ /dev/null
@@ -1,20 +0,0 @@
-The `splunk_hec` source now accepts optional per-endpoint codec configuration via `event: { framing, decoding }` and `raw: { framing, decoding }`. When `decoding` is set on an endpoint, Vector applies a second decoding pass after the HEC envelope is parsed: on `/services/collector/event` the envelope's `event` field is fed through the codec, and on `/services/collector/raw` the request body is fed through the codec directly. A single payload can fan out to multiple events.
-
-For example, to decode JSON payloads in `/event` requests while splitting `/raw` bodies on newlines:
-
-```yaml
-sources:
-  hec:
-    type: splunk_hec
-    address: 0.0.0.0:8088
-    event:
-      decoding:
-        codec: json
-    raw:
-      framing:
-        method: newline_delimited
-      decoding:
-        codec: bytes
-```
-
-authors: thomasqueirozb
diff --git a/changelog.d/tag_cardinality_limit_global_per_tag.enhancement.md b/changelog.d/tag_cardinality_limit_global_per_tag.enhancement.md
deleted file mode 100644
index 37d26ffaaed89..0000000000000
--- a/changelog.d/tag_cardinality_limit_global_per_tag.enhancement.md
+++ /dev/null
@@ -1,6 +0,0 @@
-The `tag_cardinality_limit` transform now accepts a top-level `per_tag_limits` map,
-mirroring the per-metric one: `mode: limit_override` to set a per-tag cap, or
-`mode: excluded` to bypass cardinality tracking for that tag on every metric without a
-`per_metric_limits` entry.
-
-authors: kaarolch
diff --git a/changelog.d/tag_cardinality_limit_improve_memory_usage.enhancement.md b/changelog.d/tag_cardinality_limit_improve_memory_usage.enhancement.md
deleted file mode 100644
index 37e2fbdb77527..0000000000000
--- a/changelog.d/tag_cardinality_limit_improve_memory_usage.enhancement.md
+++ /dev/null
@@ -1,3 +0,0 @@
-Reduce the memory usage of the `tag_cardinality_limit` transform when running in `exact` mode by allocating less unused memory on initialization.
-
-authors: ArunPiduguDD
diff --git a/changelog.d/tag_cardinality_limit_per_tag_and_exclude.enhancement.md b/changelog.d/tag_cardinality_limit_per_tag_and_exclude.enhancement.md
deleted file mode 100644
index 9d05f3170b305..0000000000000
--- a/changelog.d/tag_cardinality_limit_per_tag_and_exclude.enhancement.md
+++ /dev/null
@@ -1,6 +0,0 @@
-The `tag_cardinality_limit` transform gained two new configuration capabilities:
-
-- **Per-tag overrides** (`per_tag_limits`): configure cardinality limits per tag key within a metric, or exclude individual tags from tracking.
-- **Metric exclusion**: opt entire metrics out of cardinality tracking via `mode: excluded` in `per_metric_limits`.
-
-authors: ArunPiduguDD
diff --git a/changelog.d/tag_cardinality_limit_tracking_scope.enhancement.md b/changelog.d/tag_cardinality_limit_tracking_scope.enhancement.md
deleted file mode 100644
index 693a5c6005f5a..0000000000000
--- a/changelog.d/tag_cardinality_limit_tracking_scope.enhancement.md
+++ /dev/null
@@ -1,6 +0,0 @@
-The `tag_cardinality_limit` transform gained two new settings:
-
-- **`tracking_scope`**: isolate tag tracking per metric (`per_metric`) instead of sharing a single bucket across all metrics (`global`, the default).
-- **`max_tracked_keys`**: cap the total number of tag keys tracked to bound memory usage.
-
-authors: ArunPiduguDD
diff --git a/changelog.d/tcp_ack_graceful_tls_shutdown.fix.md b/changelog.d/tcp_ack_graceful_tls_shutdown.fix.md
deleted file mode 100644
index 79ccda1ecf422..0000000000000
--- a/changelog.d/tcp_ack_graceful_tls_shutdown.fix.md
+++ /dev/null
@@ -1,5 +0,0 @@
-TCP-based sources that emit acknowledgements (`fluent`, `logstash`) no longer log a spurious `Error writing acknowledgement, dropping connection.` at ERROR level when the ack write fails because the peer cleanly closed its TLS session (for example, during a rolling pod restart). These graceful shutdowns now log at WARN and no longer increment `component_errors_total{error_code="ack_failed", ...}`, preventing operator dashboards/alerts from firing on routine peer disconnects. Genuine ack write failures are still logged at ERROR and continue to increment `component_errors_total`.
-
-The `connection_shutdown_total{mode="tcp"}` counter is now incremented exactly once per accepted source connection when its per-connection task exits, pairing with `ConnectionOpen` — regardless of cause (TLS handshake failure, shutdown signal during handshake, graceful peer EOF, decoder failure, downstream closed, ack write failure, tripwire, max connection duration). Previously it was not emitted by TCP sources at all.
-
-authors: taylorchandleryoung
diff --git a/distribution/install.sh b/distribution/install.sh
index f2ab269e2fd01..6e4654b813b4f 100755
--- a/distribution/install.sh
+++ b/distribution/install.sh
@@ -13,7 +13,7 @@ set -u
 # If PACKAGE_ROOT is unset or empty, default it.
 PACKAGE_ROOT="${PACKAGE_ROOT:-"https://packages.timber.io/vector"}"
 # If VECTOR_VERSION is unset or empty, default it.
-VECTOR_VERSION="${VECTOR_VERSION:-"0.55.0"}"
+VECTOR_VERSION="${VECTOR_VERSION:-"0.56.0"}"
 _divider="--------------------------------------------------------------------------------"
 _prompt=">>>"
 _indent="   "
diff --git a/distribution/kubernetes/vector-agent/README.md b/distribution/kubernetes/vector-agent/README.md
index 15dfbf6207643..ed2114453dc2e 100644
--- a/distribution/kubernetes/vector-agent/README.md
+++ b/distribution/kubernetes/vector-agent/README.md
@@ -1,6 +1,6 @@
 The kubernetes manifests found in this directory have been automatically generated
 from the [helm chart `vector/vector`](https://github.com/vectordotdev/helm-charts/tree/master/charts/vector)
-version 0.52.0 with the following `values.yaml`:
+version 0.56.0 with the following `values.yaml`:
 
 ```yaml
 role: Agent
diff --git a/distribution/kubernetes/vector-agent/configmap.yaml b/distribution/kubernetes/vector-agent/configmap.yaml
index 99cb8d91f4345..45a8cb2b5d42b 100644
--- a/distribution/kubernetes/vector-agent/configmap.yaml
+++ b/distribution/kubernetes/vector-agent/configmap.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
 data:
   agent.yaml: |
     data_dir: /vector-data-dir
diff --git a/distribution/kubernetes/vector-agent/daemonset.yaml b/distribution/kubernetes/vector-agent/daemonset.yaml
index 8c74a70107dec..c71bdd78bce4f 100644
--- a/distribution/kubernetes/vector-agent/daemonset.yaml
+++ b/distribution/kubernetes/vector-agent/daemonset.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
 spec:
   selector:
     matchLabels:
@@ -30,7 +30,7 @@ spec:
       dnsPolicy: ClusterFirst
       containers:
         - name: vector
-          image: "docker.io/timberio/vector:0.55.0-distroless-libc"
+          image: "docker.io/timberio/vector:0.56.0-distroless-libc"
           imagePullPolicy: IfNotPresent
           args:
             - --config-dir
diff --git a/distribution/kubernetes/vector-agent/rbac.yaml b/distribution/kubernetes/vector-agent/rbac.yaml
index 5cd8e99594981..735b6e9888bf0 100644
--- a/distribution/kubernetes/vector-agent/rbac.yaml
+++ b/distribution/kubernetes/vector-agent/rbac.yaml
@@ -10,7 +10,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
 rules:
   - apiGroups:
       - ""
@@ -31,7 +31,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
diff --git a/distribution/kubernetes/vector-agent/service-headless.yaml b/distribution/kubernetes/vector-agent/service-headless.yaml
index 573c2e67310c4..387a0f22c6c95 100644
--- a/distribution/kubernetes/vector-agent/service-headless.yaml
+++ b/distribution/kubernetes/vector-agent/service-headless.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
   annotations:
 spec:
   clusterIP: None
diff --git a/distribution/kubernetes/vector-agent/serviceaccount.yaml b/distribution/kubernetes/vector-agent/serviceaccount.yaml
index c1b65be5aea95..5c8e4754b56c2 100644
--- a/distribution/kubernetes/vector-agent/serviceaccount.yaml
+++ b/distribution/kubernetes/vector-agent/serviceaccount.yaml
@@ -9,5 +9,5 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Agent
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
 automountServiceAccountToken: true
diff --git a/distribution/kubernetes/vector-aggregator/README.md b/distribution/kubernetes/vector-aggregator/README.md
index ab45515cdaf94..8fba80518580e 100644
--- a/distribution/kubernetes/vector-aggregator/README.md
+++ b/distribution/kubernetes/vector-aggregator/README.md
@@ -1,6 +1,6 @@
 The kubernetes manifests found in this directory have been automatically generated
 from the [helm chart `vector/vector`](https://github.com/vectordotdev/helm-charts/tree/master/charts/vector)
-version 0.52.0 with the following `values.yaml`:
+version 0.56.0 with the following `values.yaml`:
 
 ```yaml
 
diff --git a/distribution/kubernetes/vector-aggregator/configmap.yaml b/distribution/kubernetes/vector-aggregator/configmap.yaml
index 464539b0afd4d..23fa0da68e6f0 100644
--- a/distribution/kubernetes/vector-aggregator/configmap.yaml
+++ b/distribution/kubernetes/vector-aggregator/configmap.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Aggregator
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
 data:
   aggregator.yaml: |
     data_dir: /vector-data-dir
diff --git a/distribution/kubernetes/vector-aggregator/service-headless.yaml b/distribution/kubernetes/vector-aggregator/service-headless.yaml
index bd5a2c5cc8432..5e5dafebd2908 100644
--- a/distribution/kubernetes/vector-aggregator/service-headless.yaml
+++ b/distribution/kubernetes/vector-aggregator/service-headless.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Aggregator
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
   annotations:
 spec:
   clusterIP: None
diff --git a/distribution/kubernetes/vector-aggregator/service.yaml b/distribution/kubernetes/vector-aggregator/service.yaml
index 5277bea614bdf..0c9d253d84991 100644
--- a/distribution/kubernetes/vector-aggregator/service.yaml
+++ b/distribution/kubernetes/vector-aggregator/service.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Aggregator
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
   annotations:
 spec:
   ports:
diff --git a/distribution/kubernetes/vector-aggregator/serviceaccount.yaml b/distribution/kubernetes/vector-aggregator/serviceaccount.yaml
index 8bc7b591147b7..8c61ef1a3dff8 100644
--- a/distribution/kubernetes/vector-aggregator/serviceaccount.yaml
+++ b/distribution/kubernetes/vector-aggregator/serviceaccount.yaml
@@ -9,5 +9,5 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Aggregator
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
 automountServiceAccountToken: true
diff --git a/distribution/kubernetes/vector-aggregator/statefulset.yaml b/distribution/kubernetes/vector-aggregator/statefulset.yaml
index e5ec9f1fcd1aa..450015edae7c2 100644
--- a/distribution/kubernetes/vector-aggregator/statefulset.yaml
+++ b/distribution/kubernetes/vector-aggregator/statefulset.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Aggregator
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
   annotations: {}
 spec:
   replicas: 1
@@ -34,7 +34,7 @@ spec:
       dnsPolicy: ClusterFirst
       containers:
         - name: vector
-          image: "docker.io/timberio/vector:0.55.0-distroless-libc"
+          image: "docker.io/timberio/vector:0.56.0-distroless-libc"
           imagePullPolicy: IfNotPresent
           args:
             - --config-dir
diff --git a/distribution/kubernetes/vector-stateless-aggregator/README.md b/distribution/kubernetes/vector-stateless-aggregator/README.md
index d3a701364d611..614f6426226e4 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/README.md
+++ b/distribution/kubernetes/vector-stateless-aggregator/README.md
@@ -1,6 +1,6 @@
 The kubernetes manifests found in this directory have been automatically generated
 from the [helm chart `vector/vector`](https://github.com/vectordotdev/helm-charts/tree/master/charts/vector)
-version 0.52.0 with the following `values.yaml`:
+version 0.56.0 with the following `values.yaml`:
 
 ```yaml
 role: Stateless-Aggregator
diff --git a/distribution/kubernetes/vector-stateless-aggregator/configmap.yaml b/distribution/kubernetes/vector-stateless-aggregator/configmap.yaml
index 5fe8fa6d1a4ca..11e9ecc0d0b20 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/configmap.yaml
+++ b/distribution/kubernetes/vector-stateless-aggregator/configmap.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Stateless-Aggregator
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
 data:
   aggregator.yaml: |
     data_dir: /vector-data-dir
diff --git a/distribution/kubernetes/vector-stateless-aggregator/deployment.yaml b/distribution/kubernetes/vector-stateless-aggregator/deployment.yaml
index d7b31fd50a07c..345a6458281ab 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/deployment.yaml
+++ b/distribution/kubernetes/vector-stateless-aggregator/deployment.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Stateless-Aggregator
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
   annotations: {}
 spec:
   replicas: 1
@@ -32,7 +32,7 @@ spec:
       dnsPolicy: ClusterFirst
       containers:
         - name: vector
-          image: "docker.io/timberio/vector:0.55.0-distroless-libc"
+          image: "docker.io/timberio/vector:0.56.0-distroless-libc"
           imagePullPolicy: IfNotPresent
           args:
             - --config-dir
diff --git a/distribution/kubernetes/vector-stateless-aggregator/service-headless.yaml b/distribution/kubernetes/vector-stateless-aggregator/service-headless.yaml
index 0c6143ee4074c..bf51f36a508d7 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/service-headless.yaml
+++ b/distribution/kubernetes/vector-stateless-aggregator/service-headless.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Stateless-Aggregator
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
   annotations:
 spec:
   clusterIP: None
diff --git a/distribution/kubernetes/vector-stateless-aggregator/service.yaml b/distribution/kubernetes/vector-stateless-aggregator/service.yaml
index 2f325ba8df63a..f19a6123ab9b8 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/service.yaml
+++ b/distribution/kubernetes/vector-stateless-aggregator/service.yaml
@@ -9,7 +9,7 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Stateless-Aggregator
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
   annotations:
 spec:
   ports:
diff --git a/distribution/kubernetes/vector-stateless-aggregator/serviceaccount.yaml b/distribution/kubernetes/vector-stateless-aggregator/serviceaccount.yaml
index 0a282a591d5e7..8c5dc213f27f0 100644
--- a/distribution/kubernetes/vector-stateless-aggregator/serviceaccount.yaml
+++ b/distribution/kubernetes/vector-stateless-aggregator/serviceaccount.yaml
@@ -9,5 +9,5 @@ metadata:
     app.kubernetes.io/name: vector
     app.kubernetes.io/instance: vector
     app.kubernetes.io/component: Stateless-Aggregator
-    app.kubernetes.io/version: "0.55.0-distroless-libc"
+    app.kubernetes.io/version: "0.56.0-distroless-libc"
 automountServiceAccountToken: true
diff --git a/website/content/en/releases/0.56.0.md b/website/content/en/releases/0.56.0.md
new file mode 100644
index 0000000000000..83e693e3434d9
--- /dev/null
+++ b/website/content/en/releases/0.56.0.md
@@ -0,0 +1,4 @@
+---
+title: Vector v0.56.0 release notes
+weight: 35
+---
diff --git a/website/cue/reference/administration/interfaces/kubectl.cue b/website/cue/reference/administration/interfaces/kubectl.cue
index 94d30ab6bedc2..0c74b574c9cc2 100644
--- a/website/cue/reference/administration/interfaces/kubectl.cue
+++ b/website/cue/reference/administration/interfaces/kubectl.cue
@@ -19,7 +19,7 @@ administration: interfaces: kubectl: {
 	role_implementations: [Name=string]: {
 		commands: {
 			_deployment_variant:       string
-			_vector_version:           "0.55"
+			_vector_version:           "0.56"
 			_namespace:                string | *"vector"
 			_controller_resource_type: string
 			_controller_resource_name: string | *_deployment_variant
diff --git a/website/cue/reference/releases/0.56.0.cue b/website/cue/reference/releases/0.56.0.cue
new file mode 100644
index 0000000000000..bfb16550249b8
--- /dev/null
+++ b/website/cue/reference/releases/0.56.0.cue
@@ -0,0 +1,646 @@
+package metadata
+
+releases: "0.56.0": {
+	date:     "2026-06-03"
+	codename: ""
+
+	whats_next: []
+
+	description: """
+		The [COSE team](https://opensource.datadoghq.com/about/#the-community-open-source-engineering-team) is excited to announce version `0.56.0`!
+
+		## Release highlights
+
+		- Added a new `databricks_zerobus` sink that streams log data to Databricks Unity Catalog tables through the Zerobus ingestion service. The sink supports OAuth 2.0 authentication, automatic schema fetching from Unity Catalog, and protobuf batch encoding.
+		- Added a new `delay` transform that delays each event by a fixed duration. Events can also
+		  be delayed based on a condition which includes VRL transforms.
+		- HTTP-based sinks that use the shared retry helpers now support a `retry_strategy` configuration
+		option to control which HTTP response codes are retried. The `http` sink also includes a new
+		example showing how to retry only specific transient status codes.
+		- The `vector` sink now supports `zstd` compression in addition to `gzip`. This provides better
+		 compression ratios and performance for Vector-to-Vector communication.
+		- The `tag_cardinality_limit` transform received major enhancements: per-tag cardinality
+		  overrides (`per_tag_limits`), per-metric tracking isolation (`tracking_scope: per_metric`),
+		  a global key cap (`max_tracked_keys`), and the ability to opt entire metrics out of
+		  cardinality tracking.
+		- Parquet batch encoding in the `aws_s3` sink is now available out of the box in official release
+		  binaries for all users.
+		- Fixed a CPU regression introduced in 0.50.0 affecting all sinks that use metric normalization such as `prometheus_remote_write`, `aws_cloudwatch_metrics`, `statsd`, and others.
+		- Restored support for installing Vector on RHEL 8, Rocky Linux 8, AlmaLinux 8, and CentOS
+		  Stream 8, which had been broken since 0.55.0 due to an inadvertent glibc requirement bump.
+		- Unit tests now support an optional `expected_event_count` field on test outputs, allowing assertions on the number of events emitted by a transform.
+
+		## Breaking Changes
+
+		- The `greptimedb_metrics` and `greptimedb_logs` sinks now require GreptimeDB v1.x. Users running GreptimeDB v0.x must upgrade their GreptimeDB instance before upgrading Vector.
+		"""
+
+	changelog: [
+		{
+			type: "feat"
+			description: #"""
+				HTTP-based sinks that use the shared retry helpers now support a `retry_strategy` configuration
+				option to control which HTTP response codes are retried. The `http` sink also includes a new
+				example showing how to retry only specific transient status codes.
+
+				Issue: https://github.com/vectordotdev/vector/issues/10870
+				"""#
+			contributors: ["ndrsg"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				HTTP-based sinks using the shared retry logic now classify transport-layer failures with
+				`HttpError::is_retriable`: connection and TLS connector issues may be retried, while failures
+				such as invalid HTTP request construction or an invalid proxy URI are not. Setting
+				`retry_strategy` to `none` disables retries for these transport errors and for request
+				timeouts, in addition to status-code-based retries.
+
+				Issue: https://github.com/vectordotdev/vector/issues/10870
+				"""#
+			contributors: ["ndrsg"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				The default `/etc/vector/vector.yaml` config file is no longer installed by the Debian, RPM, Alpine, and distroless-static Docker packages. The previous default ran a `demo_logs` source and printed synthesized syslog lines to stdout, which then surfaced in journald or `/var/log/` on hosts running Vector as a service and was a common source of confusion.
+
+				New installs will now have no active config on disk. Provide your own configuration at `/etc/vector/vector.yaml` (or pass `--config <path>`) before starting Vector. A reference example is shipped at `/usr/share/vector/examples/vector.yaml`, and more sample configs remain at `/etc/vector/examples/`.
+
+				Existing installs are unaffected on upgrade: package managers preserve the on-disk `/etc/vector/vector.yaml` if you already had one.
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "feat"
+			description: #"""
+				Unit tests now support an optional `expected_event_count` field on test outputs, allowing assertions on the number of events emitted by a transform.
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				The `vector` sink now supports `zstd` compression in addition to `gzip`. This provides better
+				compression ratios and performance for Vector-to-Vector communication.
+
+				The compression configuration has been enhanced to support multiple algorithms while maintaining
+				full backward compatibility:
+
+				## Legacy boolean syntax (still supported)
+
+				```yaml
+				sinks:
+				  my_vector:
+				    type: vector
+				    address: "localhost:6000"
+				    compression: true   # Uses gzip (default)
+				    # or
+				    compression: false  # No compression
+				```
+
+				## New string syntax
+
+				```yaml
+				sinks:
+				  my_vector:
+				    type: vector
+				    address: "localhost:6000"
+				    compression: "zstd"  # Use zstd compression
+				    # Supported values: "none", "gzip", "zstd"
+				```
+
+				The Vector source automatically accepts both gzip and zstd compressed data, enabling seamless
+				communication between Vector instances using different compression algorithms.
+				"""#
+			contributors: ["jpds"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed a CPU regression introduced in 0.50.0 affecting all sinks that use metric normalization such as `prometheus_remote_write`, `aws_cloudwatch_metrics`, `statsd`, and others.
+
+				The only exception is the `incremental_to_absolute` transform when `max_bytes` or `max_events` are configured, where the overhead is expected and necessary for eviction to work correctly.
+				"""#
+			contributors: ["thomasqueirozb"]
+		},
+		{
+			type: "feat"
+			description: #"""
+				Added a new `databricks_zerobus` sink that streams log data to Databricks Unity Catalog tables through the Zerobus ingestion service. The sink supports OAuth 2.0 authentication, automatic schema fetching from Unity Catalog, and protobuf batch encoding.
+				"""#
+			contributors: ["flaviocruz"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				The shared gRPC decompression layer now rejects request frames that set the
+				compressed flag without a negotiated `grpc-encoding` (e.g. `identity` or a
+				missing header). Previously, such malformed frames were silently decoded as
+				gzip, which could mask client/server compression-negotiation bugs.
+				"""#
+			contributors: ["jpds"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				The `opentelemetry` source's gRPC OTLP receiver now accepts `zstd`-compressed
+				requests in addition to `gzip`, matching the compression schemes advertised via
+				the `grpc-accept-encoding` response header. No configuration change is required;
+				clients can send OTLP payloads with `grpc-encoding: zstd` and they will be
+				transparently decompressed.
+				"""#
+			contributors: ["jpds"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed an issue during in-place reload of a sink with a disk buffer configured, where
+				the component would stall for batch.timeout_sec before gracefully reloading.
+				This fix also resolves an issue where Vector ignored SIGINT when a pipeline stall occurred.
+				"""#
+			contributors: ["graphcareful"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				The `windows_event_log` source no longer freezes after periods of inactivity.
+				"""#
+			contributors: ["tot19"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Sinks using batch encoding (Parquet, Arrow IPC) now consistently emit `ComponentEventsDropped` for every encode failure path. Previously some `build_record_batch` failures (notably type mismatches) dropped events silently. A new `EncoderRecordBatchError` internal event also reports `component_errors_total` with `error_code="arrow_json_decode"` or `"arrow_record_batch_creation"` at `stage="sending"` for granular alerting.
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				The error log + metric that the `splunk_hec` source emits on missing or invalid auth
+				headers now specifies "authentication_failed" as the `error_type`.
+				"""#
+			contributors: ["20agbekodo"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Restored support for installing Vector on RHEL 8, Rocky Linux 8, AlmaLinux 8, and CentOS Stream 8, which had been broken since v0.55.0 due to an inadvertent glibc requirement bump.
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Restored the full VRL stdlib, including `get_env_var`, in the standalone VRL CLI and web playground by default.
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Parquet encoding in the `aws_s3` sink (`batch_encoding`) now works out of the box in the official release binaries. Previously it required compiling Vector from source with the `codecs-parquet` feature.
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				The `windows_event_log` source now adds standard source metadata, including `source_type`, to emitted log events.
+				"""#
+			contributors: ["tot19"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				The `custom` auth strategy for the `http_server` source now supports event enrichment via metadata
+				writes. VRL programs can write `%field = value` during authentication; those values are injected
+				into every successfully authenticated event. The event body (`.field`) remains read-only. Existing
+				`custom` programs that do not write metadata are unaffected.
+				"""#
+			contributors: ["20agbekodo"]
+		},
+		{
+			type: "feat"
+			description: #"""
+				Added a new `delay` transform that delays each event by a fixed duration.
+				"""#
+			contributors: ["esensar", "Quad9DNS"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed a bug in the `file` source where checkpoints recording the last-read file position were not always fully written before Vector shut down. On the next startup, the `file` source could start reading from an earlier position, causing events to be re-processed.
+				"""#
+			contributors: ["thomasqueirozb"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				The `aggregate` transform now correctly passes through or ignores metrics whose kind is not supported
+				by the configured mode. Prior to this change, these metrics would be silently dropped, contrary to
+				the officially documented behavior. For example, `absolute` metrics flowing through a `sum`-mode aggregate
+				transform are now forwarded to the next step in the pipeline unchanged rather than being dropped:
+
+				```text
+				{kind: incremental, type: counter, name: "http.requests", value: 10}  → summed into aggregate
+				{kind: absolute,    type: gauge,   name: "cpu.usage",     value: 0.83} → previously dropped, now passes through unchanged
+				{kind: incremental, type: counter, name: "http.requests", value: 5}   → summed into aggregate
+				```
+
+				If you want to preserve the previous drop behavior, add a `filter` transform before the aggregate transform to discard the unwanted metric kind.
+				"""#
+			contributors: ["ArunPiduguDD"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				The `aws_s3` and `clickhouse` sinks now correctly advertise only the `batch_encoding.codec` values they actually support: `parquet` for `aws_s3` and `arrow_stream` for `clickhouse`. Previously, the documentation and configuration schema listed both codecs for both sinks, even though picking the wrong one produced a startup error.
+				"""#
+			contributors: ["flaviofcruz"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed a crash that could occur when a source or transform emitted an empty event batch into a topology with downstream buffers. Vector now
+				drops empty batches before they reach those buffers and logs a warning identifying the upstream component.
+				"""#
+			contributors: ["graphcareful"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				The text content generated by the `demo_logs` source has changed: the
+				pool of fake usernames and the pool of fake domain TLDs are now both
+				defined inside Vector rather than pulled from an external crate. The
+				line formats (`apache_common`, `apache_error`, `json`, `syslog`,
+				`bsd_syslog`) are unchanged. If any of your tests or downstream
+				pipelines assert on specific generated usernames or TLDs, update those expectations.
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed a bug in the topology builder causing component metrics registered at build
+				time to miss the component tags if the component build function awaits non-trivially.
+
+				This notably affected sinks using a disk buffer, and sources or sinks performing
+				IO work in the build function.
+				"""#
+			contributors: ["gwenaskell"]
+		},
+		{
+			type:     "chore"
+			breaking: true
+			description: #"""
+				The `greptimedb_metrics` and `greptimedb_logs` sinks now require GreptimeDB v1.x. Users running GreptimeDB v0.x must upgrade their GreptimeDB instance before upgrading Vector.
+				"""#
+			contributors: ["thomasqueirozb"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Fixed a bug in the `mqtt` source where user-provided TLS client certificates (`crt_file` / `key_file`) were being silently ignored, breaking mTLS connections to strict brokers like AWS IoT Core.
+				"""#
+			contributors: ["mr-"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				Redact sink-specific API key headers (`DD-API-KEY`, `X-Honeycomb-Team`, `x-api-key`, `Api-Key`) in debug-level HTTP request and response logs, alongside the existing standard headers (`Authorization`, `Proxy-Authorization`, `Proxy-Authenticate`, `WWW-Authenticate`, `Cookie`, `Set-Cookie`, `Cookie2`).
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "feat"
+			description: #"""
+				Added `ratio_field` and `rate_field` options to the `sample` transform to support dynamic per-event sampling, while requiring static `rate` or `ratio` fallback configuration and disallowing `ratio_field` and `rate_field` together.
+				"""#
+			contributors: ["jhammer"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				Bumped `serde_json` to `1.0.149` and `serde_with` to `3.18.0`. `serde_json` switched its float-to-string formatter from Ryū to Żmij in `1.0.147`, so floats serialized via the `native_json` codec may render with slightly different textual form (for example `1e+16` instead of `1e16`). The change is purely cosmetic: parsed `f32`/`f64` values round-trip identically, and Vector-to-Vector communication between old and new versions is unaffected.
+				"""#
+			contributors: ["pront"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				The `splunk_hec` source now accepts optional per-endpoint codec configuration via `event: { framing, decoding }` and `raw: { framing, decoding }`. When `decoding` is set on an endpoint, Vector applies a second decoding pass after the HEC envelope is parsed: on `/services/collector/event` the envelope's `event` field is fed through the codec, and on `/services/collector/raw` the request body is fed through the codec directly. A single payload can fan out to multiple events.
+
+				For example, to decode JSON payloads in `/event` requests while splitting `/raw` bodies on newlines:
+
+				```yaml
+				sources:
+				  hec:
+				    type: splunk_hec
+				    address: 0.0.0.0:8088
+				    event:
+				      decoding:
+				        codec: json
+				    raw:
+				      framing:
+				        method: newline_delimited
+				      decoding:
+				        codec: bytes
+				```
+				"""#
+			contributors: ["thomasqueirozb"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				The `tag_cardinality_limit` transform now accepts a top-level `per_tag_limits` map,
+				mirroring the per-metric one: `mode: limit_override` to set a per-tag cap, or
+				`mode: excluded` to bypass cardinality tracking for that tag on every metric without a
+				`per_metric_limits` entry.
+				"""#
+			contributors: ["kaarolch"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				Reduced the memory usage of the `tag_cardinality_limit` transform when running in `exact` mode by allocating less unused memory on initialization.
+				"""#
+			contributors: ["ArunPiduguDD"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				The `tag_cardinality_limit` transform gained two new configuration capabilities:
+
+				- **Per-tag overrides** (`per_tag_limits`): configure cardinality limits per tag key within a metric, or exclude individual tags from tracking.
+				- **Metric exclusion**: opt entire metrics out of cardinality tracking via `mode: excluded` in `per_metric_limits`.
+				"""#
+			contributors: ["ArunPiduguDD"]
+		},
+		{
+			type: "enhancement"
+			description: #"""
+				The `tag_cardinality_limit` transform gained two new settings:
+
+				- **`tracking_scope`**: isolate tag tracking per metric (`per_metric`) instead of sharing a single bucket across all metrics (`global`, the default).
+				- **`max_tracked_keys`**: cap the total number of tag keys tracked to bound memory usage.
+				"""#
+			contributors: ["ArunPiduguDD"]
+		},
+		{
+			type: "fix"
+			description: #"""
+				TCP-based sources that emit acknowledgements (`fluent`, `logstash`) no longer log a spurious `Error writing acknowledgement, dropping connection.` at ERROR level when the ack write fails because the peer cleanly closed its TLS session (for example, during a rolling pod restart). These graceful shutdowns now log at WARN and no longer increment `component_errors_total{error_code="ack_failed", ...}`, preventing operator dashboards/alerts from firing on routine peer disconnects. Genuine ack write failures are still logged at ERROR and continue to increment `component_errors_total`.
+
+				The `connection_shutdown_total{mode="tcp"}` counter is now incremented exactly once per accepted source connection when its per-connection task exits, pairing with `ConnectionOpen` — regardless of cause (TLS handshake failure, shutdown signal during handshake, graceful peer EOF, decoder failure, downstream closed, ack write failure, tripwire, max connection duration). Previously it was not emitted by TCP sources at all.
+				"""#
+			contributors: ["taylorchandleryoung"]
+		},
+	]
+
+	vrl_changelog: #"""
+		### [0.33.1 (2026-06-02)]
+
+		#### Fixes
+
+		- Reverted `parse_regex` changes from 0.33.0 which introduced a performance regression in multi-threaded scenarios.
+
+		(https://github.com/vectordotdev/vrl/pull/1789)
+
+
+		### [0.33.0 (2026-05-28)]
+
+		#### New Features
+
+		- VRL string literals now support `\u{HEX}` Unicode escape sequences. Any valid Unicode scalar value can be expressed, e.g. `"hello\u{1F30E}world"`. Invalid sequences (empty braces, non-hex digits, surrogate codepoints, or values above U+10FFFF) are reported as a compile-time error.
+
+		(https://github.com/vectordotdev/vrl/pull/1771)
+		- ~`parse_regex` now accepts dynamic regex patterns (variables and runtime expressions), consistent with `parse_regex_all`. When the pattern is a literal, return type information remains precise based on named capture groups.~
+
+		~(https://github.com/vectordotdev/vrl/pull/1774)~
+
+		#### Enhancements
+
+		- Updated user agent data for `parse_user_agent` function
+
+		(https://github.com/vectordotdev/vrl/pull/1776)
+		- Protobuf encoding now coerces compatible scalar types into the target field type: integers and strings are accepted for `bool` fields (using the same parsing as `to_bool`), and integers are accepted for `float`/`double` fields. Previously these inputs failed encoding and required explicit conversion in VRL.
+
+		(https://github.com/vectordotdev/vrl/pull/1763)
+		- Added an optional `allow_lossy_string_coercion` argument to `encode_proto`. VRL's protobuf encoding stringifies `Boolean`, `Integer`, `Float`, and `Timestamp` values when assigned to a protobuf `string` field as a convenience for callers handling loosely typed input. The [protobuf JSON mapping](https://protobuf.dev/programming-guides/json/) only accepts a JSON string for a `string` field, so callers who want strict spec-compliant encoding can now pass `allow_lossy_string_coercion: false`. The default stays `true`, so today's behavior is unchanged.
+
+		(https://github.com/vectordotdev/vrl/pull/1764)
+		- ~Improved performance of `parse_regex`/`parse_regex_all` by pre-computing capture group names and indices at compile time. Users may see anywhere from 4% to 13% speedups in some cases.~
+
+		~(https://github.com/vectordotdev/vrl/pull/1773)~
+		- Improved performance of `parse_regex_all` by reusing the compiled regex across invocations.
+
+		(https://github.com/vectordotdev/vrl/pull/1775)
+
+		#### Fixes
+
+		- The compiler now reports every unhandled-error in a single compilation pass instead of stopping at the first one. For example:
+
+		```coffee
+		{
+		push(.x, 1)
+		.b = push(.y, 2)
+		}
+		```
+
+		now reports both `push(.x, 1)` (unhandled error) and `.b = push(.y, 2)` (unhandled fallible assignment) in one go. Previously you'd only see the second one, fix it, recompile, and only then discover the first.
+
+		(https://github.com/vectordotdev/vrl/pull/1759)
+		- Fixed a confusing compile error where a fallible call earlier in a block could cause a later, unrelated assignment to be reported as the problem. For example:
+
+		```coffee
+		{
+		.a = 1
+		push(.x, 1)        # the unhandled error is actually here
+		.b = 2             # but the compiler used to flag this line
+		}
+		```
+
+		The error is now reported on the actual fallible expression, so adding `!` or the `, err =` form fixes it where you'd expect. This also fixes the same shape inside closure bodies, e.g. inside `for_each`/`map_values`.
+
+		(https://github.com/vectordotdev/vrl/pull/453)
+		- Fixed a false positive in the unused-variable diagnostic (`E900`) where a variable used before being reassigned (shadowed) was incorrectly flagged as unused at its original assignment.
+
+		(https://github.com/vectordotdev/vrl/pull/1743)
+		- `encode_proto` and `parse_proto` now support proto maps whose keys are integers or booleans, not just strings. Because VRL object keys are always strings, integer and boolean keys are written in their string form:
+
+		```coffee
+		encode_proto({ "by_id": { "42": "alice" } }, "schema.desc", "MyMessage")
+		```
+
+		Previously `parse_proto` errored on these maps and `encode_proto` silently dropped the field. Note that `encode_proto` will now return an error if a key string can't be parsed into the schema's key type (for example, `"abc"` against a `map<int32, ...>`).
+
+		(https://github.com/vectordotdev/vrl/pull/1762)
+		- Fixed a typo in enum variant that made it impossible to use `SCREAMING_SNAKE` in casing functions such as `pascalcase`, `camelcase` and others.
+
+		`pascalcase("hello", original_case: "SCREAMING_SNAKE")` now compiles properly.
+
+		(https://github.com/vectordotdev/vrl/pull/1770)
+		- Allowed the `else` keyword (and `else if`) to appear on a new line after the closing `}` of an `if`-block. Previously the trailing newline terminated the if-expression at the parser level, forcing `else` to share a line with `}`.
+
+		authors: pront
+
+		(https://github.com/vectordotdev/vrl/pull/1756)
+
+		"""#
+
+	commits: [
+		{sha: "1c70988b54156abf8d031538f0f81f28e7c0a0e4", date: "2026-04-21 17:00:33 UTC", description: "restore HTTP GET /health endpoint", pr_number: 25234, scopes: ["api"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 6, insertions_count: 162, deletions_count: 11},
+		{sha: "aafd4cb44f5649e692722b97d82973fea5509a41", date: "2026-04-21 18:21:39 UTC", description: "drop fakedata_generator, fix broken fake domains", pr_number: 25236, scopes: ["demo_logs source"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 6, insertions_count: 61, deletions_count: 26},
+		{sha: "8cf773df0e3b219e40537119aa2b95b916342df2", date: "2026-04-22 18:31:21 UTC", description: "start 0.56.0 development cycle", pr_number: 25242, scopes: ["releasing"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 59, insertions_count: 786, deletions_count: 233},
+		{sha: "f36ed0e2cebf36efdc7392aed0ed52ae28a29101", date: "2026-04-22 19:54:48 UTC", description: "render release date on per-version release page", pr_number: 25244, scopes: ["website"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 9, deletions_count: 0},
+		{sha: "29b17aadc63fdd9a9bdc3b64bbd8f9c647844cdb", date: "2026-04-22 20:30:30 UTC", description: "skip re-adding WIP label on synchronize if already approved", pr_number: 25246, scopes: ["ci"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 29, deletions_count: 1},
+		{sha: "d99899e2f9cb94c8d421270ada8688243402b5a1", date: "2026-04-22 20:41:08 UTC", description: "fix docs sidebar expand/collapse navigation", pr_number: 25238, scopes: ["website"], type: "fix", breaking_change: false, author: "shalk(xiao kun)", files_count: 1, insertions_count: 5, deletions_count: 2},
+		{sha: "ecdaa50ac15e6a26e811bf21e3a6e33729bebb33", date: "2026-04-22 23:23:12 UTC", description: "verify choco package install after 5xx from feed", pr_number: 25116, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 4, deletions_count: 1},
+		{sha: "f1557d68c8e7f36feb8e2d0c7a04286817c6bf9f", date: "2026-04-23 14:16:39 UTC", description: "add `expected_event_count` field to test outputs", pr_number: 25186, scopes: ["unit tests"], type: "feat", breaking_change: false, author: "Pavlos Rontidis", files_count: 5, insertions_count: 323, deletions_count: 11},
+		{sha: "cfb942bf7d1983b9eeaeb93ba2f843a816d1db5d", date: "2026-04-23 17:39:22 UTC", description: "bump openssl from 0.10.75 to 0.10.78", pr_number: 25250, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 5, deletions_count: 5},
+		{sha: "c0cdf2068f79176fd8af4dca9b27cabae5be3091", date: "2026-04-23 17:52:07 UTC", description: "extract unit tests into reusable workflow", pr_number: 25247, scopes: ["ci"], type: "chore", breaking_change: false, author: "Thomas", files_count: 3, insertions_count: 125, deletions_count: 24},
+		{sha: "f56f4fa7234440345d790a2b81c7aa880be831d8", date: "2026-04-23 20:29:50 UTC", description: "remove Chocolatey from Windows bootstrap", pr_number: 25254, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 2, insertions_count: 39, deletions_count: 40},
+		{sha: "7428dc3f4b23c56f1f2eecf44b3f6b2532c28dac", date: "2026-04-24 18:40:53 UTC", description: "use dd-sts instead of DD_API_KEY", pr_number: 25235, scopes: ["ci"], type: "chore", breaking_change: false, author: "Thomas", files_count: 11, insertions_count: 82, deletions_count: 12},
+		{sha: "7815f26ef4f357c7e3e90048e4287728c9506423", date: "2026-04-24 18:43:56 UTC", description: "add Docker support for local development", pr_number: 25237, scopes: ["website"], type: "chore", breaking_change: false, author: "shalk(xiao kun)", files_count: 3, insertions_count: 83, deletions_count: 0},
+		{sha: "74574a360112a4bb212915b896471320fb157b96", date: "2026-04-24 18:50:53 UTC", description: "add linux arm64 to publish matrix and bump to 0.3.2", pr_number: 25260, scopes: ["vdev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 4, insertions_count: 5, deletions_count: 3},
+		{sha: "3b043d33b95670ef1cbd2f5af274fa25ebb1db84", date: "2026-04-24 18:55:51 UTC", description: "add support for GreptimeDB v1.0.0", pr_number: 25178, scopes: ["greptimedb sink"], type: "feat", breaking_change: true, author: "Thomas", files_count: 12, insertions_count: 623, deletions_count: 273},
+		{sha: "61cc4d84d2966e7552a308d5df5a0f03305d7eed", date: "2026-04-27 13:40:18 UTC", description: "make publish-s3 wait for generate-sha256sum", pr_number: 25265, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 1, deletions_count: 0},
+		{sha: "454b096abcfd609b4e317b83fa4ec1ec79af5da8", date: "2026-04-27 14:14:28 UTC", description: "add datadog_metrics series v1 deprecation entry", pr_number: 25271, scopes: ["deprecations"], type: "docs", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 1, deletions_count: 0},
+		{sha: "aa9265d6026f7d5998cada6a50e9c66790fbf054", date: "2026-04-27 14:47:04 UTC", description: "add dependabot config for scripts/environment/npm-tools", pr_number: 25175, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 16, deletions_count: 0},
+		{sha: "69fd3b6f7e544a3f4bbba1d6d7e882a67387b081", date: "2026-04-27 14:56:51 UTC", description: "bump github/codeql-action from 4.32.4 to 4.35.2", pr_number: 25280, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "413caac10f64475b509687000317e06e55de55e0", date: "2026-04-27 15:18:47 UTC", description: "allow dd-token federation to fail on fork PRs", pr_number: 25284, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 6, deletions_count: 1},
+		{sha: "ba84da5d8965aef1d5eb5455dc9f4d723177e914", date: "2026-04-27 15:01:24 UTC", description: "bump actions/github-script from 7 to 9", pr_number: 25278, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 6, insertions_count: 10, deletions_count: 10},
+		{sha: "a4ea6de53b829e6ec66fadaddd78317f099207b9", date: "2026-04-27 15:34:31 UTC", description: "bump actions/upload-artifact from 7.0.0 to 7.0.1 in the artifact group across 1 directory", pr_number: 25276, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 8, insertions_count: 15, deletions_count: 15},
+		{sha: "1d4b6c2122b82997b808bba0527ec60dbb37a3ba", date: "2026-04-27 15:36:38 UTC", description: "Emit warn on unauthenticated request", pr_number: 25230, scopes: ["splunk_hec source"], type: "fix", breaking_change: false, author: "Josué AGBEKODO", files_count: 3, insertions_count: 35, deletions_count: 12},
+		{sha: "156b832637c2f18b4d32fbb347e0e5f0919407d3", date: "2026-04-27 18:33:20 UTC", description: "include page title in docs search query fields", pr_number: 25255, scopes: ["website"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "a843435f9677fe45f482ff4604bfe92b8a3d57c7", date: "2026-04-27 20:16:32 UTC", description: "Fix for issue causing stalling on shutdown for sinks configured w/ disk buffers", pr_number: 24949, scopes: ["topology"], type: "fix", breaking_change: false, author: "Rob Blafford", files_count: 7, insertions_count: 396, deletions_count: 111},
+		{sha: "ff4754ab10da5838f68cc143e507087090518f91", date: "2026-04-28 14:04:28 UTC", description: "make nightly S3 verify resilient to CDN staleness", pr_number: 25259, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 17, deletions_count: 10},
+		{sha: "6f3857906d3a54d9c05aa5d3aaa8b132ac8f5e6e", date: "2026-04-28 15:12:07 UTC", description: "restore stdlib functions in CLI and playground", pr_number: 25310, scopes: ["vrl"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 3, insertions_count: 10, deletions_count: 0},
+		{sha: "23016adf7d87f41a3d887d587b21d3409e71e3fe", date: "2026-04-28 15:52:16 UTC", description: "fix release issue templates", pr_number: 25318, scopes: ["internal docs"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 2, insertions_count: 4, deletions_count: 3},
+		{sha: "96ad9edc5bd894029af95961ea205e0d89b17bf0", date: "2026-04-28 18:17:38 UTC", description: "improve docs search ranking for component pages", pr_number: 25319, scopes: ["website"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 5, deletions_count: 2},
+		{sha: "ce6ca439caf80bd2af10864a84e949ef244e2163", date: "2026-04-28 19:40:29 UTC", description: "centralize `events_dropped` emission for batch encoding errors", pr_number: 25199, scopes: ["codecs"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 5, insertions_count: 153, deletions_count: 61},
+		{sha: "d6cdf031d16a382a38046127fbc7ff30c2457709", date: "2026-04-28 21:40:45 UTC", description: "enable codecs-parquet in all release feature sets", pr_number: 25321, scopes: ["releasing"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 8, insertions_count: 186, deletions_count: 23},
+		{sha: "233a35c47eab1a0691b39e4af06991dfe4b0f571", date: "2026-04-28 23:33:23 UTC", description: "correct cross-build artifact name and path", pr_number: 25282, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "8b465f6406fd088302d42f7e879297937bb8783f", date: "2026-04-29 17:44:41 UTC", description: "bump the patches group across 1 directory with 13 updates", pr_number: 25283, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 6, insertions_count: 293, deletions_count: 155},
+		{sha: "75b9d07a8231e7c321652e4ff031d8ce0757d9ab", date: "2026-04-29 19:57:15 UTC", description: "improve search ranking for component reference pages", pr_number: 25327, scopes: ["website"], type: "feat", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 44, deletions_count: 6},
+		{sha: "625c1d3a57a59784da7b1e42b2318d4c372649d8", date: "2026-04-29 20:06:31 UTC", description: "bump the serde group across 1 directory with 2 updates", pr_number: 25227, scopes: ["deps"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 16, insertions_count: 71, deletions_count: 26},
+		{sha: "b5fb618eb24bade72d5277be6d23836810d24fa8", date: "2026-04-30 21:53:00 UTC", description: "remove unused update_counter macro", pr_number: 25333, scopes: ["dev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 0, deletions_count: 44},
+		{sha: "bd8ab1a245a439134b2bd9f2cb540ca550db860c", date: "2026-05-01 13:30:24 UTC", description: "introduce RetryStrategy / Config for http based sinks", pr_number: 25057, scopes: ["sinks"], type: "feat", breaking_change: false, author: "Andy", files_count: 32, insertions_count: 957, deletions_count: 59},
+		{sha: "9c617a7b766dc95ea919384ff16da2654595f6a4", date: "2026-05-01 14:04:29 UTC", description: "grant issues:write to remove_wip_label workflow", pr_number: 25339, scopes: ["ci"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 1, deletions_count: 0},
+		{sha: "308d2469b2e70153d3eafd20a647bf33a9d69d73", date: "2026-05-01 14:43:39 UTC", description: "prevent windows_event_log permanent freeze from signal-event lost wakeup", pr_number: 25195, scopes: ["sources"], type: "fix", breaking_change: false, author: "tot19", files_count: 3, insertions_count: 546, deletions_count: 112},
+		{sha: "59a53b138d127fdca68d260628d1dc0035b3f711", date: "2026-05-01 17:43:39 UTC", description: "remove type-level default on StatusCode", pr_number: 25345, scopes: ["internal docs"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 13, insertions_count: 12, deletions_count: 13},
+		{sha: "f1b2c3a3f14f59ab9615829852da6e65a7d2c512", date: "2026-05-01 17:06:42 UTC", description: "add windows_event_log source metadata", pr_number: 25337, scopes: ["sources"], type: "fix", breaking_change: false, author: "tot19", files_count: 2, insertions_count: 18, deletions_count: 2},
+		{sha: "9f15e23943d4347a6f2171eaa97a921a5e58d457", date: "2026-05-01 17:56:58 UTC", description: "bump cue and add cue-build step to Check Cue docs", pr_number: 25346, scopes: ["ci"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 4, insertions_count: 9, deletions_count: 7},
+		{sha: "7923556313d66be69e638022e10fe3fd13f468ac", date: "2026-05-01 18:57:31 UTC", description: "use dedicated batch_encoding types", pr_number: 25340, scopes: ["clickhouse sink", "aws_s3 sink"], type: "fix", breaking_change: false, author: "Flavio Cruz", files_count: 8, insertions_count: 147, deletions_count: 212},
+		{sha: "e1c6139b9717f36027b0ac9fe4d20276da4da128", date: "2026-05-02 20:51:00 UTC", description: "introduce enums for metric names", pr_number: 25342, scopes: ["metrics"], type: "chore", breaking_change: false, author: "Thomas", files_count: 106, insertions_count: 1254, deletions_count: 711},
+		{sha: "48be543ff3b84dfbd56a49cc6a0a0aac450bbceb", date: "2026-05-04 14:01:46 UTC", description: "scope HistogramName import to s3 module", pr_number: 25353, scopes: ["aws_sqs source"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 2, deletions_count: 1},
+		{sha: "96db40ef65b0d1246f06581987e5b6428468edf0", date: "2026-05-04 17:47:01 UTC", description: "Make transform-related functions in aggregate & tag cardinality transforms public", pr_number: 25358, scopes: ["metrics"], type: "enhancement", breaking_change: false, author: "ArunPiduguDD", files_count: 2, insertions_count: 3, deletions_count: 3},
+		{sha: "8073e93b48352f781aace209f816ac55280a8935", date: "2026-05-04 19:13:10 UTC", description: "rename WIP label workflows to docs review label", pr_number: 25355, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 3, insertions_count: 23, deletions_count: 10},
+		{sha: "4524b52c921447dfca228338add190f0363b582e", date: "2026-05-04 23:08:38 UTC", description: "upgrade hickory-proto to 0.26.1, ignore RUSTSEC-2026-0119", pr_number: 25354, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 5, insertions_count: 226, deletions_count: 240},
+		{sha: "6c3116a6e0a1d44113e5e2ce0b7e5aeeef3db785", date: "2026-05-05 13:33:38 UTC", description: "retry apt fetches in deb-verify to reduce flakes", pr_number: 25367, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "95756d72356406d1a71625dbcc8f83e49f43947d", date: "2026-05-05 15:34:08 UTC", description: "dynamic rate for sample", pr_number: 25035, scopes: ["transforms"], type: "enhancement", breaking_change: false, author: "jh7459-gh", files_count: 5, insertions_count: 749, deletions_count: 61},
+		{sha: "f7cc83e980e5af429ee040c07aab7f96dd70cb15", date: "2026-05-05 17:37:26 UTC", description: "adjust tocbot content tracking", pr_number: 25359, scopes: ["external docs"], type: "fix", breaking_change: false, author: "Aaron Zheng", files_count: 2, insertions_count: 6, deletions_count: 3},
+		{sha: "bec3290d7806fbefc1923fd676bb865c95e7f115", date: "2026-05-05 17:39:34 UTC", description: "bump axios from 1.15.0 to 1.16.0 in /website", pr_number: 25369, scopes: ["website deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 5, deletions_count: 5},
+		{sha: "202c974c18a8bfdb8102f6f0a8c3580bd3e9e96a", date: "2026-05-05 18:00:29 UTC", description: "bump postcss from 8.5.6 to 8.5.14 in /website", pr_number: 25368, scopes: ["website deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 3, deletions_count: 3},
+		{sha: "92ee2b26923ea0eaf8c0b4c1bc0398c679a4b44d", date: "2026-05-06 03:49:05 UTC", description: "Add remove tag function for metrics which returns entire tag set", pr_number: 25361, scopes: ["metrics"], type: "enhancement", breaking_change: false, author: "ArunPiduguDD", files_count: 1, insertions_count: 33, deletions_count: 0},
+		{sha: "249d064d75e5337efd1cd4fd2949de20e16d801e", date: "2026-05-06 12:36:13 UTC", description: "rewrite scripts/generate-component-docs.rb in Rust (#22350)", pr_number: 24781, scopes: ["dev"], type: "feat", breaking_change: false, author: "Swaraj Patil", files_count: 11, insertions_count: 1990, deletions_count: 1930},
+		{sha: "e109afcff7b4d0d58bf710c797b5028c2d067250", date: "2026-05-06 15:19:22 UTC", description: "add docker run example in distribution README", pr_number: 25268, scopes: ["external"], type: "docs", breaking_change: false, author: "st-omarkhalid", files_count: 1, insertions_count: 12, deletions_count: 3},
+		{sha: "66e25a90bec1e3b3def56f0c00ae49d8e71260e5", date: "2026-05-06 15:23:25 UTC", description: "use single agent to fix e2e datadog-metrics histogram flakiness", pr_number: 25363, scopes: ["tests"], type: "fix", breaking_change: false, author: "Thomas", files_count: 4, insertions_count: 26, deletions_count: 64},
+		{sha: "e6c0e3f6c46dd38b3c601c473149e07f5b71eb9e", date: "2026-05-06 15:38:07 UTC", description: "add new databricks_zerobus for Databricks ingestion", pr_number: 24840, scopes: ["sinks"], type: "feat", breaking_change: false, author: "Flavio Cruz", files_count: 26, insertions_count: 3187, deletions_count: 32},
+		{sha: "5112e0ae334120465b333c1777da38593a4b8c60", date: "2026-05-06 18:00:21 UTC", description: "bump openssl from 0.10.78 to 0.10.79", pr_number: 25380, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 9, deletions_count: 10},
+		{sha: "27e74de2d2daa8368e4b073fa90d443eb7974ba2", date: "2026-05-06 20:34:22 UTC", description: "bump docker/login-action from 4.0.0 to 4.1.0", pr_number: 25349, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 4, insertions_count: 6, deletions_count: 6},
+		{sha: "8105f31eef65e4e3d823f382d05d63e433394777", date: "2026-05-06 21:26:46 UTC", description: "add code coverage collection for integration and e2e test suites", pr_number: 25088, scopes: ["ci"], type: "chore", breaking_change: false, author: "Thomas", files_count: 15, insertions_count: 353, deletions_count: 46},
+		{sha: "bfeb76986acc74ad7c28acd2c60053d3cbdeb2bd", date: "2026-05-07 15:26:32 UTC", description: "support second-stage framing and decoding", pr_number: 25312, scopes: ["splunk_hec source"], type: "feat", breaking_change: false, author: "Thomas", files_count: 7, insertions_count: 2683, deletions_count: 219},
+		{sha: "17a720cc90ebbbab9051eb5a2479a51eddf2760d", date: "2026-05-07 16:23:08 UTC", description: "remove release-flags.sh", pr_number: 24828, scopes: ["ci"], type: "chore", breaking_change: false, author: "Thomas", files_count: 7, insertions_count: 4, deletions_count: 24},
+		{sha: "256b8fa98627f37f26d6e11a84bfeda44981fc21", date: "2026-05-07 17:52:19 UTC", description: "skip Windows UDP-excluded ports in next_addr_for_ip", pr_number: 25386, scopes: ["tests"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 10, deletions_count: 0},
+		{sha: "8d83e1790cf3337f8db56c0920e629866e7a1362", date: "2026-05-07 18:03:02 UTC", description: "bump hickory-net from 0.26.0 to 0.26.1", pr_number: 25389, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 12, deletions_count: 12},
+		{sha: "bbde98b342fff4d69ccc49d537feda9572c9df79", date: "2026-05-08 14:20:34 UTC", description: "fix LTO settings after release-flags.sh removal", pr_number: 25393, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 3, deletions_count: 2},
+		{sha: "cdb27e859b95fda129cfbed5e2b078af0f3c42c9", date: "2026-05-08 14:36:09 UTC", description: "kill Ruby and port release scripts to native vdev", pr_number: 25379, scopes: ["dev"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 36, insertions_count: 2616, deletions_count: 1806},
+		{sha: "5cedf015de0c07d9f7e6f0023264279fcf986a40", date: "2026-05-08 15:06:43 UTC", description: "fix wording in decoder and framing doc strings", pr_number: 25382, scopes: ["codecs"], type: "docs", breaking_change: false, author: "Thomas", files_count: 32, insertions_count: 639, deletions_count: 712},
+		{sha: "d9b06937242d4e5f484362fab6c0506b3676347f", date: "2026-05-08 15:09:03 UTC", description: "Add zstd compression support", pr_number: 24917, scopes: ["vector sink"], type: "feat", breaking_change: false, author: "Jonathan Davies", files_count: 14, insertions_count: 528, deletions_count: 72},
+		{sha: "e59ac5715d4c8cc63b2e9076d19c4ef0429a2b4e", date: "2026-05-08 15:12:02 UTC", description: "Clarify acknowledgement guarantees with disk buffers", pr_number: 25388, scopes: ["external docs"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 7, deletions_count: 2},
+		{sha: "39138e0e7b73a3b1d4f9dd7f0617343c3afd42ca", date: "2026-05-08 15:27:00 UTC", description: "add /ci-run-regression trigger + accept refs in inputs", pr_number: 25245, scopes: ["ci"], type: "feat", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 85, deletions_count: 43},
+		{sha: "4ff1874b38008c15afeb61902298b36593a727bb", date: "2026-05-08 16:43:29 UTC", description: "emit channel-suffixed version from publish-metadata", pr_number: 25395, scopes: ["vdev"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 4, deletions_count: 3},
+		{sha: "41bc804eab5590ccb44084512eb05b4a5612e2b7", date: "2026-05-08 16:49:29 UTC", description: "replace bootstrap scripts with setup action in publish workflows", pr_number: 25311, scopes: ["ci"], type: "chore", breaking_change: false, author: "Thomas", files_count: 4, insertions_count: 56, deletions_count: 21},
+		{sha: "0d9111807bc7abb24ff53ef8590b8ca3ba4d8834", date: "2026-05-08 17:41:34 UTC", description: "bump vrl to latest main", pr_number: 25398, scopes: ["deps"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 5, insertions_count: 19, deletions_count: 15},
+		{sha: "63b29fb2d8d80b5be57a897e14c8d29ed23d5663", date: "2026-05-08 18:38:00 UTC", description: "skip dd-sts federation on fork PRs via ACTIONS_ID_TOKEN_REQUEST_URL guard", pr_number: 25399, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 14, deletions_count: 2},
+		{sha: "81f013820839be8ab0cc28069ab943c44f0f28cb", date: "2026-05-08 19:03:05 UTC", description: "use debug profile for k8s e2e build", pr_number: 25397, scopes: ["ci"], type: "chore", breaking_change: false, author: "Thomas", files_count: 3, insertions_count: 12, deletions_count: 10},
+		{sha: "f3346607ba25645a682b4b5bbc56d95a7f4bb4dd", date: "2026-05-08 19:11:30 UTC", description: "make -D warnings the default via .cargo/config.toml", pr_number: 25400, scopes: ["dev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 4, insertions_count: 2, deletions_count: 20},
+		{sha: "f2f19212bb5cee15615c8d86658447a4ac096729", date: "2026-05-08 19:18:40 UTC", description: "pass client certificates to rumqttc for mTLS", pr_number: 24929, scopes: ["mqtt source"], type: "fix", breaking_change: false, author: "Martin Ruderer", files_count: 2, insertions_count: 4, deletions_count: 1},
+		{sha: "eda5b866e83cf5e0e926cae8ecf89c00a3109dc8", date: "2026-05-08 22:39:20 UTC", description: "fix flaky `initial_size_correct_with_multievents` test", pr_number: 25239, scopes: ["tests"], type: "fix", breaking_change: false, author: "Vitalii Parfonov", files_count: 1, insertions_count: 32, deletions_count: 7},
+		{sha: "c3676b9fa8aef8088bd341775416e4ecd91095b2", date: "2026-05-08 23:11:57 UTC", description: "centralize CARGO_INCREMENTAL=0 in setup action", pr_number: 25401, scopes: ["ci"], type: "chore", breaking_change: false, author: "Thomas", files_count: 6, insertions_count: 2, deletions_count: 7},
+		{sha: "4ddc412437c69cfa6d3b5184ff3abab7e3d75008", date: "2026-05-11 14:52:29 UTC", description: "Add setting for per-metric vs global tag cardinality tracking", pr_number: 25372, scopes: ["tag_cardinality_limit transform"], type: "enhancement", breaking_change: false, author: "ArunPiduguDD", files_count: 7, insertions_count: 385, deletions_count: 45},
+		{sha: "11f1dff407534822b90d4690e446d718867d6baf", date: "2026-05-11 18:55:00 UTC", description: "include lib/ workspace crates in coverage reports", pr_number: 25402, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 1, deletions_count: 0},
+		{sha: "7efd6d7b53185a2997b81b2ef8fff4162d6c6506", date: "2026-05-11 20:19:41 UTC", description: "remove cargo vdev test --container runner", pr_number: 25410, scopes: ["dev"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 2, insertions_count: 6, deletions_count: 43},
+		{sha: "e38ef0cab69d8dbd02deaadbd63870aafd77081b", date: "2026-05-12 13:53:04 UTC", description: "warn about log namespace with disk buffers", pr_number: 25413, scopes: ["external docs"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 3, insertions_count: 39, deletions_count: 1},
+		{sha: "fc6a2b567f08a9c229e8a4b7584d6f30e1da1c9f", date: "2026-05-12 13:58:10 UTC", description: "make regression/Dockerfile self-contained", pr_number: 25411, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 29, deletions_count: 1},
+		{sha: "d06def7be6c4ac1e29e46c73f94ea3d9f99b9997", date: "2026-05-12 20:06:08 UTC", description: "bump @babel/plugin-transform-modules-systemjs from 7.28.5 to 7.29.4 in /website", pr_number: 25403, scopes: ["website deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 85, deletions_count: 6},
+		{sha: "10de0ea6c6871d14d06b741d457d3cfab3676d67", date: "2026-05-12 20:32:17 UTC", description: "publish to crates.io on tag push", pr_number: 25420, scopes: ["vdev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 21, deletions_count: 0},
+		{sha: "dce3678640998bdbaedd67a4f5c4ddea588dd3af", date: "2026-05-12 20:43:00 UTC", description: "bump version to 0.3.3", pr_number: 25419, scopes: ["vdev"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 2, insertions_count: 2, deletions_count: 2},
+		{sha: "fe3871fd15e8cc07a132aba2413f4c8efa69f983", date: "2026-05-13 01:42:02 UTC", description: "bump markdownlint-cli2 to 0.22.1 and remove smol-toml override", pr_number: 25416, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 10, deletions_count: 15},
+		{sha: "c60bc0a68c30eecdf8698eddec3ee7e3c7393fbb", date: "2026-05-13 16:46:40 UTC", description: "install vdev via binstall", pr_number: 25418, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 5, insertions_count: 42, deletions_count: 90},
+		{sha: "c3720d863abc606cef5c117486b6ced03f8cf134", date: "2026-05-13 17:18:52 UTC", description: "remove default OS package config", pr_number: 25425, scopes: ["releasing"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 7, insertions_count: 28, deletions_count: 15},
+		{sha: "904f69f81c68826a982d351cc08335cea9afab5b", date: "2026-05-13 20:35:46 UTC", description: "warn on invalid json batching", pr_number: 25423, scopes: ["opentelemetry sink"], type: "enhancement", breaking_change: false, author: "Pavlos Rontidis", files_count: 2, insertions_count: 29, deletions_count: 2},
+		{sha: "338fc3805f131ca9281baadccb05e4ff8ac26111", date: "2026-05-13 21:06:03 UTC", description: "restore Vector RPM/DEB install on EL8 family", pr_number: 25387, scopes: ["releasing"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 5, insertions_count: 116, deletions_count: 18},
+		{sha: "989f2ae0af0aa3da2691cfc78f675601178edadf", date: "2026-05-13 21:38:33 UTC", description: "pass GITHUB_TOKEN to prepare.sh for authenticated binstall requests", pr_number: 25428, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 2, deletions_count: 0},
+		{sha: "e1772733754c4d069928169675791b2a484375a2", date: "2026-05-14 14:28:23 UTC", description: "retire the unused Docker dev environment", pr_number: 25429, scopes: ["dev"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 10, insertions_count: 102, deletions_count: 623},
+		{sha: "45b6d2b8faa9d89005abefd5d6311db9d730cd0a", date: "2026-05-14 16:08:30 UTC", description: "Add more fine grained controls tag cardinality", pr_number: 25360, scopes: ["tag_cardinality_limit transform"], type: "enhancement", breaking_change: false, author: "ArunPiduguDD", files_count: 6, insertions_count: 747, deletions_count: 122},
+		{sha: "11ad4e7df2f16203357c875557230905a94cfe0d", date: "2026-05-14 17:33:09 UTC", description: "clarify JEMALLOC_SYS_WITH_LG_PAGE comment", pr_number: 25435, scopes: ["internal docs"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 4, deletions_count: 2},
+		{sha: "45c4010e78a8470177061b8257648499ba1f61fe", date: "2026-05-14 19:33:52 UTC", description: "add \"View open issues\" link to component pages", pr_number: 25437, scopes: ["external docs"], type: "feat", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 14, deletions_count: 0},
+		{sha: "a1a56fe123829ab224361648165973d6ba9a5292", date: "2026-05-14 20:04:48 UTC", description: "drop gssapi from default cargo feature", pr_number: 25256, scopes: ["deps"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 4, insertions_count: 35, deletions_count: 15},
+		{sha: "ec27f907e50dacdc7d1124720f1b29dfe967aac7", date: "2026-05-14 20:20:46 UTC", description: "unify Dockerfile apt deps into one script", pr_number: 25436, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 3, insertions_count: 27, deletions_count: 33},
+		{sha: "f06f820a9f66a6518e01f0d7a3d43b5a2826bd9b", date: "2026-05-14 20:32:54 UTC", description: "make libz.so.1 a consistent dynamic runtime dependency in distroless-libc", pr_number: 25434, scopes: ["releasing"], type: "fix", breaking_change: false, author: "Thomas", files_count: 3, insertions_count: 10, deletions_count: 3},
+		{sha: "fa2d51fb996b140f7ef725323a95d9b9ca0a8b51", date: "2026-05-15 18:35:13 UTC", description: "update Azure crates (March 2026 release)", pr_number: 25169, scopes: ["deps"], type: "chore", breaking_change: false, author: "Jed Laundry", files_count: 7, insertions_count: 158, deletions_count: 90},
+		{sha: "020ff6d3cc7dd134f558f66b0bb66bc22d01f25b", date: "2026-05-15 20:12:24 UTC", description: "validate dd-sts credentials with exponential backoff before export", pr_number: 25443, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 20, deletions_count: 1},
+		{sha: "6de2414520cb29c6265d5abb4ce74d14961195b5", date: "2026-05-18 18:33:13 UTC", description: "use each commit's own Dockerfile for regression baseline/comparison builds", pr_number: 25452, scopes: ["ci"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "0e468d73dc563f75df0246c9fd16f0838a203e6b", date: "2026-05-18 21:21:26 UTC", description: "bump clap_complete from 4.5.66 to 4.6.5 in the clap group across 1 directory", pr_number: 25279, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 7, deletions_count: 7},
+		{sha: "4e547d2e4076d0413e5307497063b57b043e4236", date: "2026-05-18 22:19:54 UTC", description: "replace str metric names with GaugeName/HistogramName", pr_number: 25445, scopes: ["buffers"], type: "chore", breaking_change: false, author: "Thomas", files_count: 5, insertions_count: 124, deletions_count: 38},
+		{sha: "689800ad1b8d63c83ec2fe60b4f72b57c441176d", date: "2026-05-19 13:14:59 UTC", description: "use gh CLI to fetch VRL release notes instead of unauthenticated GitHub API", pr_number: 25444, scopes: ["releasing"], type: "chore", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 40, deletions_count: 39},
+		{sha: "891ffbd6196835360cd5ae4fa9a50d2611a7eb03", date: "2026-05-19 15:45:57 UTC", description: "fix checkpoint write race on shutdown and flaky tests", pr_number: 25447, scopes: ["file source"], type: "fix", breaking_change: false, author: "Thomas", files_count: 4, insertions_count: 247, deletions_count: 134},
+		{sha: "610ea5c5c266fdb1e529c6303f3d68efaa4dd027", date: "2026-05-20 14:26:15 UTC", description: "bump the docker-images group across 1 directory with 2 updates", pr_number: 25273, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "227f66a94e5d8dd0a63320af31f2d07dd86a634a", date: "2026-05-20 14:27:06 UTC", description: "bump alpine from `2510918` to `5b10f43` in /distribution/docker/distroless-static in the docker-images group across 1 directory", pr_number: 25275, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "d45cc2150ea78b7b86926dfada464bd7b9bc2586", date: "2026-05-20 14:27:20 UTC", description: "bump alpine from `2510918` to `5b10f43` in /distribution/docker/alpine in the docker-images group across 1 directory", pr_number: 25274, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "43a4921376c44071082b6f83bdd9329d39ac82ab", date: "2026-05-20 14:27:40 UTC", description: "bump debian from `26f98cc` to `cedb1ef` in /distribution/docker/debian in the docker-images group across 1 directory", pr_number: 25272, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "02f7271461ab0a12566aaf0f750bfc47c418a9ed", date: "2026-05-20 14:36:42 UTC", description: "consolidate dependabot cargo groups", pr_number: 25465, scopes: ["ci"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 9, deletions_count: 4},
+		{sha: "f1717b53ae61022a65a69224ad012a7d3f5d961b", date: "2026-05-20 14:39:17 UTC", description: "bump docker/setup-qemu-action from 3.7.0 to 4.0.0", pr_number: 25348, scopes: ["ci"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "54af3b0196887a3cb76e86b9dca0616c6eae2faf", date: "2026-05-20 14:52:36 UTC", description: "bump distroless/static from `47b2d72` to `3592aa8` in /distribution/docker/distroless-static in the docker-images group", pr_number: 25467, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 1, deletions_count: 1},
+		{sha: "1a451bd3c99dc584fb96831f0a12baa672159721", date: "2026-05-20 14:53:18 UTC", description: "bump the docker-images group in /distribution/docker/distroless-libc with 2 updates", pr_number: 25466, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "fd1d4518a16d0bef8a03df87536be7105da8e0d0", date: "2026-05-20 14:53:27 UTC", description: "bump debian from `cedb1ef` to `b6e2a15` in /distribution/docker/debian in the docker-images group", pr_number: 25468, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "35c7d5a844ebacabe57e44e29e06b679ab8ea1bf", date: "2026-05-20 15:10:22 UTC", description: "bump serde_with from 3.18.0 to 3.20.0 in the serde group", pr_number: 25474, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 3, insertions_count: 16, deletions_count: 5},
+		{sha: "f3828fe8e6ecdad8355216001c40abdc93c7a59f", date: "2026-05-20 16:16:13 UTC", description: "add exclude_tags option to bypass cardinality limiting", pr_number: 25316, scopes: ["tag_cardinality_limit transform"], type: "enhancement", breaking_change: false, author: "Karol Chrapek", files_count: 6, insertions_count: 472, deletions_count: 6},
+		{sha: "c5959d7c37ad9ba8f2444f75c3d62e7930d8a8e9", date: "2026-05-21 12:39:40 UTC", description: "Remove HashSet initialization with capacity to improve memory usage", pr_number: 25480, scopes: ["tag_cardinality_limit transform"], type: "enhancement", breaking_change: false, author: "ArunPiduguDD", files_count: 3, insertions_count: 9, deletions_count: 6},
+		{sha: "a4b23cf1bf2786236e0cae2795d022ff39d4697c", date: "2026-05-22 18:51:06 UTC", description: "extend deb-verify and rpm-verify to cover aarch64", pr_number: 25487, scopes: ["releasing"], type: "chore", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 24, deletions_count: 10},
+		{sha: "2084d534f269bb1fa2d508bbc28a634d57d4dc32", date: "2026-05-22 19:51:35 UTC", description: "Add databricks_zerobus sink to semantic PR scope list", pr_number: 25490, scopes: ["ci"], type: "chore", breaking_change: false, author: "Flavio Cruz", files_count: 1, insertions_count: 1, deletions_count: 0},
+		{sha: "3df9e43140d1326bbd0058ed4f24d69ad1ee16ad", date: "2026-05-26 08:31:26 UTC", description: "do not hold span guards across await points", pr_number: 25482, scopes: ["observability"], type: "fix", breaking_change: false, author: "Yoenn Burban", files_count: 4, insertions_count: 411, deletions_count: 362},
+		{sha: "5027cd691412d9d76145486fdf185d3938241b1e", date: "2026-05-26 14:44:40 UTC", description: "Drop empty batches before they reach downstream buffers", pr_number: 25489, scopes: ["core"], type: "fix", breaking_change: false, author: "Rob Blafford", files_count: 4, insertions_count: 46, deletions_count: 7},
+		{sha: "2663ec744472213d9d2f16b8eb36e4e1c4df86ae", date: "2026-05-26 20:40:41 UTC", description: "bump mongodb to 3.7.0 and fix RUSTSEC-2026-0119", pr_number: 25499, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 4, insertions_count: 37, deletions_count: 130},
+		{sha: "6a3711436b20944b3c86417f0454f8fc2c1e6ffc", date: "2026-05-27 13:58:01 UTC", description: "remove unused apache-avro dependency", pr_number: 25502, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 4, insertions_count: 5, deletions_count: 109},
+		{sha: "08ce7b9228fa810a5c27a3be7a934f421cc406a9", date: "2026-05-27 14:38:14 UTC", description: "bump async-nats to 0.49.0", pr_number: 25503, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 7, deletions_count: 8},
+		{sha: "ee870f9cdb9fa57cf917abf0f887b1f1ca5b1aac", date: "2026-05-27 15:57:54 UTC", description: "defer Unity Catalog schema fetch out of build()", pr_number: 25408, scopes: ["databricks_zerobus sink"], type: "fix", breaking_change: false, author: "Flavio Cruz", files_count: 6, insertions_count: 500, deletions_count: 217},
+		{sha: "e5e2e15d18d85941679a6c1eacffb0f400e93422", date: "2026-05-27 17:59:40 UTC", description: "allow custom auth to enrich events via metadata writes", pr_number: 25391, scopes: ["http_server source"], type: "feat", breaking_change: false, author: "Josué AGBEKODO", files_count: 10, insertions_count: 379, deletions_count: 35},
+		{sha: "5d6f968344ed96ef14b53f496cce7d2035c2d8d6", date: "2026-05-27 19:18:29 UTC", description: "bump rand to 0.8.6 and fix RUSTSEC-2026-0097", pr_number: 25505, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 16, deletions_count: 17},
+		{sha: "5b82c16630641c3743c8f3aeb72795b24e097e04", date: "2026-05-27 20:24:50 UTC", description: "add a simple delay transform", pr_number: 25407, scopes: ["new transform"], type: "feat", breaking_change: false, author: "Ensar Sarajčić", files_count: 7, insertions_count: 468, deletions_count: 0},
+		{sha: "cc276a6c7e0ee11bf5289d82d244bb9547b47fa2", date: "2026-05-27 21:40:46 UTC", description: "add AI contribution policy", pr_number: 25511, scopes: ["internal docs"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 4, insertions_count: 45, deletions_count: 0},
+		{sha: "93f8054a206e5de6eb115b8ed50591248def7284", date: "2026-05-28 14:33:31 UTC", description: "allow downstream crates to register extra labels for metrics and logs", pr_number: 25315, scopes: ["metrics"], type: "feat", breaking_change: false, author: "Yoenn Burban", files_count: 8, insertions_count: 216, deletions_count: 13},
+		{sha: "d898743f7021f11ffb6f09cb2cebd4fe26d094c8", date: "2026-05-28 16:40:09 UTC", description: "add docs team to CODEOWNERS for top level md files", pr_number: 25515, scopes: ["internal docs"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 7, deletions_count: 7},
+		{sha: "ba27e2ef2bbeb4bf81f8896c562fa74837a13cfe", date: "2026-05-28 16:53:50 UTC", description: "update zerobus sdk to 2.0.1", pr_number: 25438, scopes: ["deps"], type: "chore", breaking_change: false, author: "Flavio Cruz", files_count: 5, insertions_count: 164, deletions_count: 79},
+		{sha: "b7aae737cef5dd37d1445915443a1eb97b584f85", date: "2026-05-28 18:33:49 UTC", description: "redact sink-specific API key headers in debug logs", pr_number: 25516, scopes: ["observability"], type: "fix", breaking_change: false, author: "Pavlos Rontidis", files_count: 2, insertions_count: 90, deletions_count: 4},
+		{sha: "08b6975fc7c0384ecb72e94bceedb7622a5340db", date: "2026-05-29 03:31:05 UTC", description: "restore IndexMap for unbounded MetricSet to fix CPU regression", pr_number: 25493, scopes: ["metrics"], type: "fix", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 180, deletions_count: 21},
+		{sha: "27497d0bda63e9c8af9da91ef66116b221e6a35f", date: "2026-05-29 13:55:44 UTC", description: "Update known lifecycle flow to warn not error", pr_number: 25458, scopes: ["shutdown"], type: "fix", breaking_change: false, author: "taylorchandleryoung", files_count: 4, insertions_count: 259, deletions_count: 2},
+		{sha: "ddf5c74514fa690cdf8c14e71050acf2db915f19", date: "2026-05-29 15:08:50 UTC", description: "bump futures to 0.3.32", pr_number: 25522, scopes: ["deps"], type: "chore", breaking_change: false, author: "Thomas", files_count: 5, insertions_count: 27, deletions_count: 35},
+		{sha: "12101a7bed47c57b78352c5ec0418f025be27712", date: "2026-05-29 15:16:47 UTC", description: "use lazy variable for CONTAINER_TOOL detection", pr_number: 25523, scopes: ["dev"], type: "chore", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 1, deletions_count: 17},
+		{sha: "708569f7db8ca444084e12a439fd15933e2b9011", date: "2026-05-29 16:34:04 UTC", description: "Bump tikv-jemallocator from 0.7.0", pr_number: 25520, scopes: ["deps"], type: "chore", breaking_change: false, author: "Jakub Onderka", files_count: 3, insertions_count: 8, deletions_count: 8},
+		{sha: "cf51ef7cf024f5fc5d1dd85593abd35e8812f636", date: "2026-05-29 17:25:01 UTC", description: "Update Azure crates (May 2026 release)", pr_number: 25492, scopes: ["deps"], type: "chore", breaking_change: false, author: "Jed Laundry", files_count: 5, insertions_count: 24, deletions_count: 27},
+		{sha: "a9b45c2c7ab6f469b042900d552279d0ae2d42e6", date: "2026-05-29 18:16:57 UTC", description: "bump openssl-src from 300.5.5+3.5.5 to 300.6.0+3.6.2", pr_number: 25299, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 1, insertions_count: 2, deletions_count: 2},
+		{sha: "9e15fc1c3a38af6f8728ebdd4ea8c0d427a14ff5", date: "2026-05-29 18:23:14 UTC", description: "bump openssl from 0.10.79 to 0.10.80 in the cargo-security group across 1 directory", pr_number: 25475, scopes: ["deps"], type: "chore", breaking_change: false, author: "dependabot[bot]", files_count: 2, insertions_count: 5, deletions_count: 5},
+		{sha: "f7e394f4f33ad10caad81e12ff8534c26fb6e385", date: "2026-05-29 18:58:12 UTC", description: "Fix incorrectly dropped events bug in metrics aggregate transform", pr_number: 25486, scopes: ["aggregate transform"], type: "fix", breaking_change: false, author: "ArunPiduguDD", files_count: 3, insertions_count: 204, deletions_count: 141},
+		{sha: "91fd215e4a06174820eaa4ee5aa8a9d31100ce86", date: "2026-06-01 14:01:13 UTC", description: "upload merged-lcov artifact from coverage workflow", pr_number: 25548, scopes: ["dev"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 7, deletions_count: 0},
+		{sha: "0833531578ab4356fa6b854c5e5bcd948040f8f6", date: "2026-06-01 14:53:28 UTC", description: "harden merged-lcov artifact upload step", pr_number: 25549, scopes: ["dev"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 9, deletions_count: 7},
+		{sha: "42fa63be5898df2f63ed4edd8c31c69f88a41a4a", date: "2026-06-01 15:10:43 UTC", description: "remove commonly_used field from component definitions", pr_number: 25551, scopes: ["website"], type: "chore", breaking_change: false, author: "Thomas", files_count: 122, insertions_count: 43, deletions_count: 169},
+		{sha: "030c6ba433a0c9aff94e411f33d8b13373603b7f", date: "2026-06-01 16:06:00 UTC", description: "AI policy follow-ups", pr_number: 25550, scopes: ["internal docs"], type: "chore", breaking_change: false, author: "Pavlos Rontidis", files_count: 1, insertions_count: 3, deletions_count: 1},
+		{sha: "2a3c5d89de23ee9b65d97fd038c2eb8bdbf98578", date: "2026-06-01 17:10:39 UTC", description: "use CUE raw string for VRL changelog in release prepare", pr_number: 25553, scopes: ["vdev"], type: "fix", breaking_change: false, author: "Thomas", files_count: 1, insertions_count: 4, deletions_count: 4},
+		{sha: "8c1861137094f09fe7a05f2f820fe1ee9479309e", date: "2026-06-01 17:22:55 UTC", description: "Pinned VRL version to 0.33.0", pr_number: null, scopes: ["releasing"], type: "chore", breaking_change: false, author: "Thomas", files_count: 2, insertions_count: 22, deletions_count: 18},
+	]
+}
diff --git a/website/cue/reference/versions.cue b/website/cue/reference/versions.cue
index 0ca3310065d7f..a00a949d1bdfc 100644
--- a/website/cue/reference/versions.cue
+++ b/website/cue/reference/versions.cue
@@ -2,6 +2,7 @@ package metadata
 
 // This has to be maintained manually because there's currently no way to sort versions programmatically
 versions: [string, ...string] & [
+	"0.56.0",
 	"0.55.0",
 	"0.54.0",
 	"0.53.0",

From 47cf4c170957839c6b0b65d9c34e1856c45e11f8 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Thu, 19 Feb 2026 21:07:29 +0100
Subject: [PATCH 302/326] feat(new source): add Azure Blob Storage source

A new `azure_blob` source for reading logs from Azure Blob Storage
containers via Azure Storage Queue notifications (Event Grid).

Designed for feature parity with the existing `aws_s3` source.

Key features:
- Event-driven architecture using Azure Event Grid via Storage Queue
- Connection string authentication
- Configurable compression (gzip, zstd) with auto-detection
- Configurable framing (newline-delimited, character-delimited, etc.)
- Multiline aggregation for stack traces and multi-line logs
- Event metadata enrichment (container, blob, timestamp)
- Acknowledgement support
---
 Cargo.lock                                    | 336 +++++-
 Cargo.toml                                    |  15 +-
 ...13882_azure_blob_storage_source.feature.md |  17 +
 src/azure/mod.rs                              |  81 ++
 src/internal_events/azure_queue.rs            | 219 ++++
 src/internal_events/mod.rs                    |   5 +
 src/lib.rs                                    |   2 +
 src/sources/azure_blob/integration_tests.rs   | 955 ++++++++++++++++++
 src/sources/azure_blob/mod.rs                 | 451 +++++++++
 src/sources/azure_blob/queue.rs               | 586 +++++++++++
 src/sources/azure_blob/test.rs                | 275 +++++
 src/sources/mod.rs                            |   2 +
 testing/github-13882/azure_blob_test.tf       | 241 +++++
 testing/github-13882/config.toml              |  73 ++
 testing/github-13882/steps.md                 | 164 +++
 testing/github-13882/test-results.md          | 134 +++
 tests/integration/azure/config/compose.yaml   |   6 +-
 tests/integration/azure/config/test.yaml      |   2 +
 .../configuration/sources/azure_blob.md       |  14 +
 .../components/sources/azure_blob.cue         | 228 +++++
 20 files changed, 3764 insertions(+), 42 deletions(-)
 create mode 100644 changelog.d/13882_azure_blob_storage_source.feature.md
 create mode 100644 src/azure/mod.rs
 create mode 100644 src/internal_events/azure_queue.rs
 create mode 100644 src/sources/azure_blob/integration_tests.rs
 create mode 100644 src/sources/azure_blob/mod.rs
 create mode 100644 src/sources/azure_blob/queue.rs
 create mode 100644 src/sources/azure_blob/test.rs
 create mode 100644 testing/github-13882/azure_blob_test.tf
 create mode 100644 testing/github-13882/config.toml
 create mode 100644 testing/github-13882/steps.md
 create mode 100644 testing/github-13882/test-results.md
 create mode 100644 website/content/en/docs/reference/configuration/sources/azure_blob.md
 create mode 100644 website/cue/reference/components/sources/azure_blob.cue

diff --git a/Cargo.lock b/Cargo.lock
index e7155549e5b48..d911bcfd69cc2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "RustyXML"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b5ace29ee3216de37c0546865ad08edef58b0f9e76838ed8959a84a990e58c5"
+
 [[package]]
 name = "adler2"
 version = "2.0.0"
@@ -791,6 +797,17 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "async-channel"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
+dependencies = [
+ "concurrent-queue",
+ "event-listener 2.5.3",
+ "futures-core",
+]
+
 [[package]]
 name = "async-channel"
 version = "2.3.1"
@@ -836,8 +853,8 @@ checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
 dependencies = [
  "async-task",
  "concurrent-queue",
- "fastrand",
- "futures-lite",
+ "fastrand 2.3.0",
+ "futures-lite 2.6.0",
  "pin-project-lite",
  "slab",
 ]
@@ -850,7 +867,7 @@ checksum = "8034a681df4aed8b8edbd7fbe472401ecf009251c8b40556b304567052e294c5"
 dependencies = [
  "async-lock 3.4.0",
  "blocking",
- "futures-lite",
+ "futures-lite 2.6.0",
 ]
 
 [[package]]
@@ -859,11 +876,11 @@ version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13f937e26114b93193065fd44f507aa2e9169ad0cdabbb996920b1fe1ddea7ba"
 dependencies = [
- "async-channel",
+ "async-channel 2.3.1",
  "async-executor",
  "async-lock 3.4.0",
  "blocking",
- "futures-lite",
+ "futures-lite 2.6.0",
  "tokio",
 ]
 
@@ -877,7 +894,7 @@ dependencies = [
  "cfg-if",
  "concurrent-queue",
  "futures-io",
- "futures-lite",
+ "futures-lite 2.6.0",
  "parking",
  "polling",
  "rustix 0.38.40",
@@ -961,7 +978,7 @@ checksum = "b948000fad4873c1c9339d60f2623323a0cfd3816e5181033c6a5cb68b2accf7"
 dependencies = [
  "async-io",
  "blocking",
- "futures-lite",
+ "futures-lite 2.6.0",
 ]
 
 [[package]]
@@ -970,7 +987,7 @@ version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
 dependencies = [
- "async-channel",
+ "async-channel 2.3.1",
  "async-io",
  "async-lock 3.4.0",
  "async-signal",
@@ -978,7 +995,7 @@ dependencies = [
  "blocking",
  "cfg-if",
  "event-listener 5.3.1",
- "futures-lite",
+ "futures-lite 2.6.0",
  "rustix 1.1.4",
 ]
 
@@ -1107,7 +1124,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "hex",
  "http 1.3.1",
  "ring",
@@ -1147,7 +1164,7 @@ dependencies = [
  "aws-types",
  "bytes",
  "bytes-utils",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "http-body 0.4.6",
@@ -1176,7 +1193,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "fastrand",
+ "fastrand 2.3.0",
  "flate2",
  "http 0.2.12",
  "http 1.3.1",
@@ -1204,7 +1221,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1228,7 +1245,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1252,7 +1269,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1277,7 +1294,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1301,7 +1318,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1329,7 +1346,7 @@ dependencies = [
  "aws-smithy-xml",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "hex",
  "hmac",
  "http 0.2.12",
@@ -1360,7 +1377,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1385,7 +1402,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1409,7 +1426,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1433,7 +1450,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1457,7 +1474,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1482,7 +1499,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1668,7 +1685,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
- "fastrand",
+ "fastrand 2.3.0",
  "http 0.2.12",
  "http 1.3.1",
  "http-body 0.4.6",
@@ -1882,6 +1899,35 @@ dependencies = [
  "tower-service",
 ]
 
+[[package]]
+name = "azure_core"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b552ad43a45a746461ec3d3a51dfb6466b4759209414b439c165eb6a6b7729e"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "bytes",
+ "dyn-clone",
+ "futures",
+ "getrandom 0.2.15",
+ "http-types",
+ "once_cell",
+ "openssl",
+ "paste",
+ "pin-project",
+ "quick-xml 0.31.0",
+ "rand 0.8.6",
+ "reqwest 0.12.28",
+ "rustc_version",
+ "serde",
+ "serde_json",
+ "time",
+ "tracing 0.1.44",
+ "url",
+ "uuid",
+]
+
 [[package]]
 name = "azure_core"
 version = "1.0.0"
@@ -1923,7 +1969,7 @@ checksum = "32edf96b356ca7c51d7590c4925cc36efc3947a5da4468e8e0b25c56ecbb3de5"
 dependencies = [
  "async-lock 3.4.0",
  "async-trait",
- "azure_core",
+ "azure_core 1.0.0",
  "futures",
  "openssl",
  "pin-project",
@@ -1934,6 +1980,25 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "azure_storage"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59f838159f4d29cb400a14d9d757578ba495ae64feb07a7516bf9e4415127126"
+dependencies = [
+ "RustyXML",
+ "async-lock 3.4.0",
+ "async-trait",
+ "azure_core 0.21.0",
+ "bytes",
+ "serde",
+ "serde_derive",
+ "time",
+ "tracing 0.1.44",
+ "url",
+ "uuid",
+]
+
 [[package]]
 name = "azure_storage_blob"
 version = "1.0.0"
@@ -1942,7 +2007,7 @@ checksum = "1756febbcca86c862ef718b983b505d08bd65a9bc984a915b0a16af4a4c3fe5b"
 dependencies = [
  "async-stream",
  "async-trait",
- "azure_core",
+ "azure_core 1.0.0",
  "bytes",
  "futures",
  "percent-encoding",
@@ -1952,13 +2017,65 @@ dependencies = [
  "time",
 ]
 
+[[package]]
+name = "azure_storage_blobs"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97e83c3636ae86d9a6a7962b2112e3b19eb3903915c50ce06ff54ff0a2e6a7e4"
+dependencies = [
+ "RustyXML",
+ "azure_core 0.21.0",
+ "azure_storage",
+ "azure_svc_blobstorage",
+ "bytes",
+ "futures",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "time",
+ "tracing 0.1.44",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "azure_storage_queues"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aa417d6bdda9c5c0d08b96617f0bd85e4f30142797b2a948f3c27963df8b58b"
+dependencies = [
+ "azure_core 0.21.0",
+ "azure_storage",
+ "futures",
+ "serde",
+ "time",
+ "tracing 0.1.44",
+ "uuid",
+]
+
+[[package]]
+name = "azure_svc_blobstorage"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e6c6f20c5611b885ba94c7bae5e02849a267381aecb8aee577e8c35ff4064c6"
+dependencies = [
+ "azure_core 0.21.0",
+ "bytes",
+ "futures",
+ "log",
+ "once_cell",
+ "serde",
+ "serde_json",
+ "time",
+]
+
 [[package]]
 name = "backon"
 version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cffb0e931875b666fc4fcb20fee52e9bbd1ef836fd9e9e04ec21555f9f85f7ef"
 dependencies = [
- "fastrand",
+ "fastrand 2.3.0",
  "gloo-timers",
  "tokio",
 ]
@@ -2126,10 +2243,10 @@ version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
 dependencies = [
- "async-channel",
+ "async-channel 2.3.1",
  "async-task",
  "futures-io",
- "futures-lite",
+ "futures-lite 2.6.0",
  "piper",
 ]
 
@@ -4224,6 +4341,15 @@ dependencies = [
  "regex-syntax",
 ]
 
+[[package]]
+name = "fastrand"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
+dependencies = [
+ "instant",
+]
+
 [[package]]
 name = "fastrand"
 version = "2.3.0"
@@ -4521,13 +4647,28 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
 
+[[package]]
+name = "futures-lite"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49a9d51ce47660b1e808d3c990b4709f2f415d928835a17dfd16991515c46bce"
+dependencies = [
+ "fastrand 1.9.0",
+ "futures-core",
+ "futures-io",
+ "memchr",
+ "parking",
+ "pin-project-lite",
+ "waker-fn",
+]
+
 [[package]]
 name = "futures-lite"
 version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f5edaec856126859abb19ed65f39e90fea3a9574b9707f13539acf4abf7eb532"
 dependencies = [
- "fastrand",
+ "fastrand 2.3.0",
  "futures-core",
  "futures-io",
  "parking",
@@ -4591,6 +4732,17 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.9.0+wasi-snapshot-preview1",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.15"
@@ -4600,7 +4752,7 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
  "wasm-bindgen",
 ]
 
@@ -5324,6 +5476,26 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "http-types"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e9b187a72d63adbfba487f48095306ac823049cb504ee195541e91c7775f5ad"
+dependencies = [
+ "anyhow",
+ "async-channel 1.9.0",
+ "base64 0.13.1",
+ "futures-lite 1.13.0",
+ "infer",
+ "pin-project-lite",
+ "rand 0.7.3",
+ "serde",
+ "serde_json",
+ "serde_qs",
+ "serde_urlencoded",
+ "url",
+]
+
 [[package]]
 name = "httparse"
 version = "1.10.1"
@@ -5825,6 +5997,12 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "infer"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64e9829a50b42bb782c1df523f78d332fe371b10c661e78b7a3c34b0198e9fac"
+
 [[package]]
 name = "influxdb-line-protocol"
 version = "2.0.0"
@@ -5878,6 +6056,15 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "instant"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "integer-encoding"
 version = "3.0.4"
@@ -7001,7 +7188,7 @@ checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
  "libc",
  "log",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
  "windows-sys 0.61.0",
 ]
 
@@ -8188,7 +8375,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "668d31b1c4eba19242f2088b2bf3316b82ca31082a8335764db4e083db7485d4"
 dependencies = [
  "atomic-waker",
- "fastrand",
+ "fastrand 2.3.0",
  "futures-io",
 ]
 
@@ -8877,7 +9064,7 @@ version = "6.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2367cb38f1b65857bc11dd13b2adf13b7a1d991ef1cd43572f1420958c56cc2"
 dependencies = [
- "async-channel",
+ "async-channel 2.3.1",
  "async-trait",
  "bytes",
  "chrono",
@@ -8925,7 +9112,7 @@ dependencies = [
  "libc",
  "once_cell",
  "raw-cpuid",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
  "web-sys",
  "winapi",
 ]
@@ -9117,6 +9304,19 @@ dependencies = [
  "nibble_vec",
 ]
 
+[[package]]
+name = "rand"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+dependencies = [
+ "getrandom 0.1.16",
+ "libc",
+ "rand_chacha 0.2.2",
+ "rand_core 0.5.1",
+ "rand_hc",
+]
+
 [[package]]
 name = "rand"
 version = "0.8.6"
@@ -9149,6 +9349,16 @@ dependencies = [
  "rand_core 0.10.0",
 ]
 
+[[package]]
+name = "rand_chacha"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.5.1",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@@ -9169,6 +9379,15 @@ dependencies = [
  "rand_core 0.9.0",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+dependencies = [
+ "getrandom 0.1.16",
+]
+
 [[package]]
 name = "rand_core"
 version = "0.6.4"
@@ -9204,6 +9423,15 @@ dependencies = [
  "rand 0.9.4",
 ]
 
+[[package]]
+name = "rand_hc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+dependencies = [
+ "rand_core 0.5.1",
+]
+
 [[package]]
 name = "rand_xorshift"
 version = "0.4.0"
@@ -10463,6 +10691,17 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_qs"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7715380eec75f029a4ef7de39a9200e0a63823176b759d055b613f5a87df6a6"
+dependencies = [
+ "percent-encoding",
+ "serde",
+ "thiserror 1.0.68",
+]
+
 [[package]]
 name = "serde_repr"
 version = "0.1.17"
@@ -10789,7 +11028,7 @@ version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a33bd3e260892199c3ccfc487c88b2da2265080acb316cd920da72fdfd7c599f"
 dependencies = [
- "async-channel",
+ "async-channel 2.3.1",
  "async-executor",
  "async-fs",
  "async-io",
@@ -10797,7 +11036,7 @@ dependencies = [
  "async-net",
  "async-process",
  "blocking",
- "futures-lite",
+ "futures-lite 2.6.0",
 ]
 
 [[package]]
@@ -11501,7 +11740,7 @@ version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
- "fastrand",
+ "fastrand 2.3.0",
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
@@ -11654,6 +11893,7 @@ checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
 dependencies = [
  "deranged",
  "itoa",
+ "js-sys",
  "libc",
  "num-conv",
  "num_threads",
@@ -12907,9 +13147,13 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "axum 0.6.20",
- "azure_core",
+ "azure_core 0.21.0",
+ "azure_core 1.0.0",
  "azure_identity",
+ "azure_storage",
  "azure_storage_blob",
+ "azure_storage_blobs",
+ "azure_storage_queues",
  "base64 0.22.1",
  "bloomy",
  "bollard",
@@ -13652,6 +13896,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "waker-fn"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "317211a0dc0ceedd78fb2ca9a44aed3d7b9b26f81870d485c07122b4350673b7"
+
 [[package]]
 name = "walkdir"
 version = "2.4.0"
@@ -13698,6 +13948,12 @@ dependencies = [
  "tracing 0.1.44",
 ]
 
+[[package]]
+name = "wasi"
+version = "0.9.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+
 [[package]]
 name = "wasi"
 version = "0.11.0+wasi-snapshot-preview1"
diff --git a/Cargo.toml b/Cargo.toml
index f5ad7c2d25d13..185a2b614ac68 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -311,6 +311,12 @@ azure_identity = { version = "1.0", default-features = false, features = ["clien
 
 # Azure Storage
 azure_storage_blob = { version = "1.0", default-features = false, optional = true }
+azure_storage = { version = "0.21", default-features = false, optional = true }
+azure_storage_blobs = { version = "0.21", default-features = false, optional = true }
+azure_storage_queues = { version = "0.21", default-features = false, optional = true }
+
+# Needed to bridge with outdated version of azure_core used in azure_storage*
+azure_core_for_storage = { package = "azure_core", version = "0.21.0", default-features = false, features = ["enable_reqwest", "hmac_openssl"] }
 
 # OpenDAL
 opendal = { version = "0.54", default-features = false, features = ["services-webhdfs"], optional = true }
@@ -491,6 +497,9 @@ approx = "0.5.1"
 strum.workspace = true
 assert_cmd = { version = "2.0.17", default-features = false }
 aws-smithy-runtime = { version = "1.8.3", default-features = false, features = ["tls-rustls"] }
+azure_storage = { version = "0.21", default-features = false, features = ["enable_reqwest", "hmac_openssl"] }
+azure_storage_blobs = { version = "0.21", default-features = false, features = ["enable_reqwest", "hmac_openssl", "azurite_workaround"] }
+azure_storage_queues = { version = "0.21", default-features = false }
 base64 = "0.22.1"
 criterion = { workspace = true, features = ["html_reports", "async_tokio"] }
 itertools.workspace = true
@@ -626,6 +635,8 @@ api-client-minimal = [
 
 top = ["vector-lib/vector-top", "vector-lib/api-client"]
 
+azure = ["dep:azure_storage", "dep:azure_storage_blobs"]
+
 aws-core = [
   "aws-runtime",
   "aws-config",
@@ -669,6 +680,7 @@ sources-logs = [
   "sources-aws_kinesis_firehose",
   "sources-aws_s3",
   "sources-aws_sqs",
+  "sources-azure_blob",
   "sources-datadog_agent",
   "sources-demo_logs",
   "sources-docker_logs",
@@ -722,6 +734,7 @@ sources-aws_ecs_metrics = ["sources-utils-http-client"]
 sources-aws_kinesis_firehose = ["dep:base64"]
 sources-aws_s3 = ["aws-core", "dep:aws-sdk-sqs", "dep:aws-sdk-s3", "dep:async-compression", "sources-aws_sqs", "tokio-util/io"]
 sources-aws_sqs = ["aws-core", "dep:aws-sdk-sqs"]
+sources-azure_blob = ["azure", "dep:azure_core", "dep:azure_storage_queues", "dep:base64", "dep:async-compression", "tokio-util/io"]
 sources-datadog_agent = ["sources-utils-http-encoding", "protobuf-build", "dep:prost"]
 sources-demo_logs = ["dep:fakedata"]
 sources-dnstap = ["sources-utils-net-tcp", "dep:base64", "dep:hickory-proto", "dep:dnsmsg-parser", "dep:dnstap-parser", "protobuf-build", "dep:prost", "vector-vrl-functions/dnstap"]
@@ -1053,7 +1066,7 @@ aws-s3-integration-tests = ["sinks-aws_s3", "sources-aws_s3"]
 aws-sqs-integration-tests = ["sinks-aws_sqs"]
 aws-sns-integration-tests = ["sinks-aws_sns"]
 axiom-integration-tests = ["sinks-axiom"]
-azure-blob-integration-tests = ["sinks-azure_blob"]
+azure-blob-integration-tests = ["sinks-azure_blob", "sources-azure_blob"]
 azure-logs-ingestion-integration-tests = ["sinks-azure_logs_ingestion"]
 chronicle-integration-tests = ["sinks-gcp"]
 clickhouse-integration-tests = ["sinks-clickhouse"]
diff --git a/changelog.d/13882_azure_blob_storage_source.feature.md b/changelog.d/13882_azure_blob_storage_source.feature.md
new file mode 100644
index 0000000000000..7a9ff7b5b9549
--- /dev/null
+++ b/changelog.d/13882_azure_blob_storage_source.feature.md
@@ -0,0 +1,17 @@
+New `azure_blob` source for reading logs from Azure Blob Storage
+
+A new `azure_blob` source has been added that allows Vector to read logs from Azure Blob Storage containers. The source processes events from Azure Storage Queues to detect when new blobs are created or modified, then reads and decodes the blob contents. The design followed an intended feature parity with AWS S3 source.
+
+Key features:
+- Supports connection string authentication
+- Automatically processes Azure Event Grid notifications via Storage Queue
+- Configurable compression support (gzip, zstd) with auto-detection from file extension (Content-Encoding detection NOT supported)
+- Configurable framing for splitting blob contents (newline-delimited, character-delimited, bytes, etc.)
+- Multiline aggregation support for combining related log lines (stack traces, multi-line JSON, etc.)
+- Configurable decoding for various log formats
+- Automatic enrichment of events with container, blob, and timestamp metadata
+- Support for acknowledgements
+
+This enables efficient log collection from Azure Blob Storage without polling, making it suitable for high-throughput logging scenarios.
+
+authors: ldrozdz93 kwapik aq1l
diff --git a/src/azure/mod.rs b/src/azure/mod.rs
new file mode 100644
index 0000000000000..96a75dba66e40
--- /dev/null
+++ b/src/azure/mod.rs
@@ -0,0 +1,81 @@
+//! Shared Azure client infrastructure used by both sources and sinks.
+
+use std::sync::Arc;
+
+use azure_core_for_storage::RetryOptions;
+use azure_storage::{CloudLocation, ConnectionString};
+use azure_storage_blobs::prelude::*;
+
+/// Builds an Azure Blob Storage container client from a connection string.
+///
+/// Supports both custom blob endpoints (e.g. Azurite) and standard Azure Commercial endpoints.
+pub fn build_client(
+    connection_string: String,
+    container_name: String,
+) -> crate::Result<Arc<ContainerClient>> {
+    let client = {
+        let connection_string = ConnectionString::new(&connection_string)?;
+        let account_name = connection_string
+            .account_name
+            .ok_or("Account name missing in connection string")?;
+
+        match connection_string.blob_endpoint {
+            // When the blob_endpoint is provided, we use the Custom CloudLocation since it is
+            // required to contain the full URI to the blob storage API endpoint, this means
+            // that account_name is not required to exist in the connection_string since
+            // account_name is only used with the default CloudLocation in the Azure SDK to
+            // generate the storage API endpoint
+            Some(uri) => ClientBuilder::with_location(
+                CloudLocation::Custom {
+                    uri: uri.to_string(),
+                    account: account_name.to_string(),
+                },
+                connection_string.storage_credentials()?,
+            ),
+            // Without a valid blob_endpoint in the connection_string, assume we are in Azure
+            // Commercial (AzureCloud location) and create a default Blob Storage Client that
+            // builds the API endpoint location using the account_name as input
+            None => ClientBuilder::new(account_name, connection_string.storage_credentials()?),
+        }
+        .retry(RetryOptions::none())
+        .container_client(container_name)
+    };
+    Ok(Arc::new(client))
+}
+
+/// Builds an Azure Storage Queue client from a connection string.
+///
+/// Supports both custom queue endpoints (e.g. Azurite) and standard Azure Commercial endpoints.
+#[cfg(feature = "sources-azure_blob")]
+pub fn build_queue_client(
+    connection_string: &str,
+    queue_name: String,
+) -> crate::Result<Arc<azure_storage_queues::QueueClient>> {
+    use azure_storage_queues::QueueServiceClientBuilder;
+
+    let service_client = {
+        let connection_string = ConnectionString::new(connection_string)?;
+        let account_name = connection_string
+            .account_name
+            .ok_or("Account name missing in connection string")?;
+
+        match connection_string.queue_endpoint {
+            Some(uri) => QueueServiceClientBuilder::with_location(
+                CloudLocation::Custom {
+                    uri: uri.to_string(),
+                    account: account_name.to_string(),
+                },
+                connection_string.storage_credentials()?,
+            ),
+            None => QueueServiceClientBuilder::new(
+                account_name,
+                connection_string.storage_credentials()?,
+            ),
+        }
+        .retry(RetryOptions::none())
+        .build()
+    };
+
+    let client = service_client.queue_client(queue_name);
+    Ok(Arc::new(client))
+}
diff --git a/src/internal_events/azure_queue.rs b/src/internal_events/azure_queue.rs
new file mode 100644
index 0000000000000..219d581fc62b3
--- /dev/null
+++ b/src/internal_events/azure_queue.rs
@@ -0,0 +1,219 @@
+#[cfg(feature = "sources-azure_blob")]
+pub use azure_blob::*;
+use metrics::counter;
+use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+
+#[cfg(feature = "sources-azure_blob")]
+mod azure_blob {
+    use super::*;
+    use crate::event::Event;
+    use crate::sources::azure_blob::queue::ProcessingError;
+
+    #[derive(Debug, NamedInternalEvent)]
+    pub struct QueueMessageProcessingError<'a> {
+        pub message_id: &'a str,
+        pub error: &'a ProcessingError,
+    }
+
+    impl<'a> InternalEvent for QueueMessageProcessingError<'a> {
+        fn emit(self) {
+            error!(
+                message = "Failed to process Queue message.",
+                message_id = %self.message_id,
+                error = %self.error,
+                error_code = "failed_processing_azure_queue_message",
+                error_type = error_type::PARSER_FAILED,
+                stage = error_stage::PROCESSING,
+                internal_log_rate_limit = true,
+            );
+            counter!(
+                "component_errors_total",
+                "error_code" => "failed_processing_azure_queue_message",
+                "error_type" => error_type::PARSER_FAILED,
+                "stage" => error_stage::PROCESSING,
+            )
+            .increment(1);
+        }
+    }
+
+    #[derive(Debug, NamedInternalEvent)]
+    pub struct InvalidRowEventType<'a> {
+        pub event: &'a Event,
+    }
+
+    impl<'a> InternalEvent for InvalidRowEventType<'a> {
+        fn emit(self) {
+            error!(
+                message = "Expected Azure rows as Log Events",
+                event = ?self.event,
+                error_code = "invalid_azure_row_event",
+                error_type = error_type::CONDITION_FAILED,
+                stage = error_stage::PROCESSING,
+            );
+            counter!(
+                "component_errors_total",
+                "error_code" => "invalid_azure_row_event",
+                "error_type" => error_type::CONDITION_FAILED,
+                "stage" => error_stage::PROCESSING,
+            )
+            .increment(1);
+        }
+    }
+}
+
+#[cfg(feature = "sources-azure_blob")]
+#[derive(Debug, NamedInternalEvent)]
+pub struct QueueMessageReceiveError<'a, E> {
+    pub error: &'a E,
+}
+
+#[cfg(feature = "sources-azure_blob")]
+impl<'a, E: std::fmt::Display + std::fmt::Debug> InternalEvent for QueueMessageReceiveError<'a, E> {
+    fn emit(self) {
+        error!(
+            message = "Failed reading messages",
+            event = format!("{:?}", self.error),
+            error_code = "failed_fetching_azure_queue_events",
+            error_type = error_type::REQUEST_FAILED,
+            stage = error_stage::RECEIVING,
+        );
+        counter!(
+            "component_errors_total",
+            "error_code" => "failed_fetching_azure_queue_events",
+            "error_type" => error_type::REQUEST_FAILED,
+            "stage" => error_stage::RECEIVING,
+        )
+        .increment(1);
+    }
+}
+
+#[cfg(feature = "sources-azure_blob")]
+#[derive(Debug, NamedInternalEvent)]
+pub struct QueueMessageDeleteError<'a, E> {
+    pub error: &'a E,
+}
+
+#[cfg(feature = "sources-azure_blob")]
+impl<'a, E: std::fmt::Display> InternalEvent for QueueMessageDeleteError<'a, E> {
+    fn emit(self) {
+        error!(
+            message = "Failed deleting message",
+            error = %self.error,
+            error_code = "failed_deleting_azure_queue_event",
+            error_type = error_type::ACKNOWLEDGMENT_FAILED,
+            stage = error_stage::PROCESSING,
+        );
+        counter!(
+            "component_errors_total",
+            "error_code" => "failed_deleting_azure_queue_event",
+            "error_type" => error_type::ACKNOWLEDGMENT_FAILED,
+            "stage" => error_stage::PROCESSING,
+        )
+        .increment(1);
+    }
+}
+
+#[cfg(feature = "sources-azure_blob")]
+#[derive(Debug, NamedInternalEvent)]
+pub struct QueueStorageInvalidEventIgnored<'a> {
+    pub container: &'a str,
+    pub subject: &'a str,
+    pub event_type: &'a str,
+}
+
+#[cfg(feature = "sources-azure_blob")]
+impl<'a> InternalEvent for QueueStorageInvalidEventIgnored<'a> {
+    fn emit(self) {
+        trace!(
+            message = "Ignoring event because of wrong event type",
+            container = %self.container,
+            subject = %self.subject,
+            event_type = %self.event_type
+        );
+        counter!(
+            "azure_queue_event_ignored_total",
+            "ignore_type" => "invalid_event_type"
+        )
+        .increment(1);
+    }
+}
+
+#[cfg(feature = "sources-azure_blob")]
+#[derive(Debug, NamedInternalEvent)]
+pub struct QueueStorageMismatchingContainerName<'a> {
+    pub container: &'a str,
+    pub configured_container: &'a str,
+}
+
+#[cfg(feature = "sources-azure_blob")]
+impl<'a> InternalEvent for QueueStorageMismatchingContainerName<'a> {
+    fn emit(self) {
+        warn!(
+            message = "Ignoring event because of wrong container name",
+            configured_container = %self.configured_container,
+            container = %self.container,
+        );
+        counter!(
+            "azure_queue_event_ignored_total",
+            "ignore_type" => "mismatching_container_name"
+        )
+        .increment(1);
+    }
+}
+
+#[cfg(feature = "sources-azure_blob")]
+#[derive(Debug, NamedInternalEvent)]
+pub struct QueueMessageProcessingSucceeded {}
+
+#[cfg(feature = "sources-azure_blob")]
+impl InternalEvent for QueueMessageProcessingSucceeded {
+    fn emit(self) {
+        trace!(message = "Processed azure queue message successfully.");
+        counter!("azure_queue_message_processing_succeeded_total").increment(1);
+    }
+}
+
+#[cfg(feature = "sources-azure_blob")]
+#[derive(Debug, NamedInternalEvent)]
+pub struct QueueMessageProcessingErrored {}
+
+#[cfg(feature = "sources-azure_blob")]
+impl InternalEvent for QueueMessageProcessingErrored {
+    fn emit(self) {
+        error!(message = "Batch event had a transient error in delivery.");
+        counter!("azure_queue_message_processing_errored_total").increment(1);
+    }
+}
+
+#[cfg(feature = "sources-azure_blob")]
+#[derive(Debug, NamedInternalEvent)]
+pub struct QueueMessageProcessingRejected {}
+
+#[cfg(feature = "sources-azure_blob")]
+impl InternalEvent for QueueMessageProcessingRejected {
+    fn emit(self) {
+        error!(message = "Batch event had a permanent failure or rejection.");
+        counter!("azure_queue_message_processing_rejected_total").increment(1);
+    }
+}
+
+#[cfg(feature = "sources-azure_blob")]
+#[derive(Debug, NamedInternalEvent)]
+pub struct BlobDoesntExist<'a> {
+    pub nonexistent_blob_name: &'a str,
+}
+
+#[cfg(feature = "sources-azure_blob")]
+impl<'a> InternalEvent for BlobDoesntExist<'a> {
+    fn emit(self) {
+        warn!(
+            message = "Ignoring event because blob doesn't exist in storage",
+            blob_name = self.nonexistent_blob_name
+        );
+        counter!(
+            "azure_queue_event_ignored_total",
+            "ignore_type" => "blob_doesnt_exist"
+        )
+        .increment(1);
+    }
+}
diff --git a/src/internal_events/mod.rs b/src/internal_events/mod.rs
index d111134e97adf..1a908102e1eb9 100644
--- a/src/internal_events/mod.rs
+++ b/src/internal_events/mod.rs
@@ -154,6 +154,9 @@ mod windows_event_log;
 #[cfg(windows)]
 mod windows;
 
+#[cfg(feature = "sources-azure_blob")]
+mod azure_queue;
+
 #[cfg(any(feature = "transforms-log_to_metric", feature = "sinks-loki"))]
 mod expansion;
 #[cfg(feature = "sources-mongodb_metrics")]
@@ -184,6 +187,8 @@ pub(crate) use self::aws_kinesis::*;
 pub(crate) use self::aws_kinesis_firehose::*;
 #[cfg(any(feature = "sources-aws_s3", feature = "sources-aws_sqs",))]
 pub(crate) use self::aws_sqs::*;
+#[cfg(feature = "sources-azure_blob")]
+pub(crate) use self::azure_queue::*;
 #[cfg(feature = "sources-datadog_agent")]
 pub(crate) use self::datadog_agent::*;
 #[cfg(feature = "sinks-datadog_metrics")]
diff --git a/src/lib.rs b/src/lib.rs
index fc05f14cc92eb..0f1e883562933 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -78,6 +78,8 @@ pub mod app;
 pub mod async_read;
 #[cfg(feature = "aws-config")]
 pub mod aws;
+#[cfg(feature = "azure")]
+pub mod azure;
 pub mod common;
 pub mod completion;
 mod convert_config;
diff --git a/src/sources/azure_blob/integration_tests.rs b/src/sources/azure_blob/integration_tests.rs
new file mode 100644
index 0000000000000..9f2179f1d7d6c
--- /dev/null
+++ b/src/sources/azure_blob/integration_tests.rs
@@ -0,0 +1,955 @@
+use azure_storage_blobs::prelude::PublicAccess;
+use base64::{Engine, prelude::BASE64_STANDARD};
+use flate2::{Compression as GzCompression, write::GzEncoder};
+use std::{io::Write, time::Duration};
+
+use super::{
+    AzureBlobConfig, Compression,
+    queue::{Config, make_container_client, make_queue_client},
+};
+use crate::{
+    event::Event,
+    serde::default_decoding,
+    test_util::components::{
+        COMPONENT_ERROR_TAGS, SOURCE_TAGS, run_and_assert_source_compliance,
+        run_and_assert_source_error,
+    },
+};
+
+impl AzureBlobConfig {
+    pub async fn new_emulator() -> AzureBlobConfig {
+        let address = std::env::var("AZURE_ADDRESS").unwrap_or_else(|_| "localhost".to_string());
+        let config = AzureBlobConfig {
+                connection_string: format!("UseDevelopmentStorage=true;DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://{}:10000/devstoreaccount1;QueueEndpoint=http://{}:10001/devstoreaccount1;TableEndpoint=http://{}:10002/devstoreaccount1;", address, address, address).into(),
+                container_name: "logs".to_string(),
+                queue: Some(Config {
+                    queue_name: format!("test-{}", rand::random::<u32>()),
+                    poll_secs: 1,
+                }),
+                decoding: default_decoding(),
+                ..Default::default()
+            };
+
+        config.ensure_container().await;
+        config.ensure_queue().await;
+
+        config
+    }
+
+    async fn run_assert(&self) -> Vec<Event> {
+        run_and_assert_source_compliance(self.clone(), Duration::from_secs(1), &SOURCE_TAGS).await
+    }
+
+    async fn run_error(&self) -> Vec<Event> {
+        run_and_assert_source_error(self.clone(), Duration::from_secs(1), &COMPONENT_ERROR_TAGS)
+            .await
+    }
+
+    async fn ensure_container(&self) {
+        let client = make_container_client(self).expect("Failed to create container client");
+        let request = client
+            .create()
+            .public_access(PublicAccess::None)
+            .into_future();
+
+        let response = match request.await {
+            Ok(_) => Ok(()),
+            Err(reason) => {
+                let error_msg = reason.to_string();
+                // Check for HTTP 409 (Conflict) which means container already exists - this is OK
+                if error_msg.contains("409")
+                    || error_msg.contains("conflict")
+                    || error_msg.contains("already exists")
+                {
+                    Ok(())
+                } else {
+                    Err(format!("Unexpected error {}", reason))
+                }
+            }
+        };
+
+        response.expect("Failed to create container")
+    }
+
+    async fn ensure_queue(&self) {
+        let client = make_queue_client(self).expect("Failed to create queue client");
+        let request = client.create().into_future();
+
+        let response = match request.await {
+            Ok(_) => Ok(()),
+            Err(reason) => {
+                let error_msg = reason.to_string();
+                // Check for HTTP 409 (Conflict) which means queue already exists - this is OK
+                if error_msg.contains("409")
+                    || error_msg.contains("conflict")
+                    || error_msg.contains("already exists")
+                {
+                    Ok(())
+                } else {
+                    Err(format!("Unexpected error {}", reason))
+                }
+            }
+        };
+
+        response.expect("Failed to create queue")
+    }
+
+    async fn upload_blob(&self, name: String, content: String) {
+        let container_client =
+            make_container_client(self).expect("Failed to create container client");
+        let blob_client = container_client.blob_client(name.clone());
+        blob_client
+            .put_block_blob(content)
+            .await
+            .expect("Failed putting blob");
+
+        self.queue_notify_blob_created(&name).await;
+    }
+
+    async fn upload_compressed_blob(&self, name: String, content: String, compression: &str) {
+        let container_client =
+            make_container_client(self).expect("Failed to create container client");
+        let blob_client = container_client.blob_client(name.clone());
+
+        let compressed_data = match compression {
+            "gzip" => {
+                let mut encoder = GzEncoder::new(Vec::new(), GzCompression::default());
+                encoder
+                    .write_all(content.as_bytes())
+                    .expect("Failed to write to gzip encoder");
+                encoder.finish().expect("Failed to finish gzip compression")
+            }
+            "zstd" => {
+                zstd::encode_all(content.as_bytes(), 3).expect("Failed to compress with zstd")
+            }
+            _ => panic!("Unsupported compression type: {}", compression),
+        };
+
+        blob_client
+            .put_block_blob(compressed_data)
+            .await
+            .expect("Failed putting compressed blob");
+
+        self.queue_notify_blob_created(&name).await;
+    }
+
+    async fn queue_notify_blob_created(&self, name: &str) {
+        let queue_client = make_queue_client(self).expect("Failed to create queue client");
+        let message = format!(
+            r#"{{
+          "topic": "/subscriptions/fa5f2180-1451-4461-9b1f-aae7d4b33cf8/resourceGroups/events_poc/providers/Microsoft.Storage/storageAccounts/eventspocaccount",
+          "subject": "/blobServices/default/containers/logs/blobs/{}",
+          "eventType": "Microsoft.Storage.BlobCreated",
+          "id": "be3f21f7-201e-000b-7605-a29195062628",
+          "data": {{
+            "api": "PutBlob",
+            "clientRequestId": "1fa42c94-6dd3-4172-95c4-fd9cf56b5009",
+            "requestId": "be3f21f7-201e-000b-7605-a29195000000",
+            "eTag": "0x8DC701C5D3FFDF6",
+            "contentType": "application/octet-stream",
+            "contentLength": 0,
+            "blobType": "BlockBlob",
+            "url": "https://eventspocaccount.blob.core.windows.net/logs/{}",
+            "sequencer": "0000000000000000000000000005C5360000000000276a63",
+            "storageDiagnostics": {{
+              "batchId": "fec5b12c-2006-0034-0005-a25936000000"
+            }}
+          }},
+          "dataVersion": "",
+          "metadataVersion": "1",
+          "eventTime": "2024-05-09T11:37:10.5637878Z"
+        }}"#,
+            name, name
+        );
+        queue_client
+            .put_message(BASE64_STANDARD.encode(message))
+            .await
+            .expect("Failed putting message");
+    }
+
+    async fn queue_notify_blob_renamed(&self, name: &str) {
+        let queue_client = make_queue_client(self).expect("Failed to create queue client");
+        let message = format!(
+            r#"{{
+          "topic": "/subscriptions/fa5f2180-1451-4461-9b1f-aae7d4b33cf8/resourceGroups/events_poc/providers/Microsoft.Storage/storageAccounts/eventspocaccount",
+          "subject": "/blobServices/default/containers/logs/blobs/{}",
+          "eventType": "Microsoft.Storage.BlobRenamed",
+          "id": "be3f21f7-201e-000b-7605-a29195062629",
+          "data": {{
+            "api": "RenameFile",
+            "clientRequestId": "6d79dbfb-0e37-4fc4-981f-442c9ca65760",
+            "requestId": "831e1650-001e-001b-66ab-eeb76e000000",
+            "destinationUrl": "https://eventspocaccount.dfs.core.windows.net/logs/{}",
+            "sourceUrl": "https://eventspocaccount.dfs.core.windows.net/logs/old-name.txt",
+            "sequencer": "00000000000004420000000000028963",
+            "storageDiagnostics": {{
+              "batchId": "b68529f3-68cd-4744-baa4-3c0498ec19f0"
+            }}
+          }},
+          "dataVersion": "1",
+          "metadataVersion": "1",
+          "eventTime": "2024-05-09T11:37:10.5637878Z"
+        }}"#,
+            name, name
+        );
+        queue_client
+            .put_message(BASE64_STANDARD.encode(message))
+            .await
+            .expect("Failed putting message");
+    }
+}
+
+/// Test basic functionality: reading a single line from a blob.
+///
+/// **Setup:**
+/// - Upload a blob containing a single line of text: "a"
+///
+/// **Verification:**
+/// - Verify exactly 1 event is received
+/// - Verify the event message matches the uploaded content
+///
+/// **Purpose:** Validate basic blob reading and event generation for single-line content.
+#[tokio::test]
+async fn azure_blob_read_single_line_from_blob() {
+    let config = AzureBlobConfig::new_emulator().await;
+    let content = "a";
+    config
+        .upload_blob("file.txt".to_string(), content.to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 1);
+    assert_eq!(events[0].as_log()["message"], "a".into());
+}
+
+/// Test handling of BlobRenamed events.
+///
+/// **Setup:**
+/// - Upload a blob with content to a destination path
+/// - Send a BlobRenamed event notification pointing to that blob
+///
+/// **Verification:**
+/// - Verify exactly 1 event is received
+/// - Verify the event message matches the blob content at the renamed location
+///
+/// **Purpose:** Validate that BlobRenamed events trigger blob reading at the new location.
+#[tokio::test]
+async fn azure_blob_read_blob_renamed_event() {
+    let config = AzureBlobConfig::new_emulator().await;
+    let content = "renamed_blob_content";
+
+    // Upload blob to the destination path
+    let blob_client = make_container_client(&config)
+        .expect("Failed to create container client")
+        .blob_client("renamed-file.txt");
+    blob_client
+        .put_block_blob(content)
+        .await
+        .expect("Failed putting blob");
+
+    // Send BlobRenamed event notification
+    config.queue_notify_blob_renamed("renamed-file.txt").await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 1);
+    assert_eq!(events[0].as_log()["message"], "renamed_blob_content".into());
+}
+
+/// Test reading multiple lines from a single blob with newline-delimited framing.
+///
+/// **Setup:**
+/// - Upload a blob with newline-separated content: "a\nb\nc"
+/// - Use default newline-delimited framing
+///
+/// **Verification:**
+/// - Verify exactly 3 events are received
+/// - Verify each line is parsed as a separate event in order
+///
+/// **Purpose:** Validate default newline-delimited framing splits blob content correctly.
+#[tokio::test]
+async fn azure_blob_read_multiple_lines_from_blob() {
+    let config = AzureBlobConfig::new_emulator().await;
+    let content = "a\nb\nc";
+    config
+        .upload_blob("file.txt".to_string(), content.to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 3);
+    assert_eq!(events[0].as_log()["message"], "a".into());
+    assert_eq!(events[1].as_log()["message"], "b".into());
+    assert_eq!(events[2].as_log()["message"], "c".into());
+}
+
+/// Test processing multiple blobs from the same container.
+///
+/// **Setup:**
+/// - Upload 3 separate blobs, each containing a single line: "a", "b", "c"
+/// - Each blob generates an Event Grid notification
+///
+/// **Verification:**
+/// - Verify exactly 3 events are received (one from each blob)
+/// - Verify each event contains the content from its respective blob
+///
+/// **Purpose:** Validate the source can handle multiple blob notifications and process them correctly.
+#[tokio::test]
+async fn azure_blob_read_single_line_from_multiple_blobs() {
+    let config = AzureBlobConfig::new_emulator().await;
+    let contents = vec!["a", "b", "c"];
+    for (i, content) in contents.clone().iter().enumerate() {
+        config
+            .upload_blob(format!("file{}.txt", i), content.to_string())
+            .await;
+    }
+
+    let events =
+        run_and_assert_source_compliance(config.clone(), Duration::from_secs(4), &SOURCE_TAGS)
+            .await;
+    assert_eq!(events.len(), contents.len());
+    for (i, event) in events.iter().enumerate() {
+        assert_eq!(event.as_log()["message"], contents[i].into());
+    }
+}
+
+/// Test error handling when queue messages cannot be read.
+///
+/// **Setup:**
+/// - Upload a blob with valid content
+/// - Configure source to read from a non-existent queue
+///
+/// **Verification:**
+/// - Verify no events are received (source should emit error metric)
+/// - Verify error tags are emitted for the component
+///
+/// **Purpose:** Validate proper error handling when queue is inaccessible.
+#[tokio::test]
+async fn azure_blob_emit_error_on_message_read() {
+    let mut config = AzureBlobConfig::new_emulator().await;
+    let content = "a\nb\nc";
+    config
+        .upload_blob("file.txt".to_string(), content.to_string())
+        .await;
+    config.queue = Some(Config {
+        queue_name: "nonexistent".to_string(),
+        poll_secs: 1,
+    });
+
+    let events = config.run_error().await;
+    assert!(events.is_empty());
+}
+
+/// Test graceful handling of notifications for non-existent blobs.
+///
+/// **Setup:**
+/// - Send Event Grid notification for a blob that doesn't exist
+/// - Then upload a valid blob with actual content
+///
+/// **Verification:**
+/// - Verify only the valid blob's event is received (1 event total)
+/// - Verify the missing blob notification is ignored without crashing
+///
+/// **Purpose:** Validate resilience when Event Grid sends notifications for deleted or non-existent blobs.
+#[tokio::test]
+async fn azure_blob_ignore_missing_blob() {
+    let config = AzureBlobConfig::new_emulator().await;
+
+    config.queue_notify_blob_created("non-existent").await;
+    config
+        .upload_blob("file.txt".to_string(), "some_content".to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 1);
+}
+
+/// Test JSON deserialization with JSON codec.
+///
+/// **Setup:**
+/// - Configure source with JSON deserializer
+/// - Upload a blob containing a single JSON object with fields: timestamp, level, message
+///
+/// **Verification:**
+/// - Verify exactly 1 event is received
+/// - Verify JSON fields are correctly parsed and accessible in the log event
+///
+/// **Purpose:** Validate decoding configuration works correctly for JSON content.
+#[tokio::test]
+async fn azure_blob_read_json_content() {
+    use vector_lib::codecs::decoding::{DeserializerConfig, JsonDeserializerConfig};
+
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.decoding = DeserializerConfig::Json(JsonDeserializerConfig::default());
+
+    let json_content =
+        r#"{"timestamp": "2024-01-01T00:00:00Z", "level": "INFO", "message": "Test log"}"#;
+    config
+        .upload_blob("log.json".to_string(), json_content.to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 1);
+    let log = events[0].as_log();
+    assert_eq!(log["level"], "INFO".into());
+    assert_eq!(log["message"], "Test log".into());
+}
+
+/// Test error handling with malformed Event Grid messages.
+///
+/// **Setup:**
+/// - Manually enqueue an invalid (non-JSON) message to the queue
+/// - Upload a valid blob with correct content
+///
+/// **Verification:**
+/// - Verify the valid blob's event is still received (1 event total)
+/// - Verify the malformed message is skipped without blocking valid messages
+///
+/// **Purpose:** Validate source resilience when queue contains corrupted or invalid messages.
+#[tokio::test]
+async fn azure_blob_handle_malformed_message() {
+    let config = AzureBlobConfig::new_emulator().await;
+    let queue_client = make_queue_client(&config).expect("Failed to create queue client");
+    queue_client
+        .put_message(BASE64_STANDARD.encode("not a valid json"))
+        .await
+        .expect("Failed putting malformed message");
+
+    config
+        .upload_blob("file.txt".to_string(), "correct content".to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 1);
+    assert_eq!(events[0].as_log()["message"], "correct content".into());
+}
+
+/// Test handling of empty blobs.
+///
+/// **Setup:**
+/// - Upload a blob with zero-length content (empty string)
+///
+/// **Verification:**
+/// - Verify the source handles empty blobs gracefully (either 0 events or 1 empty event)
+/// - Verify no errors or crashes occur
+///
+/// **Purpose:** Validate edge case handling for empty blob content.
+#[tokio::test]
+async fn azure_blob_read_empty_blob() {
+    let config = AzureBlobConfig::new_emulator().await;
+    config
+        .upload_blob("empty.txt".to_string(), "".to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    if !events.is_empty() {
+        assert_eq!(events[0].as_log()["message"], "".into());
+    }
+}
+
+// ===== Compression Integration Tests =====
+
+/// Test gzip decompression with automatic compression detection via file extension.
+///
+/// **Setup:**
+/// - Configure compression = "auto"
+/// - Upload a gzip-compressed blob with ".gz" extension containing "line1\nline2\nline3"
+///
+/// **Verification:**
+/// - Verify blob is automatically detected as gzip and decompressed
+/// - Verify exactly 3 events are received with correct content
+///
+/// **Purpose:** Validate auto-detection of gzip compression from file extension.
+#[tokio::test]
+async fn azure_blob_gzip_compression_auto() {
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.compression = Compression::Auto;
+
+    let content = "line1\nline2\nline3";
+    config
+        .upload_compressed_blob("file.gz".to_string(), content.to_string(), "gzip")
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 3);
+    assert_eq!(events[0].as_log()["message"], "line1".into());
+    assert_eq!(events[1].as_log()["message"], "line2".into());
+    assert_eq!(events[2].as_log()["message"], "line3".into());
+}
+
+/// Test gzip decompression with explicit compression configuration.
+///
+/// **Setup:**
+/// - Configure compression = "gzip" explicitly
+/// - Upload a gzip-compressed blob WITHOUT ".gz" extension
+///
+/// **Verification:**
+/// - Verify blob is decompressed despite lacking compression-indicating file extension
+/// - Verify exactly 2 events are received with correct content
+///
+/// **Purpose:** Validate explicit gzip compression override when file extension is absent.
+#[tokio::test]
+async fn azure_blob_gzip_compression_explicit() {
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.compression = Compression::Gzip;
+
+    let content = "explicit_gzip_line1\nexplicit_gzip_line2";
+    config
+        .upload_compressed_blob("file_no_extension".to_string(), content.to_string(), "gzip")
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 2);
+    assert_eq!(events[0].as_log()["message"], "explicit_gzip_line1".into());
+    assert_eq!(events[1].as_log()["message"], "explicit_gzip_line2".into());
+}
+
+/// Test zstd decompression with automatic compression detection.
+///
+/// **Setup:**
+/// - Configure compression = "auto"
+/// - Upload a zstd-compressed blob with ".zst" extension
+///
+/// **Verification:**
+/// - Verify blob is automatically detected as zstd and decompressed
+/// - Verify exactly 3 events are received with correct content
+///
+/// **Purpose:** Validate auto-detection of zstd compression from file extension.
+#[tokio::test]
+async fn azure_blob_zstd_compression() {
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.compression = Compression::Auto;
+
+    let content = "zstd_line1\nzstd_line2\nzstd_line3";
+    config
+        .upload_compressed_blob("file.zst".to_string(), content.to_string(), "zstd")
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 3);
+    assert_eq!(events[0].as_log()["message"], "zstd_line1".into());
+    assert_eq!(events[1].as_log()["message"], "zstd_line2".into());
+    assert_eq!(events[2].as_log()["message"], "zstd_line3".into());
+}
+
+/// Test that compression can be disabled even when file extension suggests compression.
+///
+/// **Setup:**
+/// - Configure compression = "none" explicitly
+/// - Upload an UNCOMPRESSED blob named "file.gz" (misleading extension)
+///
+/// **Verification:**
+/// - Verify blob is NOT decompressed despite having ".gz" extension
+/// - Verify raw uncompressed content is read correctly (2 events)
+///
+/// **Purpose:** Validate explicit compression=none overrides auto-detection.
+#[tokio::test]
+async fn azure_blob_no_compression_with_gz_extension() {
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.compression = Compression::None;
+
+    let content = "uncompressed_content\nsecond_line";
+    config
+        .upload_blob("file.gz".to_string(), content.to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 2);
+    assert_eq!(events[0].as_log()["message"], "uncompressed_content".into());
+    assert_eq!(events[1].as_log()["message"], "second_line".into());
+}
+
+/// Test decompression of multipart gzip files (multiple gzip members concatenated).
+///
+/// **Setup:**
+/// - Create a blob with two separate gzip-compressed parts concatenated together
+/// - Each part contains 2 lines with trailing newlines
+/// - Configure compression = "auto"
+///
+/// **Verification:**
+/// - Verify all 4 lines from both gzip members are decompressed and parsed
+/// - Verify events maintain correct order across both gzip members
+///
+/// **Purpose:** Validate multi-member gzip decompression (common format for log rotation).
+#[tokio::test]
+async fn azure_blob_multipart_gzip() {
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.compression = Compression::Auto;
+
+    // Create two separate gzip-compressed parts
+    // Add trailing newlines so concatenated result splits correctly
+    let content1 = "part1_line1\npart1_line2\n";
+    let content2 = "part2_line1\npart2_line2\n";
+
+    let mut encoder1 = GzEncoder::new(Vec::new(), GzCompression::default());
+    encoder1
+        .write_all(content1.as_bytes())
+        .expect("Failed to write part 1");
+    let compressed1 = encoder1.finish().expect("Failed to finish part 1");
+
+    let mut encoder2 = GzEncoder::new(Vec::new(), GzCompression::default());
+    encoder2
+        .write_all(content2.as_bytes())
+        .expect("Failed to write part 2");
+    let compressed2 = encoder2.finish().expect("Failed to finish part 2");
+
+    // Concatenate the two gzip parts
+    let mut multipart = compressed1;
+    multipart.extend(compressed2);
+
+    let container_client =
+        make_container_client(&config).expect("Failed to create container client");
+    let blob_client = container_client.blob_client("multipart.gz");
+    blob_client
+        .put_block_blob(multipart)
+        .await
+        .expect("Failed putting multipart blob");
+
+    config.queue_notify_blob_created("multipart.gz").await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 4);
+    assert_eq!(events[0].as_log()["message"], "part1_line1".into());
+    assert_eq!(events[1].as_log()["message"], "part1_line2".into());
+    assert_eq!(events[2].as_log()["message"], "part2_line1".into());
+    assert_eq!(events[3].as_log()["message"], "part2_line2".into());
+}
+
+// ============================================================================
+// Framing Integration Tests
+// ============================================================================
+
+use vector_lib::codecs::decoding::{
+    CharacterDelimitedDecoderConfig, CharacterDelimitedDecoderOptions, FramingConfig,
+    NewlineDelimitedDecoderConfig, NewlineDelimitedDecoderOptions,
+};
+
+/// Test character-delimited framing with null byte (\\0) delimiter.
+///
+/// **Setup:**
+/// - Configure character-delimited framing with \\0 (null) delimiter
+/// - Upload blob with null-delimited content: "a\\0b\\0c"
+///
+/// **Verification:**
+/// - Verify blob is split on null bytes into exactly 3 events
+/// - Verify each segment is parsed as a separate event: "a", "b", "c"
+///
+/// **Purpose:** Validate custom character-delimited framing with non-printable delimiters.
+#[tokio::test]
+async fn azure_blob_character_delimited_framing() {
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.framing = FramingConfig::CharacterDelimited(CharacterDelimitedDecoderConfig {
+        character_delimited: CharacterDelimitedDecoderOptions {
+            delimiter: b'\0',
+            max_length: None,
+        },
+    });
+
+    let content = "a\0b\0c";
+    config
+        .upload_blob("null-delimited.txt".to_string(), content.to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 3);
+    assert_eq!(events[0].as_log()["message"], "a".into());
+    assert_eq!(events[1].as_log()["message"], "b".into());
+    assert_eq!(events[2].as_log()["message"], "c".into());
+}
+
+/// Test bytes framing (treat entire blob as single event without splitting).
+///
+/// **Setup:**
+/// - Configure framing = "bytes" (no splitting)
+/// - Upload blob with content containing newlines: "single\\nevent\\nwith\\nnewlines"
+///
+/// **Verification:**
+/// - Verify exactly 1 event is received
+/// - Verify event contains entire blob content including all newlines
+///
+/// **Purpose:** Validate bytes framing treats entire blob as atomic event regardless of delimiters.
+#[tokio::test]
+async fn azure_blob_bytes_framing() {
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.framing = FramingConfig::Bytes;
+
+    let content = "single\nevent\nwith\nnewlines";
+    config
+        .upload_blob("bytes.txt".to_string(), content.to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 1);
+    assert_eq!(
+        events[0].as_log()["message"],
+        "single\nevent\nwith\nnewlines".into()
+    );
+}
+
+/// Test newline-delimited framing with mixed line ending styles.
+///
+/// **Setup:**
+/// - Configure newline-delimited framing
+/// - Upload blob with mixed line endings: Unix (\\n), Windows (\\r\\n), old Mac (\\r)
+///
+/// **Verification:**
+/// - Verify blob is split on \\n characters (newline-delimited splits only on \\n)
+/// - Verify \\r characters are preserved in content where they don't precede \\n
+/// - Verify exactly 3 events are received
+///
+/// **Purpose:** Validate newline-delimited framing behavior with non-uniform line endings.
+#[tokio::test]
+async fn azure_blob_mixed_line_endings() {
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.framing = FramingConfig::NewlineDelimited(NewlineDelimitedDecoderConfig {
+        newline_delimited: NewlineDelimitedDecoderOptions { max_length: None },
+    });
+
+    // Mix of \n, \r\n, and \r line endings
+    // Newline-delimited decoder only splits on \n, so \r is preserved in the content
+    let content = "unix\nwindows\r\nold_mac\rend";
+    config
+        .upload_blob("mixed-endings.txt".to_string(), content.to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    // Splits on \n only: "unix\n", "windows\r\n", "old_mac\rend" (no trailing \n)
+    // Results in: "unix", "windows\r", "old_mac\rend"
+    assert_eq!(events.len(), 3);
+    assert_eq!(events[0].as_log()["message"], "unix".into());
+    assert_eq!(events[1].as_log()["message"], "windows\r".into());
+    assert_eq!(events[2].as_log()["message"], "old_mac\rend".into());
+}
+
+// ============================================================================
+// Combined Tests (Framing + Compression)
+// ============================================================================
+
+/// Test combination of gzip compression and character-delimited framing.
+///
+/// **Setup:**
+/// - Configure compression = "auto" and character-delimited framing with \\0 delimiter
+/// - Upload gzip-compressed blob with null-delimited content: "item1\\0item2\\0item3"
+///
+/// **Verification:**
+/// - Verify compression is auto-detected and blob is decompressed
+/// - Verify decompressed content is split on null bytes into 3 events
+/// - Verify complete pipeline: decompress → frame → parse
+///
+/// **Purpose:** Validate compression and framing work correctly together.
+#[tokio::test]
+async fn azure_blob_gzip_character_delimited() {
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.compression = Compression::Auto;
+    config.framing = FramingConfig::CharacterDelimited(CharacterDelimitedDecoderConfig {
+        character_delimited: CharacterDelimitedDecoderOptions {
+            delimiter: b'\0',
+            max_length: None,
+        },
+    });
+
+    let content = "item1\0item2\0item3";
+    config
+        .upload_compressed_blob(
+            "null-compressed.gz".to_string(),
+            content.to_string(),
+            "gzip",
+        )
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 3);
+    assert_eq!(events[0].as_log()["message"], "item1".into());
+    assert_eq!(events[1].as_log()["message"], "item2".into());
+    assert_eq!(events[2].as_log()["message"], "item3".into());
+}
+
+// ===== Multiline Integration Tests =====
+
+/// Test multiline aggregation with continue_through mode (Java-style stack traces).
+///
+/// **Setup:**
+/// - Configure multiline mode = "continue_through"
+/// - start_pattern: lines starting with date (^\\d{4}-\\d{2}-\\d{2})
+/// - condition_pattern: continuation lines start with whitespace (^\\s)
+/// - Upload blob with Java stack trace (ERROR line + indented stack trace lines + INFO line)
+///
+/// **Verification:**
+/// - Verify exactly 2 events are received
+/// - Verify first event contains complete stack trace (ERROR line + all indented lines)
+/// - Verify second event is the single INFO line
+///
+/// **Purpose:** Validate continue_through mode aggregates multi-line stack traces correctly.
+#[tokio::test]
+async fn azure_blob_multiline_continue_through() {
+    use crate::{line_agg, sources::util::MultilineConfig};
+    use std::time::Duration;
+
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.multiline = Some(MultilineConfig {
+        start_pattern: r"^\d{4}-\d{2}-\d{2}".to_string(),
+        condition_pattern: r"^\s".to_string(),
+        mode: line_agg::Mode::ContinueThrough,
+        timeout_ms: Duration::from_millis(1000),
+    });
+
+    let content = "2024-01-01 ERROR Something failed\n  at com.example.Class.method(Class.java:10)\n  at com.example.Main.main(Main.java:20)\n2024-01-01 INFO Next log";
+    config
+        .upload_blob("stacktrace.log".to_string(), content.to_string())
+        .await;
+
+    let events =
+        run_and_assert_source_compliance(config.clone(), Duration::from_secs(3), &SOURCE_TAGS)
+            .await;
+    assert_eq!(events.len(), 2);
+
+    // First event should contain the full stack trace
+    let first_log = events[0].as_log()["message"].to_string_lossy();
+    assert!(first_log.contains("ERROR Something failed"));
+    assert!(first_log.contains("at com.example.Class.method"));
+    assert!(first_log.contains("at com.example.Main.main"));
+
+    // Second event should be the single line
+    assert_eq!(
+        events[1].as_log()["message"],
+        "2024-01-01 INFO Next log".into()
+    );
+}
+
+/// Test multiline aggregation with halt_before mode.
+///
+/// **Setup:**
+/// - Configure multiline mode = "halt_before"
+/// - start_pattern and condition_pattern: lines starting with "START"
+/// - Upload blob with content: "START block1\\nline2\\nline3\\nSTART block2\\nline5"
+///
+/// **Verification:**
+/// - Verify exactly 2 events are received
+/// - Verify first event contains "START block1" through "line3" (stops before next START)
+/// - Verify second event contains "START block2\\nline5"
+///
+/// **Purpose:** Validate halt_before mode stops aggregation before matching line.
+#[tokio::test]
+async fn azure_blob_multiline_halt_before() {
+    use crate::{line_agg, sources::util::MultilineConfig};
+    use std::time::Duration;
+
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.multiline = Some(MultilineConfig {
+        start_pattern: r"^START".to_string(),
+        condition_pattern: r"^START".to_string(),
+        mode: line_agg::Mode::HaltBefore,
+        timeout_ms: Duration::from_millis(1000),
+    });
+
+    let content = "START block1\nline2\nline3\nSTART block2\nline5";
+    config
+        .upload_blob("halt_before.log".to_string(), content.to_string())
+        .await;
+
+    let events =
+        run_and_assert_source_compliance(config.clone(), Duration::from_secs(3), &SOURCE_TAGS)
+            .await;
+    assert_eq!(events.len(), 2);
+
+    let first_log = events[0].as_log()["message"].to_string_lossy();
+    assert!(first_log.contains("START block1"));
+    assert!(first_log.contains("line2"));
+    assert!(first_log.contains("line3"));
+
+    let second_log = events[1].as_log()["message"].to_string_lossy();
+    assert!(second_log.contains("START block2"));
+    assert!(second_log.contains("line5"));
+}
+
+/// Test multiline aggregation with halt_with mode (include terminator).
+///
+/// **Setup:**
+/// - Configure multiline mode = "halt_with"
+/// - start_pattern: lines starting with "BEGIN"
+/// - condition_pattern: lines starting with "END"
+/// - Upload blob with transactions: "BEGIN...\\nprocessing\\nEND\\nBEGIN...\\nEND"
+///
+/// **Verification:**
+/// - Verify exactly 2 events are received
+/// - Verify each event contains complete transaction from BEGIN through END (inclusive)
+/// - Verify terminator line (END) is included in the aggregated event
+///
+/// **Purpose:** Validate halt_with mode includes the terminator line in aggregated event.
+#[tokio::test]
+async fn azure_blob_multiline_halt_with() {
+    use crate::{line_agg, sources::util::MultilineConfig};
+    use std::time::Duration;
+
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.multiline = Some(MultilineConfig {
+        start_pattern: r"^BEGIN".to_string(),
+        condition_pattern: r"^END".to_string(),
+        mode: line_agg::Mode::HaltWith,
+        timeout_ms: Duration::from_millis(1000),
+    });
+
+    let content = "BEGIN transaction1\nprocessing\nEND\nBEGIN transaction2\nmore processing\nEND";
+    config
+        .upload_blob("halt_with.log".to_string(), content.to_string())
+        .await;
+
+    let events =
+        run_and_assert_source_compliance(config.clone(), Duration::from_secs(3), &SOURCE_TAGS)
+            .await;
+    assert_eq!(events.len(), 2);
+
+    let first_log = events[0].as_log()["message"].to_string_lossy();
+    assert!(first_log.contains("BEGIN transaction1"));
+    assert!(first_log.contains("processing"));
+    assert!(first_log.contains("END"));
+
+    let second_log = events[1].as_log()["message"].to_string_lossy();
+    assert!(second_log.contains("BEGIN transaction2"));
+    assert!(second_log.contains("more processing"));
+    assert!(second_log.contains("END"));
+}
+
+/// Test complete pipeline: gzip compression + multiline aggregation + JSON decoding.
+///
+/// **Setup:**
+/// - Configure compression = "auto", JSON decoding, and multiline continue_through mode
+/// - start_pattern: lines starting with "{", condition_pattern: indented lines
+/// - Upload gzip-compressed blob with JSON lines and indented continuation
+///
+/// **Verification:**
+/// - Verify compression is detected and blob is decompressed
+/// - Verify multiline aggregation combines JSON with indented details
+/// - Verify JSON parsing happens after multiline aggregation
+/// - Verify at least one event is received
+///
+/// **Purpose:** Validate complete processing pipeline with all features enabled.
+#[tokio::test]
+async fn azure_blob_gzip_multiline_json() {
+    use crate::{line_agg, sources::util::MultilineConfig};
+    use std::time::Duration;
+    use vector_lib::codecs::decoding::{DeserializerConfig, JsonDeserializerConfig};
+
+    let mut config = AzureBlobConfig::new_emulator().await;
+    config.compression = Compression::Auto;
+    config.decoding = DeserializerConfig::Json(JsonDeserializerConfig::default());
+    config.multiline = Some(MultilineConfig {
+        start_pattern: r"^\{".to_string(),
+        condition_pattern: r"^\s".to_string(),
+        mode: line_agg::Mode::ContinueThrough,
+        timeout_ms: Duration::from_millis(1000),
+    });
+
+    let content = r#"{"level":"ERROR","message":"Failed"}
+  {"details":"Stack trace"}
+{"level":"INFO","message":"Success"}"#;
+
+    config
+        .upload_compressed_blob("multiline.json.gz".to_string(), content.to_string(), "gzip")
+        .await;
+
+    let events =
+        run_and_assert_source_compliance(config.clone(), Duration::from_secs(3), &SOURCE_TAGS)
+            .await;
+    // Note: JSON parsing happens after multiline aggregation, so we expect the aggregated lines
+    // The exact number of events depends on whether the aggregated lines form valid JSON
+    assert!(!events.is_empty());
+}
diff --git a/src/sources/azure_blob/mod.rs b/src/sources/azure_blob/mod.rs
new file mode 100644
index 0000000000000..5a59d6157007e
--- /dev/null
+++ b/src/sources/azure_blob/mod.rs
@@ -0,0 +1,451 @@
+use std::{future::Future, pin::Pin, sync::Arc};
+
+use async_stream::stream;
+use bytes::Bytes;
+use futures::{Stream, stream::StreamExt};
+use tokio::select;
+use vrl::{path, value::Kind};
+
+use derivative::Derivative;
+use vector_lib::internal_event::Registered;
+use vector_lib::{
+    codecs::{
+        NewlineDelimitedDecoderConfig,
+        decoding::{DeserializerConfig, FramingConfig, NewlineDelimitedDecoderOptions},
+    },
+    config::{LegacyKey, log_schema},
+    configurable::configurable_component,
+    internal_event::{ByteSize, BytesReceived, CountByteSize, InternalEventHandle as _, Protocol},
+    lookup::{PathPrefix, metadata_path, owned_value_path},
+    sensitive_string::SensitiveString,
+};
+
+/// Compression scheme for blobs retrieved from Azure Blob Storage.
+#[configurable_component]
+#[configurable(metadata(docs::advanced))]
+#[derive(Clone, Copy, Debug, Derivative, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+#[derivative(Default)]
+pub enum Compression {
+    /// Automatically attempt to determine the compression scheme.
+    ///
+    /// The compression scheme is determined from the blob's `Content-Type` metadata
+    /// and the blob name suffix (e.g., `.gz`, `.zst`).
+    ///
+    /// Priority order: 1) Content-Type, 2) File extension.
+    ///
+    /// Supported Content-Type values: `application/gzip`, `application/x-gzip`, `application/zstd`.
+    ///
+    /// **Note:** Unlike the AWS S3 source, the `Content-Encoding` header is NOT supported
+    /// due to an Azure SDK limitation. When blobs have `Content-Encoding` set, use the
+    /// file extension or `Content-Type` header instead, or configure explicit compression.
+    ///
+    /// It is set to `none` if the compression scheme cannot be determined.
+    #[derivative(Default)]
+    Auto,
+
+    /// Uncompressed.
+    None,
+
+    /// GZIP.
+    Gzip,
+
+    /// ZSTD.
+    Zstd,
+}
+
+/// Returns the default framing configuration for backwards compatibility.
+/// Uses newline-delimited framing to match the original hardcoded behavior.
+const fn default_framing() -> FramingConfig {
+    FramingConfig::NewlineDelimited(NewlineDelimitedDecoderConfig {
+        newline_delimited: NewlineDelimitedDecoderOptions { max_length: None },
+    })
+}
+
+use crate::{
+    SourceSender,
+    codecs::{Decoder, DecodingConfig},
+    config::{
+        LogNamespace, SourceAcknowledgementsConfig, SourceConfig, SourceContext, SourceOutput,
+    },
+    event::{BatchNotifier, BatchStatus, EstimatedJsonEncodedSizeOf, Event},
+    internal_events::{
+        EventsReceived, InvalidRowEventType, QueueMessageProcessingErrored,
+        QueueMessageProcessingRejected, QueueMessageProcessingSucceeded, StreamClosedError,
+    },
+    line_agg,
+    serde::{bool_or_struct, default_decoding},
+    shutdown::ShutdownSignal,
+    sources::{azure_blob::queue::make_blob_with_ack_stream, util::MultilineConfig},
+};
+
+#[cfg(all(test, feature = "azure-blob-integration-tests"))]
+mod integration_tests;
+pub mod queue;
+#[cfg(test)]
+mod test;
+
+/// Collects logs from Azure Blob Storage.
+///
+/// This source reads objects from Azure Blob Storage by processing events from an Azure Storage Queue.
+/// When a blob is created or modified in the configured container, an event is sent to the queue,
+/// and this source processes those events to read and decode the blob contents.
+#[configurable_component(source("azure_blob", "Collect logs from Azure Blob Storage."))]
+#[derive(Clone, Derivative)]
+#[derivative(Default, Debug)]
+#[serde(default, deny_unknown_fields)]
+pub struct AzureBlobConfig {
+    /// The namespace to use for logs. This overrides the global setting.
+    #[configurable(metadata(docs::hidden))]
+    #[serde(default)]
+    log_namespace: Option<bool>,
+
+    /// Factory function for creating blob streams with acknowledgements. Used only for tests.
+    #[configurable(metadata(docs::hidden))]
+    #[serde(skip)]
+    #[derivative(Default(value = "None"), Debug = "ignore")]
+    pub blob_stream_factory:
+        Option<Arc<dyn Fn(ShutdownSignal) -> crate::Result<BlobWithAckStream> + Send + Sync>>,
+
+    /// Configuration options for Storage Queue.
+    queue: Option<queue::Config>,
+
+    /// The Azure Blob Storage Account connection string.
+    ///
+    /// Authentication with access key is the only supported authentication method.
+    #[configurable(metadata(
+        docs::examples = "DefaultEndpointsProtocol=https;AccountName=mylogstorage;AccountKey=storageaccountkeybase64encoded;EndpointSuffix=core.windows.net"
+    ))]
+    pub connection_string: SensitiveString,
+
+    /// The Azure Blob Storage Account container name.
+    #[configurable(metadata(docs::examples = "my-logs"))]
+    pub(super) container_name: String,
+
+    #[configurable(derived)]
+    #[serde(default, deserialize_with = "bool_or_struct")]
+    pub acknowledgements: SourceAcknowledgementsConfig,
+
+    /// Compression scheme used for decompressing blobs retrieved from Azure Blob Storage.
+    #[configurable(derived)]
+    #[serde(default)]
+    pub compression: Compression,
+
+    /// Configurable framing for splitting blob contents into events.
+    #[configurable(derived)]
+    #[serde(default = "default_framing")]
+    #[derivative(Default(value = "default_framing()"))]
+    pub framing: FramingConfig,
+
+    /// Multiline aggregation configuration.
+    ///
+    /// If not specified, multiline aggregation is disabled.
+    #[configurable(derived)]
+    pub multiline: Option<MultilineConfig>,
+
+    #[configurable(derived)]
+    #[serde(default = "default_decoding")]
+    #[derivative(Default(value = "default_decoding()"))]
+    pub decoding: DeserializerConfig,
+}
+
+impl_generate_config_from_default!(AzureBlobConfig);
+
+impl AzureBlobConfig {
+    /// Self validation
+    pub fn validate(&self) -> crate::Result<()> {
+        if self.queue.is_none() || self.queue.as_ref().unwrap().queue_name.is_empty() {
+            return Err("Azure event grid queue must be set.".into());
+        }
+        if self.container_name.is_empty() {
+            return Err("Azure Container must be set.".into());
+        }
+
+        Ok(())
+    }
+}
+
+/// Determines the compression format from content type and blob name.
+/// Priority order: 1) Content-Type, 2) File extension.
+///
+/// Note: Content-Encoding header is NOT supported due to Azure SDK limitation.
+/// The SDK requires Content-Length header in responses, but Azure uses chunked
+/// transfer encoding when Content-Encoding is set, causing parsing failures.
+pub(super) fn determine_compression(
+    content_type: Option<&str>,
+    blob_name: &str,
+) -> Option<Compression> {
+    content_type
+        .and_then(content_type_to_compression)
+        .or_else(|| blob_name_to_compression(blob_name))
+}
+
+/// Converts Content-Type header value to Compression enum.
+fn content_type_to_compression(content_type: &str) -> Option<Compression> {
+    match content_type {
+        "application/gzip" | "application/x-gzip" => Some(Compression::Gzip),
+        "application/zstd" => Some(Compression::Zstd),
+        _ => None,
+    }
+}
+
+/// Determines compression from blob file extension.
+fn blob_name_to_compression(blob_name: &str) -> Option<Compression> {
+    let extension = std::path::Path::new(blob_name)
+        .extension()
+        .and_then(std::ffi::OsStr::to_str);
+
+    extension.and_then(|ext| match ext {
+        "gz" => Some(Compression::Gzip),
+        "zst" => Some(Compression::Zstd),
+        _ => None,
+    })
+}
+
+type BlobDataStream = Pin<Box<dyn Stream<Item = Bytes> + Send>>;
+
+pub struct BlobWithAck {
+    pub(super) blob_data_stream: BlobDataStream,
+    pub(super) success_handler: Box<dyn FnOnce() -> Pin<Box<dyn Future<Output = ()> + Send>> + Send>,
+    pub(super) container: String,
+    pub(super) blob_name: String,
+}
+
+type BlobWithAckStream = Pin<Box<dyn Stream<Item = BlobWithAck> + Send>>;
+
+struct AzureBlobStreamer {
+    shutdown: ShutdownSignal,
+    out: SourceSender,
+    log_namespace: LogNamespace,
+    acknowledge: bool,
+    decoder: Decoder,
+    bytes_received: Registered<BytesReceived>,
+    events_received: Registered<EventsReceived>,
+}
+
+impl AzureBlobStreamer {
+    pub fn new(
+        shutdown: ShutdownSignal,
+        out: SourceSender,
+        log_namespace: LogNamespace,
+        acknowledge: bool,
+        framing: FramingConfig,
+        decoding: DeserializerConfig,
+    ) -> crate::Result<Self> {
+        Ok(Self {
+            shutdown,
+            out,
+            log_namespace,
+            acknowledge,
+            decoder: DecodingConfig::new(framing, decoding, log_namespace).build()?,
+            bytes_received: register!(BytesReceived::from(Protocol::HTTP)),
+            events_received: register!(EventsReceived),
+        })
+    }
+
+    pub async fn run_streaming(mut self, mut blob_stream: BlobWithAckStream) -> Result<(), ()> {
+        debug!("Azure Blob source: starting blob event processing loop.");
+
+        loop {
+            select! {
+                blob = blob_stream.next() => {
+                    match blob{
+                        Some(blob) => {
+                            self.process_blob(blob).await?;
+                        }
+                        None => {
+                            break; // end of stream
+                        }
+                    }
+                },
+                _ = self.shutdown.clone() => {
+                    break;
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    async fn process_blob(&mut self, blob: BlobWithAck) -> Result<(), ()> {
+        let (batch, receiver) = BatchNotifier::maybe_new_with_receiver(self.acknowledge);
+        let mut data_stream = blob.blob_data_stream;
+        let container = blob.container;
+        let blob_name = blob.blob_name;
+        let mut output_stream = {
+            let bytes_received = self.bytes_received.clone();
+            let events_received = self.events_received.clone();
+            let log_namespace = self.log_namespace;
+            let decoder = self.decoder.clone();
+            let container = container.clone();
+            let blob = blob_name.clone();
+            stream! {
+                // TODO: consider selecting with a shutdown
+                while let Some(chunk) = data_stream.next().await {
+                    bytes_received.emit(ByteSize(chunk.len()));
+                    let (events, _) = match decoder.deserializer_parse(chunk) {
+                        Ok(result) => result,
+                        Err(_error) => {
+                            // Error is handled by codecs::Decoder, no further handling needed
+                            continue;
+                        }
+                    };
+                    for mut event in events {
+                        event = event.with_batch_notifier_option(&batch);
+                        match event {
+                            Event::Log(ref mut log_event) => {
+                                log_namespace.insert_source_metadata(
+                                    AzureBlobConfig::NAME,
+                                    log_event,
+                                    Some(LegacyKey::Overwrite(path!("container"))),
+                                    path!("container"),
+                                    container.clone(),
+                                );
+                                log_namespace.insert_source_metadata(
+                                    AzureBlobConfig::NAME,
+                                    log_event,
+                                    Some(LegacyKey::Overwrite(path!("blob"))),
+                                    path!("blob"),
+                                    blob.clone(),
+                                );
+
+                                // Insert timestamp metadata following AWS S3 pattern
+                                let timestamp = chrono::Utc::now();
+                                match log_namespace {
+                                    LogNamespace::Vector => {
+                                        let ts_path = metadata_path!(AzureBlobConfig::NAME, "timestamp");
+                                        log_event.insert(ts_path, timestamp);
+                                        let ingest_path = metadata_path!("vector", "ingest_timestamp");
+                                        log_event.insert(ingest_path, timestamp);
+                                    }
+                                    LogNamespace::Legacy => {
+                                        if let Some(timestamp_key) = log_schema().timestamp_key() {
+                                            log_event.try_insert((PathPrefix::Event, timestamp_key), timestamp);
+                                        }
+                                    }
+                                }
+
+                                events_received.emit(CountByteSize(1, event.estimated_json_encoded_size_of()));
+                                yield event
+                            }
+                            _ => {
+                                emit!(InvalidRowEventType{event: &event})
+                            }
+                        }
+                    }
+                }
+                drop(batch);
+            }.boxed()
+        };
+
+        let send_error = match self.out.send_event_stream(&mut output_stream).await {
+            Ok(_) => None,
+            Err(error) => {
+                let (count, _) = output_stream.size_hint();
+                emit!(StreamClosedError { count });
+                Some(error)
+            }
+        };
+
+        drop(output_stream);
+
+        if send_error.is_some() {
+            emit!(QueueMessageProcessingErrored {});
+            return Ok(());
+        }
+
+        match receiver {
+            None => (blob.success_handler)().await,
+            Some(receiver) => {
+                let result = receiver.await;
+                match result {
+                    BatchStatus::Delivered => {
+                        (blob.success_handler)().await;
+                        emit!(QueueMessageProcessingSucceeded {});
+                    }
+                    BatchStatus::Errored => {
+                        emit!(QueueMessageProcessingErrored {});
+                    }
+                    BatchStatus::Rejected => {
+                        emit!(QueueMessageProcessingRejected {});
+                    }
+                }
+            }
+        }
+
+        Ok(())
+    }
+}
+
+#[async_trait::async_trait]
+#[typetag::serde(name = "azure_blob")]
+impl SourceConfig for AzureBlobConfig {
+    async fn build(&self, cx: SourceContext) -> crate::Result<super::Source> {
+        self.validate()?;
+
+        let multiline_config: Option<line_agg::Config> = self
+            .multiline
+            .as_ref()
+            .map(|config| config.try_into())
+            .transpose()?;
+
+        let azure_blob_streamer = AzureBlobStreamer::new(
+            cx.shutdown.clone(),
+            cx.out.clone(),
+            cx.log_namespace(self.log_namespace),
+            cx.do_acknowledgements(self.acknowledgements),
+            self.framing.clone(),
+            self.decoding.clone(),
+        )?;
+
+        let blob_stream: BlobWithAckStream = match self.blob_stream_factory {
+            Some(ref factory) => factory(cx.shutdown.clone())?,
+            None => make_blob_with_ack_stream(
+                self,
+                cx.shutdown.clone(),
+                self.compression,
+                self.framing.clone(),
+                multiline_config,
+            )?,
+        };
+        Ok(Box::pin(azure_blob_streamer.run_streaming(blob_stream)))
+    }
+
+    fn outputs(&self, global_log_namespace: LogNamespace) -> Vec<SourceOutput> {
+        let log_namespace = global_log_namespace.merge(self.log_namespace);
+        let schema_definition = self
+            .decoding
+            .schema_definition(log_namespace)
+            .with_source_metadata(
+                Self::NAME,
+                Some(LegacyKey::Overwrite(owned_value_path!("container"))),
+                &owned_value_path!("container"),
+                Kind::bytes(),
+                None,
+            )
+            .with_source_metadata(
+                Self::NAME,
+                Some(LegacyKey::Overwrite(owned_value_path!("blob"))),
+                &owned_value_path!("blob"),
+                Kind::bytes(),
+                None,
+            )
+            .with_source_metadata(
+                Self::NAME,
+                None,
+                &owned_value_path!("timestamp"),
+                Kind::timestamp(),
+                Some("timestamp"),
+            )
+            .with_standard_vector_source_metadata();
+
+        vec![SourceOutput::new_maybe_logs(
+            self.decoding.output_type(),
+            schema_definition,
+        )]
+    }
+
+    fn can_acknowledge(&self) -> bool {
+        true
+    }
+}
diff --git a/src/sources/azure_blob/queue.rs b/src/sources/azure_blob/queue.rs
new file mode 100644
index 0000000000000..f1f8805858378
--- /dev/null
+++ b/src/sources/azure_blob/queue.rs
@@ -0,0 +1,586 @@
+use std::{pin::Pin, sync::Arc};
+
+use async_compression::tokio::bufread::{GzipDecoder, ZstdDecoder};
+use async_stream::stream;
+use azure_core::{self};
+use azure_storage_blobs::prelude::ContainerClient;
+use azure_storage_queues::{QueueClient, operations::Message};
+use base64::{Engine, prelude::BASE64_STANDARD};
+use bytes::Bytes;
+use futures::{future::ready, stream::StreamExt};
+use serde::Deserialize;
+use serde_with::serde_as;
+use snafu::Snafu;
+use tokio::{select, time};
+use tokio_util::{codec::FramedRead, io::StreamReader};
+
+use vector_lib::configurable::configurable_component;
+
+use crate::{
+    internal_events::{
+        BlobDoesntExist, QueueMessageDeleteError, QueueMessageProcessingError,
+        QueueMessageReceiveError, QueueStorageInvalidEventIgnored,
+        QueueStorageMismatchingContainerName,
+    },
+    line_agg::{self, LineAgg},
+    shutdown::ShutdownSignal,
+    sources::azure_blob::{
+        AzureBlobConfig, BlobWithAck, BlobWithAckStream, Compression, determine_compression,
+    },
+};
+
+/// Azure Queue configuration options.
+#[serde_as]
+#[configurable_component]
+#[derive(Clone, Debug, Derivative)]
+#[derivative(Default)]
+#[serde(deny_unknown_fields)]
+pub(super) struct Config {
+    /// The name of the storage queue to poll for events.
+    pub(super) queue_name: String,
+
+    /// How long to wait while polling the event grid queue for new messages, in seconds.
+    ///
+    // Stored as u32 for serde compatibility, converted to u64 Duration.
+    #[serde(default = "default_poll_secs")]
+    #[derivative(Default(value = "default_poll_secs()"))]
+    #[configurable(metadata(docs::type_unit = "seconds"))]
+    pub(super) poll_secs: u32,
+}
+
+/// Creates a stream of blobs with acknowledgements from the Azure Storage Queue.
+///
+/// This function polls the configured Azure Storage Queue for Event Grid notifications
+/// about blob creation/modification and rename events, then streams the blob contents
+/// with acknowledgement handlers that delete queue messages upon successful processing.
+///
+/// # Arguments
+/// * `cfg` - The Azure Blob source configuration
+/// * `shutdown` - Signal to gracefully shutdown the stream
+/// * `compression` - The compression scheme to use for blob decompression
+/// * `framing` - The framing configuration for splitting blob contents
+/// * `multiline_config` - Optional multiline aggregation configuration
+///
+/// # Returns
+/// A pinned boxed stream of `BlobWithAck` items
+///
+/// # Errors
+/// Returns an error if queue client creation fails or configuration is invalid
+pub fn make_blob_with_ack_stream(
+    cfg: &AzureBlobConfig,
+    shutdown: ShutdownSignal,
+    compression: Compression,
+    framing: vector_lib::codecs::decoding::FramingConfig,
+    multiline_config: Option<line_agg::Config>,
+) -> crate::Result<BlobWithAckStream> {
+    let queue_client = make_queue_client(cfg)?;
+    let container_client = make_container_client(cfg)?;
+    let poll_interval = std::time::Duration::from_secs(
+        cfg.queue
+            .as_ref()
+            .ok_or("Missing Event Grid queue config.")?
+            .poll_secs as u64,
+    );
+    let framer = framing.build();
+
+    Ok(Box::pin(stream! {
+        loop {
+            let messages = match queue_client.get_messages().number_of_messages(num_messages()).await {
+                Ok(messages) => messages,
+                Err(e) => {
+                    emit!(QueueMessageReceiveError{error: &e});
+                    continue;
+                }
+            };
+            if !messages.messages.is_empty() {
+                for message in messages.messages {
+                    let msg_id = message.message_id.clone();
+                    match process_event_grid_message(
+                        message,
+                        &container_client,
+                        &queue_client,
+                        compression,
+                        framer.clone(),
+                        multiline_config.clone(),
+                    ).await {
+                        Ok(Some(bp)) => yield bp,
+                        Ok(None) => trace!("Message {msg_id} processed, no blob stream produced (event may have been ignored or blob unavailable)."),
+                        Err(e) => {
+                            emit!(QueueMessageProcessingError{
+                                error: &e,
+                                message_id: &msg_id
+                            });
+                        }
+                    }
+                }
+            } else {
+                select! {
+                    _ = shutdown.clone() => {
+                        info!("Shutdown signal received, stopping Azure Blob queue polling.");
+                        break;
+                    },
+                    _ = time::sleep(poll_interval) => { }
+                }
+            }
+        }
+    }))
+}
+
+/// Creates an Azure Queue client from the source configuration.
+///
+/// This function initializes a queue client using the connection string from the configuration.
+/// The client is used to poll for Event Grid messages about blob events.
+///
+/// # Arguments
+/// * `cfg` - The Azure Blob source configuration containing connection string and queue name
+///
+/// # Returns
+/// An Arc-wrapped Azure QueueClient configured for the specified queue
+///
+/// # Errors
+/// Returns an error if:
+/// - The queue configuration is missing
+/// - The connection string is missing or invalid
+/// - The queue service client cannot be initialized
+pub fn make_queue_client(cfg: &AzureBlobConfig) -> crate::Result<Arc<QueueClient>> {
+    let q = cfg.queue.clone().ok_or("Missing queue.")?;
+    crate::azure::build_queue_client(cfg.connection_string.inner(), q.queue_name)
+}
+
+/// Creates an Azure Blob Storage container client from the source configuration.
+///
+/// This function initializes a container client using the connection string and container name
+/// from the configuration. The client is used to read blob contents when blob events are received.
+///
+/// # Arguments
+/// * `cfg` - The Azure Blob source configuration containing connection string and container name
+///
+/// # Returns
+/// An Arc-wrapped Azure ContainerClient configured for the specified container
+///
+/// # Errors
+/// Returns an error if:
+/// - The connection string is missing
+/// - The container client cannot be initialized
+/// - Azure authentication fails
+pub fn make_container_client(cfg: &AzureBlobConfig) -> crate::Result<Arc<ContainerClient>> {
+    crate::azure::build_client(cfg.connection_string.clone().into(), cfg.container_name.clone())
+        .map_err(|e| format!("Failed to create Azure container client: {}", e).into())
+}
+
+/// Applies decompression to an async reader based on the compression type.
+///
+/// # Arguments
+/// * `reader` - The async reader to wrap with decompression
+/// * `compression` - The compression scheme to use
+/// * `blob_name` - The name of the blob (used for auto-detection)
+/// * `content_type` - Optional Content-Type header value (used for auto-detection)
+///
+/// # Returns
+/// A boxed async reader that decompresses the input stream
+fn apply_decompression(
+    reader: Pin<Box<dyn tokio::io::AsyncRead + Send>>,
+    compression: Compression,
+    blob_name: &str,
+    content_type: Option<&str>,
+) -> Box<dyn tokio::io::AsyncRead + Send + Unpin> {
+    let r = tokio::io::BufReader::new(reader);
+
+    let compression = match compression {
+        Compression::Auto => {
+            determine_compression(content_type, blob_name).unwrap_or(Compression::None)
+        }
+        _ => compression,
+    };
+
+    use Compression::*;
+    match compression {
+        Auto => unreachable!(),
+        None => Box::new(r),
+        Gzip => {
+            let mut decoder = GzipDecoder::new(r);
+            decoder.multiple_members(true);
+            Box::new(decoder)
+        }
+        Zstd => {
+            let mut decoder = ZstdDecoder::new(r);
+            decoder.multiple_members(true);
+            Box::new(decoder)
+        }
+    }
+}
+
+/// Creates a streaming async reader for a blob with optional decompression.
+///
+/// # Arguments
+/// * `blob_client` - The Azure blob client for the blob to stream
+/// * `compression` - The compression configuration
+/// * `blob_name` - The name of the blob
+/// * `content_type` - Optional Content-Type header value
+///
+/// # Returns
+/// An async reader that streams and optionally decompresses blob contents
+///
+/// # Errors
+/// Returns an error if blob streaming fails
+async fn create_blob_stream(
+    blob_client: &azure_storage_blobs::prelude::BlobClient,
+    compression: Compression,
+    blob_name: &str,
+    content_type: Option<&str>,
+) -> Result<Box<dyn tokio::io::AsyncRead + Send + Unpin>, ProcessingError> {
+    let mut stream = blob_client.get().into_stream();
+
+    let byte_stream = stream! {
+        while let Some(response) = stream.next().await {
+            match response {
+                Ok(resp) => {
+                    let mut body = resp.data;
+                    while let Some(chunk) = body.next().await {
+                        match chunk {
+                            Ok(data) => yield Ok(data),
+                            Err(e) => yield Err(std::io::Error::other(e)),
+                        }
+                    }
+                }
+                Err(e) => yield Err(std::io::Error::other(e)),
+            }
+        }
+    };
+
+    let reader = Box::pin(StreamReader::new(byte_stream));
+    Ok(apply_decompression(reader, compression, blob_name, content_type))
+}
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(super) struct AzureStorageEvent {
+    pub subject: String,
+    pub event_type: String,
+}
+
+#[derive(Debug, Snafu)]
+pub enum ProcessingError {
+    #[snafu(display("Could not decode Queue message with id {}: {}", message_id, error))]
+    InvalidQueueMessage {
+        error: serde_json::Error,
+        message_id: String,
+    },
+
+    #[snafu(display("Failed to base64 decode message: {}", error))]
+    FailedDecodingMessageBase64 { error: base64::DecodeError },
+
+    #[snafu(display("Failed to utf8 decode message: {}", error))]
+    FailedDecodingUTF8 { error: std::string::FromUtf8Error },
+
+    #[snafu(display("Failed to get blob: {}", error))]
+    FailedToGetBlob { error: azure_core::Error },
+
+    #[snafu(display("Failed to parse {} as subject", subject))]
+    FailedToParseSubject { subject: String },
+}
+
+/// Processes an Azure Event Grid message from the storage queue.
+///
+/// Decodes the queue message, validates the blob event type (BlobCreated/BlobRenamed),
+/// creates a streaming reader for the blob content with optional decompression and framing,
+/// and returns a `BlobWithAck` with an acknowledgement handler that deletes the queue message.
+///
+/// # Returns
+/// - `Ok(Some(BlobWithAck))` - Successfully created blob stream
+/// - `Ok(None)` - Event ignored (wrong type, wrong container, or blob doesn't exist)
+/// - `Err(ProcessingError)` - Failed to process message or retrieve blob
+async fn process_event_grid_message(
+    message: Message,
+    container_client: &ContainerClient,
+    queue_client: &QueueClient,
+    compression: Compression,
+    framer: vector_lib::codecs::decoding::Framer,
+    multiline_config: Option<line_agg::Config>,
+) -> Result<Option<BlobWithAck>, ProcessingError> {
+    let msg_id = message.message_id.clone();
+    let decoded_bytes = BASE64_STANDARD
+        .decode(&message.message_text)
+        .map_err(|e| ProcessingError::FailedDecodingMessageBase64 { error: e })?;
+    let decoded_string = String::from_utf8(decoded_bytes)
+        .map_err(|e| ProcessingError::FailedDecodingUTF8 { error: e })?;
+    let body: AzureStorageEvent = serde_json::from_str(decoded_string.as_str()).map_err(|e| {
+        ProcessingError::InvalidQueueMessage {
+            error: e,
+            message_id: msg_id,
+        }
+    })?;
+    if body.event_type != "Microsoft.Storage.BlobCreated"
+        && body.event_type != "Microsoft.Storage.BlobRenamed"
+    {
+        emit!(QueueStorageInvalidEventIgnored {
+            container: container_client.container_name(),
+            subject: &body.subject,
+            event_type: &body.event_type,
+        });
+        return Ok(None);
+    }
+    let (container, blob) = parse_subject(body.subject.clone())
+        .ok_or(ProcessingError::FailedToParseSubject {
+            subject: body.subject,
+        })?;
+
+    if container != container_client.container_name() {
+        emit!(QueueStorageMismatchingContainerName {
+            configured_container: container_client.container_name(),
+            container: container.as_str(),
+        });
+
+        return Ok(None);
+    }
+    trace!(
+        "Detected blob event ({}) in container '{}': '{}'",
+        &body.event_type, &container, &blob
+    );
+    let blob_client = container_client.blob_client(&blob);
+
+    // Get blob properties to determine content type for compression auto-detection.
+    // Note: Content-Encoding header is NOT used due to Azure SDK limitation.
+    // When blobs have Content-Encoding set, the SDK fails with "header not found content-length"
+    // because Azure uses chunked transfer encoding for such responses.
+    let content_type = match blob_client.get_properties().await {
+        Ok(response) => Some(response.blob.properties.content_type.clone()),
+        Err(e) => {
+            // Handle 404 (blob doesn't exist)
+            if let Some(http_error) = e.as_http_error()
+                && http_error.status() == 404u16
+            {
+                emit!(BlobDoesntExist {
+                    nonexistent_blob_name: blob_client.blob_name(),
+                });
+                remove_message_from_queue(queue_client, message).await;
+                return Ok(None);
+            }
+            return Err(ProcessingError::FailedToGetBlob {
+                error: azure_core::Error::new(azure_core::error::ErrorKind::Other, e),
+            });
+        }
+    };
+
+    // Create streaming decompressing reader
+    let object_reader =
+        create_blob_stream(&blob_client, compression, &blob, content_type.as_deref()).await?;
+
+    // Use FramedRead with configurable framer
+    let queue_client_copy = queue_client.clone();
+
+    Ok(Some(BlobWithAck {
+        blob_data_stream: Box::pin({
+            let blob_for_error = blob.clone();
+            let lines: Box<dyn futures::Stream<Item = Bytes> + Send + Unpin> = Box::new(
+                FramedRead::new(object_reader, framer)
+                    .map(move |res| {
+                        res.inspect_err(|err| {
+                            error!("Framing error for blob '{}': {}", blob_for_error, err);
+                        })
+                        .ok()
+                    })
+                    .take_while(|res| ready(res.is_some()))
+                    .map(|r| r.expect("validated by take_while")),
+            );
+
+            // Apply multiline aggregation if configured
+            let lines: Box<dyn futures::Stream<Item = Bytes> + Send + Unpin> =
+                match multiline_config {
+                    Some(config) => Box::new(
+                        LineAgg::new(
+                            lines.map(|line| ((), line, ())),
+                            line_agg::Logic::new(config),
+                        )
+                        .map(|(_src, line, _ctx, _lastline_ctx)| line),
+                    ),
+                    None => lines,
+                };
+
+            lines
+        }),
+        success_handler: Box::new(|| {
+            Box::pin(async move {
+                remove_message_from_queue(&queue_client_copy, message).await;
+            })
+        }),
+        container,
+        blob_name: blob,
+    }))
+}
+
+/// Parses the subject field from an Azure Event Grid notification.
+///
+/// The subject field contains the blob path in the format:
+/// `/blobServices/default/containers/{container}/blobs/{blob-path}`
+///
+/// This function extracts the container name and blob path from the subject string.
+///
+/// # Arguments
+/// * `subject` - The subject string from an Azure Event Grid blob event
+///
+/// # Returns
+/// A tuple containing (container_name, blob_path) if parsing succeeds, None otherwise
+///
+/// # Examples
+/// ```
+/// let subject = "/blobServices/default/containers/logs/blobs/2024/01/file.txt";
+/// let result = parse_subject(subject.to_string());
+/// assert_eq!(result, Some(("logs".to_string(), "2024/01/file.txt".to_string())));
+/// ```
+fn parse_subject(subject: String) -> Option<(String, String)> {
+    let parts: Vec<&str> = subject.split('/').collect();
+    if parts.len() < 7 {
+        warn!(
+            "Ignoring event: subject has invalid format (expected /blobServices/default/containers/{{container}}/blobs/{{blob}}), got: '{}'",
+            subject
+        );
+        return None;
+    }
+    let container = parts[4];
+    let blob = parts[6..].join("/");
+    Some((container.to_string(), blob))
+}
+
+const fn default_poll_secs() -> u32 {
+    15
+}
+
+// Maximum allowed by the Azure API.
+const fn num_messages() -> u8 {
+    32
+}
+
+async fn remove_message_from_queue(queue_client: &QueueClient, message: Message) {
+    _ = queue_client
+        .pop_receipt_client(message)
+        .delete()
+        .await
+        .inspect_err(move |e| emit!(QueueMessageDeleteError { error: &e }))
+}
+
+#[test]
+fn test_azure_storage_event_deserialization() {
+    let event_value: AzureStorageEvent = serde_json::from_str(
+        r#"{
+          "topic": "/subscriptions/fa5f2180-1451-4461-9b1f-aae7d4b33cf8/resourceGroups/events_poc/providers/Microsoft.Storage/storageAccounts/eventspocaccount",
+          "subject": "/blobServices/default/containers/content/blobs/foo",
+          "eventType": "Microsoft.Storage.BlobCreated",
+          "id": "be3f21f7-201e-000b-7605-a29195062628",
+          "data": {
+            "api": "PutBlob",
+            "clientRequestId": "1fa42c94-6dd3-4172-95c4-fd9cf56b5009",
+            "requestId": "be3f21f7-201e-000b-7605-a29195000000",
+            "eTag": "0x8DC701C5D3FFDF6",
+            "contentType": "application/octet-stream",
+            "contentLength": 0,
+            "blobType": "BlockBlob",
+            "url": "https://eventspocaccount.blob.core.windows.net/content/foo",
+            "sequencer": "0000000000000000000000000005C5360000000000276a63",
+            "storageDiagnostics": {
+              "batchId": "fec5b12c-2006-0034-0005-a25936000000"
+            }
+          },
+          "dataVersion": "",
+          "metadataVersion": "1",
+          "eventTime": "2024-05-09T11:37:10.5637878Z"
+        }"#,
+    ).unwrap();
+
+    assert_eq!(
+        event_value.subject,
+        "/blobServices/default/containers/content/blobs/foo"
+    );
+    assert_eq!(event_value.event_type, "Microsoft.Storage.BlobCreated");
+}
+
+#[test]
+fn test_parse_subject() {
+    // (input, expected_container, expected_blob) — None means parse should fail
+    let cases: Vec<(&str, Option<(&str, &str)>)> = vec![
+        // Simple blob name
+        ("/blobServices/default/containers/content/blobs/foo", Some(("content", "foo"))),
+        // Single file in container
+        ("/blobServices/default/containers/logs/blobs/file.txt", Some(("logs", "file.txt"))),
+        // Nested path
+        ("/blobServices/default/containers/logs/blobs/path/to/file.txt", Some(("logs", "path/to/file.txt"))),
+        // Deep nested path with dates
+        ("/blobServices/default/containers/data/blobs/2024/01/15/logs/app.log", Some(("data", "2024/01/15/logs/app.log"))),
+        // Real-world Azure log path
+        (
+            "/blobServices/default/containers/insights-logs-signinlogs/blobs/tenantId=0e35ee7a-425d-45a5-9013-218c1eae8fd4/y=2024/m=06/d=20/h=05/m=00/PT1H.json",
+            Some(("insights-logs-signinlogs", "tenantId=0e35ee7a-425d-45a5-9013-218c1eae8fd4/y=2024/m=06/d=20/h=05/m=00/PT1H.json")),
+        ),
+        // Special characters (URL-encoded spaces)
+        ("/blobServices/default/containers/my-container/blobs/file%20with%20spaces.txt", Some(("my-container", "file%20with%20spaces.txt"))),
+        // Unicode
+        ("/blobServices/default/containers/données/blobs/файл.txt", Some(("données", "файл.txt"))),
+        // Path traversal preserved as-is (Azure handles security)
+        ("/blobServices/default/containers/backup/blobs/../../../etc/passwd", Some(("backup", "../../../etc/passwd"))),
+        // Invalid: too short
+        ("/blobServices/default", None),
+        // Invalid: empty
+        ("", None),
+        // Invalid: wrong format
+        ("not/a/valid/subject", None),
+    ];
+
+    for (subject, expected) in cases {
+        let result = parse_subject(subject.to_string());
+        match expected {
+            Some((container, blob)) => {
+                let (c, b) = result.unwrap_or_else(|| panic!("Expected Some for subject: {subject}"));
+                assert_eq!(c, container, "container mismatch for subject: {subject}");
+                assert_eq!(b, blob, "blob mismatch for subject: {subject}");
+            }
+            None => {
+                assert!(result.is_none(), "Expected None for subject: {subject}");
+            }
+        }
+    }
+}
+
+#[test]
+fn test_config_deny_unknown_fields() {
+    let json = r#"{"queue_name": "test", "poll_secs": 10, "unknown_field": "value"}"#;
+    let result: Result<Config, _> = serde_json::from_str(json);
+    assert!(result.is_err());
+}
+
+#[test]
+fn test_make_queue_client_invalid_connection_string() {
+    use crate::sources::azure_blob::AzureBlobConfig;
+
+    let config = AzureBlobConfig {
+        connection_string: "invalid-connection-string".to_string().into(),
+        container_name: "test".to_string(),
+        queue: Some(Config {
+            queue_name: "queue".to_string(),
+            poll_secs: 10,
+        }),
+        ..Default::default()
+    };
+
+    let result = make_queue_client(&config);
+    assert!(result.is_err());
+}
+
+#[test]
+fn test_make_container_client_with_connection_string() {
+    use crate::sources::azure_blob::AzureBlobConfig;
+
+    let config = AzureBlobConfig {
+        connection_string: "DefaultEndpointsProtocol=https;AccountName=test;AccountKey=dGVzdA==;EndpointSuffix=core.windows.net".to_string().into(),
+        container_name: "test-container".to_string(),
+        queue: Some(Config {
+            queue_name: "test-queue".to_string(),
+            poll_secs: default_poll_secs(),
+        }),
+        ..Default::default()
+    };
+
+    let result = make_container_client(&config);
+    assert!(result.is_ok());
+    let client = result.unwrap();
+    assert_eq!(client.container_name(), "test-container");
+}
diff --git a/src/sources/azure_blob/test.rs b/src/sources/azure_blob/test.rs
new file mode 100644
index 0000000000000..9d556909006ed
--- /dev/null
+++ b/src/sources/azure_blob/test.rs
@@ -0,0 +1,275 @@
+use super::*;
+use crate::{
+    SourceSender, config::LogNamespace, event::EventStatus, serde::default_decoding,
+    shutdown::ShutdownSignal, test_util::collect_n,
+};
+use std::time::Duration;
+use tokio::{select, sync::oneshot, time};
+
+#[tokio::test]
+async fn test_messages_delivered() {
+    let (tx, rx) = SourceSender::new_test_finalize(EventStatus::Delivered);
+    let streamer = super::AzureBlobStreamer::new(
+        ShutdownSignal::noop(),
+        tx,
+        LogNamespace::Vector,
+        true,
+        default_framing(),
+        default_decoding(),
+    );
+    let mut streamer = streamer.expect("Failed to create streamer");
+    let (success_sender, success_receiver) = oneshot::channel();
+    let blob = BlobWithAck {
+        blob_data_stream: Box::pin(stream! {
+            let lines = vec!["foo", "bar"];
+            for line in lines {
+                yield Bytes::from(line.as_bytes().to_vec());
+            }
+        }),
+        success_handler: Box::new(move || {
+            Box::pin(async move {
+                success_sender.send(()).unwrap();
+            })
+        }),
+        container: "test-container".to_string(),
+        blob_name: "test-blob.log".to_string(),
+    };
+    let (events_collector, events_receiver) = oneshot::channel();
+    tokio::spawn(async move {
+        events_collector.send(collect_n(rx, 2).await).unwrap();
+    });
+    streamer
+        .process_blob(blob)
+        .await
+        .expect("Failed processing blob");
+
+    let events = select! {
+        value = events_receiver => value.expect("Failed to receive events"),
+        _ = time::sleep(Duration::from_secs(5)) => panic!("Timeout waiting for events"),
+    };
+    assert_eq!(events[0].as_log().value().to_string(), "\"foo\"");
+    assert_eq!(events[1].as_log().value().to_string(), "\"bar\"");
+    select! {
+        _ = success_receiver => {}
+        _ = time::sleep(Duration::from_secs(5)) => panic!("Timeout waiting for success handler"),
+    }
+}
+
+#[tokio::test]
+async fn test_messages_rejected() {
+    let (tx, rx) = SourceSender::new_test_finalize(EventStatus::Rejected);
+    let streamer = super::AzureBlobStreamer::new(
+        ShutdownSignal::noop(),
+        tx,
+        LogNamespace::Vector,
+        true,
+        default_framing(),
+        default_decoding(),
+    );
+    let mut streamer = streamer.expect("Failed to create streamer");
+    let (success_sender, mut success_receiver) = oneshot::channel();
+    let blob = BlobWithAck {
+        blob_data_stream: Box::pin(stream! {
+            let lines = vec!["foo", "bar"];
+            for line in lines {
+                yield Bytes::from(line.as_bytes().to_vec());
+            }
+        }),
+        success_handler: Box::new(move || {
+            Box::pin(async move {
+                success_sender.send(()).unwrap();
+            })
+        }),
+        container: "test-container".to_string(),
+        blob_name: "test-blob.log".to_string(),
+    };
+    let (events_collector, events_receiver) = oneshot::channel();
+    tokio::spawn(async move {
+        events_collector.send(collect_n(rx, 2).await).unwrap();
+    });
+    streamer
+        .process_blob(blob)
+        .await
+        .expect("Failed processing blob");
+
+    let events = select! {
+        value = events_receiver => value.expect("Failed to receive events"),
+        _ = time::sleep(Duration::from_secs(5)) => panic!("Timeout waiting for events"),
+    };
+    assert_eq!(events[0].as_log().value().to_string(), "\"foo\"");
+    assert_eq!(events[1].as_log().value().to_string(), "\"bar\"");
+    assert!(success_receiver.try_recv().is_err()); // assert success handler not called
+}
+
+// Test blob with JSON decoding
+#[tokio::test]
+async fn test_json_decoding_blob() {
+    use tokio::{select, time};
+    use vector_lib::codecs::decoding::{DeserializerConfig, JsonDeserializerConfig};
+    use vrl::value;
+
+    let (tx, rx) = SourceSender::new_test_finalize(EventStatus::Delivered);
+    let streamer = super::AzureBlobStreamer::new(
+        ShutdownSignal::noop(),
+        tx,
+        LogNamespace::Vector,
+        true,
+        default_framing(),
+        DeserializerConfig::Json(JsonDeserializerConfig::default()),
+    );
+    let mut streamer = streamer.expect("Failed to create streamer");
+
+    let json_line = r#"{"level":"info","message":"test log","timestamp":"2023-01-01T00:00:00Z"}"#;
+    let blob = BlobWithAck {
+        blob_data_stream: Box::pin(stream! {
+            yield Bytes::from(json_line.as_bytes().to_vec());
+        }),
+        success_handler: Box::new(|| Box::pin(async move {})),
+        container: "test-container".to_string(),
+        blob_name: "json-blob.log".to_string(),
+    };
+
+    let (events_collector, events_receiver) = oneshot::channel();
+    tokio::spawn(async move {
+        events_collector.send(collect_n(rx, 1).await).unwrap();
+    });
+
+    streamer
+        .process_blob(blob)
+        .await
+        .expect("Failed processing blob with JSON");
+
+    let events = select! {
+        value = events_receiver => value.expect("Failed to receive events"),
+        _ = time::sleep(Duration::from_secs(5)) => panic!("Timeout waiting for events"),
+    };
+
+    assert_eq!(events.len(), 1);
+    let log = events[0].as_log();
+    assert_eq!(log["level"], value!("info"));
+    assert_eq!(log["message"], value!("test log"));
+    assert_eq!(log["timestamp"], value!("2023-01-01T00:00:00Z"));
+}
+
+// Test LogNamespace handling
+#[tokio::test]
+async fn test_log_namespace_legacy() {
+    use tokio::{select, time};
+
+    let (tx, rx) = SourceSender::new_test_finalize(EventStatus::Delivered);
+    let streamer = super::AzureBlobStreamer::new(
+        ShutdownSignal::noop(),
+        tx,
+        LogNamespace::Legacy,
+        true,
+        default_framing(),
+        default_decoding(),
+    );
+    let mut streamer = streamer.expect("Failed to create streamer");
+
+    let blob = BlobWithAck {
+        blob_data_stream: Box::pin(stream! {
+            yield Bytes::from("legacy_test".as_bytes().to_vec());
+        }),
+        success_handler: Box::new(|| Box::pin(async move {})),
+        container: "test-container".to_string(),
+        blob_name: "legacy-blob.log".to_string(),
+    };
+
+    let (events_collector, events_receiver) = oneshot::channel();
+    tokio::spawn(async move {
+        events_collector.send(collect_n(rx, 1).await).unwrap();
+    });
+
+    streamer
+        .process_blob(blob)
+        .await
+        .expect("Failed processing blob");
+
+    let events = select! {
+        value = events_receiver => value.expect("Failed to receive events"),
+        _ = time::sleep(Duration::from_secs(5)) => panic!("Timeout waiting for events"),
+    };
+
+    assert_eq!(events.len(), 1);
+    // In Legacy namespace, data should be in message field
+    assert_eq!(
+        events[0].as_log()["message"].to_string_lossy(),
+        "legacy_test"
+    );
+}
+
+// ===== Compression Helper Tests =====
+
+#[test]
+fn test_compression_detection_from_extensions() {
+    // Test various file extensions
+    assert_eq!(
+        super::determine_compression(None, "file.gz"),
+        Some(super::Compression::Gzip)
+    );
+    assert_eq!(
+        super::determine_compression(None, "file.tar.gz"),
+        Some(super::Compression::Gzip)
+    );
+    assert_eq!(
+        super::determine_compression(None, "/path/to/file.gz"),
+        Some(super::Compression::Gzip)
+    );
+    assert_eq!(
+        super::determine_compression(None, "file.zst"),
+        Some(super::Compression::Zstd)
+    );
+    assert_eq!(super::determine_compression(None, "file.txt"), None);
+    assert_eq!(super::determine_compression(None, "file"), None);
+}
+
+#[test]
+fn test_content_type_to_compression() {
+    // Test gzip variants
+    assert_eq!(
+        super::content_type_to_compression("application/gzip"),
+        Some(super::Compression::Gzip)
+    );
+    assert_eq!(
+        super::content_type_to_compression("application/x-gzip"),
+        Some(super::Compression::Gzip)
+    );
+
+    // Test zstd
+    assert_eq!(
+        super::content_type_to_compression("application/zstd"),
+        Some(super::Compression::Zstd)
+    );
+
+    // Test unknown types
+    assert_eq!(super::content_type_to_compression("text/plain"), None);
+    assert_eq!(super::content_type_to_compression("application/json"), None);
+}
+
+#[test]
+fn test_compression_detection_with_content_type() {
+    // Content-Type alone
+    assert_eq!(
+        super::determine_compression(Some("application/gzip"), "file.txt"),
+        Some(super::Compression::Gzip)
+    );
+
+    // Content-Type takes priority over file extension
+    assert_eq!(
+        super::determine_compression(Some("application/zstd"), "file.gz"),
+        Some(super::Compression::Zstd)
+    );
+
+    // Content-Type with x-gzip variant
+    assert_eq!(
+        super::determine_compression(Some("application/x-gzip"), "file.txt"),
+        Some(super::Compression::Gzip)
+    );
+
+    // Unknown content type falls back to file extension
+    assert_eq!(
+        super::determine_compression(Some("text/plain"), "file.gz"),
+        Some(super::Compression::Gzip)
+    );
+}
diff --git a/src/sources/mod.rs b/src/sources/mod.rs
index 2384b096f630b..f3ca03c1af6c1 100644
--- a/src/sources/mod.rs
+++ b/src/sources/mod.rs
@@ -13,6 +13,8 @@ pub mod aws_kinesis_firehose;
 pub mod aws_s3;
 #[cfg(feature = "sources-aws_sqs")]
 pub mod aws_sqs;
+#[cfg(feature = "sources-azure_blob")]
+pub mod azure_blob;
 #[cfg(feature = "sources-datadog_agent")]
 pub mod datadog_agent;
 #[cfg(feature = "sources-demo_logs")]
diff --git a/testing/github-13882/azure_blob_test.tf b/testing/github-13882/azure_blob_test.tf
new file mode 100644
index 0000000000000..59be867ce77c8
--- /dev/null
+++ b/testing/github-13882/azure_blob_test.tf
@@ -0,0 +1,241 @@
+terraform {
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 3.0"
+    }
+  }
+}
+
+provider "azurerm" {
+  features {}
+}
+
+# Resource group for testing
+resource "azurerm_resource_group" "vector_test" {
+  name     = "vector-azure-blob-test"
+  location = "East US"
+}
+
+# Storage account
+resource "azurerm_storage_account" "vector_test" {
+  name                     = "vectorblobtest${random_string.suffix.result}"
+  resource_group_name      = azurerm_resource_group.vector_test.name
+  location                 = azurerm_resource_group.vector_test.location
+  account_tier             = "Standard"
+  account_replication_type = "LRS"
+
+  # Enable blob versioning and change feed for better testing
+  blob_properties {
+    change_feed_enabled = true
+    versioning_enabled  = true
+  }
+}
+
+# Random suffix for unique naming
+resource "random_string" "suffix" {
+  length  = 8
+  special = false
+  upper   = false
+}
+
+# Blob container for JSON logs
+resource "azurerm_storage_container" "logs_json" {
+  name                  = "logs-json"
+  storage_account_name  = azurerm_storage_account.vector_test.name
+  container_access_type = "private"
+}
+
+# Blob container for plain text logs (no multiline)
+resource "azurerm_storage_container" "logs_plain" {
+  name                  = "logs-plain"
+  storage_account_name  = azurerm_storage_account.vector_test.name
+  container_access_type = "private"
+}
+
+# Blob container for plain text logs with multiline aggregation
+resource "azurerm_storage_container" "logs_multiline" {
+  name                  = "logs-multiline"
+  storage_account_name  = azurerm_storage_account.vector_test.name
+  container_access_type = "private"
+}
+
+# Storage queues for Event Grid messages (one per container)
+resource "azurerm_storage_queue" "queue_plain" {
+  name                 = "queue-plain"
+  storage_account_name = azurerm_storage_account.vector_test.name
+}
+
+resource "azurerm_storage_queue" "queue_json" {
+  name                 = "queue-json"
+  storage_account_name = azurerm_storage_account.vector_test.name
+}
+
+resource "azurerm_storage_queue" "queue_multiline" {
+  name                 = "queue-multiline"
+  storage_account_name = azurerm_storage_account.vector_test.name
+}
+
+# Event Grid System Topic for the storage account
+resource "azurerm_eventgrid_system_topic" "storage" {
+  name                   = "vector-blob-events"
+  resource_group_name    = azurerm_resource_group.vector_test.name
+  location               = azurerm_resource_group.vector_test.location
+  source_arm_resource_id = azurerm_storage_account.vector_test.id
+  topic_type             = "Microsoft.Storage.StorageAccounts"
+}
+
+# Event Grid subscription for JSON logs container
+resource "azurerm_eventgrid_event_subscription" "logs_json" {
+  name  = "logs-json-to-queue"
+  scope = azurerm_storage_account.vector_test.id
+
+  storage_queue_endpoint {
+    storage_account_id = azurerm_storage_account.vector_test.id
+    queue_name         = azurerm_storage_queue.queue_json.name
+  }
+
+  included_event_types = [
+    "Microsoft.Storage.BlobCreated",
+  ]
+
+  subject_filter {
+    subject_begins_with = "/blobServices/default/containers/logs-json/"
+  }
+
+  depends_on = [
+    azurerm_storage_queue.queue_json,
+    azurerm_eventgrid_system_topic.storage
+  ]
+}
+
+# Event Grid subscription for plain text logs container
+resource "azurerm_eventgrid_event_subscription" "logs_plain" {
+  name  = "logs-plain-to-queue"
+  scope = azurerm_storage_account.vector_test.id
+
+  storage_queue_endpoint {
+    storage_account_id = azurerm_storage_account.vector_test.id
+    queue_name         = azurerm_storage_queue.queue_plain.name
+  }
+
+  included_event_types = [
+    "Microsoft.Storage.BlobCreated",
+  ]
+
+  subject_filter {
+    subject_begins_with = "/blobServices/default/containers/logs-plain/"
+  }
+
+  depends_on = [
+    azurerm_storage_queue.queue_plain,
+    azurerm_eventgrid_system_topic.storage
+  ]
+}
+
+# Event Grid subscription for multiline logs container
+resource "azurerm_eventgrid_event_subscription" "logs_multiline" {
+  name  = "logs-multiline-to-queue"
+  scope = azurerm_storage_account.vector_test.id
+
+  storage_queue_endpoint {
+    storage_account_id = azurerm_storage_account.vector_test.id
+    queue_name         = azurerm_storage_queue.queue_multiline.name
+  }
+
+  included_event_types = [
+    "Microsoft.Storage.BlobCreated",
+  ]
+
+  subject_filter {
+    subject_begins_with = "/blobServices/default/containers/logs-multiline/"
+  }
+
+  depends_on = [
+    azurerm_storage_queue.queue_multiline,
+    azurerm_eventgrid_system_topic.storage
+  ]
+}
+
+# Outputs
+output "storage_account_name" {
+  value       = azurerm_storage_account.vector_test.name
+  description = "Storage account name"
+}
+
+output "connection_string" {
+  value       = azurerm_storage_account.vector_test.primary_connection_string
+  description = "Storage account connection string"
+  sensitive   = true
+}
+
+output "container_logs_json" {
+  value       = azurerm_storage_container.logs_json.name
+  description = "Blob container name for JSON logs"
+}
+
+output "container_logs_plain" {
+  value       = azurerm_storage_container.logs_plain.name
+  description = "Blob container name for plain text logs"
+}
+
+output "container_logs_multiline" {
+  value       = azurerm_storage_container.logs_multiline.name
+  description = "Blob container name for multiline logs"
+}
+
+output "queue_name_plain" {
+  value       = azurerm_storage_queue.queue_plain.name
+  description = "Storage queue name for plain logs"
+}
+
+output "queue_name_json" {
+  value       = azurerm_storage_queue.queue_json.name
+  description = "Storage queue name for JSON logs"
+}
+
+output "queue_name_multiline" {
+  value       = azurerm_storage_queue.queue_multiline.name
+  description = "Storage queue name for multiline logs"
+}
+
+output "resource_group" {
+  value       = azurerm_resource_group.vector_test.name
+  description = "Resource group name"
+}
+
+output "setup_instructions" {
+  sensitive = true
+  value = <<-EOT
+
+  Azure Blob Storage Test Environment Created!
+
+  To use with Vector:
+  1. Export the connection string:
+     export AZURE_STORAGE_CONNECTION_STRING="${azurerm_storage_account.vector_test.primary_connection_string}"
+
+  2. Run Vector with the test config:
+     cargo run -- --config testing/github-13882/config.toml
+
+  3. Upload test blobs to trigger events:
+     # JSON logs
+     echo '{"level":"info","message":"Test log"}' | az storage blob upload \
+       --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+       --container-name logs-json --name test-$(date +%s).log --data @-
+
+     # Plain text logs
+     echo -e "Plain text log 1\nPlain text log 2" | az storage blob upload \
+       --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+       --container-name logs-plain --name test-$(date +%s).log --data @-
+
+     # Multiline logs (compressed)
+     echo -e "2024-01-02 ERROR Failed\n  at line 1\n  at line 2" | gzip > /tmp/test.log.gz
+     az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+       --container-name logs-multiline --name test-$(date +%s).log.gz --file /tmp/test.log.gz
+
+  4. Check Vector output for processed events
+
+  To destroy resources:
+     terraform destroy
+  EOT
+}
diff --git a/testing/github-13882/config.toml b/testing/github-13882/config.toml
new file mode 100644
index 0000000000000..5ebec1b6b3ff1
--- /dev/null
+++ b/testing/github-13882/config.toml
@@ -0,0 +1,73 @@
+data_dir = "testing/data"
+
+# Source 1: Plain text logs
+[sources.azure_logs_plain]
+type = "azure_blob"
+connection_string = "${AZURE_STORAGE_CONNECTION_STRING}"
+container_name = "logs-plain"
+
+[sources.azure_logs_plain.queue]
+queue_name = "queue-plain"
+poll_secs = 5
+
+[sources.azure_logs_plain.framing]
+method = "newline_delimited"
+
+[sources.azure_logs_plain.decoding]
+codec = "bytes"
+
+[sources.azure_logs_plain.acknowledgements]
+enabled = true
+
+# Source 2: JSON logs
+[sources.azure_logs_json]
+type = "azure_blob"
+connection_string = "${AZURE_STORAGE_CONNECTION_STRING}"
+container_name = "logs-json"
+
+[sources.azure_logs_json.queue]
+queue_name = "queue-json"
+poll_secs = 5
+
+[sources.azure_logs_json.framing]
+method = "newline_delimited"
+
+[sources.azure_logs_json.decoding]
+codec = "json"
+
+[sources.azure_logs_json.acknowledgements]
+enabled = true
+
+# Source 3: Multiline logs
+[sources.azure_logs_multiline]
+type = "azure_blob"
+connection_string = "${AZURE_STORAGE_CONNECTION_STRING}"
+container_name = "logs-multiline"
+
+[sources.azure_logs_multiline.queue]
+queue_name = "queue-multiline"
+poll_secs = 5
+
+[sources.azure_logs_multiline.multiline]
+start_pattern = '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
+condition_pattern = '^[[:space:]]'
+mode = "continue_through"
+timeout_ms = 1000
+
+[sources.azure_logs_multiline.framing]
+method = "newline_delimited"
+
+[sources.azure_logs_multiline.decoding]
+codec = "bytes"
+
+[sources.azure_logs_multiline.acknowledgements]
+enabled = true
+
+# Sink: Console output
+[sinks.console_output]
+type = "console"
+inputs = ["azure_logs_plain", "azure_logs_json", "azure_logs_multiline"]
+target = "stdout"
+
+[sinks.console_output.encoding]
+codec = "json"
diff --git a/testing/github-13882/steps.md b/testing/github-13882/steps.md
new file mode 100644
index 0000000000000..84617846c43a3
--- /dev/null
+++ b/testing/github-13882/steps.md
@@ -0,0 +1,164 @@
+# Testing Plan - Azure Blob Storage Source (#XXXXX)
+
+## Context
+
+This PR introduces a new Vector source that reads logs from Azure Blob Storage by processing events from an Azure Storage Queue. The implementation aims at supporting the same features as the AWS S3 source, providing Event Grid integration for real-time blob processing.
+
+Key features implemented:
+- Compression auto-detection (gzip, zstd) from Content-Type headers and file extensions
+- Configurable framing (newline-delimited, character-delimited, bytes, length-delimited, octet-counting)
+- Multiline aggregation for stack traces and multi-line logs
+- Event metadata (container name, blob name, timestamp)
+- Acknowledgement support for reliable delivery
+
+**Known limitation:** Unlike the AWS S3 source, Content-Encoding header is NOT supported for compression detection due to an Azure SDK limitation.
+
+## Plan
+
+You must have an active Azure subscription. The Free Tier is enough to test the Azure Blob source.
+
+Start by deploying Azure infrastructure using Terraform, then build Vector from this PR with the azure_blob feature enabled. We'll use a configuration that connects to Azure Blob Storage via a Storage Queue that receives Event Grid notifications when blobs are created.
+
+For testing, we'll upload various types of blobs (plain text, JSON, compressed, multiline) to Azure Storage containers and verify that Vector processes them correctly. The test configuration will output events to the console where we can inspect the processed data, including metadata fields.
+
+We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which will trigger Event Grid notifications that are sent to the Storage Queue. Vector will poll the queue, retrieve blob references, download and process the blobs, then acknowledge the queue messages upon successful processing.
+
+## Test Case(s)
+
+### Prerequisites Setup
+
+- Deploy Azure infrastructure:
+  ```bash
+  cd testing/github-13882
+  terraform init
+  terraform apply
+  export AZURE_STORAGE_CONNECTION_STRING=$(terraform output -raw connection_string)
+  ```
+- Build Vector with azure_blob feature:
+  ```bash
+  cargo build --features sources-azure_blob
+  ```
+- Start Vector:
+  ```bash
+  cargo run --features sources-azure_blob -- --config testing/github-13882/config.toml
+  ```
+
+### Test Cases
+
+1. Plain text logs with newline-delimited framing:
+   - Upload plain text logs:
+     ```bash
+     echo -e "2024-01-02 INFO Application started\n2024-01-02 INFO Processing request\n2024-01-02 INFO Request completed" | \
+     az storage blob upload \
+       --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+       --container-name logs-plain \
+       --name "test-$(date +%s).log" \
+       --data @-
+     ```
+   - Vector receives Event Grid notification via queue.
+   - Blob is downloaded and processed by `azure_logs_plain` source (bytes codec, no multiline).
+   - Three events are emitted (one per line).
+   - Each event contains metadata: `container="logs-plain"`, `blob="test-*.log"`, `timestamp`.
+   - Queue message is acknowledged and deleted.
+
+2. JSON logs with JSON codec:
+   - Upload JSON-formatted logs:
+     ```bash
+     echo '{"timestamp":"2024-01-02T12:00:00Z","level":"info","message":"Test log 1"}
+     {"timestamp":"2024-01-02T12:00:01Z","level":"warn","message":"Test log 2"}
+     {"timestamp":"2024-01-02T12:00:02Z","level":"error","message":"Test log 3"}' | \
+     az storage blob upload \
+       --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+       --container-name logs-json \
+       --name "json-test-$(date +%s).log" \
+       --data @-
+     ```
+   - Vector processes blob with `azure_logs_json` source (JSON codec).
+   - Three events emitted.
+   - JSON fields (`timestamp`, `level`, `message`) are parsed into event structure.
+   - Source metadata fields are added: `container="logs-json"`.
+
+3. Gzip compression auto-detection from file extension:
+   - Upload gzip-compressed plain text blob with `.gz` extension:
+     ```bash
+     echo -e "Compressed log line 1\nCompressed log line 2\nCompressed log line 3" | gzip > /tmp/test.log.gz
+     az storage blob upload \
+       --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+       --container-name logs-plain \
+       --name "test-$(date +%s).log.gz" \
+       --file /tmp/test.log.gz
+     ```
+   - Compression auto-detected from `.gz` extension (compression=auto by default).
+   - Blob automatically decompressed during processing.
+   - Three events emitted (one per line after decompression).
+   - Processed by `azure_logs_plain` source with bytes codec.
+
+4. Zstd compression support:
+   - Upload zstd-compressed plain text blob:
+     ```bash
+     echo -e "Line 1\nLine 2\nLine 3" | zstd > /tmp/test.log.zst
+     az storage blob upload \
+       --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+       --container-name logs-plain \
+       --name "zstd-test-$(date +%s).log.zst" \
+       --file /tmp/test.log.zst
+     ```
+   - Zstd compression detected from `.zst` extension.
+   - Blob decompressed using zstd algorithm.
+   - Three events emitted (one per line).
+   - Processed by `azure_logs_plain` source.
+
+5. Multiline aggregation for stack traces:
+   - Upload logs with stack traces that should be aggregated:
+     ```bash
+     echo '2024-01-02 12:34:56 ERROR Something failed
+       at com.example.Service.process(Service.java:45)
+       at com.example.Handler.handle(Handler.java:23)
+       at com.example.Main.main(Main.java:10)
+     2024-01-02 12:34:57 INFO Recovery initiated
+     2024-01-02 12:34:58 INFO Service restarted' | gzip > /tmp/stacktrace.log.gz
+
+     az storage blob upload \
+       --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+       --container-name logs-multiline \
+       --name "stacktrace-$(date +%s).log.gz" \
+       --file /tmp/stacktrace.log.gz
+     ```
+   - Processed by `azure_logs_multiline` source (bytes codec WITH multiline config).
+   - Compression auto-detected and decompressed.
+   - Multiline configuration aggregates continuation lines (starting with whitespace).
+   - First event contains the ERROR line plus all three stack trace lines.
+   - Second event contains the INFO Recovery line.
+   - Third event contains the INFO Service restarted line.
+   - Total: 3 events (not 6).
+
+6. Graceful shutdown:
+   - Start Vector, upload a test blob, then send SIGTERM:
+     ```bash
+     # Start Vector
+     cargo run --features sources-azure_blob -- --config testing/github-13882/config.toml &
+     VECTOR_PID=$!
+
+     # Upload a small test blob
+     echo -e "Line 1\nLine 2\nLine 3" | \
+     az storage blob upload \
+       --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+       --container-name logs-plain \
+       --name "shutdown-test.log" \
+       --data @-
+
+     # Wait a moment, then stop Vector
+     sleep 5
+     kill -SIGTERM $VECTOR_PID
+     ```
+   - Vector receives SIGTERM and begins graceful shutdown.
+   - No panics or errors during shutdown.
+   - Vector exits with status code 0.
+
+### Cleanup
+
+- After testing, destroy Azure resources to avoid ongoing costs:
+  ```bash
+  cd testing/github-13882
+  terraform destroy
+  ```
diff --git a/testing/github-13882/test-results.md b/testing/github-13882/test-results.md
new file mode 100644
index 0000000000000..738393778f081
--- /dev/null
+++ b/testing/github-13882/test-results.md
@@ -0,0 +1,134 @@
+# Test Results
+
+## Test 1
+
+```
+$ echo -e "2024-01-02 INFO Application started\n2024-01-02 INFO Processing request\n2024-01-02 INFO Request completed" | \
+  az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING" --container-name logs-plain --name "test-plain-$(date +%s).log" --data @-
+{
+  "client_request_id": "500b3472-0e2c-11f1-a9aa-f919ee4ce6a6",
+  "content_md5": "vUjSc2DhODyKpVzQTaXxyA==",
+  "date": "2026-02-20T07:18:11+00:00",
+  "etag": "\"0x8DE705034EF616D\"",
+  "lastModified": "2026-02-20T07:18:12+00:00",
+  "request_server_encrypted": true,
+  "version": "2022-11-02",
+  "version_id": "2026-02-20T07:18:12.0986989Z"
+}
+
+### vector shell output
+{"blob":"test-plain-1771571890.log","container":"logs-plain","message":"2024-01-02 INFO Application started","timestamp":"2026-02-20T07:18:15.332418245Z"}
+{"blob":"test-plain-1771571890.log","container":"logs-plain","message":"2024-01-02 INFO Processing request","timestamp":"2026-02-20T07:18:15.332533331Z"}
+{"blob":"test-plain-1771571890.log","container":"logs-plain","message":"2024-01-02 INFO Request completed","timestamp":"2026-02-20T07:18:15.332590143Z"}
+```
+
+## Test 2
+
+```
+$ echo '{"timestamp":"2024-01-02T12:00:00Z","level":"info","message":"Test log 1"}
+{"timestamp":"2024-01-02T12:00:01Z","level":"warn","message":"Test log 2"}
+{"timestamp":"2024-01-02T12:00:02Z","level":"error","message":"Test log 3"}' | \
+  az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING" --container-name logs-json --name "test-json-$(date +%s).log" --data @-
+{
+  "client_request_id": "6064e6f6-0e2c-11f1-a9aa-f919ee4ce6a6",
+  "content_md5": "E48hSDWnYnkaBLECIvyixw==",
+  "date": "2026-02-20T07:18:38+00:00",
+  "etag": "\"0x8DE70504535A013\"",
+  "lastModified": "2026-02-20T07:18:39+00:00",
+  "request_server_encrypted": true,
+  "version": "2022-11-02",
+  "version_id": "2026-02-20T07:18:39.4035954Z"
+}
+
+### vector shell output
+{"blob":"test-json-1771571918.log","container":"logs-json","level":"info","message":"Test log 1","timestamp":"2024-01-02T12:00:00Z"}
+{"blob":"test-json-1771571918.log","container":"logs-json","level":"warn","message":"Test log 2","timestamp":"2024-01-02T12:00:01Z"}
+{"blob":"test-json-1771571918.log","container":"logs-json","level":"error","message":"Test log 3","timestamp":"2024-01-02T12:00:02Z"}
+```
+
+## Test 3
+
+```
+$ echo -e "Compressed log line 1\nCompressed log line 2\nCompressed log line 3" | gzip > /tmp/test.log.gz
+$ az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING" --container-name logs-plain --name "test-gzip-$(date +%s).log.gz" --file /tmp/test.log.gz
+{
+  "client_request_id": "71256b0a-0e2c-11f1-a9aa-f919ee4ce6a6",
+  "content_md5": "ikhzJ3lwvbAsYKC4nkdp2w==",
+  "date": "2026-02-20T07:19:07+00:00",
+  "etag": "\"0x8DE7050561AC6F7\"",
+  "lastModified": "2026-02-20T07:19:07+00:00",
+  "request_server_encrypted": true,
+  "version": "2022-11-02",
+  "version_id": "2026-02-20T07:19:07.7479159Z"
+}
+
+### vector shell output
+{"blob":"test-gzip-1771571946.log.gz","container":"logs-plain","message":"Compressed log line 1","timestamp":"2026-02-20T07:19:12.080371206Z"}
+{"blob":"test-gzip-1771571946.log.gz","container":"logs-plain","message":"Compressed log line 2","timestamp":"2026-02-20T07:19:12.080532446Z"}
+{"blob":"test-gzip-1771571946.log.gz","container":"logs-plain","message":"Compressed log line 3","timestamp":"2026-02-20T07:19:12.080559325Z"}
+```
+
+## Test 4
+
+```
+$ echo -e "Line 1\nLine 2\nLine 3" | zstd > /tmp/test.log.zst
+$ az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING" --container-name logs-plain --name "zstd-test-$(date +%s).log.zst" --file /tmp/test.log.zst
+{
+  "client_request_id": "80c0c0aa-0e2c-11f1-a9aa-f919ee4ce6a6",
+  "content_md5": "0VdGBlsSHBP9Egqqc10p0w==",
+  "date": "2026-02-20T07:19:33+00:00",
+  "etag": "\"0x8DE705065987CAA\"",
+  "lastModified": "2026-02-20T07:19:33+00:00",
+  "request_server_encrypted": true,
+  "version": "2022-11-02",
+  "version_id": "2026-02-20T07:19:33.7375914Z"
+}
+
+### vector shell output
+{"blob":"zstd-test-1771571972.log.zst","container":"logs-plain","message":"Line 1","timestamp":"2026-02-20T07:19:36.837732357Z"}
+{"blob":"zstd-test-1771571972.log.zst","container":"logs-plain","message":"Line 2","timestamp":"2026-02-20T07:19:36.837948459Z"}
+{"blob":"zstd-test-1771571972.log.zst","container":"logs-plain","message":"Line 3","timestamp":"2026-02-20T07:19:36.837982533Z"}
+```
+
+## Test 5
+
+```
+$ cat > /tmp/stacktrace.log << 'EOF'
+2024-01-02 12:34:56 ERROR Something failed
+  at com.example.Service.process(Service.java:45)
+  at com.example.Handler.handle(Handler.java:23)
+  at com.example.Main.main(Main.java:10)
+2024-01-02 12:34:57 INFO Recovery initiated
+2024-01-02 12:34:58 INFO Service restarted
+EOF
+$ gzip -f /tmp/stacktrace.log
+$ az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING" --container-name logs-multiline --name "stacktrace-$(date +%s).log.gz" --file /tmp/stacktrace.log.gz
+{
+  "client_request_id": "911e519c-0e2c-11f1-a9aa-f919ee4ce6a6",
+  "content_md5": "zoh4W4oW4tZ5+glb2wrYBg==",
+  "date": "2026-02-20T07:20:00+00:00",
+  "etag": "\"0x8DE705075EEFC52\"",
+  "lastModified": "2026-02-20T07:20:01+00:00",
+  "request_server_encrypted": true,
+  "version": "2022-11-02",
+  "version_id": "2026-02-20T07:20:01.1480146Z"
+}
+
+### vector shell output
+{"blob":"stacktrace-1771572000.log.gz","container":"logs-multiline","message":"2024-01-02 12:34:56 ERROR Something failed\n  at com.example.Service.process(Service.java:45)\n  at com.example.Handler.handle(Handler.java:23)\n  at com.example.Main.main(Main.java:10)","timestamp":"2026-02-20T07:20:06.163630394Z"}
+{"blob":"stacktrace-1771572000.log.gz","container":"logs-multiline","message":"2024-01-02 12:34:57 INFO Recovery initiated","timestamp":"2026-02-20T07:20:06.163860880Z"}
+{"blob":"stacktrace-1771572000.log.gz","container":"logs-multiline","message":"2024-01-02 12:34:58 INFO Service restarted","timestamp":"2026-02-20T07:20:06.163930066Z"}
+```
+
+## Test 6
+
+```
+$ kill -SIGTERM $VECTOR_PID
+
+### vector shell output
+2026-02-20T07:21:40.948529Z  INFO vector::signal: Signal received. signal="SIGTERM"
+2026-02-20T07:21:40.948800Z  INFO vector: Vector has stopped.
+2026-02-20T07:21:40.949317Z  INFO source{component_kind="source" component_id=azure_logs_multiline component_type=azure_blob}: vector::sources::azure_blob::queue: Shutdown signal received, stopping Azure Blob queue polling.
+2026-02-20T07:21:40.949499Z  INFO source{component_kind="source" component_id=azure_logs_json component_type=azure_blob}: vector::sources::azure_blob::queue: Shutdown signal received, stopping Azure Blob queue polling.
+2026-02-20T07:21:40.949814Z  INFO vector::topology::running: Shutting down... Waiting on running components. remaining_components="azure_logs_json, azure_logs_plain, console_output, azure_logs_multiline" time_remaining="59 seconds left"
+```
diff --git a/tests/integration/azure/config/compose.yaml b/tests/integration/azure/config/compose.yaml
index f7186a61cb00b..3c13c5060231e 100644
--- a/tests/integration/azure/config/compose.yaml
+++ b/tests/integration/azure/config/compose.yaml
@@ -3,7 +3,11 @@ version: "3"
 services:
   local-azure-blob:
     image: mcr.microsoft.com/azure-storage/azurite:${CONFIG_VERSION}
-    command: azurite --blobHost 0.0.0.0 --loose
+    command: azurite --blobHost 0.0.0.0 --queueHost 0.0.0.0 --loose
+    ports:
+    - "10000:10000"
+    - "10001:10001"
+    - "10002:10002"
     volumes:
       - /var/run:/var/run
 
diff --git a/tests/integration/azure/config/test.yaml b/tests/integration/azure/config/test.yaml
index 1b3a0e4cbe151..8f57aa5e04bf7 100644
--- a/tests/integration/azure/config/test.yaml
+++ b/tests/integration/azure/config/test.yaml
@@ -15,6 +15,8 @@ matrix:
 # changes to these files/paths will invoke the integration test in CI
 # expressions are evaluated using https://github.com/micromatch/picomatch
 paths:
+  - "src/sources/azure_blob/**"
   - "src/sinks/azure_**"
   - "src/sinks/util/**"
+  - "src/internal_events/azure_queue.rs"
   - "tests/integration/azure/**"
diff --git a/website/content/en/docs/reference/configuration/sources/azure_blob.md b/website/content/en/docs/reference/configuration/sources/azure_blob.md
new file mode 100644
index 0000000000000..8158ae829c4ed
--- /dev/null
+++ b/website/content/en/docs/reference/configuration/sources/azure_blob.md
@@ -0,0 +1,14 @@
+---
+title: Azure Blob Storage
+description: Collect logs from [Azure Blob Storage](https://azure.microsoft.com/en-us/services/storage/blobs/)
+component_kind: source
+layout: component
+tags: ["azure", "blob", "storage", "component", "source", "logs"]
+---
+
+{{/*
+This doc is generated using:
+
+1. The template in layouts/docs/component.html
+2. The relevant CUE data in cue/reference/components/...
+*/}}
diff --git a/website/cue/reference/components/sources/azure_blob.cue b/website/cue/reference/components/sources/azure_blob.cue
new file mode 100644
index 0000000000000..4452155546ae6
--- /dev/null
+++ b/website/cue/reference/components/sources/azure_blob.cue
@@ -0,0 +1,228 @@
+package metadata
+
+components: sources: azure_blob: {
+	title: "Azure Blob Storage"
+
+	features: {
+		auto_generated:   true
+		acknowledgements: true
+		multiline: enabled: true
+		collect: {
+			tls: {
+				enabled:                true
+				can_verify_certificate: true
+				can_verify_hostname:    true
+				enabled_default:        true
+				enabled_by_scheme:      true
+			}
+			checkpoint: enabled: false
+			proxy: enabled:      true
+			from: service:       services.azure_blob
+		}
+	}
+
+	classes: {
+		commonly_used: true
+		deployment_roles: ["aggregator", "daemon", "sidecar"]
+		delivery:      "at_least_once"
+		development:   "beta"
+		egress_method: "stream"
+		stateful:      true
+	}
+
+	support: {
+		requirements: [
+			"""
+				The Azure Blob Storage source requires an Azure Storage Queue configured to
+				receive Event Grid notifications for the desired Azure Blob Storage container.
+				The queue should be subscribed to BlobCreated events from the storage account.
+				""",
+		]
+		warnings: []
+		notices: []
+	}
+
+	installation: {
+		platform_name: null
+	}
+
+	configuration: generated.components.sources.azure_blob.configuration
+
+	output: {
+		logs: object: {
+			description: "A line from an Azure Blob Storage object."
+			fields: {
+				message: {
+					description: "A line from the blob."
+					required:    true
+					type: string: {
+						examples: ["53.126.150.246 - - [01/Oct/2020:11:25:58 -0400] \"GET /disintermediate HTTP/2.0\" 401 20308"]
+					}
+				}
+				timestamp: fields._current_timestamp & {
+					description: "The timestamp of when the event was ingested. Defaults to the current timestamp."
+				}
+				source_type: {
+					description: "The name of the source type."
+					required:    true
+					type: string: {
+						examples: ["azure_blob"]
+					}
+				}
+				ingest_timestamp: {
+					description: "The timestamp of when the blob was ingested by Vector."
+					required:    true
+					type: string: {
+						examples: ["2020-10-26T12:34:56.789Z"]
+					}
+				}
+			}
+		}
+		metrics: "": {
+			description: "Metric events that may be emitted by this source."
+		}
+		traces: "": {
+			description: "Trace events that may be emitted by this source."
+		}
+	}
+
+	how_it_works: {
+		event_grid: {
+			title: "Azure Event Grid Integration"
+			body:  """
+				This source uses Azure Event Grid to be notified of new blobs in Azure Blob Storage.
+				When a blob is created or modified in the configured container, an Event Grid notification
+				is sent to an Azure Storage Queue. Vector polls this queue for events and processes
+				the blobs referenced in those events.
+
+				This approach is more efficient than polling the storage container directly and ensures
+				that Vector processes blobs as soon as they are available.
+
+				To set up Event Grid notifications:
+
+				1. Create an Azure Storage Queue in your storage account
+				2. Create an Event Grid subscription for your storage account
+				3. Configure the subscription to filter for BlobCreated events
+				4. Set the endpoint to the Azure Storage Queue
+				5. Configure Vector with the queue name and connection string
+
+				For more information, see the [Azure Event Grid documentation](\(urls.azure_event_grid)).
+				"""
+		}
+
+		events: {
+			title: "Handling events from the `azure_blob` source"
+			body:  """
+				This source behaves very similarly to the `file` source in that
+				it will output one event per line (unless the `multiline`
+				configuration option is used).
+
+				You will commonly want to use [transforms](\(urls.vector_transforms)) to
+				parse the data. For example, to parse JSON logs from Azure Blob Storage:
+
+				```toml
+				[transforms.json_parser]
+				type = "remap"
+				inputs = ["azure_blob"]
+				source = '''
+				. = parse_json!(string!(.message))
+				'''
+				```
+
+				To parse structured logs with a specific format:
+
+				```toml
+				[transforms.parse_logs]
+				type = "remap"
+				inputs = ["azure_blob"]
+				drop_on_error = false
+				source = '''
+				parsed = parse_regex!(.message, r'^(?P<timestamp>[^ ]+) (?P<level>[^ ]+) (?P<message>.+)$')
+				.timestamp = parsed.timestamp
+				.level = parsed.level
+				.message = parsed.message
+				'''
+				```
+				"""
+		}
+
+		queue_processing: {
+			title: "Queue Message Processing"
+			body:  """
+				Vector polls the configured Azure Storage Queue for Event Grid messages about blob events.
+				When a message is received, Vector:
+
+				1. Decodes the Event Grid notification from the queue message
+				2. Extracts the blob container and path from the event
+				3. Downloads the blob contents using the Azure Storage SDK
+				4. Streams the blob line-by-line to the configured decoding pipeline
+				5. Deletes the queue message after successful processing
+
+				If acknowledgements are enabled, the queue message is only deleted after downstream
+				components have confirmed delivery. This ensures at-least-once delivery semantics.
+
+				The source automatically handles:
+				- Blob downloads with streaming to handle large files efficiently
+				- 404 errors for blobs that no longer exist
+				- Queue message visibility timeouts and retries
+				- Graceful shutdown without losing events
+				"""
+		}
+
+		authentication: {
+			title: "Authentication"
+			body:  """
+				The Azure Blob Storage source supports authentication via connection string.
+				The connection string should include the storage account name, access key, and endpoint.
+
+				Example connection string:
+
+				```text
+				DefaultEndpointsProtocol=https;AccountName=myaccount;AccountKey=mykey;EndpointSuffix=core.windows.net
+				```
+
+				For production use, store the connection string securely and reference it via environment variables:
+
+				```toml
+				[sources.azure_logs]
+				type = "azure_blob"
+				connection_string = "${AZURE_STORAGE_CONNECTION_STRING}"
+				container_name = "logs"
+
+				[sources.azure_logs.queue]
+				queue_name = "eventgrid"
+				```
+				"""
+		}
+
+		limitations: {
+			title: "Known Limitations"
+			body:  """
+				**Content-Encoding Header Not Supported**
+
+				Unlike the AWS S3 source, the Azure Blob source does NOT support automatic
+				compression detection via the `Content-Encoding` HTTP header. This is due to
+				an Azure SDK limitation where blobs with `Content-Encoding` set cause response
+				parsing failures.
+
+				**Workaround:** To use compressed blobs, either:
+				1. Use a file extension that indicates compression (e.g., `.gz`, `.zst`)
+				2. Set the `Content-Type` header to `application/gzip` or `application/zstd`
+				3. Configure explicit compression in the Vector configuration
+
+				```toml
+				[sources.azure_logs]
+				type = "azure_blob"
+				compression = "gzip"  # Explicit compression setting
+				```
+				"""
+		}
+	}
+
+	telemetry: metrics: {
+		component_errors_total:                      components.sources.internal_metrics.output.metrics.component_errors_total
+		component_received_bytes_total:              components.sources.internal_metrics.output.metrics.component_received_bytes_total
+		component_received_event_bytes_total:        components.sources.internal_metrics.output.metrics.component_received_event_bytes_total
+		component_received_events_total:             components.sources.internal_metrics.output.metrics.component_received_events_total
+	}
+}

From db662cb864c21b2115680ec30734eeb18177fd69 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Fri, 13 Mar 2026 22:47:15 +0100
Subject: [PATCH 303/326] refactor(azure_blob): replace read_error field with
 completion_handler pattern

Encapsulate the Arc<Mutex<Option<String>>> read_error flag as an implementation
detail inside queue.rs, replacing the separate success_handler + read_error
fields on BlobWithAck with a single completion_handler(StreamResult) that
handles both queue message deletion and read-error checking internally.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/sources/azure_blob/mod.rs   | 42 ++++++++++++++++++++-------------
 src/sources/azure_blob/queue.rs | 25 ++++++++++++++++----
 src/sources/azure_blob/test.rs  |  8 +++----
 3 files changed, 51 insertions(+), 24 deletions(-)

diff --git a/src/sources/azure_blob/mod.rs b/src/sources/azure_blob/mod.rs
index 5a59d6157007e..bbb2fd25512f1 100644
--- a/src/sources/azure_blob/mod.rs
+++ b/src/sources/azure_blob/mod.rs
@@ -204,9 +204,21 @@ fn blob_name_to_compression(blob_name: &str) -> Option<Compression> {
 
 type BlobDataStream = Pin<Box<dyn Stream<Item = Bytes> + Send>>;
 
+/// Outcome of blob stream consumption, passed to the completion handler.
+pub(super) enum StreamResult {
+    /// All events delivered successfully — safe to delete queue message.
+    Delivered,
+    /// Upstream reported an error — retain queue message for retry.
+    Errored,
+}
+
 pub struct BlobWithAck {
     pub(super) blob_data_stream: BlobDataStream,
-    pub(super) success_handler: Box<dyn FnOnce() -> Pin<Box<dyn Future<Output = ()> + Send>> + Send>,
+    /// Called after stream consumption to finalize queue message handling.
+    /// Encapsulates both the success action (delete queue message) and
+    /// read-error checking (retain queue message on framing errors).
+    pub(super) completion_handler:
+        Box<dyn FnOnce(StreamResult) -> Pin<Box<dyn Future<Output = ()> + Send>> + Send>,
     pub(super) container: String,
     pub(super) blob_name: String,
 }
@@ -355,22 +367,20 @@ impl AzureBlobStreamer {
         }
 
         match receiver {
-            None => (blob.success_handler)().await,
-            Some(receiver) => {
-                let result = receiver.await;
-                match result {
-                    BatchStatus::Delivered => {
-                        (blob.success_handler)().await;
-                        emit!(QueueMessageProcessingSucceeded {});
-                    }
-                    BatchStatus::Errored => {
-                        emit!(QueueMessageProcessingErrored {});
-                    }
-                    BatchStatus::Rejected => {
-                        emit!(QueueMessageProcessingRejected {});
-                    }
+            None => (blob.completion_handler)(StreamResult::Delivered).await,
+            Some(receiver) => match receiver.await {
+                BatchStatus::Delivered => {
+                    (blob.completion_handler)(StreamResult::Delivered).await;
+                    emit!(QueueMessageProcessingSucceeded {});
                 }
-            }
+                BatchStatus::Errored => {
+                    (blob.completion_handler)(StreamResult::Errored).await;
+                    emit!(QueueMessageProcessingErrored {});
+                }
+                BatchStatus::Rejected => {
+                    emit!(QueueMessageProcessingRejected {});
+                }
+            },
         }
 
         Ok(())
diff --git a/src/sources/azure_blob/queue.rs b/src/sources/azure_blob/queue.rs
index f1f8805858378..c2def603ce6a8 100644
--- a/src/sources/azure_blob/queue.rs
+++ b/src/sources/azure_blob/queue.rs
@@ -1,4 +1,4 @@
-use std::{pin::Pin, sync::Arc};
+use std::{pin::Pin, sync::Arc, sync::Mutex};
 
 use async_compression::tokio::bufread::{GzipDecoder, ZstdDecoder};
 use async_stream::stream;
@@ -25,7 +25,8 @@ use crate::{
     line_agg::{self, LineAgg},
     shutdown::ShutdownSignal,
     sources::azure_blob::{
-        AzureBlobConfig, BlobWithAck, BlobWithAckStream, Compression, determine_compression,
+        AzureBlobConfig, BlobWithAck, BlobWithAckStream, Compression, StreamResult,
+        determine_compression,
     },
 };
 
@@ -368,15 +369,21 @@ async fn process_event_grid_message(
 
     // Use FramedRead with configurable framer
     let queue_client_copy = queue_client.clone();
+    let read_error: Arc<Mutex<Option<String>>> = Arc::new(Mutex::new(None));
+    let read_error_for_handler = Arc::clone(&read_error);
+    let blob_for_warn = blob.clone();
+    let container_for_warn = container.clone();
 
     Ok(Some(BlobWithAck {
         blob_data_stream: Box::pin({
             let blob_for_error = blob.clone();
+            let read_error_flag = Arc::clone(&read_error);
             let lines: Box<dyn futures::Stream<Item = Bytes> + Send + Unpin> = Box::new(
                 FramedRead::new(object_reader, framer)
                     .map(move |res| {
-                        res.inspect_err(|err| {
+                        res.map_err(|err| {
                             error!("Framing error for blob '{}': {}", blob_for_error, err);
+                            *read_error_flag.lock().unwrap() = Some(format!("{}", err));
                         })
                         .ok()
                     })
@@ -399,8 +406,18 @@ async fn process_event_grid_message(
 
             lines
         }),
-        success_handler: Box::new(|| {
+        completion_handler: Box::new(move |result: StreamResult| {
             Box::pin(async move {
+                if !matches!(result, StreamResult::Delivered) {
+                    return;
+                }
+                if let Some(err) = read_error_for_handler.lock().unwrap().take() {
+                    warn!(
+                        "Read error for blob '{}' in container '{}': {}. Queue message retained for retry.",
+                        blob_for_warn, container_for_warn, err
+                    );
+                    return;
+                }
                 remove_message_from_queue(&queue_client_copy, message).await;
             })
         }),
diff --git a/src/sources/azure_blob/test.rs b/src/sources/azure_blob/test.rs
index 9d556909006ed..737c3f0c2fed2 100644
--- a/src/sources/azure_blob/test.rs
+++ b/src/sources/azure_blob/test.rs
@@ -26,7 +26,7 @@ async fn test_messages_delivered() {
                 yield Bytes::from(line.as_bytes().to_vec());
             }
         }),
-        success_handler: Box::new(move || {
+        completion_handler: Box::new(move |_result: StreamResult| {
             Box::pin(async move {
                 success_sender.send(()).unwrap();
             })
@@ -75,7 +75,7 @@ async fn test_messages_rejected() {
                 yield Bytes::from(line.as_bytes().to_vec());
             }
         }),
-        success_handler: Box::new(move || {
+        completion_handler: Box::new(move |_result: StreamResult| {
             Box::pin(async move {
                 success_sender.send(()).unwrap();
             })
@@ -124,7 +124,7 @@ async fn test_json_decoding_blob() {
         blob_data_stream: Box::pin(stream! {
             yield Bytes::from(json_line.as_bytes().to_vec());
         }),
-        success_handler: Box::new(|| Box::pin(async move {})),
+        completion_handler: Box::new(|_result: StreamResult| Box::pin(async move {})),
         container: "test-container".to_string(),
         blob_name: "json-blob.log".to_string(),
     };
@@ -171,7 +171,7 @@ async fn test_log_namespace_legacy() {
         blob_data_stream: Box::pin(stream! {
             yield Bytes::from("legacy_test".as_bytes().to_vec());
         }),
-        success_handler: Box::new(|| Box::pin(async move {})),
+        completion_handler: Box::new(|_result: StreamResult| Box::pin(async move {})),
         container: "test-container".to_string(),
         blob_name: "legacy-blob.log".to_string(),
     };

From 41cdcff3dab9e023fbb52df447b21f8368eda649 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Fri, 13 Mar 2026 23:23:34 +0100
Subject: [PATCH 304/326] fix(azure_blob): make azure_core_for_storage optional
 and update docs

- Make azure_core_for_storage dependency optional and gate it behind the azure feature flag
- Reword CloudLocation::Custom comment for clarity
- Add container and blob metadata fields to website docs
- Remove inaccurate docs line about queue message visibility timeouts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 Cargo.toml                                        |  4 ++--
 src/azure/mod.rs                                  |  9 ++++-----
 .../reference/components/sources/azure_blob.cue   | 15 ++++++++++++++-
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 185a2b614ac68..e7ce00dc59578 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -316,7 +316,7 @@ azure_storage_blobs = { version = "0.21", default-features = false, optional = t
 azure_storage_queues = { version = "0.21", default-features = false, optional = true }
 
 # Needed to bridge with outdated version of azure_core used in azure_storage*
-azure_core_for_storage = { package = "azure_core", version = "0.21.0", default-features = false, features = ["enable_reqwest", "hmac_openssl"] }
+azure_core_for_storage = { package = "azure_core", version = "0.21.0", default-features = false, features = ["enable_reqwest", "hmac_openssl"], optional = true }
 
 # OpenDAL
 opendal = { version = "0.54", default-features = false, features = ["services-webhdfs"], optional = true }
@@ -635,7 +635,7 @@ api-client-minimal = [
 
 top = ["vector-lib/vector-top", "vector-lib/api-client"]
 
-azure = ["dep:azure_storage", "dep:azure_storage_blobs"]
+azure = ["dep:azure_storage", "dep:azure_storage_blobs", "dep:azure_core_for_storage"]
 
 aws-core = [
   "aws-runtime",
diff --git a/src/azure/mod.rs b/src/azure/mod.rs
index 96a75dba66e40..9c77b9e6b5378 100644
--- a/src/azure/mod.rs
+++ b/src/azure/mod.rs
@@ -20,11 +20,10 @@ pub fn build_client(
             .ok_or("Account name missing in connection string")?;
 
         match connection_string.blob_endpoint {
-            // When the blob_endpoint is provided, we use the Custom CloudLocation since it is
-            // required to contain the full URI to the blob storage API endpoint, this means
-            // that account_name is not required to exist in the connection_string since
-            // account_name is only used with the default CloudLocation in the Azure SDK to
-            // generate the storage API endpoint
+            // When the blob_endpoint is provided, we use the Custom CloudLocation
+            // which takes the full URI directly instead of deriving it from the
+            // account_name. The account_name is still required for authentication
+            // and request signing.
             Some(uri) => ClientBuilder::with_location(
                 CloudLocation::Custom {
                     uri: uri.to_string(),
diff --git a/website/cue/reference/components/sources/azure_blob.cue b/website/cue/reference/components/sources/azure_blob.cue
index 4452155546ae6..08dd9c0676a37 100644
--- a/website/cue/reference/components/sources/azure_blob.cue
+++ b/website/cue/reference/components/sources/azure_blob.cue
@@ -69,6 +69,20 @@ components: sources: azure_blob: {
 						examples: ["azure_blob"]
 					}
 				}
+				container: {
+					description: "The Azure Blob Storage container the blob came from."
+					required:    true
+					type: string: {
+						examples: ["logs"]
+					}
+				}
+				blob: {
+					description: "The name of the blob the line came from."
+					required:    true
+					type: string: {
+						examples: ["2024/01/15/app.log"]
+					}
+				}
 				ingest_timestamp: {
 					description: "The timestamp of when the blob was ingested by Vector."
 					required:    true
@@ -164,7 +178,6 @@ components: sources: azure_blob: {
 				The source automatically handles:
 				- Blob downloads with streaming to handle large files efficiently
 				- 404 errors for blobs that no longer exist
-				- Queue message visibility timeouts and retries
 				- Graceful shutdown without losing events
 				"""
 		}

From 57ae5fcde2dc9eba360d4e932da02c50d632afbd Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sat, 14 Mar 2026 00:04:44 +0100
Subject: [PATCH 305/326] chore(azure_blob): simplify testing config

Remove redundant default settings from config.toml to keep it minimal.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 testing/github-13882/config.toml | 41 ++++----------------------------
 1 file changed, 4 insertions(+), 37 deletions(-)

diff --git a/testing/github-13882/config.toml b/testing/github-13882/config.toml
index 5ebec1b6b3ff1..ae386b77e1135 100644
--- a/testing/github-13882/config.toml
+++ b/testing/github-13882/config.toml
@@ -1,52 +1,28 @@
 data_dir = "testing/data"
 
-# Source 1: Plain text logs
+# Source 1: Plain text logs (defaults: newline_delimited framing, bytes codec, auto compression)
 [sources.azure_logs_plain]
 type = "azure_blob"
 connection_string = "${AZURE_STORAGE_CONNECTION_STRING}"
 container_name = "logs-plain"
-
-[sources.azure_logs_plain.queue]
-queue_name = "queue-plain"
-poll_secs = 5
-
-[sources.azure_logs_plain.framing]
-method = "newline_delimited"
-
-[sources.azure_logs_plain.decoding]
-codec = "bytes"
-
-[sources.azure_logs_plain.acknowledgements]
-enabled = true
+queue.queue_name = "queue-plain"
 
 # Source 2: JSON logs
 [sources.azure_logs_json]
 type = "azure_blob"
 connection_string = "${AZURE_STORAGE_CONNECTION_STRING}"
 container_name = "logs-json"
-
-[sources.azure_logs_json.queue]
-queue_name = "queue-json"
-poll_secs = 5
-
-[sources.azure_logs_json.framing]
-method = "newline_delimited"
+queue.queue_name = "queue-json"
 
 [sources.azure_logs_json.decoding]
 codec = "json"
 
-[sources.azure_logs_json.acknowledgements]
-enabled = true
-
 # Source 3: Multiline logs
 [sources.azure_logs_multiline]
 type = "azure_blob"
 connection_string = "${AZURE_STORAGE_CONNECTION_STRING}"
 container_name = "logs-multiline"
-
-[sources.azure_logs_multiline.queue]
-queue_name = "queue-multiline"
-poll_secs = 5
+queue.queue_name = "queue-multiline"
 
 [sources.azure_logs_multiline.multiline]
 start_pattern = '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
@@ -54,15 +30,6 @@ condition_pattern = '^[[:space:]]'
 mode = "continue_through"
 timeout_ms = 1000
 
-[sources.azure_logs_multiline.framing]
-method = "newline_delimited"
-
-[sources.azure_logs_multiline.decoding]
-codec = "bytes"
-
-[sources.azure_logs_multiline.acknowledgements]
-enabled = true
-
 # Sink: Console output
 [sinks.console_output]
 type = "console"

From 9ce6a26c6dc590ef8d654d8d511986518436b0fa Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sat, 14 Mar 2026 00:36:45 +0100
Subject: [PATCH 306/326] update tests results

---
 testing/github-13882/steps.md        |  16 +--
 testing/github-13882/test-results.md | 149 +++++++++++++++++----------
 2 files changed, 94 insertions(+), 71 deletions(-)

diff --git a/testing/github-13882/steps.md b/testing/github-13882/steps.md
index 84617846c43a3..94934a43e1f37 100644
--- a/testing/github-13882/steps.md
+++ b/testing/github-13882/steps.md
@@ -133,23 +133,9 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
    - Total: 3 events (not 6).
 
 6. Graceful shutdown:
-   - Start Vector, upload a test blob, then send SIGTERM:
      ```bash
-     # Start Vector
-     cargo run --features sources-azure_blob -- --config testing/github-13882/config.toml &
-     VECTOR_PID=$!
-
-     # Upload a small test blob
-     echo -e "Line 1\nLine 2\nLine 3" | \
-     az storage blob upload \
-       --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
-       --container-name logs-plain \
-       --name "shutdown-test.log" \
-       --data @-
-
-     # Wait a moment, then stop Vector
      sleep 5
-     kill -SIGTERM $VECTOR_PID
+     pkill -SIGTERM vector
      ```
    - Vector receives SIGTERM and begins graceful shutdown.
    - No panics or errors during shutdown.
diff --git a/testing/github-13882/test-results.md b/testing/github-13882/test-results.md
index 738393778f081..f87868890dc3d 100644
--- a/testing/github-13882/test-results.md
+++ b/testing/github-13882/test-results.md
@@ -4,22 +4,30 @@
 
 ```
 $ echo -e "2024-01-02 INFO Application started\n2024-01-02 INFO Processing request\n2024-01-02 INFO Request completed" | \
-  az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING" --container-name logs-plain --name "test-plain-$(date +%s).log" --data @-
+$ az storage blob upload \
+  --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+  --container-name logs-plain \
+  --name "test-$(date +%s).log" \
+  --data @-
+Finished[#############################################################]  100.0000%
 {
-  "client_request_id": "500b3472-0e2c-11f1-a9aa-f919ee4ce6a6",
+  "client_request_id": "c174b18e-1f33-11f1-a5bb-03c6b007573f",
   "content_md5": "vUjSc2DhODyKpVzQTaXxyA==",
-  "date": "2026-02-20T07:18:11+00:00",
-  "etag": "\"0x8DE705034EF616D\"",
-  "lastModified": "2026-02-20T07:18:12+00:00",
+  "date": "2026-03-13T23:24:18+00:00",
+  "encryption_key_sha256": null,
+  "encryption_scope": null,
+  "etag": "\"0x8DE8157A6615673\"",
+  "lastModified": "2026-03-13T23:24:18+00:00",
+  "request_id": "1cc6c2b0-e01e-0008-4340-b37321000000",
   "request_server_encrypted": true,
   "version": "2022-11-02",
-  "version_id": "2026-02-20T07:18:12.0986989Z"
+  "version_id": "2026-03-13T23:24:18.6723955Z"
 }
 
 ### vector shell output
-{"blob":"test-plain-1771571890.log","container":"logs-plain","message":"2024-01-02 INFO Application started","timestamp":"2026-02-20T07:18:15.332418245Z"}
-{"blob":"test-plain-1771571890.log","container":"logs-plain","message":"2024-01-02 INFO Processing request","timestamp":"2026-02-20T07:18:15.332533331Z"}
-{"blob":"test-plain-1771571890.log","container":"logs-plain","message":"2024-01-02 INFO Request completed","timestamp":"2026-02-20T07:18:15.332590143Z"}
+{"blob":"test-1773444257.log","container":"logs-plain","message":"2024-01-02 INFO Application started","timestamp":"2026-03-13T23:24:22.455279731Z"}
+{"blob":"test-1773444257.log","container":"logs-plain","message":"2024-01-02 INFO Processing request","timestamp":"2026-03-13T23:24:22.455511618Z"}
+{"blob":"test-1773444257.log","container":"logs-plain","message":"2024-01-02 INFO Request completed","timestamp":"2026-03-13T23:24:22.455655152Z"}
 ```
 
 ## Test 2
@@ -28,96 +36,125 @@ $ echo -e "2024-01-02 INFO Application started\n2024-01-02 INFO Processing reque
 $ echo '{"timestamp":"2024-01-02T12:00:00Z","level":"info","message":"Test log 1"}
 {"timestamp":"2024-01-02T12:00:01Z","level":"warn","message":"Test log 2"}
 {"timestamp":"2024-01-02T12:00:02Z","level":"error","message":"Test log 3"}' | \
-  az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING" --container-name logs-json --name "test-json-$(date +%s).log" --data @-
+$ az storage blob upload \
+  --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+  --container-name logs-json \
+  --name "json-test-$(date +%s).log" \
+  --data @-
+Finished[#############################################################]  100.0000%
 {
-  "client_request_id": "6064e6f6-0e2c-11f1-a9aa-f919ee4ce6a6",
+  "client_request_id": "04680b94-1f34-11f1-a5bb-03c6b007573f",
   "content_md5": "E48hSDWnYnkaBLECIvyixw==",
-  "date": "2026-02-20T07:18:38+00:00",
-  "etag": "\"0x8DE70504535A013\"",
-  "lastModified": "2026-02-20T07:18:39+00:00",
+  "date": "2026-03-13T23:26:10+00:00",
+  "encryption_key_sha256": null,
+  "encryption_scope": null,
+  "etag": "\"0x8DE8157E9443676\"",
+  "lastModified": "2026-03-13T23:26:10+00:00",
+  "request_id": "e4137489-601e-0064-6a40-b398b6000000",
   "request_server_encrypted": true,
   "version": "2022-11-02",
-  "version_id": "2026-02-20T07:18:39.4035954Z"
+  "version_id": "2026-03-13T23:26:10.8888694Z"
 }
 
 ### vector shell output
-{"blob":"test-json-1771571918.log","container":"logs-json","level":"info","message":"Test log 1","timestamp":"2024-01-02T12:00:00Z"}
-{"blob":"test-json-1771571918.log","container":"logs-json","level":"warn","message":"Test log 2","timestamp":"2024-01-02T12:00:01Z"}
-{"blob":"test-json-1771571918.log","container":"logs-json","level":"error","message":"Test log 3","timestamp":"2024-01-02T12:00:02Z"}
+{"blob":"json-test-1773444369.log","container":"logs-json","level":"info","message":"Test log 1","timestamp":"2024-01-02T12:00:00Z"}
+{"blob":"json-test-1773444369.log","container":"logs-json","level":"warn","message":"Test log 2","timestamp":"2024-01-02T12:00:01Z"}
+{"blob":"json-test-1773444369.log","container":"logs-json","level":"error","message":"Test log 3","timestamp":"2024-01-02T12:00:02Z"}
 ```
 
 ## Test 3
 
 ```
 $ echo -e "Compressed log line 1\nCompressed log line 2\nCompressed log line 3" | gzip > /tmp/test.log.gz
-$ az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING" --container-name logs-plain --name "test-gzip-$(date +%s).log.gz" --file /tmp/test.log.gz
+$ az storage blob upload \
+  --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+  --container-name logs-plain \
+  --name "test-$(date +%s).log.gz" \
+  --file /tmp/test.log.gz
+Finished[#############################################################]  100.0000%
 {
-  "client_request_id": "71256b0a-0e2c-11f1-a9aa-f919ee4ce6a6",
+  "client_request_id": "1de1edb0-1f34-11f1-a5bb-03c6b007573f",
   "content_md5": "ikhzJ3lwvbAsYKC4nkdp2w==",
-  "date": "2026-02-20T07:19:07+00:00",
-  "etag": "\"0x8DE7050561AC6F7\"",
-  "lastModified": "2026-02-20T07:19:07+00:00",
+  "date": "2026-03-13T23:26:53+00:00",
+  "encryption_key_sha256": null,
+  "encryption_scope": null,
+  "etag": "\"0x8DE815802AC1C8B\"",
+  "lastModified": "2026-03-13T23:26:53+00:00",
+  "request_id": "b48d740f-b01e-00f1-7140-b37003000000",
   "request_server_encrypted": true,
   "version": "2022-11-02",
-  "version_id": "2026-02-20T07:19:07.7479159Z"
+  "version_id": "2026-03-13T23:26:53.5138159Z"
 }
 
 ### vector shell output
-{"blob":"test-gzip-1771571946.log.gz","container":"logs-plain","message":"Compressed log line 1","timestamp":"2026-02-20T07:19:12.080371206Z"}
-{"blob":"test-gzip-1771571946.log.gz","container":"logs-plain","message":"Compressed log line 2","timestamp":"2026-02-20T07:19:12.080532446Z"}
-{"blob":"test-gzip-1771571946.log.gz","container":"logs-plain","message":"Compressed log line 3","timestamp":"2026-02-20T07:19:12.080559325Z"}
+{"blob":"test-1773444412.log.gz","container":"logs-plain","message":"Compressed log line 1","timestamp":"2026-03-13T23:27:02.811957026Z"}
+{"blob":"test-1773444412.log.gz","container":"logs-plain","message":"Compressed log line 2","timestamp":"2026-03-13T23:27:02.812155574Z"}
+{"blob":"test-1773444412.log.gz","container":"logs-plain","message":"Compressed log line 3","timestamp":"2026-03-13T23:27:02.812226432Z"}
 ```
 
 ## Test 4
 
 ```
 $ echo -e "Line 1\nLine 2\nLine 3" | zstd > /tmp/test.log.zst
-$ az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING" --container-name logs-plain --name "zstd-test-$(date +%s).log.zst" --file /tmp/test.log.zst
+$ az storage blob upload \
+  --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+  --container-name logs-plain \
+  --name "zstd-test-$(date +%s).log.zst" \
+  --file /tmp/test.log.zst
+Finished[#############################################################]  100.0000%
 {
-  "client_request_id": "80c0c0aa-0e2c-11f1-a9aa-f919ee4ce6a6",
+  "client_request_id": "6c11a228-1f34-11f1-a5bb-03c6b007573f",
   "content_md5": "0VdGBlsSHBP9Egqqc10p0w==",
-  "date": "2026-02-20T07:19:33+00:00",
-  "etag": "\"0x8DE705065987CAA\"",
-  "lastModified": "2026-02-20T07:19:33+00:00",
+  "date": "2026-03-13T23:29:03+00:00",
+  "encryption_key_sha256": null,
+  "encryption_scope": null,
+  "etag": "\"0x8DE815850DACC85\"",
+  "lastModified": "2026-03-13T23:29:04+00:00",
+  "request_id": "b7b79221-801e-0043-3041-b38f72000000",
   "request_server_encrypted": true,
   "version": "2022-11-02",
-  "version_id": "2026-02-20T07:19:33.7375914Z"
+  "version_id": "2026-03-13T23:29:04.6810757Z"
 }
 
 ### vector shell output
-{"blob":"zstd-test-1771571972.log.zst","container":"logs-plain","message":"Line 1","timestamp":"2026-02-20T07:19:36.837732357Z"}
-{"blob":"zstd-test-1771571972.log.zst","container":"logs-plain","message":"Line 2","timestamp":"2026-02-20T07:19:36.837948459Z"}
-{"blob":"zstd-test-1771571972.log.zst","container":"logs-plain","message":"Line 3","timestamp":"2026-02-20T07:19:36.837982533Z"}
+{"blob":"zstd-test-1773444543.log.zst","container":"logs-plain","message":"Line 1","timestamp":"2026-03-13T23:29:11.925046898Z"}
+{"blob":"zstd-test-1773444543.log.zst","container":"logs-plain","message":"Line 2","timestamp":"2026-03-13T23:29:11.925189686Z"}
+{"blob":"zstd-test-1773444543.log.zst","container":"logs-plain","message":"Line 3","timestamp":"2026-03-13T23:29:11.925253711Z"}
 ```
 
 ## Test 5
 
 ```
-$ cat > /tmp/stacktrace.log << 'EOF'
-2024-01-02 12:34:56 ERROR Something failed
+$ echo '2024-01-02 12:34:56 ERROR Something failed
   at com.example.Service.process(Service.java:45)
   at com.example.Handler.handle(Handler.java:23)
   at com.example.Main.main(Main.java:10)
 2024-01-02 12:34:57 INFO Recovery initiated
-2024-01-02 12:34:58 INFO Service restarted
-EOF
-$ gzip -f /tmp/stacktrace.log
-$ az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING" --container-name logs-multiline --name "stacktrace-$(date +%s).log.gz" --file /tmp/stacktrace.log.gz
+2024-01-02 12:34:58 INFO Service restarted' | gzip > /tmp/stacktrace.log.gz
+$ az storage blob upload \
+  --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
+  --container-name logs-multiline \
+  --name "stacktrace-$(date +%s).log.gz" \
+  --file /tmp/stacktrace.log.gz
+Finished[#############################################################]  100.0000%
 {
-  "client_request_id": "911e519c-0e2c-11f1-a9aa-f919ee4ce6a6",
-  "content_md5": "zoh4W4oW4tZ5+glb2wrYBg==",
-  "date": "2026-02-20T07:20:00+00:00",
-  "etag": "\"0x8DE705075EEFC52\"",
-  "lastModified": "2026-02-20T07:20:01+00:00",
+  "client_request_id": "9a231066-1f34-11f1-a5bb-03c6b007573f",
+  "content_md5": "bMhDFczVScp14efieN6mEg==",
+  "date": "2026-03-13T23:30:21+00:00",
+  "encryption_key_sha256": null,
+  "encryption_scope": null,
+  "etag": "\"0x8DE81587EDCF755\"",
+  "lastModified": "2026-03-13T23:30:21+00:00",
+  "request_id": "d4078003-701e-008c-3841-b30120000000",
   "request_server_encrypted": true,
   "version": "2022-11-02",
-  "version_id": "2026-02-20T07:20:01.1480146Z"
+  "version_id": "2026-03-13T23:30:21.8704725Z"
 }
 
 ### vector shell output
-{"blob":"stacktrace-1771572000.log.gz","container":"logs-multiline","message":"2024-01-02 12:34:56 ERROR Something failed\n  at com.example.Service.process(Service.java:45)\n  at com.example.Handler.handle(Handler.java:23)\n  at com.example.Main.main(Main.java:10)","timestamp":"2026-02-20T07:20:06.163630394Z"}
-{"blob":"stacktrace-1771572000.log.gz","container":"logs-multiline","message":"2024-01-02 12:34:57 INFO Recovery initiated","timestamp":"2026-02-20T07:20:06.163860880Z"}
-{"blob":"stacktrace-1771572000.log.gz","container":"logs-multiline","message":"2024-01-02 12:34:58 INFO Service restarted","timestamp":"2026-02-20T07:20:06.163930066Z"}
+{"blob":"stacktrace-1773444620.log.gz","container":"logs-multiline","message":"2024-01-02 12:34:56 ERROR Something failed\n  at com.example.Service.process(Service.java:45)\n  at com.example.Handler.handle(Handler.java:23)\n  at com.example.Main.main(Main.java:10)","timestamp":"2026-03-13T23:30:26.240267670Z"}
+{"blob":"stacktrace-1773444620.log.gz","container":"logs-multiline","message":"2024-01-02 12:34:57 INFO Recovery initiated","timestamp":"2026-03-13T23:30:26.240543397Z"}
+{"blob":"stacktrace-1773444620.log.gz","container":"logs-multiline","message":"2024-01-02 12:34:58 INFO Service restarted","timestamp":"2026-03-13T23:30:26.240691253Z"}
 ```
 
 ## Test 6
@@ -126,9 +163,9 @@ $ az storage blob upload --connection-string "$AZURE_STORAGE_CONNECTION_STRING"
 $ kill -SIGTERM $VECTOR_PID
 
 ### vector shell output
-2026-02-20T07:21:40.948529Z  INFO vector::signal: Signal received. signal="SIGTERM"
-2026-02-20T07:21:40.948800Z  INFO vector: Vector has stopped.
-2026-02-20T07:21:40.949317Z  INFO source{component_kind="source" component_id=azure_logs_multiline component_type=azure_blob}: vector::sources::azure_blob::queue: Shutdown signal received, stopping Azure Blob queue polling.
-2026-02-20T07:21:40.949499Z  INFO source{component_kind="source" component_id=azure_logs_json component_type=azure_blob}: vector::sources::azure_blob::queue: Shutdown signal received, stopping Azure Blob queue polling.
-2026-02-20T07:21:40.949814Z  INFO vector::topology::running: Shutting down... Waiting on running components. remaining_components="azure_logs_json, azure_logs_plain, console_output, azure_logs_multiline" time_remaining="59 seconds left"
+2026-03-13T23:34:12.000449Z  INFO vector::signal: Signal received. signal="SIGTERM"
+2026-03-13T23:34:12.000605Z  INFO vector: Vector has stopped.
+2026-03-13T23:34:12.000841Z  INFO source{component_kind="source" component_id=azure_logs_plain component_type=azure_blob}: vector::sources::azure_blob::queue: Shutdown signal received, stopping Azure Blob queue polling.
+2026-03-13T23:34:12.000898Z  INFO source{component_kind="source" component_id=azure_logs_json component_type=azure_blob}: vector::sources::azure_blob::queue: Shutdown signal received, stopping Azure Blob queue polling.
+2026-03-13T23:34:12.002216Z  INFO vector::topology::running: Shutting down... Waiting on running components. remaining_components="azure_logs_plain, azure_logs_json, azure_logs_multiline, console_output" time_remaining="59 seconds left"
 ```

From 8887b092af6a57addd3d48f39f0fc3ec6a23f6ca Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sat, 14 Mar 2026 12:01:23 +0100
Subject: [PATCH 307/326] fix(azure_blob): address PR review - shutdown
 handling, queue config, rejected batch, subject validation

- Add shutdown check between message batches to prevent indefinite processing
- Add configurable max_number_of_messages (default 10, was hardcoded 32) and
  visibility_timeout_secs (default 300s) to queue config
- Add delete_failed_message config (default true) with StreamResult::Rejected
  variant so rejected messages are properly deleted from the queue
- Validate fixed path segments in parse_subject (blobServices/containers/blobs)
- Update CUE docs to accurately describe visibility timeout and batch behavior
- Split rejected test into delete/retain variants for new config option

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/sources/azure_blob/mod.rs                 | 27 ++++++
 src/sources/azure_blob/queue.rs               | 93 +++++++++++++++----
 src/sources/azure_blob/test.rs                | 60 +++++++++++-
 .../components/sources/azure_blob.cue         | 19 +++-
 4 files changed, 179 insertions(+), 20 deletions(-)

diff --git a/src/sources/azure_blob/mod.rs b/src/sources/azure_blob/mod.rs
index bbb2fd25512f1..5a063964203ea 100644
--- a/src/sources/azure_blob/mod.rs
+++ b/src/sources/azure_blob/mod.rs
@@ -147,6 +147,19 @@ pub struct AzureBlobConfig {
     #[serde(default = "default_decoding")]
     #[derivative(Default(value = "default_decoding()"))]
     pub decoding: DeserializerConfig,
+
+    /// Whether to delete non-retryable messages from the queue.
+    ///
+    /// If a message is rejected by the sink and not retryable, setting this to `true`
+    /// will delete the message from the queue. When `false`, rejected messages are
+    /// retained in the queue and will become visible again after the visibility timeout.
+    #[serde(default = "default_true")]
+    #[derivative(Default(value = "default_true()"))]
+    pub delete_failed_message: bool,
+}
+
+const fn default_true() -> bool {
+    true
 }
 
 impl_generate_config_from_default!(AzureBlobConfig);
@@ -210,6 +223,8 @@ pub(super) enum StreamResult {
     Delivered,
     /// Upstream reported an error — retain queue message for retry.
     Errored,
+    /// Permanently rejected — delete queue message to prevent infinite reprocessing.
+    Rejected,
 }
 
 pub struct BlobWithAck {
@@ -230,6 +245,7 @@ struct AzureBlobStreamer {
     out: SourceSender,
     log_namespace: LogNamespace,
     acknowledge: bool,
+    delete_failed_message: bool,
     decoder: Decoder,
     bytes_received: Registered<BytesReceived>,
     events_received: Registered<EventsReceived>,
@@ -241,6 +257,7 @@ impl AzureBlobStreamer {
         out: SourceSender,
         log_namespace: LogNamespace,
         acknowledge: bool,
+        delete_failed_message: bool,
         framing: FramingConfig,
         decoding: DeserializerConfig,
     ) -> crate::Result<Self> {
@@ -249,6 +266,7 @@ impl AzureBlobStreamer {
             out,
             log_namespace,
             acknowledge,
+            delete_failed_message,
             decoder: DecodingConfig::new(framing, decoding, log_namespace).build()?,
             bytes_received: register!(BytesReceived::from(Protocol::HTTP)),
             events_received: register!(EventsReceived),
@@ -378,6 +396,14 @@ impl AzureBlobStreamer {
                     emit!(QueueMessageProcessingErrored {});
                 }
                 BatchStatus::Rejected => {
+                    if self.delete_failed_message {
+                        warn!(
+                            message = "Blob events rejected by sink. Deleting queue message per config.",
+                            container = %container,
+                            blob = %blob_name,
+                        );
+                        (blob.completion_handler)(StreamResult::Rejected).await;
+                    }
                     emit!(QueueMessageProcessingRejected {});
                 }
             },
@@ -404,6 +430,7 @@ impl SourceConfig for AzureBlobConfig {
             cx.out.clone(),
             cx.log_namespace(self.log_namespace),
             cx.do_acknowledgements(self.acknowledgements),
+            self.delete_failed_message,
             self.framing.clone(),
             self.decoding.clone(),
         )?;
diff --git a/src/sources/azure_blob/queue.rs b/src/sources/azure_blob/queue.rs
index c2def603ce6a8..836d6194fcc17 100644
--- a/src/sources/azure_blob/queue.rs
+++ b/src/sources/azure_blob/queue.rs
@@ -7,7 +7,7 @@ use azure_storage_blobs::prelude::ContainerClient;
 use azure_storage_queues::{QueueClient, operations::Message};
 use base64::{Engine, prelude::BASE64_STANDARD};
 use bytes::Bytes;
-use futures::{future::ready, stream::StreamExt};
+use futures::{FutureExt, future::ready, stream::StreamExt};
 use serde::Deserialize;
 use serde_with::serde_as;
 use snafu::Snafu;
@@ -47,6 +47,28 @@ pub(super) struct Config {
     #[derivative(Default(value = "default_poll_secs()"))]
     #[configurable(metadata(docs::type_unit = "seconds"))]
     pub(super) poll_secs: u32,
+
+    /// Maximum number of messages to receive from the queue in a single request.
+    ///
+    /// Azure Storage Queues allow between 1 and 32 messages per request.
+    /// Since messages are processed sequentially, a lower value reduces the risk of
+    /// visibility timeouts expiring before messages are processed.
+    #[serde(default = "default_max_number_of_messages")]
+    #[derivative(Default(value = "default_max_number_of_messages()"))]
+    pub(super) max_number_of_messages: u8,
+
+    /// Visibility timeout for received queue messages, in seconds.
+    ///
+    /// After a message is received, it becomes invisible to other consumers for this duration.
+    /// If processing takes longer than this timeout, the message may be received again by another
+    /// consumer (or the same consumer), potentially causing duplicate processing.
+    ///
+    /// Set this value higher than the expected time to process a full batch of messages.
+    /// Valid range: 1 to 604800 (7 days).
+    #[serde(default = "default_visibility_timeout_secs")]
+    #[derivative(Default(value = "default_visibility_timeout_secs()"))]
+    #[configurable(metadata(docs::type_unit = "seconds"))]
+    pub(super) visibility_timeout_secs: u32,
 }
 
 /// Creates a stream of blobs with acknowledgements from the Azure Storage Queue.
@@ -83,10 +105,19 @@ pub fn make_blob_with_ack_stream(
             .poll_secs as u64,
     );
     let framer = framing.build();
+    let queue_config = cfg.queue.as_ref().unwrap();
+    let max_messages = queue_config.max_number_of_messages;
+    let visibility_timeout =
+        std::time::Duration::from_secs(queue_config.visibility_timeout_secs as u64);
 
     Ok(Box::pin(stream! {
         loop {
-            let messages = match queue_client.get_messages().number_of_messages(num_messages()).await {
+            let messages = match queue_client
+                .get_messages()
+                .number_of_messages(max_messages)
+                .visibility_timeout(visibility_timeout)
+                .await
+            {
                 Ok(messages) => messages,
                 Err(e) => {
                     emit!(QueueMessageReceiveError{error: &e});
@@ -114,6 +145,12 @@ pub fn make_blob_with_ack_stream(
                         }
                     }
                 }
+                // Check shutdown between message batches to avoid processing indefinitely
+                // when messages keep arriving.
+                if shutdown.clone().now_or_never().is_some() {
+                    info!("Shutdown signal received, stopping Azure Blob queue polling.");
+                    break;
+                }
             } else {
                 select! {
                     _ = shutdown.clone() => {
@@ -408,17 +445,24 @@ async fn process_event_grid_message(
         }),
         completion_handler: Box::new(move |result: StreamResult| {
             Box::pin(async move {
-                if !matches!(result, StreamResult::Delivered) {
-                    return;
-                }
-                if let Some(err) = read_error_for_handler.lock().unwrap().take() {
-                    warn!(
-                        "Read error for blob '{}' in container '{}': {}. Queue message retained for retry.",
-                        blob_for_warn, container_for_warn, err
-                    );
-                    return;
+                match result {
+                    StreamResult::Delivered => {
+                        if let Some(err) = read_error_for_handler.lock().unwrap().take() {
+                            warn!(
+                                "Read error for blob '{}' in container '{}': {}. Queue message retained for retry.",
+                                blob_for_warn, container_for_warn, err
+                            );
+                            return;
+                        }
+                        remove_message_from_queue(&queue_client_copy, message).await;
+                    }
+                    StreamResult::Rejected => {
+                        remove_message_from_queue(&queue_client_copy, message).await;
+                    }
+                    StreamResult::Errored => {
+                        // Retain queue message for retry on transient errors.
+                    }
                 }
-                remove_message_from_queue(&queue_client_copy, message).await;
             })
         }),
         container,
@@ -447,7 +491,11 @@ async fn process_event_grid_message(
 /// ```
 fn parse_subject(subject: String) -> Option<(String, String)> {
     let parts: Vec<&str> = subject.split('/').collect();
-    if parts.len() < 7 {
+    if parts.len() < 7
+        || parts[1] != "blobServices"
+        || parts[3] != "containers"
+        || parts[5] != "blobs"
+    {
         warn!(
             "Ignoring event: subject has invalid format (expected /blobServices/default/containers/{{container}}/blobs/{{blob}}), got: '{}'",
             subject
@@ -463,9 +511,12 @@ const fn default_poll_secs() -> u32 {
     15
 }
 
-// Maximum allowed by the Azure API.
-const fn num_messages() -> u8 {
-    32
+const fn default_max_number_of_messages() -> u8 {
+    10
+}
+
+const fn default_visibility_timeout_secs() -> u32 {
+    300
 }
 
 async fn remove_message_from_queue(queue_client: &QueueClient, message: Message) {
@@ -540,6 +591,14 @@ fn test_parse_subject() {
         ("", None),
         // Invalid: wrong format
         ("not/a/valid/subject", None),
+        // Invalid: wrong fixed segment "blobServices"
+        ("/wrongSegment/default/containers/content/blobs/foo", None),
+        // Invalid: wrong fixed segment "containers"
+        ("/blobServices/default/wrongSegment/content/blobs/foo", None),
+        // Invalid: wrong fixed segment "blobs"
+        ("/blobServices/default/containers/content/wrongSegment/foo", None),
+        // Invalid: enough segments but all wrong
+        ("/a/b/c/d/e/f/g", None),
     ];
 
     for (subject, expected) in cases {
@@ -574,6 +633,7 @@ fn test_make_queue_client_invalid_connection_string() {
         queue: Some(Config {
             queue_name: "queue".to_string(),
             poll_secs: 10,
+            ..Default::default()
         }),
         ..Default::default()
     };
@@ -592,6 +652,7 @@ fn test_make_container_client_with_connection_string() {
         queue: Some(Config {
             queue_name: "test-queue".to_string(),
             poll_secs: default_poll_secs(),
+            ..Default::default()
         }),
         ..Default::default()
     };
diff --git a/src/sources/azure_blob/test.rs b/src/sources/azure_blob/test.rs
index 737c3f0c2fed2..d6cc3c009e0ed 100644
--- a/src/sources/azure_blob/test.rs
+++ b/src/sources/azure_blob/test.rs
@@ -14,6 +14,7 @@ async fn test_messages_delivered() {
         tx,
         LogNamespace::Vector,
         true,
+        true,
         default_framing(),
         default_decoding(),
     );
@@ -56,13 +57,65 @@ async fn test_messages_delivered() {
 }
 
 #[tokio::test]
-async fn test_messages_rejected() {
+async fn test_messages_rejected_delete_failed_message() {
+    let (tx, rx) = SourceSender::new_test_finalize(EventStatus::Rejected);
+    let streamer = super::AzureBlobStreamer::new(
+        ShutdownSignal::noop(),
+        tx,
+        LogNamespace::Vector,
+        true,
+        true, // delete_failed_message
+        default_framing(),
+        default_decoding(),
+    );
+    let mut streamer = streamer.expect("Failed to create streamer");
+    let (success_sender, success_receiver) = oneshot::channel();
+    let blob = BlobWithAck {
+        blob_data_stream: Box::pin(stream! {
+            let lines = vec!["foo", "bar"];
+            for line in lines {
+                yield Bytes::from(line.as_bytes().to_vec());
+            }
+        }),
+        completion_handler: Box::new(move |_result: StreamResult| {
+            Box::pin(async move {
+                success_sender.send(()).unwrap();
+            })
+        }),
+        container: "test-container".to_string(),
+        blob_name: "test-blob.log".to_string(),
+    };
+    let (events_collector, events_receiver) = oneshot::channel();
+    tokio::spawn(async move {
+        events_collector.send(collect_n(rx, 2).await).unwrap();
+    });
+    streamer
+        .process_blob(blob)
+        .await
+        .expect("Failed processing blob");
+
+    let events = select! {
+        value = events_receiver => value.expect("Failed to receive events"),
+        _ = time::sleep(Duration::from_secs(5)) => panic!("Timeout waiting for events"),
+    };
+    assert_eq!(events[0].as_log().value().to_string(), "\"foo\"");
+    assert_eq!(events[1].as_log().value().to_string(), "\"bar\"");
+    // With delete_failed_message=true, completion handler IS called on rejection
+    select! {
+        _ = success_receiver => {}
+        _ = time::sleep(Duration::from_secs(5)) => panic!("Timeout waiting for completion handler"),
+    }
+}
+
+#[tokio::test]
+async fn test_messages_rejected_retain_failed_message() {
     let (tx, rx) = SourceSender::new_test_finalize(EventStatus::Rejected);
     let streamer = super::AzureBlobStreamer::new(
         ShutdownSignal::noop(),
         tx,
         LogNamespace::Vector,
         true,
+        false, // delete_failed_message = false: retain on rejection
         default_framing(),
         default_decoding(),
     );
@@ -98,7 +151,8 @@ async fn test_messages_rejected() {
     };
     assert_eq!(events[0].as_log().value().to_string(), "\"foo\"");
     assert_eq!(events[1].as_log().value().to_string(), "\"bar\"");
-    assert!(success_receiver.try_recv().is_err()); // assert success handler not called
+    // With delete_failed_message=false, completion handler is NOT called on rejection
+    assert!(success_receiver.try_recv().is_err());
 }
 
 // Test blob with JSON decoding
@@ -114,6 +168,7 @@ async fn test_json_decoding_blob() {
         tx,
         LogNamespace::Vector,
         true,
+        true,
         default_framing(),
         DeserializerConfig::Json(JsonDeserializerConfig::default()),
     );
@@ -162,6 +217,7 @@ async fn test_log_namespace_legacy() {
         tx,
         LogNamespace::Legacy,
         true,
+        true,
         default_framing(),
         default_decoding(),
     );
diff --git a/website/cue/reference/components/sources/azure_blob.cue b/website/cue/reference/components/sources/azure_blob.cue
index 08dd9c0676a37..9e14f61f6d002 100644
--- a/website/cue/reference/components/sources/azure_blob.cue
+++ b/website/cue/reference/components/sources/azure_blob.cue
@@ -175,10 +175,25 @@ components: sources: azure_blob: {
 				If acknowledgements are enabled, the queue message is only deleted after downstream
 				components have confirmed delivery. This ensures at-least-once delivery semantics.
 
+				**Visibility Timeout:** When messages are received from the queue, they are made invisible
+				to other consumers for the duration of `visibility_timeout_secs` (default: 300 seconds).
+				This timeout is set once at receive time and is NOT extended during processing. If
+				processing takes longer than the visibility timeout, the message may be received again,
+				causing duplicate processing. Increase `visibility_timeout_secs` if processing large blobs.
+
+				**Batch Size:** The `max_number_of_messages` option (default: 10) controls how many messages
+				are fetched per queue request. Since messages are processed sequentially, a lower value
+				reduces the risk of visibility timeouts expiring before messages are processed.
+
+				**Failed Message Handling:** When a message is permanently rejected by a downstream sink,
+				the `delete_failed_message` option (default: true) controls whether the message is deleted
+				from the queue. When false, rejected messages are retained and will become visible again
+				after the visibility timeout expires.
+
 				The source automatically handles:
 				- Blob downloads with streaming to handle large files efficiently
-				- 404 errors for blobs that no longer exist
-				- Graceful shutdown without losing events
+				- 404 errors for blobs that no longer exist (queue message is deleted)
+				- Graceful shutdown with shutdown checks between message batches
 				"""
 		}
 

From 97e362fc4685808ebb19111c5626e17c40fe90c6 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Tue, 7 Apr 2026 07:02:49 +0200
Subject: [PATCH 308/326] fix(azure_blob): address PR review round 2 - ignored
 message deletion, log format, content-type, docs

- Delete queue messages for unsupported event types and mismatching
  container names (previously retained indefinitely, causing reprocessing
  loops). Consistent with S3 source behavior of treating ignored events
  as successfully processed.
- Fix QueueMessageReceiveError: use error = %self.error (Display) and
  message "Failed to fetch Azure Queue events." to match S3/SQS pattern.
  Remove unused Debug bound from impl.
- Strip MIME parameters in content_type_to_compression so e.g.
  "application/gzip; charset=utf-8" is correctly detected. Add tests.
- Remove TODO comment for mid-stream shutdown (shutdown is checked
  between messages; mid-stream cancellation is a future improvement).
- Update CUE docs: requirements now mentions BlobRenamed support;
  queue_processing section documents emitted metrics and the new
  ignored-message deletion behavior.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/internal_events/azure_queue.rs                 |  6 +++---
 src/sources/azure_blob/mod.rs                      |  5 +++--
 src/sources/azure_blob/queue.rs                    |  3 ++-
 src/sources/azure_blob/test.rs                     | 14 ++++++++++++++
 .../reference/components/sources/azure_blob.cue    | 10 +++++++++-
 5 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/src/internal_events/azure_queue.rs b/src/internal_events/azure_queue.rs
index 219d581fc62b3..1c16a2dbcf375 100644
--- a/src/internal_events/azure_queue.rs
+++ b/src/internal_events/azure_queue.rs
@@ -68,11 +68,11 @@ pub struct QueueMessageReceiveError<'a, E> {
 }
 
 #[cfg(feature = "sources-azure_blob")]
-impl<'a, E: std::fmt::Display + std::fmt::Debug> InternalEvent for QueueMessageReceiveError<'a, E> {
+impl<'a, E: std::fmt::Display> InternalEvent for QueueMessageReceiveError<'a, E> {
     fn emit(self) {
         error!(
-            message = "Failed reading messages",
-            event = format!("{:?}", self.error),
+            message = "Failed to fetch Azure Queue events.",
+            error = %self.error,
             error_code = "failed_fetching_azure_queue_events",
             error_type = error_type::REQUEST_FAILED,
             stage = error_stage::RECEIVING,
diff --git a/src/sources/azure_blob/mod.rs b/src/sources/azure_blob/mod.rs
index 5a063964203ea..4405549da4ce9 100644
--- a/src/sources/azure_blob/mod.rs
+++ b/src/sources/azure_blob/mod.rs
@@ -194,8 +194,10 @@ pub(super) fn determine_compression(
 }
 
 /// Converts Content-Type header value to Compression enum.
+/// Strips MIME parameters (e.g. `application/gzip; charset=utf-8` → `application/gzip`).
 fn content_type_to_compression(content_type: &str) -> Option<Compression> {
-    match content_type {
+    let base_type = content_type.split(';').next().unwrap_or(content_type).trim();
+    match base_type {
         "application/gzip" | "application/x-gzip" => Some(Compression::Gzip),
         "application/zstd" => Some(Compression::Zstd),
         _ => None,
@@ -310,7 +312,6 @@ impl AzureBlobStreamer {
             let container = container.clone();
             let blob = blob_name.clone();
             stream! {
-                // TODO: consider selecting with a shutdown
                 while let Some(chunk) = data_stream.next().await {
                     bytes_received.emit(ByteSize(chunk.len()));
                     let (events, _) = match decoder.deserializer_parse(chunk) {
diff --git a/src/sources/azure_blob/queue.rs b/src/sources/azure_blob/queue.rs
index 836d6194fcc17..ecdd878fc4f8a 100644
--- a/src/sources/azure_blob/queue.rs
+++ b/src/sources/azure_blob/queue.rs
@@ -356,6 +356,7 @@ async fn process_event_grid_message(
             subject: &body.subject,
             event_type: &body.event_type,
         });
+        remove_message_from_queue(queue_client, message).await;
         return Ok(None);
     }
     let (container, blob) = parse_subject(body.subject.clone())
@@ -368,7 +369,7 @@ async fn process_event_grid_message(
             configured_container: container_client.container_name(),
             container: container.as_str(),
         });
-
+        remove_message_from_queue(queue_client, message).await;
         return Ok(None);
     }
     trace!(
diff --git a/src/sources/azure_blob/test.rs b/src/sources/azure_blob/test.rs
index d6cc3c009e0ed..a86e3f468329b 100644
--- a/src/sources/azure_blob/test.rs
+++ b/src/sources/azure_blob/test.rs
@@ -301,6 +301,20 @@ fn test_content_type_to_compression() {
     // Test unknown types
     assert_eq!(super::content_type_to_compression("text/plain"), None);
     assert_eq!(super::content_type_to_compression("application/json"), None);
+
+    // Test MIME parameters are stripped
+    assert_eq!(
+        super::content_type_to_compression("application/gzip; charset=utf-8"),
+        Some(super::Compression::Gzip)
+    );
+    assert_eq!(
+        super::content_type_to_compression("application/x-gzip; boundary=something"),
+        Some(super::Compression::Gzip)
+    );
+    assert_eq!(
+        super::content_type_to_compression("application/zstd; q=0.9"),
+        Some(super::Compression::Zstd)
+    );
 }
 
 #[test]
diff --git a/website/cue/reference/components/sources/azure_blob.cue b/website/cue/reference/components/sources/azure_blob.cue
index 9e14f61f6d002..fc27258163b66 100644
--- a/website/cue/reference/components/sources/azure_blob.cue
+++ b/website/cue/reference/components/sources/azure_blob.cue
@@ -35,7 +35,7 @@ components: sources: azure_blob: {
 			"""
 				The Azure Blob Storage source requires an Azure Storage Queue configured to
 				receive Event Grid notifications for the desired Azure Blob Storage container.
-				The queue should be subscribed to BlobCreated events from the storage account.
+				The queue should be subscribed to BlobCreated and BlobRenamed events from the storage account.
 				""",
 		]
 		warnings: []
@@ -193,7 +193,15 @@ components: sources: azure_blob: {
 				The source automatically handles:
 				- Blob downloads with streaming to handle large files efficiently
 				- 404 errors for blobs that no longer exist (queue message is deleted)
+				- Unsupported event types and messages for other containers (queue message is deleted)
 				- Graceful shutdown with shutdown checks between message batches
+
+				**Emitted Metrics:**
+				- `azure_queue_message_processing_succeeded_total` — messages processed successfully
+				- `azure_queue_message_processing_errored_total` — messages with transient delivery errors
+				- `azure_queue_message_processing_rejected_total` — messages permanently rejected
+				- `azure_queue_event_ignored_total` (tagged by `ignore_type`) — events skipped due to
+				  unsupported event type, mismatching container, or blob not found
 				"""
 		}
 

From 72e0d0859da5bfe4e1d490ee01c3ce6462bf10d3 Mon Sep 17 00:00:00 2001
From: ldrozdz93 <39065752+ldrozdz93@users.noreply.github.com>
Date: Tue, 7 Apr 2026 07:27:56 +0200
Subject: [PATCH 309/326] Update testing/github-13882/steps.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 testing/github-13882/steps.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/testing/github-13882/steps.md b/testing/github-13882/steps.md
index 94934a43e1f37..7312ee2f40661 100644
--- a/testing/github-13882/steps.md
+++ b/testing/github-13882/steps.md
@@ -1,4 +1,4 @@
-# Testing Plan - Azure Blob Storage Source (#XXXXX)
+# Testing Plan - Azure Blob Storage Source (#13882)
 
 ## Context
 

From a0dc118f818a9b74c3a0f5dab466857419da7801 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sat, 11 Apr 2026 14:39:45 +0200
Subject: [PATCH 310/326] test(azure_blob): add integration tests for ignored
 message deletion and fix Config defaults

- Add azure_blob_ignore_unsupported_event_type test: verifies BlobDeleted
  events are ignored and their queue messages deleted (not stuck)
- Add azure_blob_ignore_mismatching_container test: verifies messages for
  wrong containers are deleted from queue
- Add queue_notify_custom_event helper for sending arbitrary event types
- Fix Config struct initializers to use ..Default::default() for new
  max_number_of_messages and visibility_timeout_secs fields

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/sources/azure_blob/integration_tests.rs | 118 ++++++++++++++++++++
 1 file changed, 118 insertions(+)

diff --git a/src/sources/azure_blob/integration_tests.rs b/src/sources/azure_blob/integration_tests.rs
index 9f2179f1d7d6c..ad09646ff487b 100644
--- a/src/sources/azure_blob/integration_tests.rs
+++ b/src/sources/azure_blob/integration_tests.rs
@@ -25,6 +25,7 @@ impl AzureBlobConfig {
                 queue: Some(Config {
                     queue_name: format!("test-{}", rand::random::<u32>()),
                     poll_secs: 1,
+                    ..Default::default()
                 }),
                 decoding: default_decoding(),
                 ..Default::default()
@@ -197,6 +198,39 @@ impl AzureBlobConfig {
             .await
             .expect("Failed putting message");
     }
+    async fn queue_notify_custom_event(&self, name: &str, event_type: &str) {
+        let queue_client = make_queue_client(self).expect("Failed to create queue client");
+        let message = format!(
+            r#"{{
+          "topic": "/subscriptions/fa5f2180-1451-4461-9b1f-aae7d4b33cf8/resourceGroups/events_poc/providers/Microsoft.Storage/storageAccounts/eventspocaccount",
+          "subject": "/blobServices/default/containers/logs/blobs/{}",
+          "eventType": "{}",
+          "id": "be3f21f7-201e-000b-7605-a29195062630",
+          "data": {{
+            "api": "PutBlob",
+            "clientRequestId": "1fa42c94-6dd3-4172-95c4-fd9cf56b5009",
+            "requestId": "be3f21f7-201e-000b-7605-a29195000000",
+            "eTag": "0x8DC701C5D3FFDF6",
+            "contentType": "application/octet-stream",
+            "contentLength": 0,
+            "blobType": "BlockBlob",
+            "url": "https://eventspocaccount.blob.core.windows.net/logs/{}",
+            "sequencer": "0000000000000000000000000005C5360000000000276a63",
+            "storageDiagnostics": {{
+              "batchId": "fec5b12c-2006-0034-0005-a25936000000"
+            }}
+          }},
+          "dataVersion": "",
+          "metadataVersion": "1",
+          "eventTime": "2024-05-09T11:37:10.5637878Z"
+        }}"#,
+            name, event_type, name
+        );
+        queue_client
+            .put_message(BASE64_STANDARD.encode(message))
+            .await
+            .expect("Failed putting message");
+    }
 }
 
 /// Test basic functionality: reading a single line from a blob.
@@ -332,6 +366,7 @@ async fn azure_blob_emit_error_on_message_read() {
     config.queue = Some(Config {
         queue_name: "nonexistent".to_string(),
         poll_secs: 1,
+        ..Default::default()
     });
 
     let events = config.run_error().await;
@@ -908,6 +943,89 @@ async fn azure_blob_multiline_halt_with() {
     assert!(second_log.contains("END"));
 }
 
+/// Test that unsupported event types are ignored and their queue messages deleted.
+///
+/// **Setup:**
+/// - Send an Event Grid notification with unsupported event type "Microsoft.Storage.BlobDeleted"
+/// - Upload a valid blob and send a BlobCreated notification
+///
+/// **Verification:**
+/// - Verify only the valid blob's event is received (1 event)
+/// - Verify the unsupported event message is deleted from the queue (not stuck for reprocessing)
+///
+/// **Purpose:** Validate that unsupported event types don't cause infinite reprocessing loops.
+#[tokio::test]
+async fn azure_blob_ignore_unsupported_event_type() {
+    let config = AzureBlobConfig::new_emulator().await;
+
+    config
+        .queue_notify_custom_event("some-blob.txt", "Microsoft.Storage.BlobDeleted")
+        .await;
+    config
+        .upload_blob("valid.txt".to_string(), "valid content".to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 1);
+    assert_eq!(events[0].as_log()["message"], "valid content".into());
+}
+
+/// Test that messages for mismatching containers are ignored and deleted from the queue.
+///
+/// **Setup:**
+/// - Send an Event Grid notification referencing a different container than configured
+/// - Upload a valid blob and send a BlobCreated notification for the correct container
+///
+/// **Verification:**
+/// - Verify only the valid blob's event is received (1 event)
+/// - Verify the mismatching container message is deleted (not stuck for reprocessing)
+///
+/// **Purpose:** Validate that messages for other containers don't cause infinite reprocessing loops.
+#[tokio::test]
+async fn azure_blob_ignore_mismatching_container() {
+    let config = AzureBlobConfig::new_emulator().await;
+
+    // Send a BlobCreated event referencing a different container
+    let queue_client = make_queue_client(&config).expect("Failed to create queue client");
+    let message = format!(
+        r#"{{
+      "topic": "/subscriptions/fa5f2180-1451-4461-9b1f-aae7d4b33cf8/resourceGroups/events_poc/providers/Microsoft.Storage/storageAccounts/eventspocaccount",
+      "subject": "/blobServices/default/containers/other-container/blobs/some-blob.txt",
+      "eventType": "Microsoft.Storage.BlobCreated",
+      "id": "be3f21f7-201e-000b-7605-a29195062631",
+      "data": {{
+        "api": "PutBlob",
+        "clientRequestId": "1fa42c94-6dd3-4172-95c4-fd9cf56b5009",
+        "requestId": "be3f21f7-201e-000b-7605-a29195000000",
+        "eTag": "0x8DC701C5D3FFDF6",
+        "contentType": "application/octet-stream",
+        "contentLength": 0,
+        "blobType": "BlockBlob",
+        "url": "https://eventspocaccount.blob.core.windows.net/other-container/some-blob.txt",
+        "sequencer": "0000000000000000000000000005C5360000000000276a63",
+        "storageDiagnostics": {{
+          "batchId": "fec5b12c-2006-0034-0005-a25936000000"
+        }}
+      }},
+      "dataVersion": "",
+      "metadataVersion": "1",
+      "eventTime": "2024-05-09T11:37:10.5637878Z"
+    }}"#
+    );
+    queue_client
+        .put_message(BASE64_STANDARD.encode(message))
+        .await
+        .expect("Failed putting message");
+
+    config
+        .upload_blob("valid.txt".to_string(), "valid content".to_string())
+        .await;
+
+    let events = config.run_assert().await;
+    assert_eq!(events.len(), 1);
+    assert_eq!(events[0].as_log()["message"], "valid content".into());
+}
+
 /// Test complete pipeline: gzip compression + multiline aggregation + JSON decoding.
 ///
 /// **Setup:**

From c6a07140e9d47c33aa06e2393c333d74286c2c8f Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sat, 11 Apr 2026 14:53:35 +0200
Subject: [PATCH 311/326] chore(azure_blob): fix CI - formatting, changelog
 markdown, license file

- Run cargo fmt to fix formatting in queue.rs and mod.rs
- Fix markdown lint in changelog (blank line before list)
- Update LICENSE-3rdparty.csv to match current dependencies

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 ...13882_azure_blob_storage_source.feature.md |  1 +
 src/sources/azure_blob/mod.rs                 |  6 +-
 src/sources/azure_blob/queue.rs               | 66 ++++++++++++++-----
 3 files changed, 57 insertions(+), 16 deletions(-)

diff --git a/changelog.d/13882_azure_blob_storage_source.feature.md b/changelog.d/13882_azure_blob_storage_source.feature.md
index 7a9ff7b5b9549..101e3faa71aa8 100644
--- a/changelog.d/13882_azure_blob_storage_source.feature.md
+++ b/changelog.d/13882_azure_blob_storage_source.feature.md
@@ -3,6 +3,7 @@ New `azure_blob` source for reading logs from Azure Blob Storage
 A new `azure_blob` source has been added that allows Vector to read logs from Azure Blob Storage containers. The source processes events from Azure Storage Queues to detect when new blobs are created or modified, then reads and decodes the blob contents. The design followed an intended feature parity with AWS S3 source.
 
 Key features:
+
 - Supports connection string authentication
 - Automatically processes Azure Event Grid notifications via Storage Queue
 - Configurable compression support (gzip, zstd) with auto-detection from file extension (Content-Encoding detection NOT supported)
diff --git a/src/sources/azure_blob/mod.rs b/src/sources/azure_blob/mod.rs
index 4405549da4ce9..b28ca05e3b49a 100644
--- a/src/sources/azure_blob/mod.rs
+++ b/src/sources/azure_blob/mod.rs
@@ -196,7 +196,11 @@ pub(super) fn determine_compression(
 /// Converts Content-Type header value to Compression enum.
 /// Strips MIME parameters (e.g. `application/gzip; charset=utf-8` → `application/gzip`).
 fn content_type_to_compression(content_type: &str) -> Option<Compression> {
-    let base_type = content_type.split(';').next().unwrap_or(content_type).trim();
+    let base_type = content_type
+        .split(';')
+        .next()
+        .unwrap_or(content_type)
+        .trim();
     match base_type {
         "application/gzip" | "application/x-gzip" => Some(Compression::Gzip),
         "application/zstd" => Some(Compression::Zstd),
diff --git a/src/sources/azure_blob/queue.rs b/src/sources/azure_blob/queue.rs
index ecdd878fc4f8a..de5d38efe56bb 100644
--- a/src/sources/azure_blob/queue.rs
+++ b/src/sources/azure_blob/queue.rs
@@ -202,8 +202,11 @@ pub fn make_queue_client(cfg: &AzureBlobConfig) -> crate::Result<Arc<QueueClient
 /// - The container client cannot be initialized
 /// - Azure authentication fails
 pub fn make_container_client(cfg: &AzureBlobConfig) -> crate::Result<Arc<ContainerClient>> {
-    crate::azure::build_client(cfg.connection_string.clone().into(), cfg.container_name.clone())
-        .map_err(|e| format!("Failed to create Azure container client: {}", e).into())
+    crate::azure::build_client(
+        cfg.connection_string.clone().into(),
+        cfg.container_name.clone(),
+    )
+    .map_err(|e| format!("Failed to create Azure container client: {}", e).into())
 }
 
 /// Applies decompression to an async reader based on the compression type.
@@ -287,7 +290,12 @@ async fn create_blob_stream(
     };
 
     let reader = Box::pin(StreamReader::new(byte_stream));
-    Ok(apply_decompression(reader, compression, blob_name, content_type))
+    Ok(apply_decompression(
+        reader,
+        compression,
+        blob_name,
+        content_type,
+    ))
 }
 
 #[derive(Clone, Debug, Deserialize)]
@@ -359,8 +367,8 @@ async fn process_event_grid_message(
         remove_message_from_queue(queue_client, message).await;
         return Ok(None);
     }
-    let (container, blob) = parse_subject(body.subject.clone())
-        .ok_or(ProcessingError::FailedToParseSubject {
+    let (container, blob) =
+        parse_subject(body.subject.clone()).ok_or(ProcessingError::FailedToParseSubject {
             subject: body.subject,
         })?;
 
@@ -568,24 +576,48 @@ fn test_parse_subject() {
     // (input, expected_container, expected_blob) — None means parse should fail
     let cases: Vec<(&str, Option<(&str, &str)>)> = vec![
         // Simple blob name
-        ("/blobServices/default/containers/content/blobs/foo", Some(("content", "foo"))),
+        (
+            "/blobServices/default/containers/content/blobs/foo",
+            Some(("content", "foo")),
+        ),
         // Single file in container
-        ("/blobServices/default/containers/logs/blobs/file.txt", Some(("logs", "file.txt"))),
+        (
+            "/blobServices/default/containers/logs/blobs/file.txt",
+            Some(("logs", "file.txt")),
+        ),
         // Nested path
-        ("/blobServices/default/containers/logs/blobs/path/to/file.txt", Some(("logs", "path/to/file.txt"))),
+        (
+            "/blobServices/default/containers/logs/blobs/path/to/file.txt",
+            Some(("logs", "path/to/file.txt")),
+        ),
         // Deep nested path with dates
-        ("/blobServices/default/containers/data/blobs/2024/01/15/logs/app.log", Some(("data", "2024/01/15/logs/app.log"))),
+        (
+            "/blobServices/default/containers/data/blobs/2024/01/15/logs/app.log",
+            Some(("data", "2024/01/15/logs/app.log")),
+        ),
         // Real-world Azure log path
         (
             "/blobServices/default/containers/insights-logs-signinlogs/blobs/tenantId=0e35ee7a-425d-45a5-9013-218c1eae8fd4/y=2024/m=06/d=20/h=05/m=00/PT1H.json",
-            Some(("insights-logs-signinlogs", "tenantId=0e35ee7a-425d-45a5-9013-218c1eae8fd4/y=2024/m=06/d=20/h=05/m=00/PT1H.json")),
+            Some((
+                "insights-logs-signinlogs",
+                "tenantId=0e35ee7a-425d-45a5-9013-218c1eae8fd4/y=2024/m=06/d=20/h=05/m=00/PT1H.json",
+            )),
         ),
         // Special characters (URL-encoded spaces)
-        ("/blobServices/default/containers/my-container/blobs/file%20with%20spaces.txt", Some(("my-container", "file%20with%20spaces.txt"))),
+        (
+            "/blobServices/default/containers/my-container/blobs/file%20with%20spaces.txt",
+            Some(("my-container", "file%20with%20spaces.txt")),
+        ),
         // Unicode
-        ("/blobServices/default/containers/données/blobs/файл.txt", Some(("données", "файл.txt"))),
+        (
+            "/blobServices/default/containers/données/blobs/файл.txt",
+            Some(("données", "файл.txt")),
+        ),
         // Path traversal preserved as-is (Azure handles security)
-        ("/blobServices/default/containers/backup/blobs/../../../etc/passwd", Some(("backup", "../../../etc/passwd"))),
+        (
+            "/blobServices/default/containers/backup/blobs/../../../etc/passwd",
+            Some(("backup", "../../../etc/passwd")),
+        ),
         // Invalid: too short
         ("/blobServices/default", None),
         // Invalid: empty
@@ -597,7 +629,10 @@ fn test_parse_subject() {
         // Invalid: wrong fixed segment "containers"
         ("/blobServices/default/wrongSegment/content/blobs/foo", None),
         // Invalid: wrong fixed segment "blobs"
-        ("/blobServices/default/containers/content/wrongSegment/foo", None),
+        (
+            "/blobServices/default/containers/content/wrongSegment/foo",
+            None,
+        ),
         // Invalid: enough segments but all wrong
         ("/a/b/c/d/e/f/g", None),
     ];
@@ -606,7 +641,8 @@ fn test_parse_subject() {
         let result = parse_subject(subject.to_string());
         match expected {
             Some((container, blob)) => {
-                let (c, b) = result.unwrap_or_else(|| panic!("Expected Some for subject: {subject}"));
+                let (c, b) =
+                    result.unwrap_or_else(|| panic!("Expected Some for subject: {subject}"));
                 assert_eq!(c, container, "container mismatch for subject: {subject}");
                 assert_eq!(b, blob, "blob mismatch for subject: {subject}");
             }

From a7f1c108ed62c0a69a3e28ba04c28cf4551b086c Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sun, 12 Apr 2026 08:30:06 +0200
Subject: [PATCH 312/326] docs(azure_blob): fix CUE docs - remove
 ingest_timestamp, add formal metrics, generate config

- Remove ingest_timestamp from output fields (was incorrectly documented
  as top-level string; it's standard Vector metadata). Aligns with S3
  which has no ingest_timestamp field.
- Add azure_queue_* metric definitions to internal_metrics.cue following
  the same pattern as SQS metrics: processing_succeeded, processing_errored,
  processing_rejected, and event_ignored (with ignore_type tag enum).
- Reference azure_queue_* metrics in azure_blob.cue telemetry block.
- Add azure_event_grid URL to urls.cue (was missing, caused CUE vet failure).
- Add generated azure_blob.cue configuration schema.
- Fix CUE formatting (alignment, double-space removal).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../components/sources/azure_blob.cue         |  25 +-
 .../sources/generated/azure_blob.cue          | 698 ++++++++++++++++++
 .../components/sources/internal_metrics.cue   |  35 +
 website/cue/reference/urls.cue                |   1 +
 4 files changed, 745 insertions(+), 14 deletions(-)
 create mode 100644 website/cue/reference/components/sources/generated/azure_blob.cue

diff --git a/website/cue/reference/components/sources/azure_blob.cue b/website/cue/reference/components/sources/azure_blob.cue
index fc27258163b66..8cbf6e421ee57 100644
--- a/website/cue/reference/components/sources/azure_blob.cue
+++ b/website/cue/reference/components/sources/azure_blob.cue
@@ -83,13 +83,6 @@ components: sources: azure_blob: {
 						examples: ["2024/01/15/app.log"]
 					}
 				}
-				ingest_timestamp: {
-					description: "The timestamp of when the blob was ingested by Vector."
-					required:    true
-					type: string: {
-						examples: ["2020-10-26T12:34:56.789Z"]
-					}
-				}
 			}
 		}
 		metrics: "": {
@@ -162,7 +155,7 @@ components: sources: azure_blob: {
 
 		queue_processing: {
 			title: "Queue Message Processing"
-			body:  """
+			body: """
 				Vector polls the configured Azure Storage Queue for Event Grid messages about blob events.
 				When a message is received, Vector:
 
@@ -207,7 +200,7 @@ components: sources: azure_blob: {
 
 		authentication: {
 			title: "Authentication"
-			body:  """
+			body: """
 				The Azure Blob Storage source supports authentication via connection string.
 				The connection string should include the storage account name, access key, and endpoint.
 
@@ -233,7 +226,7 @@ components: sources: azure_blob: {
 
 		limitations: {
 			title: "Known Limitations"
-			body:  """
+			body: """
 				**Content-Encoding Header Not Supported**
 
 				Unlike the AWS S3 source, the Azure Blob source does NOT support automatic
@@ -256,9 +249,13 @@ components: sources: azure_blob: {
 	}
 
 	telemetry: metrics: {
-		component_errors_total:                      components.sources.internal_metrics.output.metrics.component_errors_total
-		component_received_bytes_total:              components.sources.internal_metrics.output.metrics.component_received_bytes_total
-		component_received_event_bytes_total:        components.sources.internal_metrics.output.metrics.component_received_event_bytes_total
-		component_received_events_total:             components.sources.internal_metrics.output.metrics.component_received_events_total
+		component_errors_total:                         components.sources.internal_metrics.output.metrics.component_errors_total
+		component_received_bytes_total:                 components.sources.internal_metrics.output.metrics.component_received_bytes_total
+		component_received_event_bytes_total:           components.sources.internal_metrics.output.metrics.component_received_event_bytes_total
+		component_received_events_total:                components.sources.internal_metrics.output.metrics.component_received_events_total
+		azure_queue_message_processing_succeeded_total: components.sources.internal_metrics.output.metrics.azure_queue_message_processing_succeeded_total
+		azure_queue_message_processing_errored_total:   components.sources.internal_metrics.output.metrics.azure_queue_message_processing_errored_total
+		azure_queue_message_processing_rejected_total:  components.sources.internal_metrics.output.metrics.azure_queue_message_processing_rejected_total
+		azure_queue_event_ignored_total:                components.sources.internal_metrics.output.metrics.azure_queue_event_ignored_total
 	}
 }
diff --git a/website/cue/reference/components/sources/generated/azure_blob.cue b/website/cue/reference/components/sources/generated/azure_blob.cue
new file mode 100644
index 0000000000000..c2658ec0bee1d
--- /dev/null
+++ b/website/cue/reference/components/sources/generated/azure_blob.cue
@@ -0,0 +1,698 @@
+package metadata
+
+generated: components: sources: azure_blob: configuration: {
+	acknowledgements: {
+		deprecated: true
+		description: """
+			Controls how acknowledgements are handled by this source.
+
+			This setting is **deprecated** in favor of enabling `acknowledgements` at the [global][global_acks] or sink level.
+
+			Enabling or disabling acknowledgements at the source level has **no effect** on acknowledgement behavior.
+
+			See [End-to-end Acknowledgements][e2e_acks] for more information on how event acknowledgement is handled.
+
+			[global_acks]: https://vector.dev/docs/reference/configuration/global-options/#acknowledgements
+			[e2e_acks]: https://vector.dev/docs/architecture/end-to-end-acknowledgements/
+			"""
+		required: false
+		type: object: options: enabled: {
+			description: "Whether or not end-to-end acknowledgements are enabled for this source."
+			required:    false
+			type: bool: {}
+		}
+	}
+	compression: {
+		description: "Compression scheme used for decompressing blobs retrieved from Azure Blob Storage."
+		required:    false
+		type: string: {
+			default: "auto"
+			enum: {
+				auto: """
+					Automatically attempt to determine the compression scheme.
+
+					The compression scheme is determined from the blob's `Content-Type` metadata
+					and the blob name suffix (e.g., `.gz`, `.zst`).
+
+					Priority order: 1) Content-Type, 2) File extension.
+
+					Supported Content-Type values: `application/gzip`, `application/x-gzip`, `application/zstd`.
+
+					**Note:** Unlike the AWS S3 source, the `Content-Encoding` header is NOT supported
+					due to an Azure SDK limitation. When blobs have `Content-Encoding` set, use the
+					file extension or `Content-Type` header instead, or configure explicit compression.
+
+					It is set to `none` if the compression scheme cannot be determined.
+					"""
+				gzip: "GZIP."
+				none: "Uncompressed."
+				zstd: "ZSTD."
+			}
+		}
+	}
+	connection_string: {
+		description: """
+			The Azure Blob Storage Account connection string.
+
+			Authentication with access key is the only supported authentication method.
+			"""
+		required: false
+		type: string: {
+			default: ""
+			examples: ["DefaultEndpointsProtocol=https;AccountName=mylogstorage;AccountKey=storageaccountkeybase64encoded;EndpointSuffix=core.windows.net"]
+		}
+	}
+	container_name: {
+		description: "The Azure Blob Storage Account container name."
+		required:    false
+		type: string: {
+			default: ""
+			examples: ["my-logs"]
+		}
+	}
+	decoding: {
+		description: """
+			Configures how events are decoded from raw bytes. Note some decoders can also determine the event output
+			type (log, metric, trace).
+			"""
+		required: false
+		type: object: options: {
+			avro: {
+				description:   "Apache Avro-specific encoder options."
+				relevant_when: "codec = \"avro\""
+				required:      true
+				type: object: options: {
+					schema: {
+						description: """
+																The Avro schema definition.
+																**Note**: The following [`apache_avro::types::Value`] variants are *not* supported:
+																* `Date`
+																* `Decimal`
+																* `Duration`
+																* `Fixed`
+																* `TimeMillis`
+																"""
+						required: true
+						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
+					}
+					strip_schema_id_prefix: {
+						description: """
+																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
+																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
+																"""
+						required: true
+						type: bool: {}
+					}
+				}
+			}
+			codec: {
+				description: "The codec to use for decoding events."
+				required:    false
+				type: string: {
+					default: "bytes"
+					enum: {
+						avro: """
+															Decodes the raw bytes as as an [Apache Avro][apache_avro] message.
+
+															[apache_avro]: https://avro.apache.org/
+															"""
+						bytes: "Uses the raw bytes as-is."
+						gelf: """
+															Decodes the raw bytes as a [GELF][gelf] message.
+
+															This codec is experimental for the following reason:
+
+															The GELF specification is more strict than the actual Graylog receiver.
+															Vector's decoder adheres more strictly to the GELF spec, with
+															the exception that some characters such as `@`  are allowed in field names.
+
+															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog, and is much more relaxed than the GELF spec.
+
+															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of specification.
+
+															[gelf]: https://docs.graylog.org/docs/gelf
+															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
+															"""
+						influxdb: """
+															Decodes the raw bytes as an [Influxdb Line Protocol][influxdb] message.
+
+															[influxdb]: https://docs.influxdata.com/influxdb/cloud/reference/syntax/line-protocol
+															"""
+						json: """
+															Decodes the raw bytes as [JSON][json].
+
+															[json]: https://www.json.org/
+															"""
+						native: """
+															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
+
+															This decoder can output all types of events (logs, metrics, traces).
+
+															This codec is **[experimental][experimental]**.
+
+															[vector_native_protobuf]: https://github.com/vectordotdev/vector/blob/master/lib/vector-core/proto/event.proto
+															[experimental]: https://vector.dev/highlights/2022-03-31-native-event-codecs
+															"""
+						native_json: """
+															Decodes the raw bytes as [native JSON format][vector_native_json].
+
+															This decoder can output all types of events (logs, metrics, traces).
+
+															This codec is **[experimental][experimental]**.
+
+															[vector_native_json]: https://github.com/vectordotdev/vector/blob/master/lib/codecs/tests/data/native_encoding/schema.cue
+															[experimental]: https://vector.dev/highlights/2022-03-31-native-event-codecs
+															"""
+						otlp: """
+															Decodes the raw bytes as [OTLP (OpenTelemetry Protocol)][otlp] protobuf format.
+
+															This decoder handles the three OTLP signal types: logs, metrics, and traces.
+															It automatically detects which type of OTLP message is being decoded.
+
+															[otlp]: https://opentelemetry.io/docs/specs/otlp/
+															"""
+						protobuf: """
+															Decodes the raw bytes as [protobuf][protobuf].
+
+															[protobuf]: https://protobuf.dev/
+															"""
+						syslog: """
+															Decodes the raw bytes as a Syslog message.
+
+															Decodes either as the [RFC 3164][rfc3164]-style format ("old" style) or the
+															[RFC 5424][rfc5424]-style format ("new" style, includes structured data).
+
+															[rfc3164]: https://www.ietf.org/rfc/rfc3164.txt
+															[rfc5424]: https://www.ietf.org/rfc/rfc5424.txt
+															"""
+						vrl: """
+															Decodes the raw bytes as a string and passes them as input to a [VRL][vrl] program.
+
+															[vrl]: https://vector.dev/docs/reference/vrl
+															"""
+					}
+				}
+			}
+			gelf: {
+				description:   "GELF-specific decoding options."
+				relevant_when: "codec = \"gelf\""
+				required:      false
+				type: object: options: {
+					lossy: {
+						description: """
+																Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+																When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+																[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+																"""
+						required: false
+						type: bool: default: true
+					}
+					validation: {
+						description: "Configures the decoding validation mode."
+						required:    false
+						type: string: {
+							default: "strict"
+							enum: {
+								relaxed: """
+																			Uses more relaxed validation that skips strict GELF specification checks.
+
+																			This mode will not treat specification violations as errors, allowing the decoder
+																			to accept messages from sources that don't strictly follow the GELF spec.
+																			"""
+								strict: "Uses strict validation that closely follows the GELF spec."
+							}
+						}
+					}
+				}
+			}
+			influxdb: {
+				description:   "Influxdb-specific decoding options."
+				relevant_when: "codec = \"influxdb\""
+				required:      false
+				type: object: options: lossy: {
+					description: """
+						Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+						When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+						[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+						"""
+					required: false
+					type: bool: default: true
+				}
+			}
+			json: {
+				description:   "JSON-specific decoding options."
+				relevant_when: "codec = \"json\""
+				required:      false
+				type: object: options: lossy: {
+					description: """
+						Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+						When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+						[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+						"""
+					required: false
+					type: bool: default: true
+				}
+			}
+			native_json: {
+				description:   "Vector's native JSON-specific decoding options."
+				relevant_when: "codec = \"native_json\""
+				required:      false
+				type: object: options: lossy: {
+					description: """
+						Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+						When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+						[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+						"""
+					required: false
+					type: bool: default: true
+				}
+			}
+			protobuf: {
+				description:   "Protobuf-specific decoding options."
+				relevant_when: "codec = \"protobuf\""
+				required:      false
+				type: object: options: {
+					desc_file: {
+						description: """
+																The path to the protobuf descriptor set file.
+
+																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
+
+																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																"""
+						required: false
+						type: string: default: ""
+					}
+					message_type: {
+						description: "The name of the message type to use for serializing."
+						required:    false
+						type: string: {
+							default: ""
+							examples: ["package.Message"]
+						}
+					}
+					use_json_names: {
+						description: """
+																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
+
+																When enabled, the deserializer will output fields using their JSON names as defined
+																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+
+																This is useful when working with data that needs to be converted to JSON or
+																when interfacing with systems that use JSON naming conventions.
+																"""
+						required: false
+						type: bool: default: false
+					}
+				}
+			}
+			signal_types: {
+				description: """
+					Signal types to attempt parsing, in priority order.
+
+					The deserializer will try parsing in the order specified. This allows you to optimize
+					performance when you know the expected signal types. For example, if you only receive
+					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
+
+					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					Duplicate signal types are automatically removed while preserving order.
+					"""
+				relevant_when: "codec = \"otlp\""
+				required:      false
+				type: array: {
+					default: ["logs", "metrics", "traces"]
+					items: type: string: enum: {
+						logs:    "OTLP logs signal (ExportLogsServiceRequest)"
+						metrics: "OTLP metrics signal (ExportMetricsServiceRequest)"
+						traces:  "OTLP traces signal (ExportTraceServiceRequest)"
+					}
+				}
+			}
+			syslog: {
+				description:   "Syslog-specific decoding options."
+				relevant_when: "codec = \"syslog\""
+				required:      false
+				type: object: options: lossy: {
+					description: """
+						Determines whether to replace invalid UTF-8 sequences instead of failing.
+
+						When true, invalid UTF-8 sequences are replaced with the [`U+FFFD REPLACEMENT CHARACTER`][U+FFFD].
+
+						[U+FFFD]: https://en.wikipedia.org/wiki/Specials_(Unicode_block)#Replacement_character
+						"""
+					required: false
+					type: bool: default: true
+				}
+			}
+			vrl: {
+				description:   "VRL-specific decoding options."
+				relevant_when: "codec = \"vrl\""
+				required:      true
+				type: object: options: {
+					source: {
+						description: """
+																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
+																Note that the final contents of the `.` target will be used as the decoding result.
+																Compilation error or use of 'abort' in a program will result in a decoding error.
+
+																[vrl]: https://vector.dev/docs/reference/vrl
+																"""
+						required: true
+						type: string: {}
+					}
+					timezone: {
+						description: """
+																The name of the timezone to apply to timestamp conversions that do not contain an explicit
+																time zone. The time zone name may be any name in the [TZ database][tz_database], or `local`
+																to indicate system local time.
+
+																If not set, `local` is used.
+
+																[tz_database]: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+																"""
+						required: false
+						type: string: examples: ["local", "America/New_York", "EST5EDT"]
+					}
+				}
+			}
+		}
+	}
+	delete_failed_message: {
+		description: """
+			Whether to delete non-retryable messages from the queue.
+
+			If a message is rejected by the sink and not retryable, setting this to `true`
+			will delete the message from the queue. When `false`, rejected messages are
+			retained in the queue and will become visible again after the visibility timeout.
+			"""
+		required: false
+		type: bool: default: true
+	}
+	framing: {
+		description: "Configurable framing for splitting blob contents into events."
+		required:    false
+		type: object: options: {
+			character_delimited: {
+				description:   "Options for the character delimited decoder."
+				relevant_when: "method = \"character_delimited\""
+				required:      true
+				type: object: options: {
+					delimiter: {
+						description: "The character that delimits byte sequences."
+						required:    true
+						type: ascii_char: {}
+					}
+					max_length: {
+						description: """
+																The maximum length of the byte buffer.
+
+																This length does *not* include the trailing delimiter.
+
+																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																additional resource usage as events continue to be buffered in memory, and can potentially
+																lead to memory exhaustion in extreme cases.
+
+																If there is a risk of processing malformed data, such as logs with user-controlled input,
+																consider setting the maximum length to a reasonably large value as a safety net. This
+																ensures that processing is not actually unbounded.
+																"""
+						required: false
+						type: uint: {}
+					}
+				}
+			}
+			chunked_gelf: {
+				description:   "Options for the chunked GELF decoder."
+				relevant_when: "method = \"chunked_gelf\""
+				required:      false
+				type: object: options: {
+					decompression: {
+						description: "Decompression configuration for GELF messages."
+						required:    false
+						type: string: {
+							default: "Auto"
+							enum: {
+								Auto: "Automatically detect the decompression method based on the magic bytes of the message."
+								Gzip: "Use Gzip decompression."
+								None: "Do not decompress the message."
+								Zlib: "Use Zlib decompression."
+							}
+						}
+					}
+					max_length: {
+						description: """
+																The maximum length of a single GELF message, in bytes. Messages longer than this length will
+																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																the per-message memory is unbounded.
+
+																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																message, not to individual chunks.
+
+																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
+																The message's payload is the concatenation of all the chunks' payloads.
+																"""
+						required: false
+						type: uint: {}
+					}
+					pending_messages_limit: {
+						description: """
+																The maximum number of pending incomplete messages. If this limit is reached, the decoder starts
+																dropping chunks of new messages, ensuring the memory usage of the decoder's state is bounded.
+																If this option is not set, the decoder does not limit the number of pending messages and the memory usage
+																of its messages buffer can grow unbounded. This matches Graylog Server's behavior.
+																"""
+						required: false
+						type: uint: {}
+					}
+					timeout_secs: {
+						description: """
+																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
+																decoder drops all the received chunks of the timed out message.
+																"""
+						required: false
+						type: float: default: 5.0
+					}
+				}
+			}
+			length_delimited: {
+				description:   "Options for the length delimited decoder."
+				relevant_when: "method = \"length_delimited\""
+				required:      true
+				type: object: options: {
+					length_field_is_big_endian: {
+						description: "Length field byte order (little or big endian)"
+						required:    false
+						type: bool: default: true
+					}
+					length_field_length: {
+						description: "Number of bytes representing the field length"
+						required:    false
+						type: uint: default: 4
+					}
+					length_field_offset: {
+						description: "Number of bytes in the header before the length field"
+						required:    false
+						type: uint: default: 0
+					}
+					max_frame_length: {
+						description: "Maximum frame length"
+						required:    false
+						type: uint: default: 8388608
+					}
+				}
+			}
+			max_frame_length: {
+				description:   "Maximum frame length"
+				relevant_when: "method = \"varint_length_delimited\""
+				required:      false
+				type: uint: default: 8388608
+			}
+			method: {
+				description: "The framing method."
+				required:    false
+				type: string: {
+					default: "newline_delimited"
+					enum: {
+						bytes:               "Byte frames are passed through as-is according to the underlying I/O boundaries (for example, split between messages or stream segments)."
+						character_delimited: "Byte frames which are delimited by a chosen character."
+						chunked_gelf: """
+															Byte frames which are chunked GELF messages.
+
+															[chunked_gelf]: https://go2docs.graylog.org/current/getting_in_log_data/gelf.html
+															"""
+						length_delimited:  "Byte frames which are prefixed by an unsigned big-endian 32-bit integer indicating the length."
+						newline_delimited: "Byte frames which are delimited by a newline character."
+						octet_counting: """
+															Byte frames according to the [octet counting][octet_counting] format.
+
+															[octet_counting]: https://tools.ietf.org/html/rfc6587#section-3.4.1
+															"""
+						varint_length_delimited: """
+															Byte frames which are prefixed by a varint indicating the length.
+															This is compatible with protobuf's length-delimited encoding.
+															"""
+					}
+				}
+			}
+			newline_delimited: {
+				description:   "Options for the newline delimited decoder."
+				relevant_when: "method = \"newline_delimited\""
+				required:      false
+				type: object: options: max_length: {
+					description: """
+						The maximum length of the byte buffer.
+
+						This length does *not* include the trailing delimiter.
+
+						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						additional resource usage as events continue to be buffered in memory, and can potentially
+						lead to memory exhaustion in extreme cases.
+
+						If there is a risk of processing malformed data, such as logs with user-controlled input,
+						consider setting the maximum length to a reasonably large value as a safety net. This
+						ensures that processing is not actually unbounded.
+						"""
+					required: false
+					type: uint: {}
+				}
+			}
+			octet_counting: {
+				description:   "Options for the octet counting decoder."
+				relevant_when: "method = \"octet_counting\""
+				required:      false
+				type: object: options: max_length: {
+					description: "The maximum length of the byte buffer."
+					required:    false
+					type: uint: {}
+				}
+			}
+		}
+	}
+	multiline: {
+		description: """
+			Multiline aggregation configuration.
+
+			If not specified, multiline aggregation is disabled.
+			"""
+		required: false
+		type: object: options: {
+			condition_pattern: {
+				description: """
+					Regular expression pattern that is used to determine whether or not more lines should be read.
+
+					This setting must be configured in conjunction with `mode`.
+					"""
+				required: true
+				type: string: examples: ["^[\\s]+", "\\\\$", "^(INFO|ERROR) ", ";$"]
+			}
+			mode: {
+				description: """
+					Aggregation mode.
+
+					This setting must be configured in conjunction with `condition_pattern`.
+					"""
+				required: true
+				type: string: enum: {
+					continue_past: """
+						All consecutive lines matching this pattern, plus one additional line, are included in the group.
+
+						This is useful in cases where a log message ends with a continuation marker, such as a backslash, indicating
+						that the following line is part of the same message.
+						"""
+					continue_through: """
+						All consecutive lines matching this pattern are included in the group.
+
+						The first line (the line that matched the start pattern) does not need to match the `ContinueThrough` pattern.
+
+						This is useful in cases such as a Java stack trace, where some indicator in the line (such as a leading
+						whitespace) indicates that it is an extension of the proceeding line.
+						"""
+					halt_before: """
+						All consecutive lines not matching this pattern are included in the group.
+
+						This is useful where a log line contains a marker indicating that it begins a new message.
+						"""
+					halt_with: """
+						All consecutive lines, up to and including the first line matching this pattern, are included in the group.
+
+						This is useful where a log line ends with a termination marker, such as a semicolon.
+						"""
+				}
+			}
+			start_pattern: {
+				description: "Regular expression pattern that is used to match the start of a new message."
+				required:    true
+				type: string: examples: ["^[\\s]+", "\\\\$", "^(INFO|ERROR) ", ";$"]
+			}
+			timeout_ms: {
+				description: """
+					The maximum amount of time to wait for the next additional line, in milliseconds.
+
+					Once this timeout is reached, the buffered message is guaranteed to be flushed, even if incomplete.
+					"""
+				required: true
+				type: uint: {
+					examples: [1000, 600000]
+					unit: "milliseconds"
+				}
+			}
+		}
+	}
+	queue: {
+		description: "Configuration options for Storage Queue."
+		required:    false
+		type: object: options: {
+			max_number_of_messages: {
+				description: """
+					Maximum number of messages to receive from the queue in a single request.
+
+					Azure Storage Queues allow between 1 and 32 messages per request.
+					Since messages are processed sequentially, a lower value reduces the risk of
+					visibility timeouts expiring before messages are processed.
+					"""
+				required: false
+				type: uint: default: 10
+			}
+			poll_secs: {
+				description: "How long to wait while polling the event grid queue for new messages, in seconds."
+				required:    false
+				type: uint: {
+					default: 15
+					unit:    "seconds"
+				}
+			}
+			queue_name: {
+				description: "The name of the storage queue to poll for events."
+				required:    true
+				type: string: {}
+			}
+			visibility_timeout_secs: {
+				description: """
+					Visibility timeout for received queue messages, in seconds.
+
+					After a message is received, it becomes invisible to other consumers for this duration.
+					If processing takes longer than this timeout, the message may be received again by another
+					consumer (or the same consumer), potentially causing duplicate processing.
+
+					Set this value higher than the expected time to process a full batch of messages.
+					Valid range: 1 to 604800 (7 days).
+					"""
+				required: false
+				type: uint: {
+					default: 300
+					unit:    "seconds"
+				}
+			}
+		}
+	}
+}
diff --git a/website/cue/reference/components/sources/internal_metrics.cue b/website/cue/reference/components/sources/internal_metrics.cue
index d7a33596df37a..9a785075149d6 100644
--- a/website/cue/reference/components/sources/internal_metrics.cue
+++ b/website/cue/reference/components/sources/internal_metrics.cue
@@ -972,6 +972,41 @@ components: sources: internal_metrics: {
 				}
 			}
 		}
+		azure_queue_message_processing_succeeded_total: {
+			description:       "The total number of Azure queue messages successfully processed."
+			type:              "counter"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
+		azure_queue_message_processing_errored_total: {
+			description:       "The total number of Azure queue messages that had transient delivery errors."
+			type:              "counter"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
+		azure_queue_message_processing_rejected_total: {
+			description:       "The total number of Azure queue messages permanently rejected."
+			type:              "counter"
+			default_namespace: "vector"
+			tags:              _component_tags
+		}
+		azure_queue_event_ignored_total: {
+			description:       "The total number of Azure queue events ignored."
+			type:              "counter"
+			default_namespace: "vector"
+
+			tags: _component_tags & {
+				ignore_type: {
+					description: "The reason for ignoring the event."
+					required:    true
+					enum: {
+						"invalid_event_type":         "The event type was not BlobCreated or BlobRenamed."
+						"mismatching_container_name": "The container name did not match the configured container."
+						"blob_doesnt_exist":          "The blob no longer exists in storage."
+					}
+				}
+			}
+		}
 		stale_events_flushed_total: {
 			description:       "The number of stale events that Vector has flushed."
 			type:              "counter"
diff --git a/website/cue/reference/urls.cue b/website/cue/reference/urls.cue
index 0133e581f82e5..35a638aa82ef2 100644
--- a/website/cue/reference/urls.cue
+++ b/website/cue/reference/urls.cue
@@ -3,6 +3,7 @@ package metadata
 urls: {
 	appsignal:                                  "https://www.appsignal.com/"
 	azure_blob_storage:                         "https://azure.microsoft.com/en-us/services/storage/blobs/"
+	azure_event_grid:                           "https://learn.microsoft.com/en-us/azure/event-grid/"
 	azure_event_hubs:                           "https://learn.microsoft.com/en-us/azure/event-hubs/"
 	azure_event_hubs_kafka:                     "https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-for-kafka-ecosystem-overview"
 	azure_event_hubs_connection_string:         "https://learn.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string"

From 34ffd82c3fdfa5494c88899ddcb6a104027ba7b3 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sun, 12 Apr 2026 17:50:57 +0200
Subject: [PATCH 313/326] fix(azure_blob): validate queue config ranges and fix
 succeeded metric accuracy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add config validation for max_number_of_messages (1-32),
  visibility_timeout_secs (1-604800), and poll_secs (>0) to catch
  invalid configs at startup instead of runtime Azure API errors.
- Change completion handler to return bool indicating whether the queue
  message was actually deleted. Only emit QueueMessageProcessingSucceeded
  when the message was deleted — previously the metric fired even when
  the message was retained due to framing/read errors, which was misleading.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/sources/azure_blob/mod.rs   | 38 +++++++++++++++++++++++++++------
 src/sources/azure_blob/queue.rs |  5 ++++-
 src/sources/azure_blob/test.rs  |  7 ++++--
 3 files changed, 40 insertions(+), 10 deletions(-)

diff --git a/src/sources/azure_blob/mod.rs b/src/sources/azure_blob/mod.rs
index b28ca05e3b49a..99f850ce4fc80 100644
--- a/src/sources/azure_blob/mod.rs
+++ b/src/sources/azure_blob/mod.rs
@@ -167,13 +167,29 @@ impl_generate_config_from_default!(AzureBlobConfig);
 impl AzureBlobConfig {
     /// Self validation
     pub fn validate(&self) -> crate::Result<()> {
-        if self.queue.is_none() || self.queue.as_ref().unwrap().queue_name.is_empty() {
-            return Err("Azure event grid queue must be set.".into());
-        }
+        let queue = match self.queue.as_ref() {
+            Some(queue) if !queue.queue_name.is_empty() => queue,
+            _ => return Err("Azure event grid queue must be set.".into()),
+        };
+
         if self.container_name.is_empty() {
             return Err("Azure Container must be set.".into());
         }
 
+        if !(1..=32).contains(&queue.max_number_of_messages) {
+            return Err("Azure queue `max_number_of_messages` must be between 1 and 32.".into());
+        }
+
+        if !(1..=604800).contains(&queue.visibility_timeout_secs) {
+            return Err(
+                "Azure queue `visibility_timeout_secs` must be between 1 and 604800.".into(),
+            );
+        }
+
+        if queue.poll_secs == 0 {
+            return Err("Azure queue `poll_secs` must be greater than 0.".into());
+        }
+
         Ok(())
     }
 }
@@ -238,8 +254,9 @@ pub struct BlobWithAck {
     /// Called after stream consumption to finalize queue message handling.
     /// Encapsulates both the success action (delete queue message) and
     /// read-error checking (retain queue message on framing errors).
+    /// Returns `true` if the queue message was deleted, `false` if retained.
     pub(super) completion_handler:
-        Box<dyn FnOnce(StreamResult) -> Pin<Box<dyn Future<Output = ()> + Send>> + Send>,
+        Box<dyn FnOnce(StreamResult) -> Pin<Box<dyn Future<Output = bool> + Send>> + Send>,
     pub(super) container: String,
     pub(super) blob_name: String,
 }
@@ -390,11 +407,18 @@ impl AzureBlobStreamer {
         }
 
         match receiver {
-            None => (blob.completion_handler)(StreamResult::Delivered).await,
+            None => {
+                let deleted = (blob.completion_handler)(StreamResult::Delivered).await;
+                if deleted {
+                    emit!(QueueMessageProcessingSucceeded {});
+                }
+            }
             Some(receiver) => match receiver.await {
                 BatchStatus::Delivered => {
-                    (blob.completion_handler)(StreamResult::Delivered).await;
-                    emit!(QueueMessageProcessingSucceeded {});
+                    let deleted = (blob.completion_handler)(StreamResult::Delivered).await;
+                    if deleted {
+                        emit!(QueueMessageProcessingSucceeded {});
+                    }
                 }
                 BatchStatus::Errored => {
                     (blob.completion_handler)(StreamResult::Errored).await;
diff --git a/src/sources/azure_blob/queue.rs b/src/sources/azure_blob/queue.rs
index de5d38efe56bb..ec56c28848304 100644
--- a/src/sources/azure_blob/queue.rs
+++ b/src/sources/azure_blob/queue.rs
@@ -461,15 +461,18 @@ async fn process_event_grid_message(
                                 "Read error for blob '{}' in container '{}': {}. Queue message retained for retry.",
                                 blob_for_warn, container_for_warn, err
                             );
-                            return;
+                            return false;
                         }
                         remove_message_from_queue(&queue_client_copy, message).await;
+                        true
                     }
                     StreamResult::Rejected => {
                         remove_message_from_queue(&queue_client_copy, message).await;
+                        true
                     }
                     StreamResult::Errored => {
                         // Retain queue message for retry on transient errors.
+                        false
                     }
                 }
             })
diff --git a/src/sources/azure_blob/test.rs b/src/sources/azure_blob/test.rs
index a86e3f468329b..310c9b20a0c20 100644
--- a/src/sources/azure_blob/test.rs
+++ b/src/sources/azure_blob/test.rs
@@ -30,6 +30,7 @@ async fn test_messages_delivered() {
         completion_handler: Box::new(move |_result: StreamResult| {
             Box::pin(async move {
                 success_sender.send(()).unwrap();
+                true
             })
         }),
         container: "test-container".to_string(),
@@ -80,6 +81,7 @@ async fn test_messages_rejected_delete_failed_message() {
         completion_handler: Box::new(move |_result: StreamResult| {
             Box::pin(async move {
                 success_sender.send(()).unwrap();
+                true
             })
         }),
         container: "test-container".to_string(),
@@ -131,6 +133,7 @@ async fn test_messages_rejected_retain_failed_message() {
         completion_handler: Box::new(move |_result: StreamResult| {
             Box::pin(async move {
                 success_sender.send(()).unwrap();
+                true
             })
         }),
         container: "test-container".to_string(),
@@ -179,7 +182,7 @@ async fn test_json_decoding_blob() {
         blob_data_stream: Box::pin(stream! {
             yield Bytes::from(json_line.as_bytes().to_vec());
         }),
-        completion_handler: Box::new(|_result: StreamResult| Box::pin(async move {})),
+        completion_handler: Box::new(|_result: StreamResult| Box::pin(async move { false })),
         container: "test-container".to_string(),
         blob_name: "json-blob.log".to_string(),
     };
@@ -227,7 +230,7 @@ async fn test_log_namespace_legacy() {
         blob_data_stream: Box::pin(stream! {
             yield Bytes::from("legacy_test".as_bytes().to_vec());
         }),
-        completion_handler: Box::new(|_result: StreamResult| Box::pin(async move {})),
+        completion_handler: Box::new(|_result: StreamResult| Box::pin(async move { false })),
         container: "test-container".to_string(),
         blob_name: "legacy-blob.log".to_string(),
     };

From 6acf5ee54e1dbef27993a3b6ee4f697a924e4dcf Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sun, 12 Apr 2026 19:04:18 +0200
Subject: [PATCH 314/326] revert(azure_blob): remove completion_handler bool
 return (S3 parity)

Revert the completion_handler return type from bool back to ().
The bool approach diverged from S3's pattern where the success metric
means "processing completed without error" rather than "message was
deleted." Config validation from c732d85 is retained.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/sources/azure_blob/mod.rs   | 16 ++++------------
 src/sources/azure_blob/queue.rs |  5 +----
 src/sources/azure_blob/test.rs  |  7 ++-----
 3 files changed, 7 insertions(+), 21 deletions(-)

diff --git a/src/sources/azure_blob/mod.rs b/src/sources/azure_blob/mod.rs
index 99f850ce4fc80..24377d685784e 100644
--- a/src/sources/azure_blob/mod.rs
+++ b/src/sources/azure_blob/mod.rs
@@ -254,9 +254,8 @@ pub struct BlobWithAck {
     /// Called after stream consumption to finalize queue message handling.
     /// Encapsulates both the success action (delete queue message) and
     /// read-error checking (retain queue message on framing errors).
-    /// Returns `true` if the queue message was deleted, `false` if retained.
     pub(super) completion_handler:
-        Box<dyn FnOnce(StreamResult) -> Pin<Box<dyn Future<Output = bool> + Send>> + Send>,
+        Box<dyn FnOnce(StreamResult) -> Pin<Box<dyn Future<Output = ()> + Send>> + Send>,
     pub(super) container: String,
     pub(super) blob_name: String,
 }
@@ -407,18 +406,11 @@ impl AzureBlobStreamer {
         }
 
         match receiver {
-            None => {
-                let deleted = (blob.completion_handler)(StreamResult::Delivered).await;
-                if deleted {
-                    emit!(QueueMessageProcessingSucceeded {});
-                }
-            }
+            None => (blob.completion_handler)(StreamResult::Delivered).await,
             Some(receiver) => match receiver.await {
                 BatchStatus::Delivered => {
-                    let deleted = (blob.completion_handler)(StreamResult::Delivered).await;
-                    if deleted {
-                        emit!(QueueMessageProcessingSucceeded {});
-                    }
+                    (blob.completion_handler)(StreamResult::Delivered).await;
+                    emit!(QueueMessageProcessingSucceeded {});
                 }
                 BatchStatus::Errored => {
                     (blob.completion_handler)(StreamResult::Errored).await;
diff --git a/src/sources/azure_blob/queue.rs b/src/sources/azure_blob/queue.rs
index ec56c28848304..de5d38efe56bb 100644
--- a/src/sources/azure_blob/queue.rs
+++ b/src/sources/azure_blob/queue.rs
@@ -461,18 +461,15 @@ async fn process_event_grid_message(
                                 "Read error for blob '{}' in container '{}': {}. Queue message retained for retry.",
                                 blob_for_warn, container_for_warn, err
                             );
-                            return false;
+                            return;
                         }
                         remove_message_from_queue(&queue_client_copy, message).await;
-                        true
                     }
                     StreamResult::Rejected => {
                         remove_message_from_queue(&queue_client_copy, message).await;
-                        true
                     }
                     StreamResult::Errored => {
                         // Retain queue message for retry on transient errors.
-                        false
                     }
                 }
             })
diff --git a/src/sources/azure_blob/test.rs b/src/sources/azure_blob/test.rs
index 310c9b20a0c20..a86e3f468329b 100644
--- a/src/sources/azure_blob/test.rs
+++ b/src/sources/azure_blob/test.rs
@@ -30,7 +30,6 @@ async fn test_messages_delivered() {
         completion_handler: Box::new(move |_result: StreamResult| {
             Box::pin(async move {
                 success_sender.send(()).unwrap();
-                true
             })
         }),
         container: "test-container".to_string(),
@@ -81,7 +80,6 @@ async fn test_messages_rejected_delete_failed_message() {
         completion_handler: Box::new(move |_result: StreamResult| {
             Box::pin(async move {
                 success_sender.send(()).unwrap();
-                true
             })
         }),
         container: "test-container".to_string(),
@@ -133,7 +131,6 @@ async fn test_messages_rejected_retain_failed_message() {
         completion_handler: Box::new(move |_result: StreamResult| {
             Box::pin(async move {
                 success_sender.send(()).unwrap();
-                true
             })
         }),
         container: "test-container".to_string(),
@@ -182,7 +179,7 @@ async fn test_json_decoding_blob() {
         blob_data_stream: Box::pin(stream! {
             yield Bytes::from(json_line.as_bytes().to_vec());
         }),
-        completion_handler: Box::new(|_result: StreamResult| Box::pin(async move { false })),
+        completion_handler: Box::new(|_result: StreamResult| Box::pin(async move {})),
         container: "test-container".to_string(),
         blob_name: "json-blob.log".to_string(),
     };
@@ -230,7 +227,7 @@ async fn test_log_namespace_legacy() {
         blob_data_stream: Box::pin(stream! {
             yield Bytes::from("legacy_test".as_bytes().to_vec());
         }),
-        completion_handler: Box::new(|_result: StreamResult| Box::pin(async move { false })),
+        completion_handler: Box::new(|_result: StreamResult| Box::pin(async move {})),
         container: "test-container".to_string(),
         blob_name: "legacy-blob.log".to_string(),
     };

From 637a04dd6d02ef7a2a16f669c51212a90d3b5c8f Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Thu, 4 Jun 2026 07:54:00 +0200
Subject: [PATCH 315/326] chore(azure_blob): regenerate license inventory with
 dd-rust-license-tool 1.0.6 after rebase

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 LICENSE-3rdparty.csv | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index d152c4cb4358f..9065a519950cc 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -1,4 +1,5 @@
 Component,Origin,License,Copyright
+RustyXML,https://github.com/Florob/RustyXML,MIT OR Apache-2.0,Florian Zeitz <florob@babelmonkeys.de>
 adler2,https://github.com/oyvindln/adler2,0BSD OR MIT OR Apache-2.0,"Jonas Schievink <jonasschievink@gmail.com>, oyvindln <oyvindln@users.noreply.github.com>"
 aead,https://github.com/RustCrypto/traits,MIT OR Apache-2.0,RustCrypto Developers
 aes,https://github.com/RustCrypto/block-ciphers,MIT OR Apache-2.0,RustCrypto Developers
@@ -97,9 +98,14 @@ aws-types,https://github.com/smithy-lang/smithy-rs,Apache-2.0,"AWS Rust SDK Team
 axum,https://github.com/tokio-rs/axum,MIT,The axum Authors
 axum-core,https://github.com/tokio-rs/axum,MIT,The axum-core Authors
 azure_core,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft
+azure_core,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft Corp.
 azure_core_macros,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft
 azure_identity,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft
+azure_storage,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft Corp.
 azure_storage_blob,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft
+azure_storage_blobs,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft Corp.
+azure_storage_queues,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft Corp.
+azure_svc_blobstorage,https://github.com/azure/azure-sdk-for-rust,MIT,The azure_svc_blobstorage Authors
 backon,https://github.com/Xuanwo/backon,Apache-2.0,The backon Authors
 base16,https://github.com/thomcc/rust-base16,CC0-1.0,Thom Chiovoloni <tchiovoloni@mozilla.com>
 base16ct,https://github.com/RustCrypto/formats/tree/master/base16ct,Apache-2.0 OR MIT,RustCrypto Developers
@@ -346,6 +352,7 @@ http-body,https://github.com/hyperium/http-body,MIT,"Carl Lerche <me@carllerche.
 http-body-util,https://github.com/hyperium/http-body,MIT,"Carl Lerche <me@carllerche.com>, Lucio Franco <luciofranco14@gmail.com>, Sean McArthur <sean@seanmonstar.com>"
 http-range-header,https://github.com/MarcusGrass/parse-range-headers,MIT,The http-range-header Authors
 http-serde,https://gitlab.com/kornelski/http-serde,Apache-2.0 OR MIT,Kornel <kornel@geekhood.net>
+http-types,https://github.com/http-rs/http-types,MIT OR Apache-2.0,Yoshua Wuyts <yoshuawuyts@gmail.com>
 httparse,https://github.com/seanmonstar/httparse,MIT OR Apache-2.0,Sean McArthur <sean@seanmonstar.com>
 httpdate,https://github.com/pyfisch/httpdate,MIT OR Apache-2.0,Pyfisch <pyfisch@posteo.org>
 humantime,https://github.com/chronotope/humantime,MIT OR Apache-2.0,The humantime Authors
@@ -378,11 +385,13 @@ idna_adapter,https://github.com/hsivonen/idna_adapter,Apache-2.0 OR MIT,The rust
 indexmap,https://github.com/bluss/indexmap,Apache-2.0 OR MIT,The indexmap Authors
 indexmap,https://github.com/indexmap-rs/indexmap,Apache-2.0 OR MIT,The indexmap Authors
 indoc,https://github.com/dtolnay/indoc,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
+infer,https://github.com/bojand/infer,MIT,Bojan <dbojan@gmail.com>
 influxdb-line-protocol,https://github.com/influxdata/influxdb_iox/tree/main/influxdb_line_protocol,MIT OR Apache-2.0,InfluxDB IOx Project Developers
 inotify,https://github.com/hannobraun/inotify,ISC,"Hanno Braun <mail@hannobraun.de>, Félix Saparelli <me@passcod.name>, Cristian Kubis <cristian.kubis@tsunix.de>, Frank Denis <github@pureftpd.org>"
 inotify-sys,https://github.com/hannobraun/inotify-sys,ISC,Hanno Braun <hb@hannobraun.de>
 inout,https://github.com/RustCrypto/utils,MIT OR Apache-2.0,RustCrypto Developers
 instability,https://github.com/ratatui-org/instability,MIT,"Stephen M. Coakley <me@stephencoakley.com>, Joshka"
+instant,https://github.com/sebcrozet/instant,BSD-3-Clause,sebcrozet <developer@crozet.re>
 integer-encoding,https://github.com/dermesser/integer-encoding-rs,MIT,Lewin Bormann <lbo@spheniscida.de>
 inventory,https://github.com/dtolnay/inventory,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 ipconfig,https://github.com/liranringel/ipconfig,MIT OR Apache-2.0,Liran Ringel <liranringel@gmail.com>
@@ -612,6 +621,7 @@ rand_chacha,https://github.com/rust-random/rand,MIT OR Apache-2.0,"The Rand Proj
 rand_core,https://github.com/rust-random/rand,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers"
 rand_core,https://github.com/rust-random/rand_core,MIT OR Apache-2.0,The Rand Project Developers
 rand_distr,https://github.com/rust-random/rand_distr,MIT OR Apache-2.0,The Rand Project Developers
+rand_hc,https://github.com/rust-random/rand,MIT OR Apache-2.0,The Rand Project Developers
 rand_xorshift,https://github.com/rust-random/rngs,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers"
 ratatui,https://github.com/ratatui/ratatui,MIT,"Florian Dehau <work@fdehau.com>, The Ratatui Developers"
 ratatui-core,https://github.com/ratatui/ratatui,MIT,"Florian Dehau <work@fdehau.com>, The Ratatui Developers"
@@ -693,6 +703,7 @@ serde_json,https://github.com/serde-rs/json,MIT OR Apache-2.0,"Erick Tryzelaar <
 serde_nanos,https://github.com/caspervonb/serde_nanos,MIT OR Apache-2.0,Casper Beyer <caspervonb@pm.me>
 serde_path_to_error,https://github.com/dtolnay/path-to-error,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 serde_plain,https://github.com/mitsuhiko/serde-plain,MIT OR Apache-2.0,Armin Ronacher <armin.ronacher@active-4.com>
+serde_qs,https://github.com/samscott89/serde_qs,MIT OR Apache-2.0,Sam Scott <sam@osohq.com>
 serde_repr,https://github.com/dtolnay/serde-repr,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 serde_spanned,https://github.com/toml-rs/toml,MIT OR Apache-2.0,The serde_spanned Authors
 serde_urlencoded,https://github.com/nox/serde_urlencoded,MIT OR Apache-2.0,Anthony Ramine <n.oxyde@gmail.com>
@@ -853,6 +864,7 @@ vrl,https://github.com/vectordotdev/vrl,MPL-2.0,Vector Contributors <vector@data
 vsimd,https://github.com/Nugine/simd,MIT,The vsimd Authors
 vte,https://github.com/alacritty/vte,Apache-2.0 OR MIT,"Joe Wilm <joe@jwilm.com>, Christian Duerr <contact@christianduerr.com>"
 wait-timeout,https://github.com/alexcrichton/wait-timeout,MIT OR Apache-2.0,Alex Crichton <alex@alexcrichton.com>
+waker-fn,https://github.com/smol-rs/waker-fn,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
 walkdir,https://github.com/BurntSushi/walkdir,Unlicense OR MIT,Andrew Gallant <jamslam@gmail.com>
 want,https://github.com/seanmonstar/want,MIT,Sean McArthur <sean@seanmonstar.com>
 warp,https://github.com/seanmonstar/warp,MIT,Sean McArthur <sean@seanmonstar.com>

From 54ccaf6def8201e0a2c09e7e0ae43e76e5979fbc Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Thu, 4 Jun 2026 07:59:05 +0200
Subject: [PATCH 316/326] fix(azure_blob): satisfy vdev check events - log
 periods, error event naming, log levels

- Add trailing periods to log messages per instrumentation spec
- Rename InvalidRowEventType to InvalidRowEventTypeError (error events must
  be named *Error)
- Downgrade QueueMessageProcessingErrored/Rejected logs from error! to warn!:
  these track delivery outcomes via dedicated counters, matching S3's warn-level
  handling of errored/rejected batches; real component errors already emit
  *Error events with component_errors_total

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/internal_events/azure_queue.rs | 18 +++++++++---------
 src/sources/azure_blob/mod.rs      |  4 ++--
 src/sources/azure_blob/queue.rs    |  4 ++--
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/src/internal_events/azure_queue.rs b/src/internal_events/azure_queue.rs
index 1c16a2dbcf375..52d25a1cc6dac 100644
--- a/src/internal_events/azure_queue.rs
+++ b/src/internal_events/azure_queue.rs
@@ -37,14 +37,14 @@ mod azure_blob {
     }
 
     #[derive(Debug, NamedInternalEvent)]
-    pub struct InvalidRowEventType<'a> {
+    pub struct InvalidRowEventTypeError<'a> {
         pub event: &'a Event,
     }
 
-    impl<'a> InternalEvent for InvalidRowEventType<'a> {
+    impl<'a> InternalEvent for InvalidRowEventTypeError<'a> {
         fn emit(self) {
             error!(
-                message = "Expected Azure rows as Log Events",
+                message = "Expected Azure rows as Log Events.",
                 event = ?self.event,
                 error_code = "invalid_azure_row_event",
                 error_type = error_type::CONDITION_FAILED,
@@ -97,7 +97,7 @@ pub struct QueueMessageDeleteError<'a, E> {
 impl<'a, E: std::fmt::Display> InternalEvent for QueueMessageDeleteError<'a, E> {
     fn emit(self) {
         error!(
-            message = "Failed deleting message",
+            message = "Failed deleting message.",
             error = %self.error,
             error_code = "failed_deleting_azure_queue_event",
             error_type = error_type::ACKNOWLEDGMENT_FAILED,
@@ -125,7 +125,7 @@ pub struct QueueStorageInvalidEventIgnored<'a> {
 impl<'a> InternalEvent for QueueStorageInvalidEventIgnored<'a> {
     fn emit(self) {
         trace!(
-            message = "Ignoring event because of wrong event type",
+            message = "Ignoring event because of wrong event type.",
             container = %self.container,
             subject = %self.subject,
             event_type = %self.event_type
@@ -149,7 +149,7 @@ pub struct QueueStorageMismatchingContainerName<'a> {
 impl<'a> InternalEvent for QueueStorageMismatchingContainerName<'a> {
     fn emit(self) {
         warn!(
-            message = "Ignoring event because of wrong container name",
+            message = "Ignoring event because of wrong container name.",
             configured_container = %self.configured_container,
             container = %self.container,
         );
@@ -180,7 +180,7 @@ pub struct QueueMessageProcessingErrored {}
 #[cfg(feature = "sources-azure_blob")]
 impl InternalEvent for QueueMessageProcessingErrored {
     fn emit(self) {
-        error!(message = "Batch event had a transient error in delivery.");
+        warn!(message = "Batch event had a transient error in delivery.");
         counter!("azure_queue_message_processing_errored_total").increment(1);
     }
 }
@@ -192,7 +192,7 @@ pub struct QueueMessageProcessingRejected {}
 #[cfg(feature = "sources-azure_blob")]
 impl InternalEvent for QueueMessageProcessingRejected {
     fn emit(self) {
-        error!(message = "Batch event had a permanent failure or rejection.");
+        warn!(message = "Batch event had a permanent failure or rejection.");
         counter!("azure_queue_message_processing_rejected_total").increment(1);
     }
 }
@@ -207,7 +207,7 @@ pub struct BlobDoesntExist<'a> {
 impl<'a> InternalEvent for BlobDoesntExist<'a> {
     fn emit(self) {
         warn!(
-            message = "Ignoring event because blob doesn't exist in storage",
+            message = "Ignoring event because blob doesn't exist in storage.",
             blob_name = self.nonexistent_blob_name
         );
         counter!(
diff --git a/src/sources/azure_blob/mod.rs b/src/sources/azure_blob/mod.rs
index 24377d685784e..0191ba94fc815 100644
--- a/src/sources/azure_blob/mod.rs
+++ b/src/sources/azure_blob/mod.rs
@@ -70,7 +70,7 @@ use crate::{
     },
     event::{BatchNotifier, BatchStatus, EstimatedJsonEncodedSizeOf, Event},
     internal_events::{
-        EventsReceived, InvalidRowEventType, QueueMessageProcessingErrored,
+        EventsReceived, InvalidRowEventTypeError, QueueMessageProcessingErrored,
         QueueMessageProcessingRejected, QueueMessageProcessingSucceeded, StreamClosedError,
     },
     line_agg,
@@ -380,7 +380,7 @@ impl AzureBlobStreamer {
                                 yield event
                             }
                             _ => {
-                                emit!(InvalidRowEventType{event: &event})
+                                emit!(InvalidRowEventTypeError{event: &event})
                             }
                         }
                     }
diff --git a/src/sources/azure_blob/queue.rs b/src/sources/azure_blob/queue.rs
index de5d38efe56bb..4d30ab6eff38f 100644
--- a/src/sources/azure_blob/queue.rs
+++ b/src/sources/azure_blob/queue.rs
@@ -381,7 +381,7 @@ async fn process_event_grid_message(
         return Ok(None);
     }
     trace!(
-        "Detected blob event ({}) in container '{}': '{}'",
+        "Detected blob event ({}) in container '{}': '{}'.",
         &body.event_type, &container, &blob
     );
     let blob_client = container_client.blob_client(&blob);
@@ -506,7 +506,7 @@ fn parse_subject(subject: String) -> Option<(String, String)> {
         || parts[5] != "blobs"
     {
         warn!(
-            "Ignoring event: subject has invalid format (expected /blobServices/default/containers/{{container}}/blobs/{{blob}}), got: '{}'",
+            "Ignoring event: subject has invalid format (expected /blobServices/default/containers/{{container}}/blobs/{{blob}}), got: '{}'.",
             subject
         );
         return None;

From 6027b9ff2a20b0b589eea4d4fbca27f27f513f1c Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Thu, 4 Jun 2026 08:15:22 +0200
Subject: [PATCH 317/326] fix(azure_blob): migrate metrics to typed CounterName
 per new clippy rules

Upstream now disallows raw-string metrics::counter! in favor of vector_common's
typed counter! macro with CounterName variants. Add the four azure_queue metric
names to CounterName and migrate all call sites. Also drop a useless format! in
integration tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../src/internal_event/metric_name.rs         | 14 +++++++++++
 src/internal_events/azure_queue.rs            | 24 +++++++++----------
 src/sources/azure_blob/integration_tests.rs   | 15 ++++++------
 3 files changed, 33 insertions(+), 20 deletions(-)

diff --git a/lib/vector-common/src/internal_event/metric_name.rs b/lib/vector-common/src/internal_event/metric_name.rs
index f520a3ecee316..8ca64f0d7ecf0 100644
--- a/lib/vector-common/src/internal_event/metric_name.rs
+++ b/lib/vector-common/src/internal_event/metric_name.rs
@@ -26,6 +26,10 @@ pub enum CounterName {
     AggregateFailedUpdates,
     AggregateFlushesTotal,
     ApiStartedTotal,
+    AzureQueueEventIgnoredTotal,
+    AzureQueueMessageProcessingErroredTotal,
+    AzureQueueMessageProcessingRejectedTotal,
+    AzureQueueMessageProcessingSucceededTotal,
     CheckpointsTotal,
     ChecksumErrorsTotal,
     CollectCompletedTotal,
@@ -281,6 +285,16 @@ impl CounterName {
             Self::AggregateFailedUpdates => "aggregate_failed_updates",
             Self::AggregateFlushesTotal => "aggregate_flushes_total",
             Self::ApiStartedTotal => "api_started_total",
+            Self::AzureQueueEventIgnoredTotal => "azure_queue_event_ignored_total",
+            Self::AzureQueueMessageProcessingErroredTotal => {
+                "azure_queue_message_processing_errored_total"
+            }
+            Self::AzureQueueMessageProcessingRejectedTotal => {
+                "azure_queue_message_processing_rejected_total"
+            }
+            Self::AzureQueueMessageProcessingSucceededTotal => {
+                "azure_queue_message_processing_succeeded_total"
+            }
             Self::CheckpointsTotal => "checkpoints_total",
             Self::ChecksumErrorsTotal => "checksum_errors_total",
             Self::CollectCompletedTotal => "collect_completed_total",
diff --git a/src/internal_events/azure_queue.rs b/src/internal_events/azure_queue.rs
index 52d25a1cc6dac..89cd9a081b3b9 100644
--- a/src/internal_events/azure_queue.rs
+++ b/src/internal_events/azure_queue.rs
@@ -1,7 +1,7 @@
 #[cfg(feature = "sources-azure_blob")]
 pub use azure_blob::*;
-use metrics::counter;
-use vector_lib::internal_event::{InternalEvent, error_stage, error_type};
+use vector_lib::counter;
+use vector_lib::internal_event::{CounterName, InternalEvent, error_stage, error_type};
 
 #[cfg(feature = "sources-azure_blob")]
 mod azure_blob {
@@ -27,7 +27,7 @@ mod azure_blob {
                 internal_log_rate_limit = true,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "failed_processing_azure_queue_message",
                 "error_type" => error_type::PARSER_FAILED,
                 "stage" => error_stage::PROCESSING,
@@ -51,7 +51,7 @@ mod azure_blob {
                 stage = error_stage::PROCESSING,
             );
             counter!(
-                "component_errors_total",
+                CounterName::ComponentErrorsTotal,
                 "error_code" => "invalid_azure_row_event",
                 "error_type" => error_type::CONDITION_FAILED,
                 "stage" => error_stage::PROCESSING,
@@ -78,7 +78,7 @@ impl<'a, E: std::fmt::Display> InternalEvent for QueueMessageReceiveError<'a, E>
             stage = error_stage::RECEIVING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "failed_fetching_azure_queue_events",
             "error_type" => error_type::REQUEST_FAILED,
             "stage" => error_stage::RECEIVING,
@@ -104,7 +104,7 @@ impl<'a, E: std::fmt::Display> InternalEvent for QueueMessageDeleteError<'a, E>
             stage = error_stage::PROCESSING,
         );
         counter!(
-            "component_errors_total",
+            CounterName::ComponentErrorsTotal,
             "error_code" => "failed_deleting_azure_queue_event",
             "error_type" => error_type::ACKNOWLEDGMENT_FAILED,
             "stage" => error_stage::PROCESSING,
@@ -131,7 +131,7 @@ impl<'a> InternalEvent for QueueStorageInvalidEventIgnored<'a> {
             event_type = %self.event_type
         );
         counter!(
-            "azure_queue_event_ignored_total",
+            CounterName::AzureQueueEventIgnoredTotal,
             "ignore_type" => "invalid_event_type"
         )
         .increment(1);
@@ -154,7 +154,7 @@ impl<'a> InternalEvent for QueueStorageMismatchingContainerName<'a> {
             container = %self.container,
         );
         counter!(
-            "azure_queue_event_ignored_total",
+            CounterName::AzureQueueEventIgnoredTotal,
             "ignore_type" => "mismatching_container_name"
         )
         .increment(1);
@@ -169,7 +169,7 @@ pub struct QueueMessageProcessingSucceeded {}
 impl InternalEvent for QueueMessageProcessingSucceeded {
     fn emit(self) {
         trace!(message = "Processed azure queue message successfully.");
-        counter!("azure_queue_message_processing_succeeded_total").increment(1);
+        counter!(CounterName::AzureQueueMessageProcessingSucceededTotal).increment(1);
     }
 }
 
@@ -181,7 +181,7 @@ pub struct QueueMessageProcessingErrored {}
 impl InternalEvent for QueueMessageProcessingErrored {
     fn emit(self) {
         warn!(message = "Batch event had a transient error in delivery.");
-        counter!("azure_queue_message_processing_errored_total").increment(1);
+        counter!(CounterName::AzureQueueMessageProcessingErroredTotal).increment(1);
     }
 }
 
@@ -193,7 +193,7 @@ pub struct QueueMessageProcessingRejected {}
 impl InternalEvent for QueueMessageProcessingRejected {
     fn emit(self) {
         warn!(message = "Batch event had a permanent failure or rejection.");
-        counter!("azure_queue_message_processing_rejected_total").increment(1);
+        counter!(CounterName::AzureQueueMessageProcessingRejectedTotal).increment(1);
     }
 }
 
@@ -211,7 +211,7 @@ impl<'a> InternalEvent for BlobDoesntExist<'a> {
             blob_name = self.nonexistent_blob_name
         );
         counter!(
-            "azure_queue_event_ignored_total",
+            CounterName::AzureQueueEventIgnoredTotal,
             "ignore_type" => "blob_doesnt_exist"
         )
         .increment(1);
diff --git a/src/sources/azure_blob/integration_tests.rs b/src/sources/azure_blob/integration_tests.rs
index ad09646ff487b..50c8e4d42ad72 100644
--- a/src/sources/azure_blob/integration_tests.rs
+++ b/src/sources/azure_blob/integration_tests.rs
@@ -987,13 +987,12 @@ async fn azure_blob_ignore_mismatching_container() {
 
     // Send a BlobCreated event referencing a different container
     let queue_client = make_queue_client(&config).expect("Failed to create queue client");
-    let message = format!(
-        r#"{{
+    let message = r#"{
       "topic": "/subscriptions/fa5f2180-1451-4461-9b1f-aae7d4b33cf8/resourceGroups/events_poc/providers/Microsoft.Storage/storageAccounts/eventspocaccount",
       "subject": "/blobServices/default/containers/other-container/blobs/some-blob.txt",
       "eventType": "Microsoft.Storage.BlobCreated",
       "id": "be3f21f7-201e-000b-7605-a29195062631",
-      "data": {{
+      "data": {
         "api": "PutBlob",
         "clientRequestId": "1fa42c94-6dd3-4172-95c4-fd9cf56b5009",
         "requestId": "be3f21f7-201e-000b-7605-a29195000000",
@@ -1003,15 +1002,15 @@ async fn azure_blob_ignore_mismatching_container() {
         "blobType": "BlockBlob",
         "url": "https://eventspocaccount.blob.core.windows.net/other-container/some-blob.txt",
         "sequencer": "0000000000000000000000000005C5360000000000276a63",
-        "storageDiagnostics": {{
+        "storageDiagnostics": {
           "batchId": "fec5b12c-2006-0034-0005-a25936000000"
-        }}
-      }},
+        }
+      },
       "dataVersion": "",
       "metadataVersion": "1",
       "eventTime": "2024-05-09T11:37:10.5637878Z"
-    }}"#
-    );
+    }"#
+    .to_string();
     queue_client
         .put_message(BASE64_STANDARD.encode(message))
         .await

From 09c1722a0fde3a0bbac3905dbd1e81afae0ff2cf Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Thu, 4 Jun 2026 09:30:44 +0200
Subject: [PATCH 318/326] docs(azure_blob): regenerate component CUE docs after
 rebase

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../sources/generated/azure_blob.cue          | 55 +++++++++----------
 1 file changed, 26 insertions(+), 29 deletions(-)

diff --git a/website/cue/reference/components/sources/generated/azure_blob.cue b/website/cue/reference/components/sources/generated/azure_blob.cue
index c2658ec0bee1d..e8a6da992c1e7 100644
--- a/website/cue/reference/components/sources/generated/azure_blob.cue
+++ b/website/cue/reference/components/sources/generated/azure_blob.cue
@@ -96,11 +96,8 @@ generated: components: sources: azure_blob: configuration: {
 						type: string: examples: ["{ \"type\": \"record\", \"name\": \"log\", \"fields\": [{ \"name\": \"message\", \"type\": \"string\" }] }"]
 					}
 					strip_schema_id_prefix: {
-						description: """
-																For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix.
-																According to [Confluent Kafka's document](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format).
-																"""
-						required: true
+						description: "For Avro datum encoded in Kafka messages, the bytes are prefixed with the schema ID.  Set this to `true` to strip the schema ID prefix, as described in [Confluent Kafka's documentation](https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#wire-format)."
+						required:    true
 						type: bool: {}
 					}
 				}
@@ -124,13 +121,13 @@ generated: components: sources: azure_blob: configuration: {
 
 															The GELF specification is more strict than the actual Graylog receiver.
 															Vector's decoder adheres more strictly to the GELF spec, with
-															the exception that some characters such as `@`  are allowed in field names.
+															the exception that some characters such as `@` are allowed in field names.
 
-															Other GELF codecs such as Loki's, use a [Go SDK][implementation] that is maintained
-															by Graylog, and is much more relaxed than the GELF spec.
+															Other GELF codecs, such as Loki's, use a [Go SDK][implementation] that is maintained
+															by Graylog and is much more relaxed than the GELF spec.
 
-															Going forward, Vector will use that [Go SDK][implementation] as the reference implementation, which means
-															the codec may continue to relax the enforcement of specification.
+															Going forward, Vector will use the [Go SDK][implementation] as the reference implementation, which means
+															the codec may continue to relax the enforcement of the specification.
 
 															[gelf]: https://docs.graylog.org/docs/gelf
 															[implementation]: https://github.com/Graylog2/go-gelf/blob/v2/gelf/reader.go
@@ -148,7 +145,7 @@ generated: components: sources: azure_blob: configuration: {
 						native: """
 															Decodes the raw bytes as [native Protocol Buffers format][vector_native_protobuf].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -158,7 +155,7 @@ generated: components: sources: azure_blob: configuration: {
 						native_json: """
 															Decodes the raw bytes as [native JSON format][vector_native_json].
 
-															This decoder can output all types of events (logs, metrics, traces).
+															This decoder can output all types of events: logs, metrics, and traces.
 
 															This codec is **[experimental][experimental]**.
 
@@ -220,7 +217,7 @@ generated: components: sources: azure_blob: configuration: {
 								relaxed: """
 																			Uses more relaxed validation that skips strict GELF specification checks.
 
-																			This mode will not treat specification violations as errors, allowing the decoder
+																			This mode does not treat specification violations as errors, allowing the decoder
 																			to accept messages from sources that don't strictly follow the GELF spec.
 																			"""
 								strict: "Uses strict validation that closely follows the GELF spec."
@@ -288,7 +285,7 @@ generated: components: sources: azure_blob: configuration: {
 
 																This file is the output of `protoc -I <include path> -o <desc output path> <proto>`.
 
-																You can read more [here](https://buf.build/docs/reference/images/#how-buf-images-work).
+																For more information, see [How Buf images work](https://buf.build/docs/reference/images/#how-buf-images-work).
 																"""
 						required: false
 						type: string: default: ""
@@ -306,7 +303,7 @@ generated: components: sources: azure_blob: configuration: {
 																Use JSON field names (camelCase) instead of protobuf field names (snake_case).
 
 																When enabled, the deserializer will output fields using their JSON names as defined
-																in the `.proto` file (e.g., `jobDescription` instead of `job_description`).
+																in the `.proto` file (for example, `jobDescription` instead of `job_description`).
 
 																This is useful when working with data that needs to be converted to JSON or
 																when interfacing with systems that use JSON naming conventions.
@@ -320,11 +317,11 @@ generated: components: sources: azure_blob: configuration: {
 				description: """
 					Signal types to attempt parsing, in priority order.
 
-					The deserializer will try parsing in the order specified. This allows you to optimize
+					The deserializer tries to parse signals in the specified order. This allows you to optimize
 					performance when you know the expected signal types. For example, if you only receive
 					traces, set this to `["traces"]` to avoid attempting to parse as logs or metrics first.
 
-					If not specified, defaults to trying all types in order: logs, metrics, traces.
+					If not specified, defaults to trying all types in this order: logs, metrics, traces.
 					Duplicate signal types are automatically removed while preserving order.
 					"""
 				relevant_when: "codec = \"otlp\""
@@ -362,8 +359,8 @@ generated: components: sources: azure_blob: configuration: {
 					source: {
 						description: """
 																The [Vector Remap Language][vrl] (VRL) program to execute for each event.
-																Note that the final contents of the `.` target will be used as the decoding result.
-																Compilation error or use of 'abort' in a program will result in a decoding error.
+																The final contents of the `.` target are used as the decoding result.
+																Compilation errors or use of `abort` in the program result in a decoding error.
 
 																[vrl]: https://vector.dev/docs/reference/vrl
 																"""
@@ -418,13 +415,13 @@ generated: components: sources: azure_blob: configuration: {
 
 																This length does *not* include the trailing delimiter.
 
-																By default, there is no maximum length enforced. If events are malformed, this can lead to
+																By default, no maximum length is enforced. If events are malformed, this can lead to
 																additional resource usage as events continue to be buffered in memory, and can potentially
 																lead to memory exhaustion in extreme cases.
 
 																If there is a risk of processing malformed data, such as logs with user-controlled input,
 																consider setting the maximum length to a reasonably large value as a safety net. This
-																ensures that processing is not actually unbounded.
+																prevents processing from being unbounded.
 																"""
 						required: false
 						type: uint: {}
@@ -451,15 +448,15 @@ generated: components: sources: azure_blob: configuration: {
 					}
 					max_length: {
 						description: """
-																The maximum length of a single GELF message, in bytes. Messages longer than this length will
-																be dropped. If this option is not set, the decoder does not limit the length of messages and
+																The maximum length of a single GELF message, in bytes. Messages longer than this length are
+																dropped. If this option is not set, the decoder does not limit the length of messages and
 																the per-message memory is unbounded.
 
-																**Note**: A message can be composed of multiple chunks and this limit is applied to the whole
+																**Note**: A message can be composed of multiple chunks, and this limit applies to the whole
 																message, not to individual chunks.
 
-																This limit takes only into account the message's payload and the GELF header bytes are excluded from the calculation.
-																The message's payload is the concatenation of all the chunks' payloads.
+																This limit takes into account only the message payload. GELF header bytes are excluded from the calculation.
+																The message payload is the concatenation of all chunk payloads.
 																"""
 						required: false
 						type: uint: {}
@@ -477,7 +474,7 @@ generated: components: sources: azure_blob: configuration: {
 					timeout_secs: {
 						description: """
 																The timeout, in seconds, for a message to be fully received. If the timeout is reached, the
-																decoder drops all the received chunks of the timed out message.
+																decoder drops all received chunks for the timed-out message.
 																"""
 						required: false
 						type: float: default: 5.0
@@ -554,13 +551,13 @@ generated: components: sources: azure_blob: configuration: {
 
 						This length does *not* include the trailing delimiter.
 
-						By default, there is no maximum length enforced. If events are malformed, this can lead to
+						By default, no maximum length is enforced. If events are malformed, this can lead to
 						additional resource usage as events continue to be buffered in memory, and can potentially
 						lead to memory exhaustion in extreme cases.
 
 						If there is a risk of processing malformed data, such as logs with user-controlled input,
 						consider setting the maximum length to a reasonably large value as a safety net. This
-						ensures that processing is not actually unbounded.
+						prevents processing from being unbounded.
 						"""
 					required: false
 					type: uint: {}

From f2786ba865435021f21fc02b9b494764a8120b82 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Thu, 4 Jun 2026 15:19:44 +0200
Subject: [PATCH 319/326] docs(azure_blob): fix markdownlint violations in
 manual test docs

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 testing/github-13882/steps.md        | 19 +++++++++++++++++++
 testing/github-13882/test-results.md | 12 ++++++------
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/testing/github-13882/steps.md b/testing/github-13882/steps.md
index 7312ee2f40661..a8ea0bb4db8fe 100644
--- a/testing/github-13882/steps.md
+++ b/testing/github-13882/steps.md
@@ -5,6 +5,7 @@
 This PR introduces a new Vector source that reads logs from Azure Blob Storage by processing events from an Azure Storage Queue. The implementation aims at supporting the same features as the AWS S3 source, providing Event Grid integration for real-time blob processing.
 
 Key features implemented:
+
 - Compression auto-detection (gzip, zstd) from Content-Type headers and file extensions
 - Configurable framing (newline-delimited, character-delimited, bytes, length-delimited, octet-counting)
 - Multiline aggregation for stack traces and multi-line logs
@@ -28,17 +29,22 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
 ### Prerequisites Setup
 
 - Deploy Azure infrastructure:
+
   ```bash
   cd testing/github-13882
   terraform init
   terraform apply
   export AZURE_STORAGE_CONNECTION_STRING=$(terraform output -raw connection_string)
   ```
+
 - Build Vector with azure_blob feature:
+
   ```bash
   cargo build --features sources-azure_blob
   ```
+
 - Start Vector:
+
   ```bash
   cargo run --features sources-azure_blob -- --config testing/github-13882/config.toml
   ```
@@ -47,6 +53,7 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
 
 1. Plain text logs with newline-delimited framing:
    - Upload plain text logs:
+
      ```bash
      echo -e "2024-01-02 INFO Application started\n2024-01-02 INFO Processing request\n2024-01-02 INFO Request completed" | \
      az storage blob upload \
@@ -55,6 +62,7 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
        --name "test-$(date +%s).log" \
        --data @-
      ```
+
    - Vector receives Event Grid notification via queue.
    - Blob is downloaded and processed by `azure_logs_plain` source (bytes codec, no multiline).
    - Three events are emitted (one per line).
@@ -63,6 +71,7 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
 
 2. JSON logs with JSON codec:
    - Upload JSON-formatted logs:
+
      ```bash
      echo '{"timestamp":"2024-01-02T12:00:00Z","level":"info","message":"Test log 1"}
      {"timestamp":"2024-01-02T12:00:01Z","level":"warn","message":"Test log 2"}
@@ -73,6 +82,7 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
        --name "json-test-$(date +%s).log" \
        --data @-
      ```
+
    - Vector processes blob with `azure_logs_json` source (JSON codec).
    - Three events emitted.
    - JSON fields (`timestamp`, `level`, `message`) are parsed into event structure.
@@ -80,6 +90,7 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
 
 3. Gzip compression auto-detection from file extension:
    - Upload gzip-compressed plain text blob with `.gz` extension:
+
      ```bash
      echo -e "Compressed log line 1\nCompressed log line 2\nCompressed log line 3" | gzip > /tmp/test.log.gz
      az storage blob upload \
@@ -88,6 +99,7 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
        --name "test-$(date +%s).log.gz" \
        --file /tmp/test.log.gz
      ```
+
    - Compression auto-detected from `.gz` extension (compression=auto by default).
    - Blob automatically decompressed during processing.
    - Three events emitted (one per line after decompression).
@@ -95,6 +107,7 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
 
 4. Zstd compression support:
    - Upload zstd-compressed plain text blob:
+
      ```bash
      echo -e "Line 1\nLine 2\nLine 3" | zstd > /tmp/test.log.zst
      az storage blob upload \
@@ -103,6 +116,7 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
        --name "zstd-test-$(date +%s).log.zst" \
        --file /tmp/test.log.zst
      ```
+
    - Zstd compression detected from `.zst` extension.
    - Blob decompressed using zstd algorithm.
    - Three events emitted (one per line).
@@ -110,6 +124,7 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
 
 5. Multiline aggregation for stack traces:
    - Upload logs with stack traces that should be aggregated:
+
      ```bash
      echo '2024-01-02 12:34:56 ERROR Something failed
        at com.example.Service.process(Service.java:45)
@@ -124,6 +139,7 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
        --name "stacktrace-$(date +%s).log.gz" \
        --file /tmp/stacktrace.log.gz
      ```
+
    - Processed by `azure_logs_multiline` source (bytes codec WITH multiline config).
    - Compression auto-detected and decompressed.
    - Multiline configuration aggregates continuation lines (starting with whitespace).
@@ -133,10 +149,12 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
    - Total: 3 events (not 6).
 
 6. Graceful shutdown:
+
      ```bash
      sleep 5
      pkill -SIGTERM vector
      ```
+
    - Vector receives SIGTERM and begins graceful shutdown.
    - No panics or errors during shutdown.
    - Vector exits with status code 0.
@@ -144,6 +162,7 @@ We'll use the Azure CLI (`az storage blob upload`) to upload test blobs, which w
 ### Cleanup
 
 - After testing, destroy Azure resources to avoid ongoing costs:
+
   ```bash
   cd testing/github-13882
   terraform destroy
diff --git a/testing/github-13882/test-results.md b/testing/github-13882/test-results.md
index f87868890dc3d..fe2e2f1e40cd5 100644
--- a/testing/github-13882/test-results.md
+++ b/testing/github-13882/test-results.md
@@ -2,7 +2,7 @@
 
 ## Test 1
 
-```
+```text
 $ echo -e "2024-01-02 INFO Application started\n2024-01-02 INFO Processing request\n2024-01-02 INFO Request completed" | \
 $ az storage blob upload \
   --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
@@ -32,7 +32,7 @@ Finished[#############################################################]  100.000
 
 ## Test 2
 
-```
+```text
 $ echo '{"timestamp":"2024-01-02T12:00:00Z","level":"info","message":"Test log 1"}
 {"timestamp":"2024-01-02T12:00:01Z","level":"warn","message":"Test log 2"}
 {"timestamp":"2024-01-02T12:00:02Z","level":"error","message":"Test log 3"}' | \
@@ -64,7 +64,7 @@ Finished[#############################################################]  100.000
 
 ## Test 3
 
-```
+```text
 $ echo -e "Compressed log line 1\nCompressed log line 2\nCompressed log line 3" | gzip > /tmp/test.log.gz
 $ az storage blob upload \
   --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
@@ -94,7 +94,7 @@ Finished[#############################################################]  100.000
 
 ## Test 4
 
-```
+```text
 $ echo -e "Line 1\nLine 2\nLine 3" | zstd > /tmp/test.log.zst
 $ az storage blob upload \
   --connection-string "$AZURE_STORAGE_CONNECTION_STRING" \
@@ -124,7 +124,7 @@ Finished[#############################################################]  100.000
 
 ## Test 5
 
-```
+```text
 $ echo '2024-01-02 12:34:56 ERROR Something failed
   at com.example.Service.process(Service.java:45)
   at com.example.Handler.handle(Handler.java:23)
@@ -159,7 +159,7 @@ Finished[#############################################################]  100.000
 
 ## Test 6
 
-```
+```text
 $ kill -SIGTERM $VECTOR_PID
 
 ### vector shell output

From a1c4d4b32c3a80f198a99315594b84019ed033e7 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Thu, 4 Jun 2026 15:20:15 +0200
Subject: [PATCH 320/326] chore(azure_blob): add azure_blob doc terms to
 spelling expect list

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/actions/spelling/expect.txt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index beee750db8d5b..c64d506ed3db5 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -187,6 +187,7 @@ EOL'ed
 errorf
 esque
 etsy
+eventgrid
 eventsdropped
 eventstore
 eventstoredb
@@ -376,6 +377,7 @@ musleabihf
 muslueabihf
 mustprogress
 mutiple
+myaccount
 myannotation
 mycie
 mycorp
@@ -436,6 +438,7 @@ percpu
 pgo
 PIDs
 PII
+pkill
 plainify
 plds
 ple

From e8e4ee5882d1f0aa0c941cfe0b8fcf36c37ce8a7 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Thu, 4 Jun 2026 15:29:28 +0200
Subject: [PATCH 321/326] test(azure_blob): use AZURITE_ADDRESS env var in
 source integration tests

Upstream restructured the azure integration test env (AZURITE_ADDRESS +
AZURITE_OAUTH_ADDRESS); the branch's custom AZURE_ADDRESS line was lost in
the rebase. Align the source tests with the sink tests' convention instead
of reintroducing a third variable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/sources/azure_blob/integration_tests.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sources/azure_blob/integration_tests.rs b/src/sources/azure_blob/integration_tests.rs
index 50c8e4d42ad72..ca7f5b92cc2c9 100644
--- a/src/sources/azure_blob/integration_tests.rs
+++ b/src/sources/azure_blob/integration_tests.rs
@@ -18,7 +18,7 @@ use crate::{
 
 impl AzureBlobConfig {
     pub async fn new_emulator() -> AzureBlobConfig {
-        let address = std::env::var("AZURE_ADDRESS").unwrap_or_else(|_| "localhost".to_string());
+        let address = std::env::var("AZURITE_ADDRESS").unwrap_or_else(|_| "localhost".to_string());
         let config = AzureBlobConfig {
                 connection_string: format!("UseDevelopmentStorage=true;DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://{}:10000/devstoreaccount1;QueueEndpoint=http://{}:10001/devstoreaccount1;TableEndpoint=http://{}:10002/devstoreaccount1;", address, address, address).into(),
                 container_name: "logs".to_string(),

From 1d26444c78adba74a628da91704a673487cb05bb Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Fri, 5 Jun 2026 06:53:47 +0200
Subject: [PATCH 322/326] fix(azure_blob): address remaining CI failures on
 rebased branch

- deny.toml: re-add RUSTSEC-2024-0384 (instant) ignore - reintroduced by the
  legacy azure_core 0.21 dependency chain; upstream dropped it when nothing
  pulled instant anymore
- azure_blob.cue: drop classes.commonly_used - field removed from the
  component schema upstream
- expect.txt: add deser - pre-existing word flagged by code scanning due to
  large PR diff
- compose.yaml: prettier list indentation

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/actions/spelling/expect.txt                     | 1 +
 deny.toml                                               | 1 +
 tests/integration/azure/config/compose.yaml             | 6 +++---
 website/cue/reference/components/sources/azure_blob.cue | 1 -
 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index c64d506ed3db5..817894b24e552 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -151,6 +151,7 @@ demoing
 demux
 dependant
 dereferenceable
+deser
 desync
 developerguide
 DFm
diff --git a/deny.toml b/deny.toml
index e6c3a90bd6e9c..2465c817e0440 100644
--- a/deny.toml
+++ b/deny.toml
@@ -48,4 +48,5 @@ ignore = [
   { id = "RUSTSEC-2026-0099", reason = "rustls-webpki 0.102/0.101 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
   { id = "RUSTSEC-2024-0436", reason = "paste crate is unmaintained - transitive dependency via parquet v56.2.0, no safe upgrade available" },
   { id = "RUSTSEC-2026-0104", reason = "rustls-webpki 0.102/0.101 CRL parsing panic - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179); 0.103 already patched to 0.103.13" },
+  { id = "RUSTSEC-2024-0384", reason = "instant is unmaintained - transitive dependency of the legacy azure_core 0.21 (via http-types/futures-lite), needed until the azure_storage* crates migrate to the new Azure SDK" },
 ]
diff --git a/tests/integration/azure/config/compose.yaml b/tests/integration/azure/config/compose.yaml
index 3c13c5060231e..3f8db0c64f416 100644
--- a/tests/integration/azure/config/compose.yaml
+++ b/tests/integration/azure/config/compose.yaml
@@ -5,9 +5,9 @@ services:
     image: mcr.microsoft.com/azure-storage/azurite:${CONFIG_VERSION}
     command: azurite --blobHost 0.0.0.0 --queueHost 0.0.0.0 --loose
     ports:
-    - "10000:10000"
-    - "10001:10001"
-    - "10002:10002"
+      - "10000:10000"
+      - "10001:10001"
+      - "10002:10002"
     volumes:
       - /var/run:/var/run
 
diff --git a/website/cue/reference/components/sources/azure_blob.cue b/website/cue/reference/components/sources/azure_blob.cue
index 8cbf6e421ee57..75ed99831ef32 100644
--- a/website/cue/reference/components/sources/azure_blob.cue
+++ b/website/cue/reference/components/sources/azure_blob.cue
@@ -22,7 +22,6 @@ components: sources: azure_blob: {
 	}
 
 	classes: {
-		commonly_used: true
 		deployment_roles: ["aggregator", "daemon", "sidecar"]
 		delivery:      "at_least_once"
 		development:   "beta"

From 6c48e36be5159367edf9c59bd7102ef185204642 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sat, 6 Jun 2026 08:20:13 +0200
Subject: [PATCH 323/326] refactor(azure_blob): promote new-SDK client
 machinery to src/azure

Move connection_string.rs, shared_key_policy.rs, and the auth/client-construction
code (AzureAuthentication, build_client, transport assembly) from
sinks/azure_common into the shared src/azure module, so the azure_blob source can
reuse them. Sinks keep their import paths via re-exports.

Also:
- Fix SharedKey signing: Content-Length must contribute an empty string when the
  request body is zero-length (per the Authorize-with-Shared-Key spec and this
  file's own doc comment). The sink never signs zero-body requests so this was
  latent; queue operations (create/delete_message) hit it.
- Re-gate 'pub mod azure' on the azure component features instead of the 'azure'
  meta-feature (which only the source enabled, and which will be removed when the
  legacy SDK is dropped).
- Add azure_storage_queue 1.0 dependency and new-SDK deps to sources-azure_blob
  (transitional, legacy crates removed in a follow-up commit).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Cargo.lock                                    |  13 +
 Cargo.toml                                    |   3 +-
 src/azure/client.rs                           | 596 ++++++++++++++++++
 .../connection_string.rs                      |   1 +
 src/azure/mod.rs                              |  12 +
 .../shared_key_policy.rs                      |  10 +-
 src/lib.rs                                    |   6 +-
 src/sinks/azure_common/config.rs              | 596 +-----------------
 src/sinks/azure_common/mod.rs                 |   2 -
 9 files changed, 645 insertions(+), 594 deletions(-)
 create mode 100644 src/azure/client.rs
 rename src/{sinks/azure_common => azure}/connection_string.rs (99%)
 rename src/{sinks/azure_common => azure}/shared_key_policy.rs (96%)

diff --git a/Cargo.lock b/Cargo.lock
index d911bcfd69cc2..7d88268c9a83b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2038,6 +2038,18 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "azure_storage_queue"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e3836053722dfa5aa3461e47aebb96e230a87d8d22eb1f866ca704f691b93ae"
+dependencies = [
+ "async-trait",
+ "azure_core 1.0.0",
+ "serde",
+ "time",
+]
+
 [[package]]
 name = "azure_storage_queues"
 version = "0.21.0"
@@ -13153,6 +13165,7 @@ dependencies = [
  "azure_storage",
  "azure_storage_blob",
  "azure_storage_blobs",
+ "azure_storage_queue",
  "azure_storage_queues",
  "base64 0.22.1",
  "bloomy",
diff --git a/Cargo.toml b/Cargo.toml
index e7ce00dc59578..cbb36f609ce3f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -311,6 +311,7 @@ azure_identity = { version = "1.0", default-features = false, features = ["clien
 
 # Azure Storage
 azure_storage_blob = { version = "1.0", default-features = false, optional = true }
+azure_storage_queue = { version = "1.0", default-features = false, optional = true }
 azure_storage = { version = "0.21", default-features = false, optional = true }
 azure_storage_blobs = { version = "0.21", default-features = false, optional = true }
 azure_storage_queues = { version = "0.21", default-features = false, optional = true }
@@ -734,7 +735,7 @@ sources-aws_ecs_metrics = ["sources-utils-http-client"]
 sources-aws_kinesis_firehose = ["dep:base64"]
 sources-aws_s3 = ["aws-core", "dep:aws-sdk-sqs", "dep:aws-sdk-s3", "dep:async-compression", "sources-aws_sqs", "tokio-util/io"]
 sources-aws_sqs = ["aws-core", "dep:aws-sdk-sqs"]
-sources-azure_blob = ["azure", "dep:azure_core", "dep:azure_storage_queues", "dep:base64", "dep:async-compression", "tokio-util/io"]
+sources-azure_blob = ["azure", "dep:azure_core", "dep:azure_identity", "dep:azure_storage_blob", "dep:azure_storage_queue", "dep:azure_storage_queues", "dep:base64", "dep:async-compression", "tokio-util/io"]
 sources-datadog_agent = ["sources-utils-http-encoding", "protobuf-build", "dep:prost"]
 sources-demo_logs = ["dep:fakedata"]
 sources-dnstap = ["sources-utils-net-tcp", "dep:base64", "dep:hickory-proto", "dep:dnsmsg-parser", "dep:dnstap-parser", "protobuf-build", "dep:prost", "vector-vrl-functions/dnstap"]
diff --git a/src/azure/client.rs b/src/azure/client.rs
new file mode 100644
index 0000000000000..a77d17a8886d0
--- /dev/null
+++ b/src/azure/client.rs
@@ -0,0 +1,596 @@
+//! Shared Azure client construction: authentication, connection-string handling,
+//! and HTTP transport assembly for the new official Azure SDK (`azure_core` 1.0).
+//!
+//! Used by both Azure sinks (via re-exports in `crate::sinks::azure_common`) and
+//! the `azure_blob` source.
+#![allow(missing_docs)]
+
+use std::fs::File;
+use std::io::Read;
+use std::path::PathBuf;
+use std::sync::Arc;
+
+#[cfg(test)]
+use base64::prelude::*;
+
+use azure_core::credentials::{TokenCredential, TokenRequestOptions};
+use azure_core::http::{ClientMethodOptions, Url};
+use azure_core::{Error, error::ErrorKind};
+
+use azure_identity::{
+    AzureCliCredential, ClientAssertion, ClientAssertionCredential, ClientCertificateCredential,
+    ClientCertificateCredentialOptions, ClientSecretCredential, ManagedIdentityCredential,
+    ManagedIdentityCredentialOptions, UserAssignedId, WorkloadIdentityCredential,
+    WorkloadIdentityCredentialOptions,
+};
+
+use azure_storage_blob::{BlobContainerClient, BlobContainerClientOptions};
+
+use vector_lib::{configurable::configurable_component, sensitive_string::SensitiveString};
+
+use crate::azure::connection_string::{Auth, ParsedConnectionString};
+use crate::azure::shared_key_policy::SharedKeyAuthorizationPolicy;
+
+/// TLS configuration.
+#[configurable_component]
+#[configurable(metadata(docs::advanced))]
+#[derive(Clone, Debug, Default)]
+#[serde(deny_unknown_fields)]
+pub struct AzureBlobTlsConfig {
+    /// Absolute path to an additional CA certificate file.
+    ///
+    /// The certificate must be in PEM (X.509) format.
+    #[serde(alias = "ca_path")]
+    #[configurable(metadata(docs::examples = "/path/to/certificate_authority.crt"))]
+    #[configurable(metadata(docs::human_name = "CA File Path"))]
+    pub ca_file: Option<PathBuf>,
+}
+
+/// Azure service principal authentication.
+#[configurable_component]
+#[derive(Clone, Debug, Eq, PartialEq)]
+#[serde(deny_unknown_fields, untagged)]
+pub enum AzureAuthentication {
+    #[configurable(metadata(docs::enum_tag_description = "The kind of Azure credential to use."))]
+    Specific(SpecificAzureCredential),
+
+    /// Mock credential for testing — returns a static fake token
+    #[cfg(test)]
+    #[serde(skip)]
+    MockCredential,
+}
+
+impl Default for AzureAuthentication {
+    // This should never be actually used.
+    // This is only needed when using Default::default() (such as unit tests),
+    // as serde requires `azure_credential_kind` to be specified.
+    fn default() -> Self {
+        Self::Specific(SpecificAzureCredential::ManagedIdentity {
+            user_assigned_managed_identity_id: None,
+            user_assigned_managed_identity_id_type: None,
+        })
+    }
+}
+
+#[configurable_component]
+#[derive(Clone, Debug, Eq, PartialEq)]
+#[serde(deny_unknown_fields, rename_all = "snake_case")]
+#[derive(Default)]
+/// User Assigned Managed Identity Types.
+pub enum UserAssignedManagedIdentityIdType {
+    #[default]
+    /// Client ID
+    ClientId,
+    /// Object ID
+    ObjectId,
+    /// Resource ID
+    ResourceId,
+}
+
+/// Specific Azure credential types.
+#[configurable_component]
+#[derive(Clone, Debug, Eq, PartialEq)]
+#[serde(
+    tag = "azure_credential_kind",
+    rename_all = "snake_case",
+    deny_unknown_fields
+)]
+pub enum SpecificAzureCredential {
+    /// Use Azure CLI credentials
+    #[cfg(not(target_arch = "wasm32"))]
+    AzureCli {},
+
+    /// Use certificate credentials
+    ClientCertificateCredential {
+        /// The [Azure Tenant ID][azure_tenant_id].
+        ///
+        /// [azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_TENANT_ID:?err}"))]
+        azure_tenant_id: String,
+
+        /// The [Azure Client ID][azure_client_id].
+        ///
+        /// [azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_ID:?err}"))]
+        azure_client_id: String,
+
+        /// PKCS12 certificate with RSA private key.
+        #[configurable(metadata(docs::examples = "path/to/certificate.pfx"))]
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_CERTIFICATE_PATH:?err}"))]
+        certificate_path: PathBuf,
+
+        /// The password for the client certificate, if applicable.
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_CERTIFICATE_PASSWORD}"))]
+        certificate_password: Option<SensitiveString>,
+    },
+
+    /// Use client ID/secret credentials
+    ClientSecretCredential {
+        /// The [Azure Tenant ID][azure_tenant_id].
+        ///
+        /// [azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_TENANT_ID:?err}"))]
+        azure_tenant_id: String,
+
+        /// The [Azure Client ID][azure_client_id].
+        ///
+        /// [azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_ID:?err}"))]
+        azure_client_id: String,
+
+        /// The [Azure Client Secret][azure_client_secret].
+        ///
+        /// [azure_client_secret]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00-00~000000-0000000~0000000000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_SECRET:?err}"))]
+        azure_client_secret: SensitiveString,
+    },
+
+    /// Use Managed Identity credentials
+    ManagedIdentity {
+        /// The User Assigned Managed Identity to use.
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        user_assigned_managed_identity_id: Option<String>,
+
+        /// The type of the User Assigned Managed Identity ID provided (Client ID, Object ID,
+        /// or Resource ID). Defaults to Client ID.
+        user_assigned_managed_identity_id_type: Option<UserAssignedManagedIdentityIdType>,
+    },
+
+    /// Use Managed Identity with Client Assertion credentials
+    ManagedIdentityClientAssertion {
+        /// The User Assigned Managed Identity to use for the managed identity.
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(
+            docs::examples = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-vector/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id-vector-uami"
+        ))]
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        user_assigned_managed_identity_id: Option<String>,
+
+        /// The type of the User Assigned Managed Identity ID provided (Client ID, Object ID, or Resource ID). Defaults to Client ID.
+        user_assigned_managed_identity_id_type: Option<UserAssignedManagedIdentityIdType>,
+
+        /// The target Tenant ID to use.
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        client_assertion_tenant_id: String,
+
+        /// The target Client ID to use.
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        client_assertion_client_id: String,
+    },
+
+    /// Use Workload Identity credentials
+    WorkloadIdentity {
+        /// The [Azure Tenant ID][azure_tenant_id]. Defaults to the value of the environment variable `AZURE_TENANT_ID`.
+        ///
+        /// [azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_TENANT_ID}"))]
+        tenant_id: Option<String>,
+
+        /// The [Azure Client ID][azure_client_id]. Defaults to the value of the environment variable `AZURE_CLIENT_ID`.
+        ///
+        /// [azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
+        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
+        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_ID}"))]
+        client_id: Option<String>,
+
+        /// Path of a file containing a Kubernetes service account token. Defaults to the value of the environment variable `AZURE_FEDERATED_TOKEN_FILE`.
+        #[configurable(metadata(
+            docs::examples = "/var/run/secrets/azure/tokens/azure-identity-token"
+        ))]
+        #[configurable(metadata(docs::examples = "${AZURE_FEDERATED_TOKEN_FILE}"))]
+        token_file_path: Option<PathBuf>,
+    },
+}
+
+#[derive(Debug)]
+struct ManagedIdentityClientAssertion {
+    credential: Arc<dyn TokenCredential>,
+    scope: String,
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
+impl ClientAssertion for ManagedIdentityClientAssertion {
+    async fn secret(&self, options: Option<ClientMethodOptions<'_>>) -> azure_core::Result<String> {
+        Ok(self
+            .credential
+            .get_token(
+                &[&self.scope],
+                Some(TokenRequestOptions {
+                    method_options: options.unwrap_or_default(),
+                }),
+            )
+            .await?
+            .token
+            .secret()
+            .to_string())
+    }
+}
+
+impl AzureAuthentication {
+    /// Returns the provider for the credentials based on the authentication mechanism chosen.
+    pub async fn credential(&self) -> azure_core::Result<Arc<dyn TokenCredential>> {
+        match self {
+            Self::Specific(specific) => specific.credential().await,
+
+            #[cfg(test)]
+            Self::MockCredential => Ok(Arc::new(MockTokenCredential) as Arc<dyn TokenCredential>),
+        }
+    }
+}
+
+impl SpecificAzureCredential {
+    /// Returns the provider for the credentials based on the specific credential type.
+    pub async fn credential(&self) -> azure_core::Result<Arc<dyn TokenCredential>> {
+        let credential: Arc<dyn TokenCredential> = match self {
+            #[cfg(not(target_arch = "wasm32"))]
+            Self::AzureCli {} => AzureCliCredential::new(None)?,
+
+            // requires azure_identity feature 'client_certificate'
+            Self::ClientCertificateCredential {
+                azure_tenant_id,
+                azure_client_id,
+                certificate_path,
+                certificate_password,
+            } => {
+                let certificate_bytes: Vec<u8> = std::fs::read(certificate_path).map_err(|e| {
+                    Error::with_message(
+                        ErrorKind::Credential,
+                        format!(
+                            "Failed to read certificate file {}: {e}",
+                            certificate_path.display()
+                        ),
+                    )
+                })?;
+
+                let mut options: ClientCertificateCredentialOptions =
+                    ClientCertificateCredentialOptions::default();
+                if let Some(password) = certificate_password {
+                    options.password = Some(password.inner().to_string().into());
+                }
+
+                ClientCertificateCredential::new(
+                    azure_tenant_id.clone(),
+                    azure_client_id.clone(),
+                    certificate_bytes.into(),
+                    Some(options),
+                )?
+            }
+
+            Self::ClientSecretCredential {
+                azure_tenant_id,
+                azure_client_id,
+                azure_client_secret,
+            } => {
+                if azure_tenant_id.is_empty() {
+                    return Err(Error::with_message(ErrorKind::Credential,
+                        "`auth.azure_tenant_id` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
+                    ));
+                }
+                if azure_client_id.is_empty() {
+                    return Err(Error::with_message(ErrorKind::Credential,
+                        "`auth.azure_client_id` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
+                    ));
+                }
+                if azure_client_secret.inner().is_empty() {
+                    return Err(Error::with_message(ErrorKind::Credential,
+                        "`auth.azure_client_secret` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
+                    ));
+                }
+
+                let secret: String = azure_client_secret.inner().into();
+                ClientSecretCredential::new(
+                    &azure_tenant_id.clone(),
+                    azure_client_id.clone(),
+                    secret.into(),
+                    None,
+                )?
+            }
+
+            Self::ManagedIdentity {
+                user_assigned_managed_identity_id,
+                user_assigned_managed_identity_id_type,
+            } => {
+                let mut options = ManagedIdentityCredentialOptions::default();
+                if let Some(id) = user_assigned_managed_identity_id {
+                    options.user_assigned_id = match user_assigned_managed_identity_id_type
+                        .as_ref()
+                        .unwrap_or(&Default::default())
+                    {
+                        UserAssignedManagedIdentityIdType::ClientId => {
+                            Some(UserAssignedId::ClientId(id.clone()))
+                        }
+                        UserAssignedManagedIdentityIdType::ObjectId => {
+                            Some(UserAssignedId::ObjectId(id.clone()))
+                        }
+                        UserAssignedManagedIdentityIdType::ResourceId => {
+                            Some(UserAssignedId::ResourceId(id.clone()))
+                        }
+                    };
+                }
+                ManagedIdentityCredential::new(Some(options))?
+            }
+
+            Self::ManagedIdentityClientAssertion {
+                user_assigned_managed_identity_id,
+                user_assigned_managed_identity_id_type,
+                client_assertion_tenant_id,
+                client_assertion_client_id,
+            } => {
+                let mut options = ManagedIdentityCredentialOptions::default();
+                if let Some(id) = user_assigned_managed_identity_id {
+                    options.user_assigned_id = match user_assigned_managed_identity_id_type
+                        .as_ref()
+                        .unwrap_or(&Default::default())
+                    {
+                        UserAssignedManagedIdentityIdType::ClientId => {
+                            Some(UserAssignedId::ClientId(id.clone()))
+                        }
+                        UserAssignedManagedIdentityIdType::ObjectId => {
+                            Some(UserAssignedId::ObjectId(id.clone()))
+                        }
+                        UserAssignedManagedIdentityIdType::ResourceId => {
+                            Some(UserAssignedId::ResourceId(id.clone()))
+                        }
+                    };
+                }
+                let msi: Arc<dyn TokenCredential> = ManagedIdentityCredential::new(Some(options))?;
+                let assertion = ManagedIdentityClientAssertion {
+                    credential: msi,
+                    // Future: make this configurable for sovereign clouds? (no way to test...)
+                    scope: "api://AzureADTokenExchange/.default".to_string(),
+                };
+
+                ClientAssertionCredential::new(
+                    client_assertion_tenant_id.clone(),
+                    client_assertion_client_id.clone(),
+                    assertion,
+                    None,
+                )?
+            }
+
+            Self::WorkloadIdentity {
+                tenant_id,
+                client_id,
+                token_file_path,
+            } => {
+                let options = WorkloadIdentityCredentialOptions {
+                    tenant_id: tenant_id.clone(),
+                    client_id: client_id.clone(),
+                    token_file_path: token_file_path.clone(),
+                    ..Default::default()
+                };
+
+                WorkloadIdentityCredential::new(Some(options))?
+            }
+        };
+        Ok(credential)
+    }
+}
+
+pub async fn build_client(
+    auth: Option<AzureAuthentication>,
+    connection_string: String,
+    container_name: String,
+    proxy: &crate::config::ProxyConfig,
+    tls: Option<AzureBlobTlsConfig>,
+) -> crate::Result<Arc<BlobContainerClient>> {
+    // Parse connection string without legacy SDK
+    let parsed = ParsedConnectionString::parse(&connection_string)
+        .map_err(|e| format!("Invalid connection string: {e}"))?;
+    // Compose container URL (SAS appended if present)
+    let container_url = parsed
+        .container_url(&container_name)
+        .map_err(|e| format!("Failed to build container URL: {e}"))?;
+    let url = Url::parse(&container_url).map_err(|e| format!("Invalid container URL: {e}"))?;
+
+    let mut credential: Option<Arc<dyn TokenCredential>> = None;
+
+    // Prepare options; attach Shared Key policy if needed
+    let mut options = BlobContainerClientOptions::default();
+    match (parsed.auth(), &auth) {
+        (Auth::None, None) => {
+            warn!("No authentication method provided, requests will be anonymous.");
+        }
+        (Auth::Sas { .. }, None) => {
+            info!("Using SAS token authentication.");
+        }
+        (
+            Auth::SharedKey {
+                account_name,
+                account_key,
+            },
+            None,
+        ) => {
+            info!("Using Shared Key authentication.");
+
+            let policy = SharedKeyAuthorizationPolicy::new(
+                account_name,
+                account_key,
+                // Use an Azurite-supported storage service version
+                String::from("2025-11-05"),
+            )
+            .map_err(|e| format!("Failed to create SharedKey policy: {e}"))?;
+            options
+                .client_options
+                .per_call_policies
+                .push(Arc::new(policy));
+        }
+        (Auth::None, Some(AzureAuthentication::Specific(..))) => {
+            info!("Using Azure Authentication method.");
+            let credential_result: Arc<dyn TokenCredential> =
+                auth.unwrap().credential().await.map_err(|e| {
+                    Error::with_message(
+                        ErrorKind::Credential,
+                        format!("Failed to configure Azure Authentication: {e}"),
+                    )
+                })?;
+            credential = Some(credential_result);
+        }
+        (Auth::Sas { .. }, Some(AzureAuthentication::Specific(..))) => {
+            return Err(Box::new(Error::with_message(
+                ErrorKind::Credential,
+                "Cannot use both SAS token and another Azure Authentication method at the same time",
+            )));
+        }
+        (Auth::SharedKey { .. }, Some(AzureAuthentication::Specific(..))) => {
+            return Err(Box::new(Error::with_message(
+                ErrorKind::Credential,
+                "Cannot use both Shared Key and another Azure Authentication method at the same time",
+            )));
+        }
+        #[cfg(test)]
+        (Auth::None, Some(AzureAuthentication::MockCredential)) => {
+            warn!("Using mock token credential authentication.");
+            credential = Some(auth.unwrap().credential().await.unwrap());
+        }
+        #[cfg(test)]
+        (_, Some(AzureAuthentication::MockCredential)) => {
+            return Err(Box::new(Error::with_message(
+                ErrorKind::Credential,
+                "Cannot use both connection string auth and mock credential at the same time",
+            )));
+        }
+    }
+
+    // Use reqwest v0.13 since Azure SDK only implements HttpClient for reqwest::Client v0.13
+    let mut reqwest_builder = reqwest_13::ClientBuilder::new();
+    let bypass_proxy = {
+        let host = url.host_str().unwrap_or("");
+        let port = url.port();
+        proxy.no_proxy.matches(host)
+            || port
+                .map(|p| proxy.no_proxy.matches(&format!("{}:{}", host, p)))
+                .unwrap_or(false)
+    };
+    if bypass_proxy || !proxy.enabled {
+        // Ensure no proxy (and disable any potential system proxy auto-detection)
+        reqwest_builder = reqwest_builder.no_proxy();
+    } else {
+        if let Some(http) = &proxy.http {
+            let p = reqwest_13::Proxy::http(http)
+                .map_err(|e| format!("Invalid HTTP proxy URL: {e}"))?;
+            // If credentials are embedded in the proxy URL, reqwest will handle them.
+            reqwest_builder = reqwest_builder.proxy(p);
+        }
+        if let Some(https) = &proxy.https {
+            let p = reqwest_13::Proxy::https(https)
+                .map_err(|e| format!("Invalid HTTPS proxy URL: {e}"))?;
+            // If credentials are embedded in the proxy URL, reqwest will handle them.
+            reqwest_builder = reqwest_builder.proxy(p);
+        }
+    }
+
+    if let Some(AzureBlobTlsConfig { ca_file }) = &tls
+        && let Some(ca_file) = ca_file
+    {
+        let mut buf = Vec::new();
+        File::open(ca_file)?.read_to_end(&mut buf)?;
+        let cert = reqwest_13::Certificate::from_pem(&buf)?;
+
+        warn!("Adding TLS root certificate from {}", ca_file.display());
+        reqwest_builder = reqwest_builder.add_root_certificate(cert);
+    }
+
+    options.client_options.transport = Some(azure_core::http::Transport::new(std::sync::Arc::new(
+        reqwest_builder
+            .build()
+            .map_err(|e| format!("Failed to build reqwest client: {e}"))?,
+    )));
+    let client =
+        BlobContainerClient::new(url, credential, Some(options)).map_err(|e| format!("{e}"))?;
+    Ok(Arc::new(client))
+}
+
+#[cfg(test)]
+#[derive(Debug)]
+struct MockTokenCredential;
+
+#[cfg(test)]
+#[async_trait::async_trait]
+impl TokenCredential for MockTokenCredential {
+    async fn get_token(
+        &self,
+        scopes: &[&str],
+        _options: Option<azure_core::credentials::TokenRequestOptions<'_>>,
+    ) -> azure_core::Result<azure_core::credentials::AccessToken> {
+        let Some(scope) = scopes.first() else {
+            return Err(Error::with_message(
+                ErrorKind::Credential,
+                "no scopes were provided",
+            ));
+        };
+
+        // serde_json sometimes does and sometimes doesn't preserve order, be careful to sort
+        // the claims in alphabetical order to ensure a consistent base64 encoding for testing
+        let jwt = serde_json::json!({
+            "aud": scope.strip_suffix("/.default").unwrap_or(*scope),
+            "exp": 2147483647,
+            "iat": 0,
+            "iss": "https://sts.windows.net/",
+            "nbf": 0,
+        });
+
+        // JWTs do not include standard base64 padding.
+        // this seemed cleaner than importing a new crates just for this function
+        let jwt_base64 = format!(
+            "e30.{}.",
+            BASE64_STANDARD
+                .encode(serde_json::to_string(&jwt).unwrap())
+                .trim_end_matches("=")
+        )
+        .to_string();
+
+        warn!(
+            "Using mock token credential, JWT: {}, base64: {}",
+            serde_json::to_string(&jwt).unwrap(),
+            jwt_base64
+        );
+
+        Ok(azure_core::credentials::AccessToken::new(
+            jwt_base64,
+            azure_core::time::OffsetDateTime::now_utc() + std::time::Duration::from_secs(3600),
+        ))
+    }
+}
+
+#[cfg(test)]
+#[tokio::test]
+async fn azure_mock_token_credential_test() {
+    let credential = MockTokenCredential;
+    let access_token = credential
+        .get_token(&["https://example.com/.default"], None)
+        .await
+        .expect("valid credential should return a token");
+    assert_eq!(
+        access_token.token.secret(),
+        "e30.eyJhdWQiOiJodHRwczovL2V4YW1wbGUuY29tIiwiZXhwIjoyMTQ3NDgzNjQ3LCJpYXQiOjAsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LyIsIm5iZiI6MH0."
+    );
+}
diff --git a/src/sinks/azure_common/connection_string.rs b/src/azure/connection_string.rs
similarity index 99%
rename from src/sinks/azure_common/connection_string.rs
rename to src/azure/connection_string.rs
index 391f9d196a9dd..b7ed560093daf 100644
--- a/src/sinks/azure_common/connection_string.rs
+++ b/src/azure/connection_string.rs
@@ -45,6 +45,7 @@ Examples:
   "UseDevelopmentStorage=true;DefaultEndpointsProtocol=http;AccountName=devstoreaccount1"
   Container URL: <http://127.0.0.1:10000/devstoreaccount1/logs>
 */
+#![allow(missing_docs)]
 
 use std::collections::HashMap;
 
diff --git a/src/azure/mod.rs b/src/azure/mod.rs
index 9c77b9e6b5378..486ddb677eea7 100644
--- a/src/azure/mod.rs
+++ b/src/azure/mod.rs
@@ -1,14 +1,26 @@
 //! Shared Azure client infrastructure used by both sources and sinks.
 
+/// Client construction: authentication, credentials, and HTTP transport assembly.
+pub mod client;
+/// Azure Storage connection-string parsing and endpoint resolution.
+pub mod connection_string;
+/// SharedKey request signing for the new Azure SDK pipeline.
+pub mod shared_key_policy;
+
+#[cfg(feature = "azure")]
 use std::sync::Arc;
 
+#[cfg(feature = "azure")]
 use azure_core_for_storage::RetryOptions;
+#[cfg(feature = "azure")]
 use azure_storage::{CloudLocation, ConnectionString};
+#[cfg(feature = "azure")]
 use azure_storage_blobs::prelude::*;
 
 /// Builds an Azure Blob Storage container client from a connection string.
 ///
 /// Supports both custom blob endpoints (e.g. Azurite) and standard Azure Commercial endpoints.
+#[cfg(feature = "azure")]
 pub fn build_client(
     connection_string: String,
     container_name: String,
diff --git a/src/sinks/azure_common/shared_key_policy.rs b/src/azure/shared_key_policy.rs
similarity index 96%
rename from src/sinks/azure_common/shared_key_policy.rs
rename to src/azure/shared_key_policy.rs
index f684f19a00a65..f85b9ec3914c9 100644
--- a/src/sinks/azure_common/shared_key_policy.rs
+++ b/src/azure/shared_key_policy.rs
@@ -1,3 +1,6 @@
+//! SharedKey authorization as an `azure_core` pipeline policy.
+#![allow(missing_docs)]
+
 use std::{collections::BTreeMap, fmt::Write as _, sync::Arc};
 
 use async_trait::async_trait;
@@ -118,8 +121,11 @@ impl SharedKeyAuthorizationPolicy {
         }
         s.push('\n');
 
-        // Content-Length (include value if present; keep "0")
-        if let Some(v) = header("Content-Length") {
+        // Content-Length: must be the empty string when the content length of the
+        // request is zero (storage service versions 2015-02-21 and later).
+        if let Some(v) = header("Content-Length")
+            && v != "0"
+        {
             s.push_str(v);
         }
         s.push('\n');
diff --git a/src/lib.rs b/src/lib.rs
index 0f1e883562933..170ca0b162e12 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -78,7 +78,11 @@ pub mod app;
 pub mod async_read;
 #[cfg(feature = "aws-config")]
 pub mod aws;
-#[cfg(feature = "azure")]
+#[cfg(any(
+    feature = "sinks-azure_blob",
+    feature = "sinks-azure_logs_ingestion",
+    feature = "sources-azure_blob"
+))]
 pub mod azure;
 pub mod common;
 pub mod completion;
diff --git a/src/sinks/azure_common/config.rs b/src/sinks/azure_common/config.rs
index 245517d89170b..38cf6f15c9de6 100644
--- a/src/sinks/azure_common/config.rs
+++ b/src/sinks/azure_common/config.rs
@@ -1,37 +1,14 @@
-use std::fs::File;
-use std::io::Read;
-use std::path::PathBuf;
 use std::sync::Arc;
 
-#[cfg(test)]
-use base64::prelude::*;
-
 use azure_core::error::Error as AzureCoreError;
-
-use crate::sinks::azure_common::connection_string::{Auth, ParsedConnectionString};
-use crate::sinks::azure_common::shared_key_policy::SharedKeyAuthorizationPolicy;
-use azure_core::http::{ClientMethodOptions, StatusCode, Url};
-
-use azure_core::credentials::{TokenCredential, TokenRequestOptions};
-use azure_core::{Error, error::ErrorKind};
-
-use azure_identity::{
-    AzureCliCredential, ClientAssertion, ClientAssertionCredential, ClientCertificateCredential,
-    ClientCertificateCredentialOptions, ClientSecretCredential, ManagedIdentityCredential,
-    ManagedIdentityCredentialOptions, UserAssignedId, WorkloadIdentityCredential,
-    WorkloadIdentityCredentialOptions,
-};
-
-use azure_storage_blob::{BlobContainerClient, BlobContainerClientOptions};
-
+use azure_core::http::StatusCode;
+use azure_storage_blob::BlobContainerClient;
 use bytes::Bytes;
 use futures::FutureExt;
 use snafu::Snafu;
 use vector_lib::{
-    configurable::configurable_component,
     json_size::JsonSize,
     request_metadata::{GroupedCountByteSize, MetaDescriptive, RequestMetadata},
-    sensitive_string::SensitiveString,
     stream::DriverResponse,
 };
 
@@ -40,369 +17,12 @@ use crate::{
     sinks::{Healthcheck, util::retries::RetryLogic},
 };
 
-/// TLS configuration.
-#[configurable_component]
-#[configurable(metadata(docs::advanced))]
-#[derive(Clone, Debug, Default)]
-#[serde(deny_unknown_fields)]
-pub struct AzureBlobTlsConfig {
-    /// Absolute path to an additional CA certificate file.
-    ///
-    /// The certificate must be in PEM (X.509) format.
-    #[serde(alias = "ca_path")]
-    #[configurable(metadata(docs::examples = "/path/to/certificate_authority.crt"))]
-    #[configurable(metadata(docs::human_name = "CA File Path"))]
-    pub ca_file: Option<PathBuf>,
-}
-
-/// Azure service principal authentication.
-#[configurable_component]
-#[derive(Clone, Debug, Eq, PartialEq)]
-#[serde(deny_unknown_fields, untagged)]
-pub enum AzureAuthentication {
-    #[configurable(metadata(docs::enum_tag_description = "The kind of Azure credential to use."))]
-    Specific(SpecificAzureCredential),
-
-    /// Mock credential for testing — returns a static fake token
-    #[cfg(test)]
-    #[serde(skip)]
-    MockCredential,
-}
-
-impl Default for AzureAuthentication {
-    // This should never be actually used.
-    // This is only needed when using Default::default() (such as unit tests),
-    // as serde requires `azure_credential_kind` to be specified.
-    fn default() -> Self {
-        Self::Specific(SpecificAzureCredential::ManagedIdentity {
-            user_assigned_managed_identity_id: None,
-            user_assigned_managed_identity_id_type: None,
-        })
-    }
-}
-
-#[configurable_component]
-#[derive(Clone, Debug, Eq, PartialEq)]
-#[serde(deny_unknown_fields, rename_all = "snake_case")]
-#[derive(Default)]
-/// User Assigned Managed Identity Types.
-pub enum UserAssignedManagedIdentityIdType {
-    #[default]
-    /// Client ID
-    ClientId,
-    /// Object ID
-    ObjectId,
-    /// Resource ID
-    ResourceId,
-}
-
-/// Specific Azure credential types.
-#[configurable_component]
-#[derive(Clone, Debug, Eq, PartialEq)]
-#[serde(
-    tag = "azure_credential_kind",
-    rename_all = "snake_case",
-    deny_unknown_fields
-)]
-pub enum SpecificAzureCredential {
-    /// Use Azure CLI credentials
-    #[cfg(not(target_arch = "wasm32"))]
-    AzureCli {},
-
-    /// Use certificate credentials
-    ClientCertificateCredential {
-        /// The [Azure Tenant ID][azure_tenant_id].
-        ///
-        /// [azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        #[configurable(metadata(docs::examples = "${AZURE_TENANT_ID:?err}"))]
-        azure_tenant_id: String,
-
-        /// The [Azure Client ID][azure_client_id].
-        ///
-        /// [azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_ID:?err}"))]
-        azure_client_id: String,
-
-        /// PKCS12 certificate with RSA private key.
-        #[configurable(metadata(docs::examples = "path/to/certificate.pfx"))]
-        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_CERTIFICATE_PATH:?err}"))]
-        certificate_path: PathBuf,
-
-        /// The password for the client certificate, if applicable.
-        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_CERTIFICATE_PASSWORD}"))]
-        certificate_password: Option<SensitiveString>,
-    },
-
-    /// Use client ID/secret credentials
-    ClientSecretCredential {
-        /// The [Azure Tenant ID][azure_tenant_id].
-        ///
-        /// [azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        #[configurable(metadata(docs::examples = "${AZURE_TENANT_ID:?err}"))]
-        azure_tenant_id: String,
-
-        /// The [Azure Client ID][azure_client_id].
-        ///
-        /// [azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_ID:?err}"))]
-        azure_client_id: String,
-
-        /// The [Azure Client Secret][azure_client_secret].
-        ///
-        /// [azure_client_secret]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
-        #[configurable(metadata(docs::examples = "00-00~000000-0000000~0000000000000000000"))]
-        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_SECRET:?err}"))]
-        azure_client_secret: SensitiveString,
-    },
-
-    /// Use Managed Identity credentials
-    ManagedIdentity {
-        /// The User Assigned Managed Identity to use.
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        user_assigned_managed_identity_id: Option<String>,
-
-        /// The type of the User Assigned Managed Identity ID provided (Client ID, Object ID,
-        /// or Resource ID). Defaults to Client ID.
-        user_assigned_managed_identity_id_type: Option<UserAssignedManagedIdentityIdType>,
-    },
-
-    /// Use Managed Identity with Client Assertion credentials
-    ManagedIdentityClientAssertion {
-        /// The User Assigned Managed Identity to use for the managed identity.
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        #[configurable(metadata(
-            docs::examples = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-vector/providers/Microsoft.ManagedIdentity/userAssignedIdentities/id-vector-uami"
-        ))]
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        user_assigned_managed_identity_id: Option<String>,
-
-        /// The type of the User Assigned Managed Identity ID provided (Client ID, Object ID, or Resource ID). Defaults to Client ID.
-        user_assigned_managed_identity_id_type: Option<UserAssignedManagedIdentityIdType>,
-
-        /// The target Tenant ID to use.
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        client_assertion_tenant_id: String,
-
-        /// The target Client ID to use.
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        client_assertion_client_id: String,
-    },
-
-    /// Use Workload Identity credentials
-    WorkloadIdentity {
-        /// The [Azure Tenant ID][azure_tenant_id]. Defaults to the value of the environment variable `AZURE_TENANT_ID`.
-        ///
-        /// [azure_tenant_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        #[configurable(metadata(docs::examples = "${AZURE_TENANT_ID}"))]
-        tenant_id: Option<String>,
-
-        /// The [Azure Client ID][azure_client_id]. Defaults to the value of the environment variable `AZURE_CLIENT_ID`.
-        ///
-        /// [azure_client_id]: https://learn.microsoft.com/entra/identity-platform/howto-create-service-principal-portal
-        #[configurable(metadata(docs::examples = "00000000-0000-0000-0000-000000000000"))]
-        #[configurable(metadata(docs::examples = "${AZURE_CLIENT_ID}"))]
-        client_id: Option<String>,
-
-        /// Path of a file containing a Kubernetes service account token. Defaults to the value of the environment variable `AZURE_FEDERATED_TOKEN_FILE`.
-        #[configurable(metadata(
-            docs::examples = "/var/run/secrets/azure/tokens/azure-identity-token"
-        ))]
-        #[configurable(metadata(docs::examples = "${AZURE_FEDERATED_TOKEN_FILE}"))]
-        token_file_path: Option<PathBuf>,
-    },
-}
-
-#[derive(Debug)]
-struct ManagedIdentityClientAssertion {
-    credential: Arc<dyn TokenCredential>,
-    scope: String,
-}
-
-#[cfg_attr(target_arch = "wasm32", async_trait::async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait::async_trait)]
-impl ClientAssertion for ManagedIdentityClientAssertion {
-    async fn secret(&self, options: Option<ClientMethodOptions<'_>>) -> azure_core::Result<String> {
-        Ok(self
-            .credential
-            .get_token(
-                &[&self.scope],
-                Some(TokenRequestOptions {
-                    method_options: options.unwrap_or_default(),
-                }),
-            )
-            .await?
-            .token
-            .secret()
-            .to_string())
-    }
-}
-
-impl AzureAuthentication {
-    /// Returns the provider for the credentials based on the authentication mechanism chosen.
-    pub async fn credential(&self) -> azure_core::Result<Arc<dyn TokenCredential>> {
-        match self {
-            Self::Specific(specific) => specific.credential().await,
-
-            #[cfg(test)]
-            Self::MockCredential => Ok(Arc::new(MockTokenCredential) as Arc<dyn TokenCredential>),
-        }
-    }
-}
-
-impl SpecificAzureCredential {
-    /// Returns the provider for the credentials based on the specific credential type.
-    pub async fn credential(&self) -> azure_core::Result<Arc<dyn TokenCredential>> {
-        let credential: Arc<dyn TokenCredential> = match self {
-            #[cfg(not(target_arch = "wasm32"))]
-            Self::AzureCli {} => AzureCliCredential::new(None)?,
-
-            // requires azure_identity feature 'client_certificate'
-            Self::ClientCertificateCredential {
-                azure_tenant_id,
-                azure_client_id,
-                certificate_path,
-                certificate_password,
-            } => {
-                let certificate_bytes: Vec<u8> = std::fs::read(certificate_path).map_err(|e| {
-                    Error::with_message(
-                        ErrorKind::Credential,
-                        format!(
-                            "Failed to read certificate file {}: {e}",
-                            certificate_path.display()
-                        ),
-                    )
-                })?;
-
-                let mut options: ClientCertificateCredentialOptions =
-                    ClientCertificateCredentialOptions::default();
-                if let Some(password) = certificate_password {
-                    options.password = Some(password.inner().to_string().into());
-                }
-
-                ClientCertificateCredential::new(
-                    azure_tenant_id.clone(),
-                    azure_client_id.clone(),
-                    certificate_bytes.into(),
-                    Some(options),
-                )?
-            }
-
-            Self::ClientSecretCredential {
-                azure_tenant_id,
-                azure_client_id,
-                azure_client_secret,
-            } => {
-                if azure_tenant_id.is_empty() {
-                    return Err(Error::with_message(ErrorKind::Credential,
-                        "`auth.azure_tenant_id` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
-                    ));
-                }
-                if azure_client_id.is_empty() {
-                    return Err(Error::with_message(ErrorKind::Credential,
-                        "`auth.azure_client_id` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
-                    ));
-                }
-                if azure_client_secret.inner().is_empty() {
-                    return Err(Error::with_message(ErrorKind::Credential,
-                        "`auth.azure_client_secret` is blank; either use `auth.azure_credential_kind`, or provide tenant ID, client ID, and secret.".to_string()
-                    ));
-                }
-
-                let secret: String = azure_client_secret.inner().into();
-                ClientSecretCredential::new(
-                    &azure_tenant_id.clone(),
-                    azure_client_id.clone(),
-                    secret.into(),
-                    None,
-                )?
-            }
-
-            Self::ManagedIdentity {
-                user_assigned_managed_identity_id,
-                user_assigned_managed_identity_id_type,
-            } => {
-                let mut options = ManagedIdentityCredentialOptions::default();
-                if let Some(id) = user_assigned_managed_identity_id {
-                    options.user_assigned_id = match user_assigned_managed_identity_id_type
-                        .as_ref()
-                        .unwrap_or(&Default::default())
-                    {
-                        UserAssignedManagedIdentityIdType::ClientId => {
-                            Some(UserAssignedId::ClientId(id.clone()))
-                        }
-                        UserAssignedManagedIdentityIdType::ObjectId => {
-                            Some(UserAssignedId::ObjectId(id.clone()))
-                        }
-                        UserAssignedManagedIdentityIdType::ResourceId => {
-                            Some(UserAssignedId::ResourceId(id.clone()))
-                        }
-                    };
-                }
-                ManagedIdentityCredential::new(Some(options))?
-            }
-
-            Self::ManagedIdentityClientAssertion {
-                user_assigned_managed_identity_id,
-                user_assigned_managed_identity_id_type,
-                client_assertion_tenant_id,
-                client_assertion_client_id,
-            } => {
-                let mut options = ManagedIdentityCredentialOptions::default();
-                if let Some(id) = user_assigned_managed_identity_id {
-                    options.user_assigned_id = match user_assigned_managed_identity_id_type
-                        .as_ref()
-                        .unwrap_or(&Default::default())
-                    {
-                        UserAssignedManagedIdentityIdType::ClientId => {
-                            Some(UserAssignedId::ClientId(id.clone()))
-                        }
-                        UserAssignedManagedIdentityIdType::ObjectId => {
-                            Some(UserAssignedId::ObjectId(id.clone()))
-                        }
-                        UserAssignedManagedIdentityIdType::ResourceId => {
-                            Some(UserAssignedId::ResourceId(id.clone()))
-                        }
-                    };
-                }
-                let msi: Arc<dyn TokenCredential> = ManagedIdentityCredential::new(Some(options))?;
-                let assertion = ManagedIdentityClientAssertion {
-                    credential: msi,
-                    // Future: make this configurable for sovereign clouds? (no way to test...)
-                    scope: "api://AzureADTokenExchange/.default".to_string(),
-                };
-
-                ClientAssertionCredential::new(
-                    client_assertion_tenant_id.clone(),
-                    client_assertion_client_id.clone(),
-                    assertion,
-                    None,
-                )?
-            }
-
-            Self::WorkloadIdentity {
-                tenant_id,
-                client_id,
-                token_file_path,
-            } => {
-                let options = WorkloadIdentityCredentialOptions {
-                    tenant_id: tenant_id.clone(),
-                    client_id: client_id.clone(),
-                    token_file_path: token_file_path.clone(),
-                    ..Default::default()
-                };
-
-                WorkloadIdentityCredential::new(Some(options))?
-            }
-        };
-        Ok(credential)
-    }
-}
+// Shared Azure client machinery lives in `crate::azure`; re-exported here to keep
+// existing sink import paths stable.
+pub use crate::azure::client::{
+    AzureAuthentication, AzureBlobTlsConfig, SpecificAzureCredential,
+    UserAssignedManagedIdentityIdType, build_client,
+};
 
 #[derive(Debug, Clone)]
 pub struct AzureBlobRequest {
@@ -507,203 +127,3 @@ pub fn build_healthcheck(
 
     Ok(healthcheck.boxed())
 }
-
-pub async fn build_client(
-    auth: Option<AzureAuthentication>,
-    connection_string: String,
-    container_name: String,
-    proxy: &crate::config::ProxyConfig,
-    tls: Option<AzureBlobTlsConfig>,
-) -> crate::Result<Arc<BlobContainerClient>> {
-    // Parse connection string without legacy SDK
-    let parsed = ParsedConnectionString::parse(&connection_string)
-        .map_err(|e| format!("Invalid connection string: {e}"))?;
-    // Compose container URL (SAS appended if present)
-    let container_url = parsed
-        .container_url(&container_name)
-        .map_err(|e| format!("Failed to build container URL: {e}"))?;
-    let url = Url::parse(&container_url).map_err(|e| format!("Invalid container URL: {e}"))?;
-
-    let mut credential: Option<Arc<dyn TokenCredential>> = None;
-
-    // Prepare options; attach Shared Key policy if needed
-    let mut options = BlobContainerClientOptions::default();
-    match (parsed.auth(), &auth) {
-        (Auth::None, None) => {
-            warn!("No authentication method provided, requests will be anonymous.");
-        }
-        (Auth::Sas { .. }, None) => {
-            info!("Using SAS token authentication.");
-        }
-        (
-            Auth::SharedKey {
-                account_name,
-                account_key,
-            },
-            None,
-        ) => {
-            info!("Using Shared Key authentication.");
-
-            let policy = SharedKeyAuthorizationPolicy::new(
-                account_name,
-                account_key,
-                // Use an Azurite-supported storage service version
-                String::from("2025-11-05"),
-            )
-            .map_err(|e| format!("Failed to create SharedKey policy: {e}"))?;
-            options
-                .client_options
-                .per_call_policies
-                .push(Arc::new(policy));
-        }
-        (Auth::None, Some(AzureAuthentication::Specific(..))) => {
-            info!("Using Azure Authentication method.");
-            let credential_result: Arc<dyn TokenCredential> =
-                auth.unwrap().credential().await.map_err(|e| {
-                    Error::with_message(
-                        ErrorKind::Credential,
-                        format!("Failed to configure Azure Authentication: {e}"),
-                    )
-                })?;
-            credential = Some(credential_result);
-        }
-        (Auth::Sas { .. }, Some(AzureAuthentication::Specific(..))) => {
-            return Err(Box::new(Error::with_message(
-                ErrorKind::Credential,
-                "Cannot use both SAS token and another Azure Authentication method at the same time",
-            )));
-        }
-        (Auth::SharedKey { .. }, Some(AzureAuthentication::Specific(..))) => {
-            return Err(Box::new(Error::with_message(
-                ErrorKind::Credential,
-                "Cannot use both Shared Key and another Azure Authentication method at the same time",
-            )));
-        }
-        #[cfg(test)]
-        (Auth::None, Some(AzureAuthentication::MockCredential)) => {
-            warn!("Using mock token credential authentication.");
-            credential = Some(auth.unwrap().credential().await.unwrap());
-        }
-        #[cfg(test)]
-        (_, Some(AzureAuthentication::MockCredential)) => {
-            return Err(Box::new(Error::with_message(
-                ErrorKind::Credential,
-                "Cannot use both connection string auth and mock credential at the same time",
-            )));
-        }
-    }
-
-    // Use reqwest v0.13 since Azure SDK only implements HttpClient for reqwest::Client v0.13
-    let mut reqwest_builder = reqwest_13::ClientBuilder::new();
-    let bypass_proxy = {
-        let host = url.host_str().unwrap_or("");
-        let port = url.port();
-        proxy.no_proxy.matches(host)
-            || port
-                .map(|p| proxy.no_proxy.matches(&format!("{}:{}", host, p)))
-                .unwrap_or(false)
-    };
-    if bypass_proxy || !proxy.enabled {
-        // Ensure no proxy (and disable any potential system proxy auto-detection)
-        reqwest_builder = reqwest_builder.no_proxy();
-    } else {
-        if let Some(http) = &proxy.http {
-            let p = reqwest_13::Proxy::http(http)
-                .map_err(|e| format!("Invalid HTTP proxy URL: {e}"))?;
-            // If credentials are embedded in the proxy URL, reqwest will handle them.
-            reqwest_builder = reqwest_builder.proxy(p);
-        }
-        if let Some(https) = &proxy.https {
-            let p = reqwest_13::Proxy::https(https)
-                .map_err(|e| format!("Invalid HTTPS proxy URL: {e}"))?;
-            // If credentials are embedded in the proxy URL, reqwest will handle them.
-            reqwest_builder = reqwest_builder.proxy(p);
-        }
-    }
-
-    if let Some(AzureBlobTlsConfig { ca_file }) = &tls
-        && let Some(ca_file) = ca_file
-    {
-        let mut buf = Vec::new();
-        File::open(ca_file)?.read_to_end(&mut buf)?;
-        let cert = reqwest_13::Certificate::from_pem(&buf)?;
-
-        warn!("Adding TLS root certificate from {}", ca_file.display());
-        reqwest_builder = reqwest_builder.add_root_certificate(cert);
-    }
-
-    options.client_options.transport = Some(azure_core::http::Transport::new(std::sync::Arc::new(
-        reqwest_builder
-            .build()
-            .map_err(|e| format!("Failed to build reqwest client: {e}"))?,
-    )));
-    let client =
-        BlobContainerClient::new(url, credential, Some(options)).map_err(|e| format!("{e}"))?;
-    Ok(Arc::new(client))
-}
-
-#[cfg(test)]
-#[derive(Debug)]
-struct MockTokenCredential;
-
-#[cfg(test)]
-#[async_trait::async_trait]
-impl TokenCredential for MockTokenCredential {
-    async fn get_token(
-        &self,
-        scopes: &[&str],
-        _options: Option<azure_core::credentials::TokenRequestOptions<'_>>,
-    ) -> azure_core::Result<azure_core::credentials::AccessToken> {
-        let Some(scope) = scopes.first() else {
-            return Err(Error::with_message(
-                ErrorKind::Credential,
-                "no scopes were provided",
-            ));
-        };
-
-        // serde_json sometimes does and sometimes doesn't preserve order, be careful to sort
-        // the claims in alphabetical order to ensure a consistent base64 encoding for testing
-        let jwt = serde_json::json!({
-            "aud": scope.strip_suffix("/.default").unwrap_or(*scope),
-            "exp": 2147483647,
-            "iat": 0,
-            "iss": "https://sts.windows.net/",
-            "nbf": 0,
-        });
-
-        // JWTs do not include standard base64 padding.
-        // this seemed cleaner than importing a new crates just for this function
-        let jwt_base64 = format!(
-            "e30.{}.",
-            BASE64_STANDARD
-                .encode(serde_json::to_string(&jwt).unwrap())
-                .trim_end_matches("=")
-        )
-        .to_string();
-
-        warn!(
-            "Using mock token credential, JWT: {}, base64: {}",
-            serde_json::to_string(&jwt).unwrap(),
-            jwt_base64
-        );
-
-        Ok(azure_core::credentials::AccessToken::new(
-            jwt_base64,
-            azure_core::time::OffsetDateTime::now_utc() + std::time::Duration::from_secs(3600),
-        ))
-    }
-}
-
-#[cfg(test)]
-#[tokio::test]
-async fn azure_mock_token_credential_test() {
-    let credential = MockTokenCredential;
-    let access_token = credential
-        .get_token(&["https://example.com/.default"], None)
-        .await
-        .expect("valid credential should return a token");
-    assert_eq!(
-        access_token.token.secret(),
-        "e30.eyJhdWQiOiJodHRwczovL2V4YW1wbGUuY29tIiwiZXhwIjoyMTQ3NDgzNjQ3LCJpYXQiOjAsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LyIsIm5iZiI6MH0."
-    );
-}
diff --git a/src/sinks/azure_common/mod.rs b/src/sinks/azure_common/mod.rs
index 368c88164fd8d..4d1c931977f03 100644
--- a/src/sinks/azure_common/mod.rs
+++ b/src/sinks/azure_common/mod.rs
@@ -1,5 +1,3 @@
 pub mod config;
-pub mod connection_string;
 pub mod service;
-pub mod shared_key_policy;
 pub mod sink;

From 5af8608c3edfc25e790bf4901f8fdb2fbe75f079 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sat, 6 Jun 2026 08:54:40 +0200
Subject: [PATCH 324/326] feat(azure_blob): add new-SDK queue client builder
 with shared auth machinery
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- connection_string: parse QueueEndpoint, add queue_account_endpoint()/queue_url()
  mirroring the blob logic (explicit endpoint short-circuits dev-storage synthesis)
- client: factor resolve_credential()/build_transport() out of build_client and add
  build_queue_client() for azure_storage_queue 1.0; pin the Azurite-supported
  service version
- shared_key_policy: sign the actual body length when the Content-Length header is
  absent — generated SDK clients (e.g. queue send_message) rely on the transport to
  set the header, so signing previously omitted it and the service rejected the
  signature
- add an Azurite SharedKey roundtrip spike test (create/send/receive/delete)
  covering zero-body signing and query-parameter canonicalization

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/azure/client.rs            | 182 ++++++++++++++++++++++++++++-----
 src/azure/connection_string.rs |  99 ++++++++++++++++++
 src/azure/shared_key_policy.rs |  14 ++-
 3 files changed, 265 insertions(+), 30 deletions(-)

diff --git a/src/azure/client.rs b/src/azure/client.rs
index a77d17a8886d0..b3ad5f708d7a6 100644
--- a/src/azure/client.rs
+++ b/src/azure/client.rs
@@ -395,26 +395,22 @@ impl SpecificAzureCredential {
     }
 }
 
-pub async fn build_client(
+/// An Azurite-supported storage service version, also accepted by the real Azure
+/// service (which accepts all previous versions).
+const STORAGE_SERVICE_VERSION: &str = "2025-11-05";
+
+/// Resolve the authentication for a client from the parsed connection string and the
+/// optional explicit authentication config.
+///
+/// Returns the token credential to pass to the client constructor (if any) and pushes
+/// the SharedKey signing policy into `client_options` when account-key auth is in use.
+async fn resolve_credential(
+    parsed: &ParsedConnectionString,
     auth: Option<AzureAuthentication>,
-    connection_string: String,
-    container_name: String,
-    proxy: &crate::config::ProxyConfig,
-    tls: Option<AzureBlobTlsConfig>,
-) -> crate::Result<Arc<BlobContainerClient>> {
-    // Parse connection string without legacy SDK
-    let parsed = ParsedConnectionString::parse(&connection_string)
-        .map_err(|e| format!("Invalid connection string: {e}"))?;
-    // Compose container URL (SAS appended if present)
-    let container_url = parsed
-        .container_url(&container_name)
-        .map_err(|e| format!("Failed to build container URL: {e}"))?;
-    let url = Url::parse(&container_url).map_err(|e| format!("Invalid container URL: {e}"))?;
-
+    client_options: &mut azure_core::http::ClientOptions,
+) -> crate::Result<Option<Arc<dyn TokenCredential>>> {
     let mut credential: Option<Arc<dyn TokenCredential>> = None;
 
-    // Prepare options; attach Shared Key policy if needed
-    let mut options = BlobContainerClientOptions::default();
     match (parsed.auth(), &auth) {
         (Auth::None, None) => {
             warn!("No authentication method provided, requests will be anonymous.");
@@ -434,14 +430,10 @@ pub async fn build_client(
             let policy = SharedKeyAuthorizationPolicy::new(
                 account_name,
                 account_key,
-                // Use an Azurite-supported storage service version
-                String::from("2025-11-05"),
+                String::from(STORAGE_SERVICE_VERSION),
             )
             .map_err(|e| format!("Failed to create SharedKey policy: {e}"))?;
-            options
-                .client_options
-                .per_call_policies
-                .push(Arc::new(policy));
+            client_options.per_call_policies.push(Arc::new(policy));
         }
         (Auth::None, Some(AzureAuthentication::Specific(..))) => {
             info!("Using Azure Authentication method.");
@@ -480,6 +472,16 @@ pub async fn build_client(
         }
     }
 
+    Ok(credential)
+}
+
+/// Build the HTTP transport for an Azure client, honoring Vector's proxy configuration
+/// and any additional CA certificate.
+fn build_transport(
+    url: &Url,
+    proxy: &crate::config::ProxyConfig,
+    tls: Option<&AzureBlobTlsConfig>,
+) -> crate::Result<azure_core::http::Transport> {
     // Use reqwest v0.13 since Azure SDK only implements HttpClient for reqwest::Client v0.13
     let mut reqwest_builder = reqwest_13::ClientBuilder::new();
     let bypass_proxy = {
@@ -508,7 +510,7 @@ pub async fn build_client(
         }
     }
 
-    if let Some(AzureBlobTlsConfig { ca_file }) = &tls
+    if let Some(AzureBlobTlsConfig { ca_file }) = tls
         && let Some(ca_file) = ca_file
     {
         let mut buf = Vec::new();
@@ -519,16 +521,76 @@ pub async fn build_client(
         reqwest_builder = reqwest_builder.add_root_certificate(cert);
     }
 
-    options.client_options.transport = Some(azure_core::http::Transport::new(std::sync::Arc::new(
+    Ok(azure_core::http::Transport::new(std::sync::Arc::new(
         reqwest_builder
             .build()
             .map_err(|e| format!("Failed to build reqwest client: {e}"))?,
-    )));
+    )))
+}
+
+/// Builds an Azure Blob Storage container client from a connection string,
+/// optionally with an explicit authentication method.
+///
+/// Supports both custom blob endpoints (e.g. Azurite) and standard Azure endpoints.
+pub async fn build_client(
+    auth: Option<AzureAuthentication>,
+    connection_string: String,
+    container_name: String,
+    proxy: &crate::config::ProxyConfig,
+    tls: Option<AzureBlobTlsConfig>,
+) -> crate::Result<Arc<BlobContainerClient>> {
+    // Parse connection string without legacy SDK
+    let parsed = ParsedConnectionString::parse(&connection_string)
+        .map_err(|e| format!("Invalid connection string: {e}"))?;
+    // Compose container URL (SAS appended if present)
+    let container_url = parsed
+        .container_url(&container_name)
+        .map_err(|e| format!("Failed to build container URL: {e}"))?;
+    let url = Url::parse(&container_url).map_err(|e| format!("Invalid container URL: {e}"))?;
+
+    let mut options = BlobContainerClientOptions::default();
+    let credential = resolve_credential(&parsed, auth, &mut options.client_options).await?;
+    options.client_options.transport = Some(build_transport(&url, proxy, tls.as_ref())?);
+
     let client =
         BlobContainerClient::new(url, credential, Some(options)).map_err(|e| format!("{e}"))?;
     Ok(Arc::new(client))
 }
 
+/// Builds an Azure Storage Queue client from a connection string,
+/// optionally with an explicit authentication method.
+///
+/// Supports both custom queue endpoints (e.g. Azurite) and standard Azure endpoints.
+#[cfg(feature = "sources-azure_blob")]
+pub async fn build_queue_client(
+    auth: Option<AzureAuthentication>,
+    connection_string: &str,
+    queue_name: &str,
+    proxy: &crate::config::ProxyConfig,
+    tls: Option<AzureBlobTlsConfig>,
+) -> crate::Result<Arc<azure_storage_queue::QueueClient>> {
+    let parsed = ParsedConnectionString::parse(connection_string)
+        .map_err(|e| format!("Invalid connection string: {e}"))?;
+    // Compose queue URL (SAS appended if present)
+    let queue_url = parsed
+        .queue_url(queue_name)
+        .map_err(|e| format!("Failed to build queue URL: {e}"))?;
+    let url = Url::parse(&queue_url).map_err(|e| format!("Invalid queue URL: {e}"))?;
+
+    let mut options = azure_storage_queue::QueueClientOptions {
+        // Pin an Azurite-supported service version; the real service accepts older
+        // versions, and the SharedKey policy signs with the same version.
+        version: String::from(STORAGE_SERVICE_VERSION),
+        ..Default::default()
+    };
+    let credential = resolve_credential(&parsed, auth, &mut options.client_options).await?;
+    options.client_options.transport = Some(build_transport(&url, proxy, tls.as_ref())?);
+
+    let client = azure_storage_queue::QueueClient::new(url, credential, Some(options))
+        .map_err(|e| format!("{e}"))?;
+    Ok(Arc::new(client))
+}
+
 #[cfg(test)]
 #[derive(Debug)]
 struct MockTokenCredential;
@@ -594,3 +656,71 @@ async fn azure_mock_token_credential_test() {
         "e30.eyJhdWQiOiJodHRwczovL2V4YW1wbGUuY29tIiwiZXhwIjoyMTQ3NDgzNjQ3LCJpYXQiOjAsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LyIsIm5iZiI6MH0."
     );
 }
+
+#[cfg(all(test, feature = "azure-blob-integration-tests"))]
+mod azure_integration_tests {
+    use azure_storage_queue::models::{
+        QueueClientReceiveMessagesOptions, QueueMessage, ReceivedMessages,
+    };
+
+    use super::*;
+
+    /// End-to-end SharedKey signing spike for the queue client against Azurite:
+    /// create (zero-body PUT), send, receive (query-parameter canonicalization),
+    /// and delete (zero-body DELETE) must all authorize correctly.
+    #[tokio::test]
+    async fn azure_queue_client_shared_key_roundtrip() {
+        let address = std::env::var("AZURITE_ADDRESS").unwrap_or_else(|_| "localhost".to_string());
+        let connection_string = format!(
+            "UseDevelopmentStorage=true;DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;QueueEndpoint=http://{address}:10001/devstoreaccount1;"
+        );
+        let queue_name = format!("spike-{}", rand::random::<u32>());
+        let client = build_queue_client(
+            None,
+            &connection_string,
+            &queue_name,
+            &crate::config::ProxyConfig::default(),
+            None,
+        )
+        .await
+        .expect("Failed to build queue client");
+
+        // Zero-body PUT: exercises the Content-Length empty-string signing rule.
+        client.create(None).await.expect("Failed to create queue");
+
+        let message = QueueMessage {
+            message_text: Some("spike".to_string()),
+        };
+        client
+            .send_message(message.try_into().expect("infallible"), None)
+            .await
+            .expect("Failed to send message");
+
+        // Query parameters: exercises canonicalized-resource query handling.
+        let received: ReceivedMessages = client
+            .receive_messages(Some(QueueClientReceiveMessagesOptions {
+                number_of_messages: Some(10),
+                visibility_timeout: Some(5),
+                ..Default::default()
+            }))
+            .await
+            .expect("Failed to receive messages")
+            .into_model()
+            .expect("Failed to parse received messages");
+
+        let items = received.items.unwrap_or_default();
+        assert_eq!(items.len(), 1, "expected exactly one message");
+        let msg = &items[0];
+        assert_eq!(msg.message_text.as_deref(), Some("spike"));
+
+        // Zero-body DELETE with pop-receipt query parameter.
+        client
+            .delete_message(
+                msg.message_id.as_deref().expect("message id present"),
+                msg.pop_receipt.as_deref().expect("pop receipt present"),
+                None,
+            )
+            .await
+            .expect("Failed to delete message");
+    }
+}
diff --git a/src/azure/connection_string.rs b/src/azure/connection_string.rs
index b7ed560093daf..c42047b3f77e7 100644
--- a/src/azure/connection_string.rs
+++ b/src/azure/connection_string.rs
@@ -96,6 +96,7 @@ pub struct ParsedConnectionString {
     pub default_endpoints_protocol: Option<String>,
     pub endpoint_suffix: Option<String>,
     pub blob_endpoint: Option<String>,
+    pub queue_endpoint: Option<String>,
     pub use_development_storage: bool,
     pub development_storage_proxy_uri: Option<String>,
 }
@@ -132,6 +133,7 @@ impl ParsedConnectionString {
                 .map(|s| s.to_ascii_lowercase()),
             endpoint_suffix: map.get("endpointsuffix").cloned(),
             blob_endpoint: map.get("blobendpoint").cloned(),
+            queue_endpoint: map.get("queueendpoint").cloned(),
             use_development_storage: map
                 .get("usedevelopmentstorage")
                 .map(|v| v.eq_ignore_ascii_case("true"))
@@ -235,6 +237,55 @@ impl ParsedConnectionString {
         ))
     }
 
+    /// Build the base Queue endpoint URL (no queue path).
+    ///
+    /// Resolution order mirrors [`Self::blob_account_endpoint`]:
+    /// 1. QueueEndpoint (as-is)
+    /// 2. Development storage synthesized URL: `{proto}://127.0.0.1:10001/{account}`
+    ///    If DevelopmentStorageProxyUri is present, it will be used instead of 127.0.0.1:10001.
+    /// 3. Public cloud synthesized URL: `{proto}://{account}.queue.{suffix}`
+    pub fn queue_account_endpoint(&self) -> Result<String, ConnectionStringError> {
+        if let Some(explicit) = self.queue_endpoint.as_ref() {
+            return Ok(explicit.clone());
+        }
+
+        let account_name = self
+            .account_name
+            .as_ref()
+            .ok_or(ConnectionStringError::MissingAccountName)?;
+
+        let proto = self.default_protocol();
+
+        if self.use_development_storage {
+            // If the proxy URI is provided, use it. Otherwise default to 127.0.0.1:10001
+            let host = self
+                .development_storage_proxy_uri
+                .as_deref()
+                .map(|s| s.trim_end_matches('/').to_string())
+                .unwrap_or_else(|| "127.0.0.1:10001".to_string());
+
+            let base = if host.starts_with("http://") || host.starts_with("https://") {
+                format!("{}/{}", trim_trailing_slash(&host), account_name)
+            } else {
+                format!("{proto}://{host}/{}", account_name)
+            };
+            return Ok(base);
+        }
+
+        // Public cloud-style base
+        let suffix = self.endpoint_suffix();
+        Ok(format!("{proto}://{}.queue.{}", account_name, suffix))
+    }
+
+    /// Build a queue URL, optionally appending SAS if present.
+    pub fn queue_url(&self, queue: &str) -> Result<String, ConnectionStringError> {
+        let base = self.queue_account_endpoint()?;
+        Ok(append_query_segment(
+            &format!("{}/{}", trim_trailing_slash(&base), queue),
+            self.shared_access_signature.as_deref(),
+        ))
+    }
+
     /// Build a blob URL, optionally appending SAS if present.
     pub fn blob_url(&self, container: &str, blob: &str) -> Result<String, ConnectionStringError> {
         // Build the base container URL without SAS, then append the blob path,
@@ -290,6 +341,54 @@ fn encode_path_segment(seg: &str) -> String {
 mod tests {
     use super::*;
 
+    #[test]
+    fn queue_endpoint_public_cloud() {
+        let cs = "DefaultEndpointsProtocol=https;AccountName=myacct;AccountKey=base64==;EndpointSuffix=core.windows.net";
+        let parsed = ParsedConnectionString::parse(cs).unwrap();
+        assert_eq!(
+            parsed.queue_account_endpoint().unwrap(),
+            "https://myacct.queue.core.windows.net"
+        );
+        assert_eq!(
+            parsed.queue_url("events").unwrap(),
+            "https://myacct.queue.core.windows.net/events"
+        );
+    }
+
+    #[test]
+    fn queue_endpoint_explicit_overrides_dev_storage() {
+        let cs = "UseDevelopmentStorage=true;DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=key==;QueueEndpoint=http://azurite:10001/devstoreaccount1;";
+        let parsed = ParsedConnectionString::parse(cs).unwrap();
+        assert_eq!(
+            parsed.queue_account_endpoint().unwrap(),
+            "http://azurite:10001/devstoreaccount1"
+        );
+        assert_eq!(
+            parsed.queue_url("events").unwrap(),
+            "http://azurite:10001/devstoreaccount1/events"
+        );
+    }
+
+    #[test]
+    fn queue_endpoint_dev_storage_default() {
+        let cs = "UseDevelopmentStorage=true;AccountName=devstoreaccount1;AccountKey=key==";
+        let parsed = ParsedConnectionString::parse(cs).unwrap();
+        assert_eq!(
+            parsed.queue_account_endpoint().unwrap(),
+            "http://127.0.0.1:10001/devstoreaccount1"
+        );
+    }
+
+    #[test]
+    fn queue_url_appends_sas() {
+        let cs = "AccountName=myacct;SharedAccessSignature=sv=2020&sig=abc;";
+        let parsed = ParsedConnectionString::parse(cs).unwrap();
+        assert_eq!(
+            parsed.queue_url("events").unwrap(),
+            "https://myacct.queue.core.windows.net/events?sv=2020&sig=abc"
+        );
+    }
+
     #[test]
     fn parse_access_key_public_cloud() {
         let cs = "DefaultEndpointsProtocol=https;AccountName=myacct;AccountKey=base64==;EndpointSuffix=core.windows.net";
diff --git a/src/azure/shared_key_policy.rs b/src/azure/shared_key_policy.rs
index f85b9ec3914c9..5d6c173dd4940 100644
--- a/src/azure/shared_key_policy.rs
+++ b/src/azure/shared_key_policy.rs
@@ -123,10 +123,16 @@ impl SharedKeyAuthorizationPolicy {
 
         // Content-Length: must be the empty string when the content length of the
         // request is zero (storage service versions 2015-02-21 and later).
-        if let Some(v) = header("Content-Length")
-            && v != "0"
-        {
-            s.push_str(v);
+        //
+        // Generated SDK clients do not always set this header themselves — for
+        // body-carrying requests the HTTP transport adds it when sending — so fall
+        // back to the actual body length to sign the value the service will see.
+        let content_length = header("Content-Length")
+            .map(str::to_string)
+            .or_else(|| req.body().len().map(|l| l.to_string()))
+            .unwrap_or_default();
+        if content_length != "0" {
+            s.push_str(&content_length);
         }
         s.push('\n');
 

From 961c7f25cb4d08c368cfe972a6416bd30b4485da Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sat, 6 Jun 2026 12:48:17 +0200
Subject: [PATCH 325/326] feat(azure_blob): migrate source from legacy Azure
 SDK to azure_storage_blob/queue 1.0

Replace the legacy azure_storage_blobs/azure_storage_queues 0.21 clients with the
official azure_storage_blob 1.0 and azure_storage_queue 1.0 SDKs:

- queue path: receive_messages with typed options (visibility timeout and batch
  size as seconds/i32), delete_message(message_id, pop_receipt); ReceivedMessage
  fields are optional in the new SDK, so extract a MessageHandle up front and fail
  with the new IncompleteMessage error if the service response lacks identifiers
- blob path: get_properties via typed header traits, 404 detection via
  http_status(), and download() limited to a single in-flight range request so
  blob contents stream sequentially with bounded memory like the legacy client
- client construction goes through the shared src/azure machinery (gains proxy
  support); make_* helpers and make_blob_with_ack_stream become async
- integration tests ported: container/queue create with status-based 409
  tolerance, blob upload via RequestContent, queue messages via send_message

All 70 azure integration tests pass against Azurite (the moved connection-string
unit tests left the integration filter scope and run in the unit suite instead).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/sources/azure_blob/integration_tests.rs | 152 +++++++--------
 src/sources/azure_blob/mod.rs               |  18 +-
 src/sources/azure_blob/queue.rs             | 199 +++++++++++++-------
 3 files changed, 207 insertions(+), 162 deletions(-)

diff --git a/src/sources/azure_blob/integration_tests.rs b/src/sources/azure_blob/integration_tests.rs
index ca7f5b92cc2c9..d53af33940fa8 100644
--- a/src/sources/azure_blob/integration_tests.rs
+++ b/src/sources/azure_blob/integration_tests.rs
@@ -1,6 +1,9 @@
-use azure_storage_blobs::prelude::PublicAccess;
+use azure_core::http::{RequestContent, StatusCode};
+use azure_storage_blob::BlobContainerClient;
+use azure_storage_queue::{QueueClient, models::QueueMessage};
 use base64::{Engine, prelude::BASE64_STANDARD};
 use flate2::{Compression as GzCompression, write::GzEncoder};
+use std::sync::Arc;
 use std::{io::Write, time::Duration};
 
 use super::{
@@ -8,6 +11,7 @@ use super::{
     queue::{Config, make_container_client, make_queue_client},
 };
 use crate::{
+    config::ProxyConfig,
     event::Event,
     serde::default_decoding,
     test_util::components::{
@@ -16,6 +20,34 @@ use crate::{
     },
 };
 
+/// Test helper: build a container client with default proxy settings.
+async fn test_container_client(config: &AzureBlobConfig) -> Arc<BlobContainerClient> {
+    make_container_client(config, &ProxyConfig::default())
+        .await
+        .expect("Failed to create container client")
+}
+
+/// Test helper: build a queue client with default proxy settings.
+async fn test_queue_client(config: &AzureBlobConfig) -> Arc<QueueClient> {
+    make_queue_client(config, &ProxyConfig::default())
+        .await
+        .expect("Failed to create queue client")
+}
+
+/// Test helper: base64-encode a message and put it on the queue, as Event Grid does.
+async fn put_base64_message(queue_client: &QueueClient, message: &str) {
+    let queue_message = QueueMessage {
+        message_text: Some(BASE64_STANDARD.encode(message)),
+    };
+    queue_client
+        .send_message(
+            queue_message.try_into().expect("infallible conversion"),
+            None,
+        )
+        .await
+        .expect("Failed putting message");
+}
+
 impl AzureBlobConfig {
     pub async fn new_emulator() -> AzureBlobConfig {
         let address = std::env::var("AZURITE_ADDRESS").unwrap_or_else(|_| "localhost".to_string());
@@ -47,60 +79,32 @@ impl AzureBlobConfig {
     }
 
     async fn ensure_container(&self) {
-        let client = make_container_client(self).expect("Failed to create container client");
-        let request = client
-            .create()
-            .public_access(PublicAccess::None)
-            .into_future();
-
-        let response = match request.await {
-            Ok(_) => Ok(()),
-            Err(reason) => {
-                let error_msg = reason.to_string();
-                // Check for HTTP 409 (Conflict) which means container already exists - this is OK
-                if error_msg.contains("409")
-                    || error_msg.contains("conflict")
-                    || error_msg.contains("already exists")
-                {
-                    Ok(())
-                } else {
-                    Err(format!("Unexpected error {}", reason))
-                }
-            }
-        };
+        let client = test_container_client(self).await;
 
-        response.expect("Failed to create container")
+        // HTTP 409 (Conflict) means the container already exists - this is OK
+        match client.create(None).await {
+            Ok(_) => {}
+            Err(e) if e.http_status() == Some(StatusCode::Conflict) => {}
+            Err(e) => panic!("Failed to create container: {e}"),
+        }
     }
 
     async fn ensure_queue(&self) {
-        let client = make_queue_client(self).expect("Failed to create queue client");
-        let request = client.create().into_future();
-
-        let response = match request.await {
-            Ok(_) => Ok(()),
-            Err(reason) => {
-                let error_msg = reason.to_string();
-                // Check for HTTP 409 (Conflict) which means queue already exists - this is OK
-                if error_msg.contains("409")
-                    || error_msg.contains("conflict")
-                    || error_msg.contains("already exists")
-                {
-                    Ok(())
-                } else {
-                    Err(format!("Unexpected error {}", reason))
-                }
-            }
-        };
+        let client = test_queue_client(self).await;
 
-        response.expect("Failed to create queue")
+        // HTTP 409 (Conflict) means the queue already exists - this is OK
+        match client.create(None).await {
+            Ok(_) => {}
+            Err(e) if e.http_status() == Some(StatusCode::Conflict) => {}
+            Err(e) => panic!("Failed to create queue: {e}"),
+        }
     }
 
     async fn upload_blob(&self, name: String, content: String) {
-        let container_client =
-            make_container_client(self).expect("Failed to create container client");
-        let blob_client = container_client.blob_client(name.clone());
+        let container_client = test_container_client(self).await;
+        let blob_client = container_client.blob_client(&name);
         blob_client
-            .put_block_blob(content)
+            .upload(RequestContent::from(content.into_bytes()), None)
             .await
             .expect("Failed putting blob");
 
@@ -108,9 +112,8 @@ impl AzureBlobConfig {
     }
 
     async fn upload_compressed_blob(&self, name: String, content: String, compression: &str) {
-        let container_client =
-            make_container_client(self).expect("Failed to create container client");
-        let blob_client = container_client.blob_client(name.clone());
+        let container_client = test_container_client(self).await;
+        let blob_client = container_client.blob_client(&name);
 
         let compressed_data = match compression {
             "gzip" => {
@@ -127,7 +130,7 @@ impl AzureBlobConfig {
         };
 
         blob_client
-            .put_block_blob(compressed_data)
+            .upload(RequestContent::from(compressed_data), None)
             .await
             .expect("Failed putting compressed blob");
 
@@ -135,7 +138,7 @@ impl AzureBlobConfig {
     }
 
     async fn queue_notify_blob_created(&self, name: &str) {
-        let queue_client = make_queue_client(self).expect("Failed to create queue client");
+        let queue_client = test_queue_client(self).await;
         let message = format!(
             r#"{{
           "topic": "/subscriptions/fa5f2180-1451-4461-9b1f-aae7d4b33cf8/resourceGroups/events_poc/providers/Microsoft.Storage/storageAccounts/eventspocaccount",
@@ -162,14 +165,11 @@ impl AzureBlobConfig {
         }}"#,
             name, name
         );
-        queue_client
-            .put_message(BASE64_STANDARD.encode(message))
-            .await
-            .expect("Failed putting message");
+        put_base64_message(&queue_client, &message).await;
     }
 
     async fn queue_notify_blob_renamed(&self, name: &str) {
-        let queue_client = make_queue_client(self).expect("Failed to create queue client");
+        let queue_client = test_queue_client(self).await;
         let message = format!(
             r#"{{
           "topic": "/subscriptions/fa5f2180-1451-4461-9b1f-aae7d4b33cf8/resourceGroups/events_poc/providers/Microsoft.Storage/storageAccounts/eventspocaccount",
@@ -193,13 +193,10 @@ impl AzureBlobConfig {
         }}"#,
             name, name
         );
-        queue_client
-            .put_message(BASE64_STANDARD.encode(message))
-            .await
-            .expect("Failed putting message");
+        put_base64_message(&queue_client, &message).await;
     }
     async fn queue_notify_custom_event(&self, name: &str, event_type: &str) {
-        let queue_client = make_queue_client(self).expect("Failed to create queue client");
+        let queue_client = test_queue_client(self).await;
         let message = format!(
             r#"{{
           "topic": "/subscriptions/fa5f2180-1451-4461-9b1f-aae7d4b33cf8/resourceGroups/events_poc/providers/Microsoft.Storage/storageAccounts/eventspocaccount",
@@ -226,10 +223,7 @@ impl AzureBlobConfig {
         }}"#,
             name, event_type, name
         );
-        queue_client
-            .put_message(BASE64_STANDARD.encode(message))
-            .await
-            .expect("Failed putting message");
+        put_base64_message(&queue_client, &message).await;
     }
 }
 
@@ -273,11 +267,11 @@ async fn azure_blob_read_blob_renamed_event() {
     let content = "renamed_blob_content";
 
     // Upload blob to the destination path
-    let blob_client = make_container_client(&config)
-        .expect("Failed to create container client")
+    let blob_client = test_container_client(&config)
+        .await
         .blob_client("renamed-file.txt");
     blob_client
-        .put_block_blob(content)
+        .upload(RequestContent::from(content.as_bytes().to_vec()), None)
         .await
         .expect("Failed putting blob");
 
@@ -442,11 +436,8 @@ async fn azure_blob_read_json_content() {
 #[tokio::test]
 async fn azure_blob_handle_malformed_message() {
     let config = AzureBlobConfig::new_emulator().await;
-    let queue_client = make_queue_client(&config).expect("Failed to create queue client");
-    queue_client
-        .put_message(BASE64_STANDARD.encode("not a valid json"))
-        .await
-        .expect("Failed putting malformed message");
+    let queue_client = test_queue_client(&config).await;
+    put_base64_message(&queue_client, "not a valid json").await;
 
     config
         .upload_blob("file.txt".to_string(), "correct content".to_string())
@@ -630,11 +621,10 @@ async fn azure_blob_multipart_gzip() {
     let mut multipart = compressed1;
     multipart.extend(compressed2);
 
-    let container_client =
-        make_container_client(&config).expect("Failed to create container client");
+    let container_client = test_container_client(&config).await;
     let blob_client = container_client.blob_client("multipart.gz");
     blob_client
-        .put_block_blob(multipart)
+        .upload(RequestContent::from(multipart), None)
         .await
         .expect("Failed putting multipart blob");
 
@@ -986,7 +976,7 @@ async fn azure_blob_ignore_mismatching_container() {
     let config = AzureBlobConfig::new_emulator().await;
 
     // Send a BlobCreated event referencing a different container
-    let queue_client = make_queue_client(&config).expect("Failed to create queue client");
+    let queue_client = test_queue_client(&config).await;
     let message = r#"{
       "topic": "/subscriptions/fa5f2180-1451-4461-9b1f-aae7d4b33cf8/resourceGroups/events_poc/providers/Microsoft.Storage/storageAccounts/eventspocaccount",
       "subject": "/blobServices/default/containers/other-container/blobs/some-blob.txt",
@@ -1009,12 +999,8 @@ async fn azure_blob_ignore_mismatching_container() {
       "dataVersion": "",
       "metadataVersion": "1",
       "eventTime": "2024-05-09T11:37:10.5637878Z"
-    }"#
-    .to_string();
-    queue_client
-        .put_message(BASE64_STANDARD.encode(message))
-        .await
-        .expect("Failed putting message");
+    }"#;
+    put_base64_message(&queue_client, message).await;
 
     config
         .upload_blob("valid.txt".to_string(), "valid content".to_string())
diff --git a/src/sources/azure_blob/mod.rs b/src/sources/azure_blob/mod.rs
index 0191ba94fc815..ad5beed844b4d 100644
--- a/src/sources/azure_blob/mod.rs
+++ b/src/sources/azure_blob/mod.rs
@@ -458,13 +458,17 @@ impl SourceConfig for AzureBlobConfig {
 
         let blob_stream: BlobWithAckStream = match self.blob_stream_factory {
             Some(ref factory) => factory(cx.shutdown.clone())?,
-            None => make_blob_with_ack_stream(
-                self,
-                cx.shutdown.clone(),
-                self.compression,
-                self.framing.clone(),
-                multiline_config,
-            )?,
+            None => {
+                make_blob_with_ack_stream(
+                    self,
+                    cx.shutdown.clone(),
+                    self.compression,
+                    self.framing.clone(),
+                    multiline_config,
+                    &cx.proxy,
+                )
+                .await?
+            }
         };
         Ok(Box::pin(azure_blob_streamer.run_streaming(blob_stream)))
     }
diff --git a/src/sources/azure_blob/queue.rs b/src/sources/azure_blob/queue.rs
index 4d30ab6eff38f..ffceba3ce0c1b 100644
--- a/src/sources/azure_blob/queue.rs
+++ b/src/sources/azure_blob/queue.rs
@@ -2,9 +2,11 @@ use std::{pin::Pin, sync::Arc, sync::Mutex};
 
 use async_compression::tokio::bufread::{GzipDecoder, ZstdDecoder};
 use async_stream::stream;
-use azure_core::{self};
-use azure_storage_blobs::prelude::ContainerClient;
-use azure_storage_queues::{QueueClient, operations::Message};
+use azure_core::http::StatusCode;
+use azure_storage_blob::models::{BlobClientDownloadOptions, BlobClientGetPropertiesResultHeaders};
+use azure_storage_blob::{BlobClient, BlobContainerClient};
+use azure_storage_queue::QueueClient;
+use azure_storage_queue::models::{QueueClientReceiveMessagesOptions, ReceivedMessage};
 use base64::{Engine, prelude::BASE64_STANDARD};
 use bytes::Bytes;
 use futures::{FutureExt, future::ready, stream::StreamExt};
@@ -89,15 +91,17 @@ pub(super) struct Config {
 ///
 /// # Errors
 /// Returns an error if queue client creation fails or configuration is invalid
-pub fn make_blob_with_ack_stream(
+pub async fn make_blob_with_ack_stream(
     cfg: &AzureBlobConfig,
     shutdown: ShutdownSignal,
     compression: Compression,
     framing: vector_lib::codecs::decoding::FramingConfig,
     multiline_config: Option<line_agg::Config>,
+    proxy: &crate::config::ProxyConfig,
 ) -> crate::Result<BlobWithAckStream> {
-    let queue_client = make_queue_client(cfg)?;
-    let container_client = make_container_client(cfg)?;
+    let queue_client = make_queue_client(cfg, proxy).await?;
+    let container_client = make_container_client(cfg, proxy).await?;
+    let container_name = cfg.container_name.clone();
     let poll_interval = std::time::Duration::from_secs(
         cfg.queue
             .as_ref()
@@ -107,28 +111,31 @@ pub fn make_blob_with_ack_stream(
     let framer = framing.build();
     let queue_config = cfg.queue.as_ref().unwrap();
     let max_messages = queue_config.max_number_of_messages;
-    let visibility_timeout =
-        std::time::Duration::from_secs(queue_config.visibility_timeout_secs as u64);
+    let visibility_timeout_secs = queue_config.visibility_timeout_secs;
 
     Ok(Box::pin(stream! {
         loop {
             let messages = match queue_client
-                .get_messages()
-                .number_of_messages(max_messages)
-                .visibility_timeout(visibility_timeout)
+                .receive_messages(Some(QueueClientReceiveMessagesOptions {
+                    number_of_messages: Some(max_messages as i32),
+                    visibility_timeout: Some(visibility_timeout_secs as i32),
+                    ..Default::default()
+                }))
                 .await
+                .and_then(|response| response.into_model())
             {
-                Ok(messages) => messages,
+                Ok(messages) => messages.items.unwrap_or_default(),
                 Err(e) => {
                     emit!(QueueMessageReceiveError{error: &e});
                     continue;
                 }
             };
-            if !messages.messages.is_empty() {
-                for message in messages.messages {
-                    let msg_id = message.message_id.clone();
+            if !messages.is_empty() {
+                for message in messages {
+                    let msg_id = message.message_id.clone().unwrap_or_default();
                     match process_event_grid_message(
                         message,
+                        &container_name,
                         &container_client,
                         &queue_client,
                         compression,
@@ -180,9 +187,20 @@ pub fn make_blob_with_ack_stream(
 /// - The queue configuration is missing
 /// - The connection string is missing or invalid
 /// - The queue service client cannot be initialized
-pub fn make_queue_client(cfg: &AzureBlobConfig) -> crate::Result<Arc<QueueClient>> {
+pub async fn make_queue_client(
+    cfg: &AzureBlobConfig,
+    proxy: &crate::config::ProxyConfig,
+) -> crate::Result<Arc<QueueClient>> {
     let q = cfg.queue.clone().ok_or("Missing queue.")?;
-    crate::azure::build_queue_client(cfg.connection_string.inner(), q.queue_name)
+    crate::azure::client::build_queue_client(
+        None,
+        cfg.connection_string.inner(),
+        &q.queue_name,
+        proxy,
+        None,
+    )
+    .await
+    .map_err(|e| format!("Failed to create Azure queue client: {}", e).into())
 }
 
 /// Creates an Azure Blob Storage container client from the source configuration.
@@ -201,11 +219,18 @@ pub fn make_queue_client(cfg: &AzureBlobConfig) -> crate::Result<Arc<QueueClient
 /// - The connection string is missing
 /// - The container client cannot be initialized
 /// - Azure authentication fails
-pub fn make_container_client(cfg: &AzureBlobConfig) -> crate::Result<Arc<ContainerClient>> {
-    crate::azure::build_client(
+pub async fn make_container_client(
+    cfg: &AzureBlobConfig,
+    proxy: &crate::config::ProxyConfig,
+) -> crate::Result<Arc<BlobContainerClient>> {
+    crate::azure::client::build_client(
+        None,
         cfg.connection_string.clone().into(),
         cfg.container_name.clone(),
+        proxy,
+        None,
     )
+    .await
     .map_err(|e| format!("Failed to create Azure container client: {}", e).into())
 }
 
@@ -265,29 +290,25 @@ fn apply_decompression(
 /// # Errors
 /// Returns an error if blob streaming fails
 async fn create_blob_stream(
-    blob_client: &azure_storage_blobs::prelude::BlobClient,
+    blob_client: &BlobClient,
     compression: Compression,
     blob_name: &str,
     content_type: Option<&str>,
 ) -> Result<Box<dyn tokio::io::AsyncRead + Send + Unpin>, ProcessingError> {
-    let mut stream = blob_client.get().into_stream();
-
-    let byte_stream = stream! {
-        while let Some(response) = stream.next().await {
-            match response {
-                Ok(resp) => {
-                    let mut body = resp.data;
-                    while let Some(chunk) = body.next().await {
-                        match chunk {
-                            Ok(data) => yield Ok(data),
-                            Err(e) => yield Err(std::io::Error::other(e)),
-                        }
-                    }
-                }
-                Err(e) => yield Err(std::io::Error::other(e)),
-            }
-        }
-    };
+    // Limit the managed download to a single in-flight range request so blob
+    // contents stream sequentially with bounded memory, matching the previous
+    // (legacy SDK) chunked streaming behavior.
+    let download = blob_client
+        .download(Some(BlobClientDownloadOptions {
+            parallel: std::num::NonZero::new(1),
+            ..Default::default()
+        }))
+        .await
+        .map_err(|e| ProcessingError::FailedToGetBlob { error: e })?;
+
+    let byte_stream = download
+        .body
+        .map(|chunk| chunk.map_err(std::io::Error::other));
 
     let reader = Box::pin(StreamReader::new(byte_stream));
     Ok(apply_decompression(
@@ -324,6 +345,32 @@ pub enum ProcessingError {
 
     #[snafu(display("Failed to parse {} as subject", subject))]
     FailedToParseSubject { subject: String },
+
+    #[snafu(display("Queue message {} is missing required fields", message_id))]
+    IncompleteMessage { message_id: String },
+}
+
+/// The identifiers required to delete a message from the queue after processing.
+#[derive(Clone, Debug)]
+struct MessageHandle {
+    message_id: String,
+    pop_receipt: String,
+}
+
+impl MessageHandle {
+    /// Extract the deletion handle from a received message, failing if the service
+    /// response is missing either identifier.
+    fn from_message(message: &ReceivedMessage) -> Result<Self, ProcessingError> {
+        match (message.message_id.as_ref(), message.pop_receipt.as_ref()) {
+            (Some(message_id), Some(pop_receipt)) => Ok(Self {
+                message_id: message_id.clone(),
+                pop_receipt: pop_receipt.clone(),
+            }),
+            _ => Err(ProcessingError::IncompleteMessage {
+                message_id: message.message_id.clone().unwrap_or_default(),
+            }),
+        }
+    }
 }
 
 /// Processes an Azure Event Grid message from the storage queue.
@@ -337,34 +384,42 @@ pub enum ProcessingError {
 /// - `Ok(None)` - Event ignored (wrong type, wrong container, or blob doesn't exist)
 /// - `Err(ProcessingError)` - Failed to process message or retrieve blob
 async fn process_event_grid_message(
-    message: Message,
-    container_client: &ContainerClient,
-    queue_client: &QueueClient,
+    message: ReceivedMessage,
+    container_name: &str,
+    container_client: &BlobContainerClient,
+    queue_client: &Arc<QueueClient>,
     compression: Compression,
     framer: vector_lib::codecs::decoding::Framer,
     multiline_config: Option<line_agg::Config>,
 ) -> Result<Option<BlobWithAck>, ProcessingError> {
-    let msg_id = message.message_id.clone();
+    let handle = MessageHandle::from_message(&message)?;
+    let message_text =
+        message
+            .message_text
+            .as_deref()
+            .ok_or_else(|| ProcessingError::IncompleteMessage {
+                message_id: handle.message_id.clone(),
+            })?;
     let decoded_bytes = BASE64_STANDARD
-        .decode(&message.message_text)
+        .decode(message_text)
         .map_err(|e| ProcessingError::FailedDecodingMessageBase64 { error: e })?;
     let decoded_string = String::from_utf8(decoded_bytes)
         .map_err(|e| ProcessingError::FailedDecodingUTF8 { error: e })?;
     let body: AzureStorageEvent = serde_json::from_str(decoded_string.as_str()).map_err(|e| {
         ProcessingError::InvalidQueueMessage {
             error: e,
-            message_id: msg_id,
+            message_id: handle.message_id.clone(),
         }
     })?;
     if body.event_type != "Microsoft.Storage.BlobCreated"
         && body.event_type != "Microsoft.Storage.BlobRenamed"
     {
         emit!(QueueStorageInvalidEventIgnored {
-            container: container_client.container_name(),
+            container: container_name,
             subject: &body.subject,
             event_type: &body.event_type,
         });
-        remove_message_from_queue(queue_client, message).await;
+        remove_message_from_queue(queue_client, &handle).await;
         return Ok(None);
     }
     let (container, blob) =
@@ -372,12 +427,12 @@ async fn process_event_grid_message(
             subject: body.subject,
         })?;
 
-    if container != container_client.container_name() {
+    if container != container_name {
         emit!(QueueStorageMismatchingContainerName {
-            configured_container: container_client.container_name(),
+            configured_container: container_name,
             container: container.as_str(),
         });
-        remove_message_from_queue(queue_client, message).await;
+        remove_message_from_queue(queue_client, &handle).await;
         return Ok(None);
     }
     trace!(
@@ -390,22 +445,20 @@ async fn process_event_grid_message(
     // Note: Content-Encoding header is NOT used due to Azure SDK limitation.
     // When blobs have Content-Encoding set, the SDK fails with "header not found content-length"
     // because Azure uses chunked transfer encoding for such responses.
-    let content_type = match blob_client.get_properties().await {
-        Ok(response) => Some(response.blob.properties.content_type.clone()),
+    let content_type = match blob_client.get_properties(None).await {
+        Ok(response) => response
+            .content_type()
+            .map_err(|e| ProcessingError::FailedToGetBlob { error: e })?,
         Err(e) => {
             // Handle 404 (blob doesn't exist)
-            if let Some(http_error) = e.as_http_error()
-                && http_error.status() == 404u16
-            {
+            if e.http_status() == Some(StatusCode::NotFound) {
                 emit!(BlobDoesntExist {
-                    nonexistent_blob_name: blob_client.blob_name(),
+                    nonexistent_blob_name: &blob,
                 });
-                remove_message_from_queue(queue_client, message).await;
+                remove_message_from_queue(queue_client, &handle).await;
                 return Ok(None);
             }
-            return Err(ProcessingError::FailedToGetBlob {
-                error: azure_core::Error::new(azure_core::error::ErrorKind::Other, e),
-            });
+            return Err(ProcessingError::FailedToGetBlob { error: e });
         }
     };
 
@@ -414,7 +467,7 @@ async fn process_event_grid_message(
         create_blob_stream(&blob_client, compression, &blob, content_type.as_deref()).await?;
 
     // Use FramedRead with configurable framer
-    let queue_client_copy = queue_client.clone();
+    let queue_client_copy = Arc::clone(queue_client);
     let read_error: Arc<Mutex<Option<String>>> = Arc::new(Mutex::new(None));
     let read_error_for_handler = Arc::clone(&read_error);
     let blob_for_warn = blob.clone();
@@ -463,10 +516,10 @@ async fn process_event_grid_message(
                             );
                             return;
                         }
-                        remove_message_from_queue(&queue_client_copy, message).await;
+                        remove_message_from_queue(&queue_client_copy, &handle).await;
                     }
                     StreamResult::Rejected => {
-                        remove_message_from_queue(&queue_client_copy, message).await;
+                        remove_message_from_queue(&queue_client_copy, &handle).await;
                     }
                     StreamResult::Errored => {
                         // Retain queue message for retry on transient errors.
@@ -528,10 +581,9 @@ const fn default_visibility_timeout_secs() -> u32 {
     300
 }
 
-async fn remove_message_from_queue(queue_client: &QueueClient, message: Message) {
+async fn remove_message_from_queue(queue_client: &QueueClient, handle: &MessageHandle) {
     _ = queue_client
-        .pop_receipt_client(message)
-        .delete()
+        .delete_message(&handle.message_id, &handle.pop_receipt, None)
         .await
         .inspect_err(move |e| emit!(QueueMessageDeleteError { error: &e }))
 }
@@ -660,8 +712,8 @@ fn test_config_deny_unknown_fields() {
     assert!(result.is_err());
 }
 
-#[test]
-fn test_make_queue_client_invalid_connection_string() {
+#[tokio::test]
+async fn test_make_queue_client_invalid_connection_string() {
     use crate::sources::azure_blob::AzureBlobConfig;
 
     let config = AzureBlobConfig {
@@ -675,12 +727,12 @@ fn test_make_queue_client_invalid_connection_string() {
         ..Default::default()
     };
 
-    let result = make_queue_client(&config);
+    let result = make_queue_client(&config, &crate::config::ProxyConfig::default()).await;
     assert!(result.is_err());
 }
 
-#[test]
-fn test_make_container_client_with_connection_string() {
+#[tokio::test]
+async fn test_make_container_client_with_connection_string() {
     use crate::sources::azure_blob::AzureBlobConfig;
 
     let config = AzureBlobConfig {
@@ -694,8 +746,11 @@ fn test_make_container_client_with_connection_string() {
         ..Default::default()
     };
 
-    let result = make_container_client(&config);
+    let result = make_container_client(&config, &crate::config::ProxyConfig::default()).await;
     assert!(result.is_ok());
     let client = result.unwrap();
-    assert_eq!(client.container_name(), "test-container");
+    assert_eq!(
+        client.url().as_str(),
+        "https://test.blob.core.windows.net/test-container"
+    );
 }

From df98e30928743b412d23d9b9062266f2172c6397 Mon Sep 17 00:00:00 2001
From: Lukasz Drozdz <lukasz.drozdz93@gmail.com>
Date: Sat, 6 Jun 2026 12:51:03 +0200
Subject: [PATCH 326/326] chore(azure_blob): drop the legacy Azure SDK
 dependencies

Remove azure_storage/azure_storage_blobs/azure_storage_queues 0.21 and the
azure_core_for_storage bridge (plus the 'azure' meta-feature and the legacy
client builders), now that the source uses the official SDK throughout. This
also sheds ~20 transitive crates (instant, http-types, futures-lite 1.x,
RustyXML, ...) and the RUSTSEC-2024-0384 deny.toml ignore that existed only
for the legacy dependency chain.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Cargo.lock           | 338 ++++++-------------------------------------
 Cargo.toml           |  12 +-
 LICENSE-3rdparty.csv |  13 +-
 deny.toml            |   1 -
 src/azure/mod.rs     |  84 -----------
 5 files changed, 43 insertions(+), 405 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 7d88268c9a83b..d4d96a9b3606b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,12 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "RustyXML"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b5ace29ee3216de37c0546865ad08edef58b0f9e76838ed8959a84a990e58c5"
-
 [[package]]
 name = "adler2"
 version = "2.0.0"
@@ -797,17 +791,6 @@ dependencies = [
  "pin-project-lite",
 ]
 
-[[package]]
-name = "async-channel"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
-dependencies = [
- "concurrent-queue",
- "event-listener 2.5.3",
- "futures-core",
-]
-
 [[package]]
 name = "async-channel"
 version = "2.3.1"
@@ -853,8 +836,8 @@ checksum = "c96bf972d85afc50bf5ab8fe2d54d1586b4e0b46c97c50a0c9e71e2f7bcd812a"
 dependencies = [
  "async-task",
  "concurrent-queue",
- "fastrand 2.3.0",
- "futures-lite 2.6.0",
+ "fastrand",
+ "futures-lite",
  "pin-project-lite",
  "slab",
 ]
@@ -867,7 +850,7 @@ checksum = "8034a681df4aed8b8edbd7fbe472401ecf009251c8b40556b304567052e294c5"
 dependencies = [
  "async-lock 3.4.0",
  "blocking",
- "futures-lite 2.6.0",
+ "futures-lite",
 ]
 
 [[package]]
@@ -876,11 +859,11 @@ version = "3.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13f937e26114b93193065fd44f507aa2e9169ad0cdabbb996920b1fe1ddea7ba"
 dependencies = [
- "async-channel 2.3.1",
+ "async-channel",
  "async-executor",
  "async-lock 3.4.0",
  "blocking",
- "futures-lite 2.6.0",
+ "futures-lite",
  "tokio",
 ]
 
@@ -894,7 +877,7 @@ dependencies = [
  "cfg-if",
  "concurrent-queue",
  "futures-io",
- "futures-lite 2.6.0",
+ "futures-lite",
  "parking",
  "polling",
  "rustix 0.38.40",
@@ -978,7 +961,7 @@ checksum = "b948000fad4873c1c9339d60f2623323a0cfd3816e5181033c6a5cb68b2accf7"
 dependencies = [
  "async-io",
  "blocking",
- "futures-lite 2.6.0",
+ "futures-lite",
 ]
 
 [[package]]
@@ -987,7 +970,7 @@ version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
 dependencies = [
- "async-channel 2.3.1",
+ "async-channel",
  "async-io",
  "async-lock 3.4.0",
  "async-signal",
@@ -995,7 +978,7 @@ dependencies = [
  "blocking",
  "cfg-if",
  "event-listener 5.3.1",
- "futures-lite 2.6.0",
+ "futures-lite",
  "rustix 1.1.4",
 ]
 
@@ -1124,7 +1107,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "hex",
  "http 1.3.1",
  "ring",
@@ -1164,7 +1147,7 @@ dependencies = [
  "aws-types",
  "bytes",
  "bytes-utils",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "http-body 0.4.6",
@@ -1193,7 +1176,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "aws-types",
- "fastrand 2.3.0",
+ "fastrand",
  "flate2",
  "http 0.2.12",
  "http 1.3.1",
@@ -1221,7 +1204,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1245,7 +1228,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1269,7 +1252,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1294,7 +1277,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1318,7 +1301,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1346,7 +1329,7 @@ dependencies = [
  "aws-smithy-xml",
  "aws-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "hex",
  "hmac",
  "http 0.2.12",
@@ -1377,7 +1360,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1402,7 +1385,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1426,7 +1409,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1450,7 +1433,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1474,7 +1457,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1499,7 +1482,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "regex-lite",
@@ -1685,7 +1668,7 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
- "fastrand 2.3.0",
+ "fastrand",
  "http 0.2.12",
  "http 1.3.1",
  "http-body 0.4.6",
@@ -1899,35 +1882,6 @@ dependencies = [
  "tower-service",
 ]
 
-[[package]]
-name = "azure_core"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b552ad43a45a746461ec3d3a51dfb6466b4759209414b439c165eb6a6b7729e"
-dependencies = [
- "async-trait",
- "base64 0.22.1",
- "bytes",
- "dyn-clone",
- "futures",
- "getrandom 0.2.15",
- "http-types",
- "once_cell",
- "openssl",
- "paste",
- "pin-project",
- "quick-xml 0.31.0",
- "rand 0.8.6",
- "reqwest 0.12.28",
- "rustc_version",
- "serde",
- "serde_json",
- "time",
- "tracing 0.1.44",
- "url",
- "uuid",
-]
-
 [[package]]
 name = "azure_core"
 version = "1.0.0"
@@ -1969,7 +1923,7 @@ checksum = "32edf96b356ca7c51d7590c4925cc36efc3947a5da4468e8e0b25c56ecbb3de5"
 dependencies = [
  "async-lock 3.4.0",
  "async-trait",
- "azure_core 1.0.0",
+ "azure_core",
  "futures",
  "openssl",
  "pin-project",
@@ -1980,25 +1934,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "azure_storage"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59f838159f4d29cb400a14d9d757578ba495ae64feb07a7516bf9e4415127126"
-dependencies = [
- "RustyXML",
- "async-lock 3.4.0",
- "async-trait",
- "azure_core 0.21.0",
- "bytes",
- "serde",
- "serde_derive",
- "time",
- "tracing 0.1.44",
- "url",
- "uuid",
-]
-
 [[package]]
 name = "azure_storage_blob"
 version = "1.0.0"
@@ -2007,7 +1942,7 @@ checksum = "1756febbcca86c862ef718b983b505d08bd65a9bc984a915b0a16af4a4c3fe5b"
 dependencies = [
  "async-stream",
  "async-trait",
- "azure_core 1.0.0",
+ "azure_core",
  "bytes",
  "futures",
  "percent-encoding",
@@ -2017,27 +1952,6 @@ dependencies = [
  "time",
 ]
 
-[[package]]
-name = "azure_storage_blobs"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97e83c3636ae86d9a6a7962b2112e3b19eb3903915c50ce06ff54ff0a2e6a7e4"
-dependencies = [
- "RustyXML",
- "azure_core 0.21.0",
- "azure_storage",
- "azure_svc_blobstorage",
- "bytes",
- "futures",
- "serde",
- "serde_derive",
- "serde_json",
- "time",
- "tracing 0.1.44",
- "url",
- "uuid",
-]
-
 [[package]]
 name = "azure_storage_queue"
 version = "1.0.0"
@@ -2045,49 +1959,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e3836053722dfa5aa3461e47aebb96e230a87d8d22eb1f866ca704f691b93ae"
 dependencies = [
  "async-trait",
- "azure_core 1.0.0",
+ "azure_core",
  "serde",
  "time",
 ]
 
-[[package]]
-name = "azure_storage_queues"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7aa417d6bdda9c5c0d08b96617f0bd85e4f30142797b2a948f3c27963df8b58b"
-dependencies = [
- "azure_core 0.21.0",
- "azure_storage",
- "futures",
- "serde",
- "time",
- "tracing 0.1.44",
- "uuid",
-]
-
-[[package]]
-name = "azure_svc_blobstorage"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e6c6f20c5611b885ba94c7bae5e02849a267381aecb8aee577e8c35ff4064c6"
-dependencies = [
- "azure_core 0.21.0",
- "bytes",
- "futures",
- "log",
- "once_cell",
- "serde",
- "serde_json",
- "time",
-]
-
 [[package]]
 name = "backon"
 version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cffb0e931875b666fc4fcb20fee52e9bbd1ef836fd9e9e04ec21555f9f85f7ef"
 dependencies = [
- "fastrand 2.3.0",
+ "fastrand",
  "gloo-timers",
  "tokio",
 ]
@@ -2255,10 +2138,10 @@ version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e83f8d02be6967315521be875afa792a316e28d57b5a2d401897e2a7921b7f21"
 dependencies = [
- "async-channel 2.3.1",
+ "async-channel",
  "async-task",
  "futures-io",
- "futures-lite 2.6.0",
+ "futures-lite",
  "piper",
 ]
 
@@ -4353,15 +4236,6 @@ dependencies = [
  "regex-syntax",
 ]
 
-[[package]]
-name = "fastrand"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
-dependencies = [
- "instant",
-]
-
 [[package]]
 name = "fastrand"
 version = "2.3.0"
@@ -4659,28 +4533,13 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
 
-[[package]]
-name = "futures-lite"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49a9d51ce47660b1e808d3c990b4709f2f415d928835a17dfd16991515c46bce"
-dependencies = [
- "fastrand 1.9.0",
- "futures-core",
- "futures-io",
- "memchr",
- "parking",
- "pin-project-lite",
- "waker-fn",
-]
-
 [[package]]
 name = "futures-lite"
 version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f5edaec856126859abb19ed65f39e90fea3a9574b9707f13539acf4abf7eb532"
 dependencies = [
- "fastrand 2.3.0",
+ "fastrand",
  "futures-core",
  "futures-io",
  "parking",
@@ -4744,17 +4603,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "getrandom"
-version = "0.1.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi 0.9.0+wasi-snapshot-preview1",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.2.15"
@@ -4764,7 +4612,7 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
  "wasm-bindgen",
 ]
 
@@ -5488,26 +5336,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "http-types"
-version = "2.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e9b187a72d63adbfba487f48095306ac823049cb504ee195541e91c7775f5ad"
-dependencies = [
- "anyhow",
- "async-channel 1.9.0",
- "base64 0.13.1",
- "futures-lite 1.13.0",
- "infer",
- "pin-project-lite",
- "rand 0.7.3",
- "serde",
- "serde_json",
- "serde_qs",
- "serde_urlencoded",
- "url",
-]
-
 [[package]]
 name = "httparse"
 version = "1.10.1"
@@ -6009,12 +5837,6 @@ dependencies = [
  "rustversion",
 ]
 
-[[package]]
-name = "infer"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64e9829a50b42bb782c1df523f78d332fe371b10c661e78b7a3c34b0198e9fac"
-
 [[package]]
 name = "influxdb-line-protocol"
 version = "2.0.0"
@@ -6068,15 +5890,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "instant"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
-dependencies = [
- "cfg-if",
-]
-
 [[package]]
 name = "integer-encoding"
 version = "3.0.4"
@@ -7200,7 +7013,7 @@ checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
  "libc",
  "log",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
  "windows-sys 0.61.0",
 ]
 
@@ -8387,7 +8200,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "668d31b1c4eba19242f2088b2bf3316b82ca31082a8335764db4e083db7485d4"
 dependencies = [
  "atomic-waker",
- "fastrand 2.3.0",
+ "fastrand",
  "futures-io",
 ]
 
@@ -9076,7 +8889,7 @@ version = "6.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2367cb38f1b65857bc11dd13b2adf13b7a1d991ef1cd43572f1420958c56cc2"
 dependencies = [
- "async-channel 2.3.1",
+ "async-channel",
  "async-trait",
  "bytes",
  "chrono",
@@ -9124,7 +8937,7 @@ dependencies = [
  "libc",
  "once_cell",
  "raw-cpuid",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
  "web-sys",
  "winapi",
 ]
@@ -9316,19 +9129,6 @@ dependencies = [
  "nibble_vec",
 ]
 
-[[package]]
-name = "rand"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
-dependencies = [
- "getrandom 0.1.16",
- "libc",
- "rand_chacha 0.2.2",
- "rand_core 0.5.1",
- "rand_hc",
-]
-
 [[package]]
 name = "rand"
 version = "0.8.6"
@@ -9361,16 +9161,6 @@ dependencies = [
  "rand_core 0.10.0",
 ]
 
-[[package]]
-name = "rand_chacha"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.5.1",
-]
-
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@@ -9391,15 +9181,6 @@ dependencies = [
  "rand_core 0.9.0",
 ]
 
-[[package]]
-name = "rand_core"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
-dependencies = [
- "getrandom 0.1.16",
-]
-
 [[package]]
 name = "rand_core"
 version = "0.6.4"
@@ -9435,15 +9216,6 @@ dependencies = [
  "rand 0.9.4",
 ]
 
-[[package]]
-name = "rand_hc"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
-dependencies = [
- "rand_core 0.5.1",
-]
-
 [[package]]
 name = "rand_xorshift"
 version = "0.4.0"
@@ -10703,17 +10475,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "serde_qs"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7715380eec75f029a4ef7de39a9200e0a63823176b759d055b613f5a87df6a6"
-dependencies = [
- "percent-encoding",
- "serde",
- "thiserror 1.0.68",
-]
-
 [[package]]
 name = "serde_repr"
 version = "0.1.17"
@@ -11040,7 +10801,7 @@ version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a33bd3e260892199c3ccfc487c88b2da2265080acb316cd920da72fdfd7c599f"
 dependencies = [
- "async-channel 2.3.1",
+ "async-channel",
  "async-executor",
  "async-fs",
  "async-io",
@@ -11048,7 +10809,7 @@ dependencies = [
  "async-net",
  "async-process",
  "blocking",
- "futures-lite 2.6.0",
+ "futures-lite",
 ]
 
 [[package]]
@@ -11752,7 +11513,7 @@ version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
- "fastrand 2.3.0",
+ "fastrand",
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
@@ -11905,7 +11666,6 @@ checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
 dependencies = [
  "deranged",
  "itoa",
- "js-sys",
  "libc",
  "num-conv",
  "num_threads",
@@ -13159,14 +12919,10 @@ dependencies = [
  "aws-smithy-types",
  "aws-types",
  "axum 0.6.20",
- "azure_core 0.21.0",
- "azure_core 1.0.0",
+ "azure_core",
  "azure_identity",
- "azure_storage",
  "azure_storage_blob",
- "azure_storage_blobs",
  "azure_storage_queue",
- "azure_storage_queues",
  "base64 0.22.1",
  "bloomy",
  "bollard",
@@ -13909,12 +13665,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "waker-fn"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "317211a0dc0ceedd78fb2ca9a44aed3d7b9b26f81870d485c07122b4350673b7"
-
 [[package]]
 name = "walkdir"
 version = "2.4.0"
@@ -13961,12 +13711,6 @@ dependencies = [
  "tracing 0.1.44",
 ]
 
-[[package]]
-name = "wasi"
-version = "0.9.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
-
 [[package]]
 name = "wasi"
 version = "0.11.0+wasi-snapshot-preview1"
diff --git a/Cargo.toml b/Cargo.toml
index cbb36f609ce3f..e7ea30d7491b4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -312,12 +312,6 @@ azure_identity = { version = "1.0", default-features = false, features = ["clien
 # Azure Storage
 azure_storage_blob = { version = "1.0", default-features = false, optional = true }
 azure_storage_queue = { version = "1.0", default-features = false, optional = true }
-azure_storage = { version = "0.21", default-features = false, optional = true }
-azure_storage_blobs = { version = "0.21", default-features = false, optional = true }
-azure_storage_queues = { version = "0.21", default-features = false, optional = true }
-
-# Needed to bridge with outdated version of azure_core used in azure_storage*
-azure_core_for_storage = { package = "azure_core", version = "0.21.0", default-features = false, features = ["enable_reqwest", "hmac_openssl"], optional = true }
 
 # OpenDAL
 opendal = { version = "0.54", default-features = false, features = ["services-webhdfs"], optional = true }
@@ -498,9 +492,6 @@ approx = "0.5.1"
 strum.workspace = true
 assert_cmd = { version = "2.0.17", default-features = false }
 aws-smithy-runtime = { version = "1.8.3", default-features = false, features = ["tls-rustls"] }
-azure_storage = { version = "0.21", default-features = false, features = ["enable_reqwest", "hmac_openssl"] }
-azure_storage_blobs = { version = "0.21", default-features = false, features = ["enable_reqwest", "hmac_openssl", "azurite_workaround"] }
-azure_storage_queues = { version = "0.21", default-features = false }
 base64 = "0.22.1"
 criterion = { workspace = true, features = ["html_reports", "async_tokio"] }
 itertools.workspace = true
@@ -636,7 +627,6 @@ api-client-minimal = [
 
 top = ["vector-lib/vector-top", "vector-lib/api-client"]
 
-azure = ["dep:azure_storage", "dep:azure_storage_blobs", "dep:azure_core_for_storage"]
 
 aws-core = [
   "aws-runtime",
@@ -735,7 +725,7 @@ sources-aws_ecs_metrics = ["sources-utils-http-client"]
 sources-aws_kinesis_firehose = ["dep:base64"]
 sources-aws_s3 = ["aws-core", "dep:aws-sdk-sqs", "dep:aws-sdk-s3", "dep:async-compression", "sources-aws_sqs", "tokio-util/io"]
 sources-aws_sqs = ["aws-core", "dep:aws-sdk-sqs"]
-sources-azure_blob = ["azure", "dep:azure_core", "dep:azure_identity", "dep:azure_storage_blob", "dep:azure_storage_queue", "dep:azure_storage_queues", "dep:base64", "dep:async-compression", "tokio-util/io"]
+sources-azure_blob = ["dep:azure_core", "dep:azure_identity", "dep:azure_storage_blob", "dep:azure_storage_queue", "dep:base64", "dep:async-compression", "tokio-util/io"]
 sources-datadog_agent = ["sources-utils-http-encoding", "protobuf-build", "dep:prost"]
 sources-demo_logs = ["dep:fakedata"]
 sources-dnstap = ["sources-utils-net-tcp", "dep:base64", "dep:hickory-proto", "dep:dnsmsg-parser", "dep:dnstap-parser", "protobuf-build", "dep:prost", "vector-vrl-functions/dnstap"]
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 9065a519950cc..b7ed2ef27ffa2 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -1,5 +1,4 @@
 Component,Origin,License,Copyright
-RustyXML,https://github.com/Florob/RustyXML,MIT OR Apache-2.0,Florian Zeitz <florob@babelmonkeys.de>
 adler2,https://github.com/oyvindln/adler2,0BSD OR MIT OR Apache-2.0,"Jonas Schievink <jonasschievink@gmail.com>, oyvindln <oyvindln@users.noreply.github.com>"
 aead,https://github.com/RustCrypto/traits,MIT OR Apache-2.0,RustCrypto Developers
 aes,https://github.com/RustCrypto/block-ciphers,MIT OR Apache-2.0,RustCrypto Developers
@@ -98,14 +97,10 @@ aws-types,https://github.com/smithy-lang/smithy-rs,Apache-2.0,"AWS Rust SDK Team
 axum,https://github.com/tokio-rs/axum,MIT,The axum Authors
 axum-core,https://github.com/tokio-rs/axum,MIT,The axum-core Authors
 azure_core,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft
-azure_core,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft Corp.
 azure_core_macros,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft
 azure_identity,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft
-azure_storage,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft Corp.
 azure_storage_blob,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft
-azure_storage_blobs,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft Corp.
-azure_storage_queues,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft Corp.
-azure_svc_blobstorage,https://github.com/azure/azure-sdk-for-rust,MIT,The azure_svc_blobstorage Authors
+azure_storage_queue,https://github.com/azure/azure-sdk-for-rust,MIT,Microsoft
 backon,https://github.com/Xuanwo/backon,Apache-2.0,The backon Authors
 base16,https://github.com/thomcc/rust-base16,CC0-1.0,Thom Chiovoloni <tchiovoloni@mozilla.com>
 base16ct,https://github.com/RustCrypto/formats/tree/master/base16ct,Apache-2.0 OR MIT,RustCrypto Developers
@@ -352,7 +347,6 @@ http-body,https://github.com/hyperium/http-body,MIT,"Carl Lerche <me@carllerche.
 http-body-util,https://github.com/hyperium/http-body,MIT,"Carl Lerche <me@carllerche.com>, Lucio Franco <luciofranco14@gmail.com>, Sean McArthur <sean@seanmonstar.com>"
 http-range-header,https://github.com/MarcusGrass/parse-range-headers,MIT,The http-range-header Authors
 http-serde,https://gitlab.com/kornelski/http-serde,Apache-2.0 OR MIT,Kornel <kornel@geekhood.net>
-http-types,https://github.com/http-rs/http-types,MIT OR Apache-2.0,Yoshua Wuyts <yoshuawuyts@gmail.com>
 httparse,https://github.com/seanmonstar/httparse,MIT OR Apache-2.0,Sean McArthur <sean@seanmonstar.com>
 httpdate,https://github.com/pyfisch/httpdate,MIT OR Apache-2.0,Pyfisch <pyfisch@posteo.org>
 humantime,https://github.com/chronotope/humantime,MIT OR Apache-2.0,The humantime Authors
@@ -385,13 +379,11 @@ idna_adapter,https://github.com/hsivonen/idna_adapter,Apache-2.0 OR MIT,The rust
 indexmap,https://github.com/bluss/indexmap,Apache-2.0 OR MIT,The indexmap Authors
 indexmap,https://github.com/indexmap-rs/indexmap,Apache-2.0 OR MIT,The indexmap Authors
 indoc,https://github.com/dtolnay/indoc,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
-infer,https://github.com/bojand/infer,MIT,Bojan <dbojan@gmail.com>
 influxdb-line-protocol,https://github.com/influxdata/influxdb_iox/tree/main/influxdb_line_protocol,MIT OR Apache-2.0,InfluxDB IOx Project Developers
 inotify,https://github.com/hannobraun/inotify,ISC,"Hanno Braun <mail@hannobraun.de>, Félix Saparelli <me@passcod.name>, Cristian Kubis <cristian.kubis@tsunix.de>, Frank Denis <github@pureftpd.org>"
 inotify-sys,https://github.com/hannobraun/inotify-sys,ISC,Hanno Braun <hb@hannobraun.de>
 inout,https://github.com/RustCrypto/utils,MIT OR Apache-2.0,RustCrypto Developers
 instability,https://github.com/ratatui-org/instability,MIT,"Stephen M. Coakley <me@stephencoakley.com>, Joshka"
-instant,https://github.com/sebcrozet/instant,BSD-3-Clause,sebcrozet <developer@crozet.re>
 integer-encoding,https://github.com/dermesser/integer-encoding-rs,MIT,Lewin Bormann <lbo@spheniscida.de>
 inventory,https://github.com/dtolnay/inventory,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 ipconfig,https://github.com/liranringel/ipconfig,MIT OR Apache-2.0,Liran Ringel <liranringel@gmail.com>
@@ -621,7 +613,6 @@ rand_chacha,https://github.com/rust-random/rand,MIT OR Apache-2.0,"The Rand Proj
 rand_core,https://github.com/rust-random/rand,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers"
 rand_core,https://github.com/rust-random/rand_core,MIT OR Apache-2.0,The Rand Project Developers
 rand_distr,https://github.com/rust-random/rand_distr,MIT OR Apache-2.0,The Rand Project Developers
-rand_hc,https://github.com/rust-random/rand,MIT OR Apache-2.0,The Rand Project Developers
 rand_xorshift,https://github.com/rust-random/rngs,MIT OR Apache-2.0,"The Rand Project Developers, The Rust Project Developers"
 ratatui,https://github.com/ratatui/ratatui,MIT,"Florian Dehau <work@fdehau.com>, The Ratatui Developers"
 ratatui-core,https://github.com/ratatui/ratatui,MIT,"Florian Dehau <work@fdehau.com>, The Ratatui Developers"
@@ -703,7 +694,6 @@ serde_json,https://github.com/serde-rs/json,MIT OR Apache-2.0,"Erick Tryzelaar <
 serde_nanos,https://github.com/caspervonb/serde_nanos,MIT OR Apache-2.0,Casper Beyer <caspervonb@pm.me>
 serde_path_to_error,https://github.com/dtolnay/path-to-error,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 serde_plain,https://github.com/mitsuhiko/serde-plain,MIT OR Apache-2.0,Armin Ronacher <armin.ronacher@active-4.com>
-serde_qs,https://github.com/samscott89/serde_qs,MIT OR Apache-2.0,Sam Scott <sam@osohq.com>
 serde_repr,https://github.com/dtolnay/serde-repr,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 serde_spanned,https://github.com/toml-rs/toml,MIT OR Apache-2.0,The serde_spanned Authors
 serde_urlencoded,https://github.com/nox/serde_urlencoded,MIT OR Apache-2.0,Anthony Ramine <n.oxyde@gmail.com>
@@ -864,7 +854,6 @@ vrl,https://github.com/vectordotdev/vrl,MPL-2.0,Vector Contributors <vector@data
 vsimd,https://github.com/Nugine/simd,MIT,The vsimd Authors
 vte,https://github.com/alacritty/vte,Apache-2.0 OR MIT,"Joe Wilm <joe@jwilm.com>, Christian Duerr <contact@christianduerr.com>"
 wait-timeout,https://github.com/alexcrichton/wait-timeout,MIT OR Apache-2.0,Alex Crichton <alex@alexcrichton.com>
-waker-fn,https://github.com/smol-rs/waker-fn,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
 walkdir,https://github.com/BurntSushi/walkdir,Unlicense OR MIT,Andrew Gallant <jamslam@gmail.com>
 want,https://github.com/seanmonstar/want,MIT,Sean McArthur <sean@seanmonstar.com>
 warp,https://github.com/seanmonstar/warp,MIT,Sean McArthur <sean@seanmonstar.com>
diff --git a/deny.toml b/deny.toml
index 2465c817e0440..e6c3a90bd6e9c 100644
--- a/deny.toml
+++ b/deny.toml
@@ -48,5 +48,4 @@ ignore = [
   { id = "RUSTSEC-2026-0099", reason = "rustls-webpki 0.102/0.101 is vulnerable - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179)" },
   { id = "RUSTSEC-2024-0436", reason = "paste crate is unmaintained - transitive dependency via parquet v56.2.0, no safe upgrade available" },
   { id = "RUSTSEC-2026-0104", reason = "rustls-webpki 0.102/0.101 CRL parsing panic - tonic upgrade (https://github.com/vectordotdev/vector/issues/19179); 0.103 already patched to 0.103.13" },
-  { id = "RUSTSEC-2024-0384", reason = "instant is unmaintained - transitive dependency of the legacy azure_core 0.21 (via http-types/futures-lite), needed until the azure_storage* crates migrate to the new Azure SDK" },
 ]
diff --git a/src/azure/mod.rs b/src/azure/mod.rs
index 486ddb677eea7..ccf2834c81b90 100644
--- a/src/azure/mod.rs
+++ b/src/azure/mod.rs
@@ -6,87 +6,3 @@ pub mod client;
 pub mod connection_string;
 /// SharedKey request signing for the new Azure SDK pipeline.
 pub mod shared_key_policy;
-
-#[cfg(feature = "azure")]
-use std::sync::Arc;
-
-#[cfg(feature = "azure")]
-use azure_core_for_storage::RetryOptions;
-#[cfg(feature = "azure")]
-use azure_storage::{CloudLocation, ConnectionString};
-#[cfg(feature = "azure")]
-use azure_storage_blobs::prelude::*;
-
-/// Builds an Azure Blob Storage container client from a connection string.
-///
-/// Supports both custom blob endpoints (e.g. Azurite) and standard Azure Commercial endpoints.
-#[cfg(feature = "azure")]
-pub fn build_client(
-    connection_string: String,
-    container_name: String,
-) -> crate::Result<Arc<ContainerClient>> {
-    let client = {
-        let connection_string = ConnectionString::new(&connection_string)?;
-        let account_name = connection_string
-            .account_name
-            .ok_or("Account name missing in connection string")?;
-
-        match connection_string.blob_endpoint {
-            // When the blob_endpoint is provided, we use the Custom CloudLocation
-            // which takes the full URI directly instead of deriving it from the
-            // account_name. The account_name is still required for authentication
-            // and request signing.
-            Some(uri) => ClientBuilder::with_location(
-                CloudLocation::Custom {
-                    uri: uri.to_string(),
-                    account: account_name.to_string(),
-                },
-                connection_string.storage_credentials()?,
-            ),
-            // Without a valid blob_endpoint in the connection_string, assume we are in Azure
-            // Commercial (AzureCloud location) and create a default Blob Storage Client that
-            // builds the API endpoint location using the account_name as input
-            None => ClientBuilder::new(account_name, connection_string.storage_credentials()?),
-        }
-        .retry(RetryOptions::none())
-        .container_client(container_name)
-    };
-    Ok(Arc::new(client))
-}
-
-/// Builds an Azure Storage Queue client from a connection string.
-///
-/// Supports both custom queue endpoints (e.g. Azurite) and standard Azure Commercial endpoints.
-#[cfg(feature = "sources-azure_blob")]
-pub fn build_queue_client(
-    connection_string: &str,
-    queue_name: String,
-) -> crate::Result<Arc<azure_storage_queues::QueueClient>> {
-    use azure_storage_queues::QueueServiceClientBuilder;
-
-    let service_client = {
-        let connection_string = ConnectionString::new(connection_string)?;
-        let account_name = connection_string
-            .account_name
-            .ok_or("Account name missing in connection string")?;
-
-        match connection_string.queue_endpoint {
-            Some(uri) => QueueServiceClientBuilder::with_location(
-                CloudLocation::Custom {
-                    uri: uri.to_string(),
-                    account: account_name.to_string(),
-                },
-                connection_string.storage_credentials()?,
-            ),
-            None => QueueServiceClientBuilder::new(
-                account_name,
-                connection_string.storage_credentials()?,
-            ),
-        }
-        .retry(RetryOptions::none())
-        .build()
-    };
-
-    let client = service_client.queue_client(queue_name);
-    Ok(Arc::new(client))
-}